Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
685s -
max time network
713s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
07/05/2024, 15:11
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Nursultan 1.16.5 Crack.exe
Resource
win7-20240221-en
windows7-x64
25 signatures
1800 seconds
General
-
Target
Nursultan 1.16.5 Crack.exe
-
Size
8.7MB
-
MD5
57ec49d438753f3bdfec6a616258b370
-
SHA1
a34f757f5f2bd4763f04206c0d0cd32ab4491117
-
SHA256
872a2f4decf76a5c8cf44a9b017a780847d8b3c50571433232e398ab0931c638
-
SHA512
88bdae1b6a45efa83c4a9ff28a4549c33db28ba2bb1d1911d028090e9dc3831ef57f6577388844a4cfccc60dbca70315a7f9d7311f6638bcf00da97110e1c64a
-
SSDEEP
196608:ITAJDpNk+Rl4/Xi/yRvyCyKuhBfldGdrmVLaY1rHgu:oAlzJ7yRvyCx+xpgu
Score
10/10
Malware Config
Signatures
-
Detect ZGRat V1 7 IoCs
resource yara_rule behavioral1/files/0x00080000000141b5-23.dat family_zgrat_v1 behavioral1/memory/4992-163-0x0000000000260000-0x00000000005EE000-memory.dmp family_zgrat_v1 behavioral1/files/0x0006000000015362-239.dat family_zgrat_v1 behavioral1/memory/9408-388-0x0000000000AD0000-0x0000000000E5E000-memory.dmp family_zgrat_v1 behavioral1/memory/7672-1953-0x0000000001370000-0x00000000016FE000-memory.dmp family_zgrat_v1 behavioral1/memory/10456-4205-0x0000000000DC0000-0x000000000114E000-memory.dmp family_zgrat_v1 behavioral1/memory/8708-4487-0x00000000011D0000-0x000000000155E000-memory.dmp family_zgrat_v1 -
Modifies WinLogon for persistence 2 TTPs 6 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Windows Mail\\it-IT\\3b73a6fa2092a350d795.exe\"" portmonitor.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Windows Mail\\it-IT\\3b73a6fa2092a350d795.exe\", \"C:\\Users\\Default User\\wscript.exe\"" portmonitor.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Windows Mail\\it-IT\\3b73a6fa2092a350d795.exe\", \"C:\\Users\\Default User\\wscript.exe\", \"C:\\Users\\Admin\\wscript.exe\"" portmonitor.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Windows Mail\\it-IT\\3b73a6fa2092a350d795.exe\", \"C:\\Users\\Default User\\wscript.exe\", \"C:\\Users\\Admin\\wscript.exe\", \"C:\\Windows\\Microsoft.NET\\authman\\3b73a6fa2092a350d795.exe\"" portmonitor.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Windows Mail\\it-IT\\3b73a6fa2092a350d795.exe\", \"C:\\Users\\Default User\\wscript.exe\", \"C:\\Users\\Admin\\wscript.exe\", \"C:\\Windows\\Microsoft.NET\\authman\\3b73a6fa2092a350d795.exe\", \"C:\\Program Files (x86)\\Microsoft SQL Server Compact Edition\\v3.5\\Desktop\\3b73a6fa2092a350d795.exe\"" portmonitor.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Windows Mail\\it-IT\\3b73a6fa2092a350d795.exe\", \"C:\\Users\\Default User\\wscript.exe\", \"C:\\Users\\Admin\\wscript.exe\", \"C:\\Windows\\Microsoft.NET\\authman\\3b73a6fa2092a350d795.exe\", \"C:\\Program Files (x86)\\Microsoft SQL Server Compact Edition\\v3.5\\Desktop\\3b73a6fa2092a350d795.exe\", \"C:\\Webnet\\portmonitor.exe\"" portmonitor.exe -
Process spawned unexpected child process 11 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 612 1948 schtasks.exe 695 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2708 1948 schtasks.exe 695 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2944 1948 schtasks.exe 695 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3912 1948 schtasks.exe 695 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4084 1948 schtasks.exe 695 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 7004 1948 schtasks.exe 695 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2508 1948 schtasks.exe 695 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3648 1948 schtasks.exe 695 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 6204 1948 schtasks.exe 695 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3816 1948 schtasks.exe 695 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 796 1948 WScript.exe 695 -
Executes dropped EXE 64 IoCs
pid Process 2416 Nursultan 1.16.5 Crack.exe 2768 leetcrack.exe 2596 3b73a6fa2092a350d795.exe 2944 Nursultan 1.16.5 Crack.exe 2648 portmonitor.exe 2728 leetcrack.exe 2316 leetcrack.exe 2752 Nursultan 1.16.5 Crack.exe 2536 portmonitor.exe 2504 portmonitor.exe 2628 3b73a6fa2092a350d795.exe 2688 3b73a6fa2092a350d795.exe 2072 Nursultan 1.16.5 Crack.exe 2844 Nursultan 1.16.5 Crack.exe 2860 Nursultan 1.16.5 Crack.exe 2560 Nursultan 1.16.5 Crack.exe 1536 Nursultan 1.16.5 Crack.exe 1592 Nursultan 1.16.5 Crack.exe 1704 Nursultan 1.16.5 Crack.exe 2888 leetcrack.exe 992 Nursultan 1.16.5 Crack.exe 2156 Nursultan 1.16.5 Crack.exe 2824 leetcrack.exe 2964 leetcrack.exe 336 leetcrack.exe 1968 3b73a6fa2092a350d795.exe 740 leetcrack.exe 2832 leetcrack.exe 2088 leetcrack.exe 2332 leetcrack.exe 996 leetcrack.exe 1036 portmonitor.exe 1648 3b73a6fa2092a350d795.exe 1688 3b73a6fa2092a350d795.exe 656 portmonitor.exe 108 3b73a6fa2092a350d795.exe 588 3b73a6fa2092a350d795.exe 3004 portmonitor.exe 1804 portmonitor.exe 1152 portmonitor.exe 2120 3b73a6fa2092a350d795.exe 2304 3b73a6fa2092a350d795.exe 1980 3b73a6fa2092a350d795.exe 1388 3b73a6fa2092a350d795.exe 2288 portmonitor.exe 2428 portmonitor.exe 680 portmonitor.exe 1812 portmonitor.exe 2576 Nursultan 1.16.5 Crack.exe 1244 leetcrack.exe 1956 Nursultan 1.16.5 Crack.exe 2188 3b73a6fa2092a350d795.exe 2916 leetcrack.exe 1984 portmonitor.exe 2744 3b73a6fa2092a350d795.exe 2708 portmonitor.exe 2500 Nursultan 1.16.5 Crack.exe 1796 leetcrack.exe 2000 Nursultan 1.16.5 Crack.exe 1852 leetcrack.exe 2800 3b73a6fa2092a350d795.exe 3068 portmonitor.exe 2316 Nursultan 1.16.5 Crack.exe 2072 3b73a6fa2092a350d795.exe -
Loads dropped DLL 64 IoCs
pid Process 2248 Nursultan 1.16.5 Crack.exe 2248 Nursultan 1.16.5 Crack.exe 2248 Nursultan 1.16.5 Crack.exe 2768 leetcrack.exe 2416 Nursultan 1.16.5 Crack.exe 2768 leetcrack.exe 2416 Nursultan 1.16.5 Crack.exe 2416 Nursultan 1.16.5 Crack.exe 2944 Nursultan 1.16.5 Crack.exe 2944 Nursultan 1.16.5 Crack.exe 2944 Nursultan 1.16.5 Crack.exe 2728 leetcrack.exe 2728 leetcrack.exe 2316 leetcrack.exe 2316 leetcrack.exe 2752 Nursultan 1.16.5 Crack.exe 2072 Nursultan 1.16.5 Crack.exe 2072 Nursultan 1.16.5 Crack.exe 2844 Nursultan 1.16.5 Crack.exe 2860 Nursultan 1.16.5 Crack.exe 2560 Nursultan 1.16.5 Crack.exe 1536 Nursultan 1.16.5 Crack.exe 1592 Nursultan 1.16.5 Crack.exe 2072 Nursultan 1.16.5 Crack.exe 2752 Nursultan 1.16.5 Crack.exe 1704 Nursultan 1.16.5 Crack.exe 992 Nursultan 1.16.5 Crack.exe 2888 leetcrack.exe 2844 Nursultan 1.16.5 Crack.exe 2860 Nursultan 1.16.5 Crack.exe 2560 Nursultan 1.16.5 Crack.exe 1592 Nursultan 1.16.5 Crack.exe 2752 Nursultan 1.16.5 Crack.exe 1536 Nursultan 1.16.5 Crack.exe 2844 Nursultan 1.16.5 Crack.exe 1592 Nursultan 1.16.5 Crack.exe 2860 Nursultan 1.16.5 Crack.exe 992 Nursultan 1.16.5 Crack.exe 992 Nursultan 1.16.5 Crack.exe 2560 Nursultan 1.16.5 Crack.exe 1536 Nursultan 1.16.5 Crack.exe 1704 Nursultan 1.16.5 Crack.exe 1704 Nursultan 1.16.5 Crack.exe 2888 leetcrack.exe 336 leetcrack.exe 2824 leetcrack.exe 2964 leetcrack.exe 336 leetcrack.exe 2824 leetcrack.exe 2964 leetcrack.exe 740 leetcrack.exe 740 leetcrack.exe 2832 leetcrack.exe 2832 leetcrack.exe 2088 leetcrack.exe 2088 leetcrack.exe 2332 leetcrack.exe 2332 leetcrack.exe 996 leetcrack.exe 996 leetcrack.exe 2156 Nursultan 1.16.5 Crack.exe 2156 Nursultan 1.16.5 Crack.exe 2156 Nursultan 1.16.5 Crack.exe 1244 leetcrack.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
resource yara_rule behavioral1/files/0x0033000000013f21-20.dat upx behavioral1/memory/2596-27-0x000000013F0D0000-0x000000013FCFA000-memory.dmp upx -
Adds Run key to start application 2 TTPs 12 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\3b73a6fa2092a350d795 = "\"C:\\Program Files (x86)\\Microsoft SQL Server Compact Edition\\v3.5\\Desktop\\3b73a6fa2092a350d795.exe\"" portmonitor.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\3b73a6fa2092a350d795 = "\"C:\\Program Files (x86)\\Windows Mail\\it-IT\\3b73a6fa2092a350d795.exe\"" portmonitor.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\wscript = "\"C:\\Users\\Default User\\wscript.exe\"" portmonitor.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wscript = "\"C:\\Users\\Admin\\wscript.exe\"" portmonitor.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\3b73a6fa2092a350d795 = "\"C:\\Program Files (x86)\\Microsoft SQL Server Compact Edition\\v3.5\\Desktop\\3b73a6fa2092a350d795.exe\"" portmonitor.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\3b73a6fa2092a350d795 = "\"C:\\Windows\\Microsoft.NET\\authman\\3b73a6fa2092a350d795.exe\"" portmonitor.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\portmonitor = "\"C:\\Webnet\\portmonitor.exe\"" portmonitor.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\portmonitor = "\"C:\\Webnet\\portmonitor.exe\"" portmonitor.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\3b73a6fa2092a350d795 = "\"C:\\Program Files (x86)\\Windows Mail\\it-IT\\3b73a6fa2092a350d795.exe\"" portmonitor.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wscript = "\"C:\\Users\\Default User\\wscript.exe\"" portmonitor.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\wscript = "\"C:\\Users\\Admin\\wscript.exe\"" portmonitor.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\3b73a6fa2092a350d795 = "\"C:\\Windows\\Microsoft.NET\\authman\\3b73a6fa2092a350d795.exe\"" portmonitor.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created \??\c:\Windows\System32\tcszo9.exe csc.exe File created \??\c:\Windows\System32\CSCD40F2ABD9C924CABA4948A6323DA6738.TMP csc.exe -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\b1397aec-340d-407f-84b7-c108cf849afa.bmp" Process not Found -
Drops file in Program Files directory 5 IoCs
description ioc Process File created C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\3b73a6fa2092a350d795.exe portmonitor.exe File opened for modification C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\3b73a6fa2092a350d795.exe portmonitor.exe File created C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\5edc5a7018482e portmonitor.exe File created C:\Program Files (x86)\Windows Mail\it-IT\3b73a6fa2092a350d795.exe portmonitor.exe File created C:\Program Files (x86)\Windows Mail\it-IT\5edc5a7018482e portmonitor.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\Microsoft.NET\authman\3b73a6fa2092a350d795.exe portmonitor.exe File created C:\Windows\Microsoft.NET\authman\5edc5a7018482e portmonitor.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 18 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 7004 schtasks.exe 6056 schtasks.exe 2508 schtasks.exe 3816 schtasks.exe 5720 schtasks.exe 4916 schtasks.exe 3912 schtasks.exe 4084 schtasks.exe 3648 schtasks.exe 6204 schtasks.exe 612 schtasks.exe 2708 schtasks.exe 3500 schtasks.exe 5592 schtasks.exe 4884 schtasks.exe 5592 schtasks.exe 2944 schtasks.exe 3240 schtasks.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS Process not Found Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName Process not Found Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer Process not Found -
Modifies Control Panel 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Control Panel\Desktop\WallpaperStyle = "2" Process not Found Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Control Panel\Desktop\TileWallpaper = "0" Process not Found -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 4628 PING.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4776 portmonitor.exe 4776 portmonitor.exe 4776 portmonitor.exe 4776 portmonitor.exe 4776 portmonitor.exe 4776 portmonitor.exe 4776 portmonitor.exe 4776 portmonitor.exe 4776 portmonitor.exe 4776 portmonitor.exe 4776 portmonitor.exe 4776 portmonitor.exe 4776 portmonitor.exe 4776 portmonitor.exe 4776 portmonitor.exe 4776 portmonitor.exe 4776 portmonitor.exe 4776 portmonitor.exe 4776 portmonitor.exe 4776 portmonitor.exe 4776 portmonitor.exe 4776 portmonitor.exe 4776 portmonitor.exe 4776 portmonitor.exe 4776 portmonitor.exe 4776 portmonitor.exe 4776 portmonitor.exe 4776 portmonitor.exe 4776 portmonitor.exe 4776 portmonitor.exe 4776 portmonitor.exe 4776 portmonitor.exe 4776 portmonitor.exe 4776 portmonitor.exe 4776 portmonitor.exe 4776 portmonitor.exe 4776 portmonitor.exe 4776 portmonitor.exe 4776 portmonitor.exe 4776 portmonitor.exe 4776 portmonitor.exe 4776 portmonitor.exe 4776 portmonitor.exe 4776 portmonitor.exe 4776 portmonitor.exe 4776 portmonitor.exe 4776 portmonitor.exe 4776 portmonitor.exe 4776 portmonitor.exe 4776 portmonitor.exe 4776 portmonitor.exe 4776 portmonitor.exe 4776 portmonitor.exe 4776 portmonitor.exe 4776 portmonitor.exe 4776 portmonitor.exe 4776 portmonitor.exe 4776 portmonitor.exe 4776 portmonitor.exe 4776 portmonitor.exe 4776 portmonitor.exe 4776 portmonitor.exe 4776 portmonitor.exe 4776 portmonitor.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 7672 Process not Found -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 5064 portmonitor.exe Token: SeDebugPrivilege 5572 portmonitor.exe Token: SeDebugPrivilege 5436 portmonitor.exe Token: SeDebugPrivilege 4776 portmonitor.exe Token: SeDebugPrivilege 4992 portmonitor.exe Token: SeDebugPrivilege 5536 portmonitor.exe Token: SeDebugPrivilege 5448 portmonitor.exe Token: SeDebugPrivilege 5748 portmonitor.exe Token: SeDebugPrivilege 5996 portmonitor.exe Token: SeDebugPrivilege 6052 portmonitor.exe Token: SeDebugPrivilege 6112 portmonitor.exe Token: SeDebugPrivilege 328 portmonitor.exe Token: SeDebugPrivilege 2076 portmonitor.exe Token: SeDebugPrivilege 1928 portmonitor.exe Token: SeDebugPrivilege 5916 portmonitor.exe Token: SeDebugPrivilege 5308 portmonitor.exe Token: SeDebugPrivilege 2292 portmonitor.exe Token: SeDebugPrivilege 320 portmonitor.exe Token: SeDebugPrivilege 2144 portmonitor.exe Token: SeDebugPrivilege 5820 portmonitor.exe Token: SeDebugPrivilege 2604 portmonitor.exe Token: SeDebugPrivilege 6328 portmonitor.exe Token: SeDebugPrivilege 6336 portmonitor.exe Token: SeDebugPrivilege 6428 portmonitor.exe Token: SeDebugPrivilege 6768 portmonitor.exe Token: SeDebugPrivilege 6648 portmonitor.exe Token: SeDebugPrivilege 6604 portmonitor.exe Token: SeDebugPrivilege 6728 portmonitor.exe Token: SeDebugPrivilege 6916 portmonitor.exe Token: SeDebugPrivilege 6932 portmonitor.exe Token: SeDebugPrivilege 6900 portmonitor.exe Token: SeDebugPrivilege 6924 portmonitor.exe Token: SeDebugPrivilege 6908 portmonitor.exe Token: SeDebugPrivilege 6892 portmonitor.exe Token: SeDebugPrivilege 6220 portmonitor.exe Token: SeDebugPrivilege 324 portmonitor.exe Token: SeDebugPrivilege 6156 portmonitor.exe Token: SeDebugPrivilege 6356 portmonitor.exe Token: SeDebugPrivilege 2156 portmonitor.exe Token: SeDebugPrivilege 3332 portmonitor.exe Token: SeDebugPrivilege 5816 portmonitor.exe Token: SeDebugPrivilege 1644 portmonitor.exe Token: SeDebugPrivilege 580 portmonitor.exe Token: SeDebugPrivilege 1744 portmonitor.exe Token: SeDebugPrivilege 9408 Process not Found Token: SeDebugPrivilege 7068 portmonitor.exe Token: SeDebugPrivilege 3648 portmonitor.exe Token: SeDebugPrivilege 3440 portmonitor.exe Token: SeDebugPrivilege 5696 portmonitor.exe Token: SeDebugPrivilege 2372 portmonitor.exe Token: SeDebugPrivilege 5744 portmonitor.exe Token: SeDebugPrivilege 4468 portmonitor.exe Token: SeDebugPrivilege 4952 portmonitor.exe Token: SeDebugPrivilege 7516 portmonitor.exe Token: SeDebugPrivilege 7408 portmonitor.exe Token: SeDebugPrivilege 5408 portmonitor.exe Token: SeDebugPrivilege 3852 portmonitor.exe Token: SeDebugPrivilege 5992 portmonitor.exe Token: SeDebugPrivilege 6048 portmonitor.exe Token: SeDebugPrivilege 5852 portmonitor.exe Token: SeDebugPrivilege 7912 portmonitor.exe Token: SeDebugPrivilege 4760 portmonitor.exe Token: SeDebugPrivilege 2552 portmonitor.exe Token: SeDebugPrivilege 6340 Process not Found -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 9676 Process not Found 9676 Process not Found 9676 Process not Found 9676 Process not Found 9676 Process not Found 9676 Process not Found 9676 Process not Found 9676 Process not Found 9676 Process not Found 9676 Process not Found 9676 Process not Found 9676 Process not Found 9676 Process not Found 9676 Process not Found 9676 Process not Found 9676 Process not Found 9676 Process not Found 9676 Process not Found 9676 Process not Found 9676 Process not Found 9676 Process not Found 9676 Process not Found 9676 Process not Found 9676 Process not Found 9676 Process not Found 9676 Process not Found 9676 Process not Found 9676 Process not Found 9676 Process not Found 9676 Process not Found 9676 Process not Found 9676 Process not Found 9676 Process not Found 9676 Process not Found 9676 Process not Found 9676 Process not Found 9676 Process not Found 9676 Process not Found 9676 Process not Found 6236 Process not Found 6236 Process not Found 6236 Process not Found 6236 Process not Found 6236 Process not Found 6236 Process not Found 6236 Process not Found 6236 Process not Found 6236 Process not Found 6236 Process not Found 6236 Process not Found 6236 Process not Found 6236 Process not Found 6236 Process not Found 6236 Process not Found 6236 Process not Found 6236 Process not Found 6236 Process not Found 6236 Process not Found 6236 Process not Found 6236 Process not Found 6236 Process not Found 6236 Process not Found 6236 Process not Found 6236 Process not Found -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 9676 Process not Found 9676 Process not Found 9676 Process not Found 9676 Process not Found 9676 Process not Found 9676 Process not Found 9676 Process not Found 9676 Process not Found 9676 Process not Found 9676 Process not Found 9676 Process not Found 9676 Process not Found 9676 Process not Found 9676 Process not Found 9676 Process not Found 9676 Process not Found 9676 Process not Found 9676 Process not Found 9676 Process not Found 9676 Process not Found 9676 Process not Found 9676 Process not Found 9676 Process not Found 9676 Process not Found 9676 Process not Found 9676 Process not Found 9676 Process not Found 9676 Process not Found 9676 Process not Found 9676 Process not Found 9676 Process not Found 9676 Process not Found 9676 Process not Found 9676 Process not Found 9676 Process not Found 9676 Process not Found 9676 Process not Found 9676 Process not Found 9676 Process not Found 6236 Process not Found 6236 Process not Found 6236 Process not Found 6236 Process not Found 6236 Process not Found 6236 Process not Found 6236 Process not Found 6236 Process not Found 6236 Process not Found 6236 Process not Found 6236 Process not Found 6236 Process not Found 6236 Process not Found 6236 Process not Found 6236 Process not Found 6236 Process not Found 6236 Process not Found 6236 Process not Found 6236 Process not Found 6236 Process not Found 6236 Process not Found 6236 Process not Found 6236 Process not Found 6236 Process not Found 6236 Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2248 wrote to memory of 2416 2248 Nursultan 1.16.5 Crack.exe 893 PID 2248 wrote to memory of 2416 2248 Nursultan 1.16.5 Crack.exe 893 PID 2248 wrote to memory of 2416 2248 Nursultan 1.16.5 Crack.exe 893 PID 2248 wrote to memory of 2416 2248 Nursultan 1.16.5 Crack.exe 893 PID 2248 wrote to memory of 2768 2248 Nursultan 1.16.5 Crack.exe 214 PID 2248 wrote to memory of 2768 2248 Nursultan 1.16.5 Crack.exe 214 PID 2248 wrote to memory of 2768 2248 Nursultan 1.16.5 Crack.exe 214 PID 2248 wrote to memory of 2768 2248 Nursultan 1.16.5 Crack.exe 214 PID 2768 wrote to memory of 2596 2768 leetcrack.exe 30 PID 2768 wrote to memory of 2596 2768 leetcrack.exe 30 PID 2768 wrote to memory of 2596 2768 leetcrack.exe 30 PID 2768 wrote to memory of 2596 2768 leetcrack.exe 30 PID 2768 wrote to memory of 2648 2768 leetcrack.exe 32 PID 2768 wrote to memory of 2648 2768 leetcrack.exe 32 PID 2768 wrote to memory of 2648 2768 leetcrack.exe 32 PID 2768 wrote to memory of 2648 2768 leetcrack.exe 32 PID 2416 wrote to memory of 2944 2416 Nursultan 1.16.5 Crack.exe 830 PID 2416 wrote to memory of 2944 2416 Nursultan 1.16.5 Crack.exe 830 PID 2416 wrote to memory of 2944 2416 Nursultan 1.16.5 Crack.exe 830 PID 2416 wrote to memory of 2944 2416 Nursultan 1.16.5 Crack.exe 830 PID 2416 wrote to memory of 2728 2416 Nursultan 1.16.5 Crack.exe 33 PID 2416 wrote to memory of 2728 2416 Nursultan 1.16.5 Crack.exe 33 PID 2416 wrote to memory of 2728 2416 Nursultan 1.16.5 Crack.exe 33 PID 2416 wrote to memory of 2728 2416 Nursultan 1.16.5 Crack.exe 33 PID 2944 wrote to memory of 2752 2944 Nursultan 1.16.5 Crack.exe 126 PID 2944 wrote to memory of 2752 2944 Nursultan 1.16.5 Crack.exe 126 PID 2944 wrote to memory of 2752 2944 Nursultan 1.16.5 Crack.exe 126 PID 2944 wrote to memory of 2752 2944 Nursultan 1.16.5 Crack.exe 126 PID 2944 wrote to memory of 2316 2944 Nursultan 1.16.5 Crack.exe 104 PID 2944 wrote to memory of 2316 2944 Nursultan 1.16.5 Crack.exe 104 PID 2944 wrote to memory of 2316 2944 Nursultan 1.16.5 Crack.exe 104 PID 2944 wrote to memory of 2316 2944 Nursultan 1.16.5 Crack.exe 104 PID 2728 wrote to memory of 2628 2728 leetcrack.exe 36 PID 2728 wrote to memory of 2628 2728 leetcrack.exe 36 PID 2728 wrote to memory of 2628 2728 leetcrack.exe 36 PID 2728 wrote to memory of 2628 2728 leetcrack.exe 36 PID 2728 wrote to memory of 2536 2728 leetcrack.exe 102 PID 2728 wrote to memory of 2536 2728 leetcrack.exe 102 PID 2728 wrote to memory of 2536 2728 leetcrack.exe 102 PID 2728 wrote to memory of 2536 2728 leetcrack.exe 102 PID 2316 wrote to memory of 2688 2316 leetcrack.exe 38 PID 2316 wrote to memory of 2688 2316 leetcrack.exe 38 PID 2316 wrote to memory of 2688 2316 leetcrack.exe 38 PID 2316 wrote to memory of 2688 2316 leetcrack.exe 38 PID 2316 wrote to memory of 2504 2316 leetcrack.exe 39 PID 2316 wrote to memory of 2504 2316 leetcrack.exe 39 PID 2316 wrote to memory of 2504 2316 leetcrack.exe 39 PID 2316 wrote to memory of 2504 2316 leetcrack.exe 39 PID 2752 wrote to memory of 2072 2752 Nursultan 1.16.5 Crack.exe 105 PID 2752 wrote to memory of 2072 2752 Nursultan 1.16.5 Crack.exe 105 PID 2752 wrote to memory of 2072 2752 Nursultan 1.16.5 Crack.exe 105 PID 2752 wrote to memory of 2072 2752 Nursultan 1.16.5 Crack.exe 105 PID 2072 wrote to memory of 2844 2072 Nursultan 1.16.5 Crack.exe 42 PID 2072 wrote to memory of 2844 2072 Nursultan 1.16.5 Crack.exe 42 PID 2072 wrote to memory of 2844 2072 Nursultan 1.16.5 Crack.exe 42 PID 2072 wrote to memory of 2844 2072 Nursultan 1.16.5 Crack.exe 42 PID 2504 wrote to memory of 2848 2504 portmonitor.exe 41 PID 2504 wrote to memory of 2848 2504 portmonitor.exe 41 PID 2504 wrote to memory of 2848 2504 portmonitor.exe 41 PID 2504 wrote to memory of 2848 2504 portmonitor.exe 41 PID 2536 wrote to memory of 2820 2536 portmonitor.exe 43 PID 2536 wrote to memory of 2820 2536 portmonitor.exe 43 PID 2536 wrote to memory of 2820 2536 portmonitor.exe 43 PID 2536 wrote to memory of 2820 2536 portmonitor.exe 43 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2248 -
C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2416 -
C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2944 -
C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2752 -
C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2072 -
C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2844 -
C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"7⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2860 -
C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"8⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2560 -
C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"9⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1536 -
C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"10⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1592 -
C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"11⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1704 -
C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"12⤵
- Executes dropped EXE
- Loads dropped DLL
PID:992 -
C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"13⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2156 -
C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"14⤵
- Executes dropped EXE
PID:2576 -
C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"15⤵
- Executes dropped EXE
PID:1956 -
C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"16⤵
- Executes dropped EXE
PID:2500 -
C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"17⤵
- Executes dropped EXE
PID:2000 -
C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"18⤵
- Executes dropped EXE
PID:2316 -
C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"19⤵PID:1680
-
C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"20⤵PID:2464
-
C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"21⤵PID:960
-
C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"22⤵PID:800
-
C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"23⤵PID:936
-
C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"24⤵PID:324
-
C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"25⤵PID:2428
-
C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"26⤵PID:2916
-
C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"27⤵PID:2728
-
C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"28⤵PID:2856
-
C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"29⤵PID:1168
-
C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"30⤵PID:2792
-
C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"31⤵PID:1696
-
C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"32⤵PID:1956
-
C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"33⤵PID:2516
-
C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"34⤵PID:2352
-
C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"35⤵PID:2576
-
C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"36⤵PID:1584
-
C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"37⤵PID:2864
-
C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"38⤵PID:1184
-
C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"39⤵PID:960
-
C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"40⤵PID:2768
-
C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"41⤵PID:1316
-
C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"42⤵PID:2956
-
C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"43⤵PID:2488
-
C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"44⤵PID:2576
-
C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"45⤵PID:3156
-
C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"46⤵PID:3208
-
C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"47⤵PID:3308
-
C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"48⤵PID:3376
-
C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"49⤵PID:3448
-
C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"50⤵PID:3504
-
C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"51⤵PID:3656
-
C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"52⤵PID:3944
-
C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"53⤵PID:4020
-
C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"54⤵PID:4092
-
C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"55⤵PID:2844
-
C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"56⤵PID:3168
-
C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"57⤵PID:3300
-
C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"58⤵PID:3420
-
C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"59⤵PID:3440
-
C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"60⤵PID:3704
-
C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"61⤵PID:3736
-
C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"62⤵PID:3180
-
C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"63⤵PID:3276
-
C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"64⤵PID:3172
-
C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"65⤵PID:3800
-
C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"66⤵PID:3076
-
C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"67⤵PID:3216
-
C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"68⤵PID:3280
-
C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"69⤵PID:3472
-
C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"70⤵PID:3320
-
C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"71⤵PID:3940
-
C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"72⤵PID:3524
-
C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"73⤵PID:3792
-
C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"74⤵PID:1808
-
C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"75⤵PID:3428
-
C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"76⤵PID:3720
-
C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"77⤵PID:3428
-
C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"78⤵PID:4156
-
C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"79⤵PID:4232
-
C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"80⤵PID:4392
-
C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"81⤵PID:4456
-
C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"82⤵PID:4588
-
C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"83⤵PID:4668
-
C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"84⤵PID:4720
-
C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"85⤵PID:4852
-
C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"86⤵PID:5008
-
C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"87⤵PID:5104
-
C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"88⤵PID:2720
-
C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"89⤵PID:4160
-
C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"90⤵PID:4256
-
C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"91⤵PID:4512
-
C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"92⤵PID:4564
-
C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"93⤵PID:632
-
C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"94⤵PID:4760
-
C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"95⤵PID:5060
-
C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"96⤵PID:5104
-
C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"97⤵PID:4236
-
C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"98⤵PID:4576
-
C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"99⤵PID:4696
-
C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"100⤵PID:4816
-
C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"101⤵PID:4108
-
C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"102⤵PID:4476
-
C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"103⤵PID:4736
-
C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"104⤵PID:4304
-
C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"105⤵PID:2788
-
C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"106⤵PID:2912
-
C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"107⤵PID:2848
-
C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"108⤵PID:4708
-
C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"109⤵PID:2532
-
C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"110⤵PID:5360
-
C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"111⤵PID:5624
-
C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"112⤵PID:5836
-
C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"113⤵PID:2008
-
C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"114⤵PID:5396
-
C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"115⤵PID:2364
-
C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"116⤵PID:5832
-
C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"117⤵PID:2392
-
C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"118⤵PID:1748
-
C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"119⤵PID:3000
-
C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"120⤵PID:5912
-
C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"121⤵PID:5236
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-