Overview
overview
10Static
static
7r-aimbot.exe
windows10-2004-x64
10r-aimbot.exe
windows11-21h2-x64
10fuck.exe
windows10-2004-x64
10fuck.exe
windows11-21h2-x64
10r-aimbot.exe
windows10-2004-x64
8r-aimbot.exe
windows11-21h2-x64
8WindowsApp...n4.exe
windows10-2004-x64
8WindowsApp...n4.exe
windows11-21h2-x64
8r-aimbot.exe
windows10-2004-x64
7r-aimbot.exe
windows11-21h2-x64
7Analysis
-
max time kernel
22s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
15/05/2024, 18:27
Behavioral task
behavioral1
Sample
r-aimbot.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral2
Sample
r-aimbot.exe
Resource
win11-20240426-en
Behavioral task
behavioral3
Sample
fuck.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral4
Sample
fuck.exe
Resource
win11-20240426-en
Behavioral task
behavioral5
Sample
r-aimbot.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral6
Sample
r-aimbot.exe
Resource
win11-20240508-en
Behavioral task
behavioral7
Sample
WindowsApplication4.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral8
Sample
WindowsApplication4.exe
Resource
win11-20240508-en
Behavioral task
behavioral9
Sample
r-aimbot.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral10
Sample
r-aimbot.exe
Resource
win11-20240426-en
General
-
Target
r-aimbot.exe
-
Size
304KB
-
MD5
1b15246eba422c272c4622e4eef21905
-
SHA1
a14275ce8215f7938e4caf0b29051e0c06c87a90
-
SHA256
feb0426e4c0d98e8fedc2be59935018fb711a47abb2973f3344a0e4ddb95d598
-
SHA512
94317cba766149b1ff3ac36013bba19c196a17b70da8fdab82dc6f2c9882ad10fa17b13bc4a779ab6a9ba02b7401d5fc6f32fd44d3ebebddfc5abf1b8efadbd4
-
SSDEEP
6144:knx1x2Dfvek42txA8+/nvGFm+ltYkTflDuONxDpHlGcUrjtxxEK:e4O/kx78nvGFm+jP9DusDpHlGcA
Malware Config
Signatures
-
Modifies Windows Firewall 2 TTPs 1 IoCs
pid Process 372 netsh.exe -
Checks computer location settings 2 TTPs 64 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation r-aimbot.exe Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation r-aimbot.exe Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation r-aimbot.exe Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation r-aimbot.exe Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation r-aimbot.exe Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation r-aimbot.exe Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation r-aimbot.exe Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation r-aimbot.exe Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation r-aimbot.exe Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation r-aimbot.exe Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation r-aimbot.exe Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation r-aimbot.exe Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation r-aimbot.exe Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation r-aimbot.exe Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation r-aimbot.exe Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation r-aimbot.exe Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation r-aimbot.exe Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation r-aimbot.exe Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation r-aimbot.exe Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation r-aimbot.exe Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation r-aimbot.exe Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation r-aimbot.exe Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation r-aimbot.exe Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation r-aimbot.exe Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation r-aimbot.exe Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation r-aimbot.exe Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation r-aimbot.exe Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation r-aimbot.exe Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation r-aimbot.exe Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation WindowsApplication4.exe Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation r-aimbot.exe Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation r-aimbot.exe Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation r-aimbot.exe Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation r-aimbot.exe Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation r-aimbot.exe Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation r-aimbot.exe Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation r-aimbot.exe Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation r-aimbot.exe Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation r-aimbot.exe Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation r-aimbot.exe Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation r-aimbot.exe Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation r-aimbot.exe Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation r-aimbot.exe Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation r-aimbot.exe Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation r-aimbot.exe Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation r-aimbot.exe Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation r-aimbot.exe Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation r-aimbot.exe Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation r-aimbot.exe Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation r-aimbot.exe Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation r-aimbot.exe Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation r-aimbot.exe Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation r-aimbot.exe Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation r-aimbot.exe Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation r-aimbot.exe Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation r-aimbot.exe Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation r-aimbot.exe Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation r-aimbot.exe Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation r-aimbot.exe Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation r-aimbot.exe Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation r-aimbot.exe Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation r-aimbot.exe Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation r-aimbot.exe Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation r-aimbot.exe -
Executes dropped EXE 64 IoCs
pid Process 4396 WindowsApplication4.exe 5044 WindowsApplication4.exe 3668 WindowsApplication4.exe 548 WindowsApplication4.exe 1392 WindowsApplication4.exe 3952 WindowsApplication4.exe 4200 WindowsApplication4.exe 2264 WindowsApplication4.exe 880 WindowsApplication4.exe 896 WindowsApplication4.exe 4072 WindowsApplication4.exe 2692 WindowsApplication4.exe 2720 WindowsApplication4.exe 4620 WindowsApplication4.exe 3076 WindowsApplication4.exe 1472 WindowsApplication4.exe 532 WindowsApplication4.exe 432 WindowsApplication4.exe 224 WindowsApplication4.exe 2928 WindowsApplication4.exe 736 WindowsApplication4.exe 3684 WindowsApplication4.exe 4632 WindowsApplication4.exe 3504 WindowsApplication4.exe 3252 WindowsApplication4.exe 372 WindowsApplication4.exe 4528 WindowsApplication4.exe 4580 WindowsApplication4.exe 2476 WindowsApplication4.exe 1168 WindowsApplication4.exe 2096 WindowsApplication4.exe 3744 WindowsApplication4.exe 4976 WindowsApplication4.exe 4472 WindowsApplication4.exe 4908 WindowsApplication4.exe 2540 WindowsApplication4.exe 980 WindowsApplication4.exe 1624 WindowsApplication4.exe 4432 WindowsApplication4.exe 1596 WindowsApplication4.exe 2220 WindowsApplication4.exe 4848 WindowsApplication4.exe 5152 WindowsApplication4.exe 5224 WindowsApplication4.exe 5292 WindowsApplication4.exe 5356 WindowsApplication4.exe 5428 WindowsApplication4.exe 5496 WindowsApplication4.exe 5552 WindowsApplication4.exe 5620 WindowsApplication4.exe 5676 WindowsApplication4.exe 5740 WindowsApplication4.exe 5812 WindowsApplication4.exe 5880 WindowsApplication4.exe 5940 WindowsApplication4.exe 6028 WindowsApplication4.exe 6096 WindowsApplication4.exe 3544 WindowsApplication4.exe 5200 WindowsApplication4.exe 5212 WindowsApplication4.exe 5404 WindowsApplication4.exe 5528 WindowsApplication4.exe 5628 WindowsApplication4.exe 5716 WindowsApplication4.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 224 wrote to memory of 4084 224 r-aimbot.exe 89 PID 224 wrote to memory of 4084 224 r-aimbot.exe 89 PID 224 wrote to memory of 4084 224 r-aimbot.exe 89 PID 224 wrote to memory of 4396 224 r-aimbot.exe 90 PID 224 wrote to memory of 4396 224 r-aimbot.exe 90 PID 224 wrote to memory of 4396 224 r-aimbot.exe 90 PID 4084 wrote to memory of 2924 4084 r-aimbot.exe 91 PID 4084 wrote to memory of 2924 4084 r-aimbot.exe 91 PID 4084 wrote to memory of 2924 4084 r-aimbot.exe 91 PID 4084 wrote to memory of 5044 4084 r-aimbot.exe 92 PID 4084 wrote to memory of 5044 4084 r-aimbot.exe 92 PID 4084 wrote to memory of 5044 4084 r-aimbot.exe 92 PID 2924 wrote to memory of 2096 2924 r-aimbot.exe 93 PID 2924 wrote to memory of 2096 2924 r-aimbot.exe 93 PID 2924 wrote to memory of 2096 2924 r-aimbot.exe 93 PID 2924 wrote to memory of 3668 2924 r-aimbot.exe 94 PID 2924 wrote to memory of 3668 2924 r-aimbot.exe 94 PID 2924 wrote to memory of 3668 2924 r-aimbot.exe 94 PID 2096 wrote to memory of 2768 2096 r-aimbot.exe 96 PID 2096 wrote to memory of 2768 2096 r-aimbot.exe 96 PID 2096 wrote to memory of 2768 2096 r-aimbot.exe 96 PID 2096 wrote to memory of 548 2096 r-aimbot.exe 97 PID 2096 wrote to memory of 548 2096 r-aimbot.exe 97 PID 2096 wrote to memory of 548 2096 r-aimbot.exe 97 PID 2768 wrote to memory of 3516 2768 r-aimbot.exe 155 PID 2768 wrote to memory of 3516 2768 r-aimbot.exe 155 PID 2768 wrote to memory of 3516 2768 r-aimbot.exe 155 PID 2768 wrote to memory of 1392 2768 r-aimbot.exe 99 PID 2768 wrote to memory of 1392 2768 r-aimbot.exe 99 PID 2768 wrote to memory of 1392 2768 r-aimbot.exe 99 PID 3516 wrote to memory of 3232 3516 r-aimbot.exe 100 PID 3516 wrote to memory of 3232 3516 r-aimbot.exe 100 PID 3516 wrote to memory of 3232 3516 r-aimbot.exe 100 PID 3516 wrote to memory of 3952 3516 r-aimbot.exe 101 PID 3516 wrote to memory of 3952 3516 r-aimbot.exe 101 PID 3516 wrote to memory of 3952 3516 r-aimbot.exe 101 PID 3232 wrote to memory of 1748 3232 r-aimbot.exe 103 PID 3232 wrote to memory of 1748 3232 r-aimbot.exe 103 PID 3232 wrote to memory of 1748 3232 r-aimbot.exe 103 PID 3232 wrote to memory of 4200 3232 r-aimbot.exe 104 PID 3232 wrote to memory of 4200 3232 r-aimbot.exe 104 PID 3232 wrote to memory of 4200 3232 r-aimbot.exe 104 PID 1748 wrote to memory of 4944 1748 r-aimbot.exe 105 PID 1748 wrote to memory of 4944 1748 r-aimbot.exe 105 PID 1748 wrote to memory of 4944 1748 r-aimbot.exe 105 PID 1748 wrote to memory of 2264 1748 r-aimbot.exe 106 PID 1748 wrote to memory of 2264 1748 r-aimbot.exe 106 PID 1748 wrote to memory of 2264 1748 r-aimbot.exe 106 PID 4944 wrote to memory of 3760 4944 r-aimbot.exe 107 PID 4944 wrote to memory of 3760 4944 r-aimbot.exe 107 PID 4944 wrote to memory of 3760 4944 r-aimbot.exe 107 PID 4944 wrote to memory of 880 4944 r-aimbot.exe 108 PID 4944 wrote to memory of 880 4944 r-aimbot.exe 108 PID 4944 wrote to memory of 880 4944 r-aimbot.exe 108 PID 3760 wrote to memory of 1668 3760 r-aimbot.exe 110 PID 3760 wrote to memory of 1668 3760 r-aimbot.exe 110 PID 3760 wrote to memory of 1668 3760 r-aimbot.exe 110 PID 3760 wrote to memory of 896 3760 r-aimbot.exe 111 PID 3760 wrote to memory of 896 3760 r-aimbot.exe 111 PID 3760 wrote to memory of 896 3760 r-aimbot.exe 111 PID 1668 wrote to memory of 1800 1668 r-aimbot.exe 250 PID 1668 wrote to memory of 1800 1668 r-aimbot.exe 250 PID 1668 wrote to memory of 1800 1668 r-aimbot.exe 250 PID 1668 wrote to memory of 4072 1668 r-aimbot.exe 113
Processes
-
C:\Users\Admin\AppData\Local\Temp\r-aimbot.exe"C:\Users\Admin\AppData\Local\Temp\r-aimbot.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:224 -
C:\Users\Admin\AppData\Local\Temp\r-aimbot.exe"C:\Users\Admin\AppData\Local\Temp\r-aimbot.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:4084 -
C:\Users\Admin\AppData\Local\Temp\r-aimbot.exe"C:\Users\Admin\AppData\Local\Temp\r-aimbot.exe"3⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2924 -
C:\Users\Admin\AppData\Local\Temp\r-aimbot.exe"C:\Users\Admin\AppData\Local\Temp\r-aimbot.exe"4⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2096 -
C:\Users\Admin\AppData\Local\Temp\r-aimbot.exe"C:\Users\Admin\AppData\Local\Temp\r-aimbot.exe"5⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2768 -
C:\Users\Admin\AppData\Local\Temp\r-aimbot.exe"C:\Users\Admin\AppData\Local\Temp\r-aimbot.exe"6⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3516 -
C:\Users\Admin\AppData\Local\Temp\r-aimbot.exe"C:\Users\Admin\AppData\Local\Temp\r-aimbot.exe"7⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3232 -
C:\Users\Admin\AppData\Local\Temp\r-aimbot.exe"C:\Users\Admin\AppData\Local\Temp\r-aimbot.exe"8⤵
- Suspicious use of WriteProcessMemory
PID:1748 -
C:\Users\Admin\AppData\Local\Temp\r-aimbot.exe"C:\Users\Admin\AppData\Local\Temp\r-aimbot.exe"9⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4944 -
C:\Users\Admin\AppData\Local\Temp\r-aimbot.exe"C:\Users\Admin\AppData\Local\Temp\r-aimbot.exe"10⤵
- Suspicious use of WriteProcessMemory
PID:3760 -
C:\Users\Admin\AppData\Local\Temp\r-aimbot.exe"C:\Users\Admin\AppData\Local\Temp\r-aimbot.exe"11⤵
- Suspicious use of WriteProcessMemory
PID:1668 -
C:\Users\Admin\AppData\Local\Temp\r-aimbot.exe"C:\Users\Admin\AppData\Local\Temp\r-aimbot.exe"12⤵
- Checks computer location settings
PID:1800 -
C:\Users\Admin\AppData\Local\Temp\r-aimbot.exe"C:\Users\Admin\AppData\Local\Temp\r-aimbot.exe"13⤵
- Checks computer location settings
PID:4424 -
C:\Users\Admin\AppData\Local\Temp\r-aimbot.exe"C:\Users\Admin\AppData\Local\Temp\r-aimbot.exe"14⤵PID:4028
-
C:\Users\Admin\AppData\Local\Temp\r-aimbot.exe"C:\Users\Admin\AppData\Local\Temp\r-aimbot.exe"15⤵
- Checks computer location settings
PID:1080 -
C:\Users\Admin\AppData\Local\Temp\r-aimbot.exe"C:\Users\Admin\AppData\Local\Temp\r-aimbot.exe"16⤵
- Checks computer location settings
PID:4308 -
C:\Users\Admin\AppData\Local\Temp\r-aimbot.exe"C:\Users\Admin\AppData\Local\Temp\r-aimbot.exe"17⤵PID:2932
-
C:\Users\Admin\AppData\Local\Temp\r-aimbot.exe"C:\Users\Admin\AppData\Local\Temp\r-aimbot.exe"18⤵PID:2476
-
C:\Users\Admin\AppData\Local\Temp\r-aimbot.exe"C:\Users\Admin\AppData\Local\Temp\r-aimbot.exe"19⤵
- Checks computer location settings
PID:2920 -
C:\Users\Admin\AppData\Local\Temp\r-aimbot.exe"C:\Users\Admin\AppData\Local\Temp\r-aimbot.exe"20⤵PID:860
-
C:\Users\Admin\AppData\Local\Temp\r-aimbot.exe"C:\Users\Admin\AppData\Local\Temp\r-aimbot.exe"21⤵PID:1504
-
C:\Users\Admin\AppData\Local\Temp\r-aimbot.exe"C:\Users\Admin\AppData\Local\Temp\r-aimbot.exe"22⤵PID:3408
-
C:\Users\Admin\AppData\Local\Temp\r-aimbot.exe"C:\Users\Admin\AppData\Local\Temp\r-aimbot.exe"23⤵PID:3048
-
C:\Users\Admin\AppData\Local\Temp\r-aimbot.exe"C:\Users\Admin\AppData\Local\Temp\r-aimbot.exe"24⤵PID:2136
-
C:\Users\Admin\AppData\Local\Temp\r-aimbot.exe"C:\Users\Admin\AppData\Local\Temp\r-aimbot.exe"25⤵PID:3888
-
C:\Users\Admin\AppData\Local\Temp\r-aimbot.exe"C:\Users\Admin\AppData\Local\Temp\r-aimbot.exe"26⤵PID:1624
-
C:\Users\Admin\AppData\Local\Temp\r-aimbot.exe"C:\Users\Admin\AppData\Local\Temp\r-aimbot.exe"27⤵
- Checks computer location settings
PID:4008 -
C:\Users\Admin\AppData\Local\Temp\r-aimbot.exe"C:\Users\Admin\AppData\Local\Temp\r-aimbot.exe"28⤵PID:4640
-
C:\Users\Admin\AppData\Local\Temp\r-aimbot.exe"C:\Users\Admin\AppData\Local\Temp\r-aimbot.exe"29⤵
- Checks computer location settings
PID:3040 -
C:\Users\Admin\AppData\Local\Temp\r-aimbot.exe"C:\Users\Admin\AppData\Local\Temp\r-aimbot.exe"30⤵PID:4828
-
C:\Users\Admin\AppData\Local\Temp\r-aimbot.exe"C:\Users\Admin\AppData\Local\Temp\r-aimbot.exe"31⤵
- Checks computer location settings
PID:2540 -
C:\Users\Admin\AppData\Local\Temp\r-aimbot.exe"C:\Users\Admin\AppData\Local\Temp\r-aimbot.exe"32⤵PID:4652
-
C:\Users\Admin\AppData\Local\Temp\r-aimbot.exe"C:\Users\Admin\AppData\Local\Temp\r-aimbot.exe"33⤵PID:3048
-
C:\Users\Admin\AppData\Local\Temp\r-aimbot.exe"C:\Users\Admin\AppData\Local\Temp\r-aimbot.exe"34⤵
- Checks computer location settings
PID:1624 -
C:\Users\Admin\AppData\Local\Temp\r-aimbot.exe"C:\Users\Admin\AppData\Local\Temp\r-aimbot.exe"35⤵
- Checks computer location settings
PID:3532 -
C:\Users\Admin\AppData\Local\Temp\r-aimbot.exe"C:\Users\Admin\AppData\Local\Temp\r-aimbot.exe"36⤵
- Checks computer location settings
PID:4596 -
C:\Users\Admin\AppData\Local\Temp\r-aimbot.exe"C:\Users\Admin\AppData\Local\Temp\r-aimbot.exe"37⤵
- Checks computer location settings
PID:4084 -
C:\Users\Admin\AppData\Local\Temp\r-aimbot.exe"C:\Users\Admin\AppData\Local\Temp\r-aimbot.exe"38⤵PID:1304
-
C:\Users\Admin\AppData\Local\Temp\r-aimbot.exe"C:\Users\Admin\AppData\Local\Temp\r-aimbot.exe"39⤵PID:4484
-
C:\Users\Admin\AppData\Local\Temp\r-aimbot.exe"C:\Users\Admin\AppData\Local\Temp\r-aimbot.exe"40⤵
- Checks computer location settings
PID:8 -
C:\Users\Admin\AppData\Local\Temp\r-aimbot.exe"C:\Users\Admin\AppData\Local\Temp\r-aimbot.exe"41⤵
- Checks computer location settings
PID:4968 -
C:\Users\Admin\AppData\Local\Temp\r-aimbot.exe"C:\Users\Admin\AppData\Local\Temp\r-aimbot.exe"42⤵PID:228
-
C:\Users\Admin\AppData\Local\Temp\r-aimbot.exe"C:\Users\Admin\AppData\Local\Temp\r-aimbot.exe"43⤵
- Checks computer location settings
PID:3532 -
C:\Users\Admin\AppData\Local\Temp\r-aimbot.exe"C:\Users\Admin\AppData\Local\Temp\r-aimbot.exe"44⤵PID:5144
-
C:\Users\Admin\AppData\Local\Temp\r-aimbot.exe"C:\Users\Admin\AppData\Local\Temp\r-aimbot.exe"45⤵
- Checks computer location settings
PID:5212 -
C:\Users\Admin\AppData\Local\Temp\r-aimbot.exe"C:\Users\Admin\AppData\Local\Temp\r-aimbot.exe"46⤵PID:5276
-
C:\Users\Admin\AppData\Local\Temp\r-aimbot.exe"C:\Users\Admin\AppData\Local\Temp\r-aimbot.exe"47⤵
- Checks computer location settings
PID:5348 -
C:\Users\Admin\AppData\Local\Temp\r-aimbot.exe"C:\Users\Admin\AppData\Local\Temp\r-aimbot.exe"48⤵
- Checks computer location settings
PID:5416 -
C:\Users\Admin\AppData\Local\Temp\r-aimbot.exe"C:\Users\Admin\AppData\Local\Temp\r-aimbot.exe"49⤵PID:5480
-
C:\Users\Admin\AppData\Local\Temp\r-aimbot.exe"C:\Users\Admin\AppData\Local\Temp\r-aimbot.exe"50⤵PID:5544
-
C:\Users\Admin\AppData\Local\Temp\r-aimbot.exe"C:\Users\Admin\AppData\Local\Temp\r-aimbot.exe"51⤵PID:5604
-
C:\Users\Admin\AppData\Local\Temp\r-aimbot.exe"C:\Users\Admin\AppData\Local\Temp\r-aimbot.exe"52⤵
- Checks computer location settings
PID:5668 -
C:\Users\Admin\AppData\Local\Temp\r-aimbot.exe"C:\Users\Admin\AppData\Local\Temp\r-aimbot.exe"53⤵PID:5732
-
C:\Users\Admin\AppData\Local\Temp\r-aimbot.exe"C:\Users\Admin\AppData\Local\Temp\r-aimbot.exe"54⤵PID:5800
-
C:\Users\Admin\AppData\Local\Temp\r-aimbot.exe"C:\Users\Admin\AppData\Local\Temp\r-aimbot.exe"55⤵PID:5864
-
C:\Users\Admin\AppData\Local\Temp\r-aimbot.exe"C:\Users\Admin\AppData\Local\Temp\r-aimbot.exe"56⤵PID:5924
-
C:\Users\Admin\AppData\Local\Temp\r-aimbot.exe"C:\Users\Admin\AppData\Local\Temp\r-aimbot.exe"57⤵PID:6016
-
C:\Users\Admin\AppData\Local\Temp\r-aimbot.exe"C:\Users\Admin\AppData\Local\Temp\r-aimbot.exe"58⤵
- Checks computer location settings
PID:6080 -
C:\Users\Admin\AppData\Local\Temp\r-aimbot.exe"C:\Users\Admin\AppData\Local\Temp\r-aimbot.exe"59⤵
- Checks computer location settings
PID:1664 -
C:\Users\Admin\AppData\Local\Temp\r-aimbot.exe"C:\Users\Admin\AppData\Local\Temp\r-aimbot.exe"60⤵
- Checks computer location settings
PID:3532 -
C:\Users\Admin\AppData\Local\Temp\r-aimbot.exe"C:\Users\Admin\AppData\Local\Temp\r-aimbot.exe"61⤵
- Checks computer location settings
PID:5268 -
C:\Users\Admin\AppData\Local\Temp\r-aimbot.exe"C:\Users\Admin\AppData\Local\Temp\r-aimbot.exe"62⤵
- Checks computer location settings
PID:5372 -
C:\Users\Admin\AppData\Local\Temp\r-aimbot.exe"C:\Users\Admin\AppData\Local\Temp\r-aimbot.exe"63⤵
- Checks computer location settings
PID:5536 -
C:\Users\Admin\AppData\Local\Temp\r-aimbot.exe"C:\Users\Admin\AppData\Local\Temp\r-aimbot.exe"64⤵PID:5572
-
C:\Users\Admin\AppData\Local\Temp\r-aimbot.exe"C:\Users\Admin\AppData\Local\Temp\r-aimbot.exe"65⤵
- Checks computer location settings
PID:5720 -
C:\Users\Admin\AppData\Local\Temp\r-aimbot.exe"C:\Users\Admin\AppData\Local\Temp\r-aimbot.exe"66⤵PID:1012
-
C:\Users\Admin\AppData\Local\Temp\r-aimbot.exe"C:\Users\Admin\AppData\Local\Temp\r-aimbot.exe"67⤵PID:5752
-
C:\Users\Admin\AppData\Local\Temp\r-aimbot.exe"C:\Users\Admin\AppData\Local\Temp\r-aimbot.exe"68⤵PID:5876
-
C:\Users\Admin\AppData\Local\Temp\r-aimbot.exe"C:\Users\Admin\AppData\Local\Temp\r-aimbot.exe"69⤵PID:6044
-
C:\Users\Admin\AppData\Local\Temp\r-aimbot.exe"C:\Users\Admin\AppData\Local\Temp\r-aimbot.exe"70⤵PID:6068
-
C:\Users\Admin\AppData\Local\Temp\r-aimbot.exe"C:\Users\Admin\AppData\Local\Temp\r-aimbot.exe"71⤵PID:1800
-
C:\Users\Admin\AppData\Local\Temp\r-aimbot.exe"C:\Users\Admin\AppData\Local\Temp\r-aimbot.exe"72⤵PID:5504
-
C:\Users\Admin\AppData\Local\Temp\r-aimbot.exe"C:\Users\Admin\AppData\Local\Temp\r-aimbot.exe"73⤵PID:5684
-
C:\Users\Admin\AppData\Local\Temp\r-aimbot.exe"C:\Users\Admin\AppData\Local\Temp\r-aimbot.exe"74⤵
- Checks computer location settings
PID:1012 -
C:\Users\Admin\AppData\Local\Temp\r-aimbot.exe"C:\Users\Admin\AppData\Local\Temp\r-aimbot.exe"75⤵
- Checks computer location settings
PID:6020 -
C:\Users\Admin\AppData\Local\Temp\r-aimbot.exe"C:\Users\Admin\AppData\Local\Temp\r-aimbot.exe"76⤵
- Checks computer location settings
PID:1664 -
C:\Users\Admin\AppData\Local\Temp\r-aimbot.exe"C:\Users\Admin\AppData\Local\Temp\r-aimbot.exe"77⤵PID:5400
-
C:\Users\Admin\AppData\Local\Temp\r-aimbot.exe"C:\Users\Admin\AppData\Local\Temp\r-aimbot.exe"78⤵PID:5344
-
C:\Users\Admin\AppData\Local\Temp\r-aimbot.exe"C:\Users\Admin\AppData\Local\Temp\r-aimbot.exe"79⤵PID:5660
-
C:\Users\Admin\AppData\Local\Temp\r-aimbot.exe"C:\Users\Admin\AppData\Local\Temp\r-aimbot.exe"80⤵
- Checks computer location settings
PID:5900 -
C:\Users\Admin\AppData\Local\Temp\r-aimbot.exe"C:\Users\Admin\AppData\Local\Temp\r-aimbot.exe"81⤵PID:6068
-
C:\Users\Admin\AppData\Local\Temp\r-aimbot.exe"C:\Users\Admin\AppData\Local\Temp\r-aimbot.exe"82⤵PID:5440
-
C:\Users\Admin\AppData\Local\Temp\r-aimbot.exe"C:\Users\Admin\AppData\Local\Temp\r-aimbot.exe"83⤵PID:4880
-
C:\Users\Admin\AppData\Local\Temp\r-aimbot.exe"C:\Users\Admin\AppData\Local\Temp\r-aimbot.exe"84⤵PID:5532
-
C:\Users\Admin\AppData\Local\Temp\r-aimbot.exe"C:\Users\Admin\AppData\Local\Temp\r-aimbot.exe"85⤵
- Checks computer location settings
PID:4712 -
C:\Users\Admin\AppData\Local\Temp\r-aimbot.exe"C:\Users\Admin\AppData\Local\Temp\r-aimbot.exe"86⤵
- Checks computer location settings
PID:1692 -
C:\Users\Admin\AppData\Local\Temp\r-aimbot.exe"C:\Users\Admin\AppData\Local\Temp\r-aimbot.exe"87⤵PID:4524
-
C:\Users\Admin\AppData\Local\Temp\r-aimbot.exe"C:\Users\Admin\AppData\Local\Temp\r-aimbot.exe"88⤵
- Checks computer location settings
PID:5368 -
C:\Users\Admin\AppData\Local\Temp\r-aimbot.exe"C:\Users\Admin\AppData\Local\Temp\r-aimbot.exe"89⤵PID:3692
-
C:\Users\Admin\AppData\Local\Temp\r-aimbot.exe"C:\Users\Admin\AppData\Local\Temp\r-aimbot.exe"90⤵
- Checks computer location settings
PID:516 -
C:\Users\Admin\AppData\Local\Temp\r-aimbot.exe"C:\Users\Admin\AppData\Local\Temp\r-aimbot.exe"91⤵PID:4712
-
C:\Users\Admin\AppData\Local\Temp\r-aimbot.exe"C:\Users\Admin\AppData\Local\Temp\r-aimbot.exe"92⤵
- Checks computer location settings
PID:1692 -
C:\Users\Admin\AppData\Local\Temp\r-aimbot.exe"C:\Users\Admin\AppData\Local\Temp\r-aimbot.exe"93⤵
- Checks computer location settings
PID:1532 -
C:\Users\Admin\AppData\Local\Temp\r-aimbot.exe"C:\Users\Admin\AppData\Local\Temp\r-aimbot.exe"94⤵
- Checks computer location settings
PID:928 -
C:\Users\Admin\AppData\Local\Temp\r-aimbot.exe"C:\Users\Admin\AppData\Local\Temp\r-aimbot.exe"95⤵PID:2804
-
C:\Users\Admin\AppData\Local\Temp\r-aimbot.exe"C:\Users\Admin\AppData\Local\Temp\r-aimbot.exe"96⤵PID:3712
-
C:\Users\Admin\AppData\Local\Temp\r-aimbot.exe"C:\Users\Admin\AppData\Local\Temp\r-aimbot.exe"97⤵PID:5504
-
C:\Users\Admin\AppData\Local\Temp\r-aimbot.exe"C:\Users\Admin\AppData\Local\Temp\r-aimbot.exe"98⤵PID:5080
-
C:\Users\Admin\AppData\Local\Temp\r-aimbot.exe"C:\Users\Admin\AppData\Local\Temp\r-aimbot.exe"99⤵PID:812
-
C:\Users\Admin\AppData\Local\Temp\r-aimbot.exe"C:\Users\Admin\AppData\Local\Temp\r-aimbot.exe"100⤵PID:1392
-
C:\Users\Admin\AppData\Local\Temp\r-aimbot.exe"C:\Users\Admin\AppData\Local\Temp\r-aimbot.exe"101⤵
- Checks computer location settings
PID:4036 -
C:\Users\Admin\AppData\Local\Temp\r-aimbot.exe"C:\Users\Admin\AppData\Local\Temp\r-aimbot.exe"102⤵
- Checks computer location settings
PID:3056 -
C:\Users\Admin\AppData\Local\Temp\r-aimbot.exe"C:\Users\Admin\AppData\Local\Temp\r-aimbot.exe"103⤵
- Checks computer location settings
PID:2804 -
C:\Users\Admin\AppData\Local\Temp\r-aimbot.exe"C:\Users\Admin\AppData\Local\Temp\r-aimbot.exe"104⤵
- Checks computer location settings
PID:2568 -
C:\Users\Admin\AppData\Local\Temp\r-aimbot.exe"C:\Users\Admin\AppData\Local\Temp\r-aimbot.exe"105⤵PID:2124
-
C:\Users\Admin\AppData\Local\Temp\r-aimbot.exe"C:\Users\Admin\AppData\Local\Temp\r-aimbot.exe"106⤵PID:2940
-
C:\Users\Admin\AppData\Local\Temp\r-aimbot.exe"C:\Users\Admin\AppData\Local\Temp\r-aimbot.exe"107⤵PID:4944
-
C:\Users\Admin\AppData\Local\Temp\r-aimbot.exe"C:\Users\Admin\AppData\Local\Temp\r-aimbot.exe"108⤵
- Checks computer location settings
PID:1920 -
C:\Users\Admin\AppData\Local\Temp\r-aimbot.exe"C:\Users\Admin\AppData\Local\Temp\r-aimbot.exe"109⤵
- Checks computer location settings
PID:3628 -
C:\Users\Admin\AppData\Local\Temp\r-aimbot.exe"C:\Users\Admin\AppData\Local\Temp\r-aimbot.exe"110⤵
- Checks computer location settings
PID:3056 -
C:\Users\Admin\AppData\Local\Temp\r-aimbot.exe"C:\Users\Admin\AppData\Local\Temp\r-aimbot.exe"111⤵
- Checks computer location settings
PID:4472 -
C:\Users\Admin\AppData\Local\Temp\r-aimbot.exe"C:\Users\Admin\AppData\Local\Temp\r-aimbot.exe"112⤵PID:4028
-
C:\Users\Admin\AppData\Local\Temp\r-aimbot.exe"C:\Users\Admin\AppData\Local\Temp\r-aimbot.exe"113⤵
- Checks computer location settings
PID:4416 -
C:\Users\Admin\AppData\Local\Temp\r-aimbot.exe"C:\Users\Admin\AppData\Local\Temp\r-aimbot.exe"114⤵
- Checks computer location settings
PID:1288 -
C:\Users\Admin\AppData\Local\Temp\r-aimbot.exe"C:\Users\Admin\AppData\Local\Temp\r-aimbot.exe"115⤵PID:1884
-
C:\Users\Admin\AppData\Local\Temp\r-aimbot.exe"C:\Users\Admin\AppData\Local\Temp\r-aimbot.exe"116⤵PID:3504
-
C:\Users\Admin\AppData\Local\Temp\r-aimbot.exe"C:\Users\Admin\AppData\Local\Temp\r-aimbot.exe"117⤵PID:3628
-
C:\Users\Admin\AppData\Local\Temp\r-aimbot.exe"C:\Users\Admin\AppData\Local\Temp\r-aimbot.exe"118⤵PID:3056
-
C:\Users\Admin\AppData\Local\Temp\r-aimbot.exe"C:\Users\Admin\AppData\Local\Temp\r-aimbot.exe"119⤵
- Checks computer location settings
PID:888 -
C:\Users\Admin\AppData\Local\Temp\r-aimbot.exe"C:\Users\Admin\AppData\Local\Temp\r-aimbot.exe"120⤵PID:2076
-
C:\Users\Admin\AppData\Local\Temp\r-aimbot.exe"C:\Users\Admin\AppData\Local\Temp\r-aimbot.exe"121⤵PID:5020
-
C:\Users\Admin\AppData\Local\Temp\r-aimbot.exe"C:\Users\Admin\AppData\Local\Temp\r-aimbot.exe"122⤵PID:1624
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-