Analysis
-
max time kernel
159s -
max time network
541s -
platform
windows11-21h2_x64 -
resource
win11-20241007-en -
resource tags
arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system -
submitted
08-10-2024 17:49
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
cheat(crack).zip
Resource
win10-20240611-en
windows10-1703-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
cheat(crack).zip
Resource
win11-20240802-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
cheat(crack)/Cheat(crack).exe
Resource
win10-20240404-en
windows10-1703-x64
18 signatures
150 seconds
Behavioral task
behavioral4
Sample
cheat(crack)/Cheat(crack).exe
Resource
win11-20241007-en
windows11-21h2-x64
22 signatures
150 seconds
General
-
Target
cheat(crack)/Cheat(crack).exe
-
Size
19.1MB
-
MD5
f9da6a2308ad8b33759396eba9d71a55
-
SHA1
d2897b32f46c232f14958a2458331274360f297d
-
SHA256
25f7453e76cd457a4646bbba21a1c2dedb0e0cd8f90e7d249e93dfd6c2b77de3
-
SHA512
c04e5804fdaf7642cade1c8d943260e2315f358cfb749dca9311798bc43d3b393b8012e3f33fea9d33745ef53c212a0592102e1b3b9d979610f3a940eb1b0bd2
-
SSDEEP
393216:CDTF+si4rs4FMRk/aD+CeXhX7NqtSmqu/2o4Pe5MCEJXZrHyxMz6:YT7zhMRk/NhhsFqu/d4PJBXmMz6
Malware Config
Signatures
-
pid Process 1200 powershell.exe 4268 powershell.exe -
Modifies Windows Firewall 2 TTPs 1 IoCs
pid Process 5296 netsh.exe -
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\8f5d693a6c9562fb214f7b3d3aabc00c.exe Microsoft OneDriveFile Co-Authoring Executable Security.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\8f5d693a6c9562fb214f7b3d3aabc00c.exe Microsoft OneDriveFile Co-Authoring Executable Security.exe -
Executes dropped EXE 64 IoCs
pid Process 4548 1.exe 336 44.exe 2844 3.exe 3248 44.exe 1056 1.exe 580 1.exe 3168 1.exe 1040 1.exe 1600 1.exe 2352 1.exe 4316 1.exe 4836 1.exe 4480 1.exe 1804 1.exe 4064 1.exe 4724 1.exe 3944 1.exe 248 1.exe 340 1.exe 2864 1.exe 3188 1.exe 3160 1.exe 4568 1.exe 3292 1.exe 1124 1.exe 540 1.exe 1192 1.exe 1316 Microsoft OneDriveFile Co-Authoring Executable Security.exe 1048 1.exe 3984 1.exe 3004 1.exe 1448 1.exe 4936 1.exe 1960 1.exe 4556 1.exe 3428 1.exe 1756 1.exe 4660 1.exe 4764 1.exe 4740 1.exe 492 1.exe 2344 1.exe 952 1.exe 2064 1.exe 1152 1.exe 2696 1.exe 2132 1.exe 1216 1.exe 680 1.exe 1852 1.exe 3792 1.exe 4480 1.exe 4296 1.exe 1604 1.exe 3532 1.exe 4800 1.exe 1528 1.exe 3232 1.exe 4680 1.exe 5124 1.exe 5168 1.exe 5212 1.exe 5252 1.exe 5328 1.exe -
Loads dropped DLL 17 IoCs
pid Process 3248 44.exe 3248 44.exe 3248 44.exe 3248 44.exe 3248 44.exe 3248 44.exe 3248 44.exe 3248 44.exe 3248 44.exe 3248 44.exe 3248 44.exe 3248 44.exe 3248 44.exe 3248 44.exe 3248 44.exe 3248 44.exe 3248 44.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\8f5d693a6c9562fb214f7b3d3aabc00c = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Microsoft OneDriveFile Co-Authoring Executable Security.exe\" .." Microsoft OneDriveFile Co-Authoring Executable Security.exe Set value (str) \REGISTRY\USER\S-1-5-21-556537508-2730415644-482548075-1000\Software\Microsoft\Windows\CurrentVersion\Run\8f5d693a6c9562fb214f7b3d3aabc00c = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Microsoft OneDriveFile Co-Authoring Executable Security.exe\" .." Microsoft OneDriveFile Co-Authoring Executable Security.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 1 ip-api.com -
Drops autorun.inf file 1 TTPs 5 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File created F:\autorun.inf Microsoft OneDriveFile Co-Authoring Executable Security.exe File opened for modification F:\autorun.inf Microsoft OneDriveFile Co-Authoring Executable Security.exe File created C:\autorun.inf Microsoft OneDriveFile Co-Authoring Executable Security.exe File opened for modification C:\autorun.inf Microsoft OneDriveFile Co-Authoring Executable Security.exe File created D:\autorun.inf Microsoft OneDriveFile Co-Authoring Executable Security.exe -
Enumerates processes with tasklist 1 TTPs 1 IoCs
pid Process 1360 tasklist.exe -
resource yara_rule behavioral4/memory/3248-60-0x00007FF9F2260000-0x00007FF9F2852000-memory.dmp upx behavioral4/files/0x001900000002ac08-53.dat upx behavioral4/files/0x001900000002abee-64.dat upx behavioral4/files/0x001900000002abfd-83.dat upx behavioral4/memory/3248-85-0x00007FF9FC250000-0x00007FF9FC25F000-memory.dmp upx behavioral4/memory/3248-84-0x00007FF9F62B0000-0x00007FF9F62D4000-memory.dmp upx behavioral4/files/0x001900000002abfc-82.dat upx behavioral4/files/0x001c00000002abfb-81.dat upx behavioral4/files/0x001900000002abfa-80.dat upx behavioral4/files/0x001900000002abf2-79.dat upx behavioral4/files/0x001900000002abf1-78.dat upx behavioral4/files/0x001900000002abef-77.dat upx behavioral4/files/0x001900000002abed-76.dat upx behavioral4/files/0x004600000002ac0f-75.dat upx behavioral4/files/0x001900000002ac0e-74.dat upx behavioral4/files/0x001c00000002ac0d-73.dat upx behavioral4/files/0x001c00000002ac07-70.dat upx behavioral4/files/0x001900000002ac02-69.dat upx behavioral4/memory/3248-97-0x00007FF9F2D30000-0x00007FF9F2D53000-memory.dmp upx behavioral4/memory/3248-96-0x00007FF9F6C40000-0x00007FF9F6C59000-memory.dmp upx behavioral4/memory/3248-99-0x00007FF9EDE60000-0x00007FF9EDFDE000-memory.dmp upx behavioral4/memory/3248-102-0x00007FF9F6660000-0x00007FF9F6679000-memory.dmp upx behavioral4/memory/3248-104-0x00007FF9F6CF0000-0x00007FF9F6CFD000-memory.dmp upx behavioral4/memory/3248-110-0x00007FF9F1E40000-0x00007FF9F1F0D000-memory.dmp upx behavioral4/memory/3248-113-0x00007FF9F62B0000-0x00007FF9F62D4000-memory.dmp upx behavioral4/memory/3248-112-0x00007FF9E0E10000-0x00007FF9E1339000-memory.dmp upx behavioral4/memory/3248-109-0x00007FF9F2260000-0x00007FF9F2852000-memory.dmp upx behavioral4/memory/3248-121-0x00007FF9F2D30000-0x00007FF9F2D53000-memory.dmp upx behavioral4/memory/3248-122-0x00007FF9EDD40000-0x00007FF9EDE5C000-memory.dmp upx behavioral4/memory/3248-119-0x00007FF9F6C10000-0x00007FF9F6C1D000-memory.dmp upx behavioral4/memory/3248-118-0x00007FF9F2160000-0x00007FF9F2174000-memory.dmp upx behavioral4/memory/3248-106-0x00007FF9F2180000-0x00007FF9F21B3000-memory.dmp upx behavioral4/memory/3248-93-0x00007FF9F2D60000-0x00007FF9F2D8D000-memory.dmp upx behavioral4/files/0x001900000002ac06-67.dat upx behavioral4/memory/3248-143-0x00007FF9EDE60000-0x00007FF9EDFDE000-memory.dmp upx behavioral4/memory/3248-160-0x00007FF9EDD40000-0x00007FF9EDE5C000-memory.dmp upx behavioral4/memory/3248-159-0x00007FF9F6C10000-0x00007FF9F6C1D000-memory.dmp upx behavioral4/memory/3248-156-0x00007FF9F1E40000-0x00007FF9F1F0D000-memory.dmp upx behavioral4/memory/3248-152-0x00007FF9EDE60000-0x00007FF9EDFDE000-memory.dmp upx behavioral4/memory/3248-151-0x00007FF9F2D30000-0x00007FF9F2D53000-memory.dmp upx behavioral4/memory/3248-150-0x00007FF9F6C40000-0x00007FF9F6C59000-memory.dmp upx behavioral4/memory/3248-149-0x00007FF9F2D60000-0x00007FF9F2D8D000-memory.dmp upx behavioral4/memory/3248-148-0x00007FF9FC250000-0x00007FF9FC25F000-memory.dmp upx behavioral4/memory/3248-146-0x00007FF9F2260000-0x00007FF9F2852000-memory.dmp upx behavioral4/memory/3248-158-0x00007FF9F2160000-0x00007FF9F2174000-memory.dmp upx behavioral4/memory/3248-157-0x00007FF9E0E10000-0x00007FF9E1339000-memory.dmp upx behavioral4/memory/3248-155-0x00007FF9F2180000-0x00007FF9F21B3000-memory.dmp upx behavioral4/memory/3248-154-0x00007FF9F6CF0000-0x00007FF9F6CFD000-memory.dmp upx behavioral4/memory/3248-153-0x00007FF9F6660000-0x00007FF9F6679000-memory.dmp upx behavioral4/memory/3248-147-0x00007FF9F62B0000-0x00007FF9F62D4000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe -
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Microsoft OneDriveFile Co-Authoring Executable Security.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Kills process with taskkill 1 IoCs
pid Process 5368 taskkill.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-556537508-2730415644-482548075-1000_Classes\Local Settings taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1200 powershell.exe 1200 powershell.exe 4268 powershell.exe 4268 powershell.exe 1200 powershell.exe 4268 powershell.exe 1316 Microsoft OneDriveFile Co-Authoring Executable Security.exe 1316 Microsoft OneDriveFile Co-Authoring Executable Security.exe 1316 Microsoft OneDriveFile Co-Authoring Executable Security.exe 1316 Microsoft OneDriveFile Co-Authoring Executable Security.exe 1316 Microsoft OneDriveFile Co-Authoring Executable Security.exe 1316 Microsoft OneDriveFile Co-Authoring Executable Security.exe 1316 Microsoft OneDriveFile Co-Authoring Executable Security.exe 1316 Microsoft OneDriveFile Co-Authoring Executable Security.exe 1316 Microsoft OneDriveFile Co-Authoring Executable Security.exe 1316 Microsoft OneDriveFile Co-Authoring Executable Security.exe 1316 Microsoft OneDriveFile Co-Authoring Executable Security.exe 1316 Microsoft OneDriveFile Co-Authoring Executable Security.exe 1316 Microsoft OneDriveFile Co-Authoring Executable Security.exe 1316 Microsoft OneDriveFile Co-Authoring Executable Security.exe 1316 Microsoft OneDriveFile Co-Authoring Executable Security.exe 1316 Microsoft OneDriveFile Co-Authoring Executable Security.exe 1316 Microsoft OneDriveFile Co-Authoring Executable Security.exe 1316 Microsoft OneDriveFile Co-Authoring Executable Security.exe 1316 Microsoft OneDriveFile Co-Authoring Executable Security.exe 1316 Microsoft OneDriveFile Co-Authoring Executable Security.exe 1316 Microsoft OneDriveFile Co-Authoring Executable Security.exe 1316 Microsoft OneDriveFile Co-Authoring Executable Security.exe 1316 Microsoft OneDriveFile Co-Authoring Executable Security.exe 1316 Microsoft OneDriveFile Co-Authoring Executable Security.exe 1316 Microsoft OneDriveFile Co-Authoring Executable Security.exe 1316 Microsoft OneDriveFile Co-Authoring Executable Security.exe 1316 Microsoft OneDriveFile Co-Authoring Executable Security.exe 1316 Microsoft OneDriveFile Co-Authoring Executable Security.exe 1316 Microsoft OneDriveFile Co-Authoring Executable Security.exe 1316 Microsoft OneDriveFile Co-Authoring Executable Security.exe 1316 Microsoft OneDriveFile Co-Authoring Executable Security.exe 1316 Microsoft OneDriveFile Co-Authoring Executable Security.exe 1316 Microsoft OneDriveFile Co-Authoring Executable Security.exe 1316 Microsoft OneDriveFile Co-Authoring Executable Security.exe 1316 Microsoft OneDriveFile Co-Authoring Executable Security.exe 1316 Microsoft OneDriveFile Co-Authoring Executable Security.exe 1316 Microsoft OneDriveFile Co-Authoring Executable Security.exe 1316 Microsoft OneDriveFile Co-Authoring Executable Security.exe 1316 Microsoft OneDriveFile Co-Authoring Executable Security.exe 1316 Microsoft OneDriveFile Co-Authoring Executable Security.exe 1316 Microsoft OneDriveFile Co-Authoring Executable Security.exe 1316 Microsoft OneDriveFile Co-Authoring Executable Security.exe 1316 Microsoft OneDriveFile Co-Authoring Executable Security.exe 1316 Microsoft OneDriveFile Co-Authoring Executable Security.exe 1316 Microsoft OneDriveFile Co-Authoring Executable Security.exe 1316 Microsoft OneDriveFile Co-Authoring Executable Security.exe 1316 Microsoft OneDriveFile Co-Authoring Executable Security.exe 1316 Microsoft OneDriveFile Co-Authoring Executable Security.exe 1316 Microsoft OneDriveFile Co-Authoring Executable Security.exe 1316 Microsoft OneDriveFile Co-Authoring Executable Security.exe 1316 Microsoft OneDriveFile Co-Authoring Executable Security.exe 1316 Microsoft OneDriveFile Co-Authoring Executable Security.exe 1316 Microsoft OneDriveFile Co-Authoring Executable Security.exe 1316 Microsoft OneDriveFile Co-Authoring Executable Security.exe 1316 Microsoft OneDriveFile Co-Authoring Executable Security.exe 1316 Microsoft OneDriveFile Co-Authoring Executable Security.exe 1316 Microsoft OneDriveFile Co-Authoring Executable Security.exe 1316 Microsoft OneDriveFile Co-Authoring Executable Security.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1316 Microsoft OneDriveFile Co-Authoring Executable Security.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 1360 tasklist.exe Token: SeIncreaseQuotaPrivilege 4148 WMIC.exe Token: SeSecurityPrivilege 4148 WMIC.exe Token: SeTakeOwnershipPrivilege 4148 WMIC.exe Token: SeLoadDriverPrivilege 4148 WMIC.exe Token: SeSystemProfilePrivilege 4148 WMIC.exe Token: SeSystemtimePrivilege 4148 WMIC.exe Token: SeProfSingleProcessPrivilege 4148 WMIC.exe Token: SeIncBasePriorityPrivilege 4148 WMIC.exe Token: SeCreatePagefilePrivilege 4148 WMIC.exe Token: SeBackupPrivilege 4148 WMIC.exe Token: SeRestorePrivilege 4148 WMIC.exe Token: SeShutdownPrivilege 4148 WMIC.exe Token: SeDebugPrivilege 4148 WMIC.exe Token: SeSystemEnvironmentPrivilege 4148 WMIC.exe Token: SeRemoteShutdownPrivilege 4148 WMIC.exe Token: SeUndockPrivilege 4148 WMIC.exe Token: SeManageVolumePrivilege 4148 WMIC.exe Token: 33 4148 WMIC.exe Token: 34 4148 WMIC.exe Token: 35 4148 WMIC.exe Token: 36 4148 WMIC.exe Token: SeDebugPrivilege 1200 powershell.exe Token: SeDebugPrivilege 4268 powershell.exe Token: SeIncreaseQuotaPrivilege 4148 WMIC.exe Token: SeSecurityPrivilege 4148 WMIC.exe Token: SeTakeOwnershipPrivilege 4148 WMIC.exe Token: SeLoadDriverPrivilege 4148 WMIC.exe Token: SeSystemProfilePrivilege 4148 WMIC.exe Token: SeSystemtimePrivilege 4148 WMIC.exe Token: SeProfSingleProcessPrivilege 4148 WMIC.exe Token: SeIncBasePriorityPrivilege 4148 WMIC.exe Token: SeCreatePagefilePrivilege 4148 WMIC.exe Token: SeBackupPrivilege 4148 WMIC.exe Token: SeRestorePrivilege 4148 WMIC.exe Token: SeShutdownPrivilege 4148 WMIC.exe Token: SeDebugPrivilege 4148 WMIC.exe Token: SeSystemEnvironmentPrivilege 4148 WMIC.exe Token: SeRemoteShutdownPrivilege 4148 WMIC.exe Token: SeUndockPrivilege 4148 WMIC.exe Token: SeManageVolumePrivilege 4148 WMIC.exe Token: 33 4148 WMIC.exe Token: 34 4148 WMIC.exe Token: 35 4148 WMIC.exe Token: 36 4148 WMIC.exe Token: SeDebugPrivilege 1316 Microsoft OneDriveFile Co-Authoring Executable Security.exe Token: SeDebugPrivilege 5368 taskkill.exe Token: 33 1316 Microsoft OneDriveFile Co-Authoring Executable Security.exe Token: SeIncBasePriorityPrivilege 1316 Microsoft OneDriveFile Co-Authoring Executable Security.exe Token: 33 1316 Microsoft OneDriveFile Co-Authoring Executable Security.exe Token: SeIncBasePriorityPrivilege 1316 Microsoft OneDriveFile Co-Authoring Executable Security.exe Token: 33 1316 Microsoft OneDriveFile Co-Authoring Executable Security.exe Token: SeIncBasePriorityPrivilege 1316 Microsoft OneDriveFile Co-Authoring Executable Security.exe Token: 33 1316 Microsoft OneDriveFile Co-Authoring Executable Security.exe Token: SeIncBasePriorityPrivilege 1316 Microsoft OneDriveFile Co-Authoring Executable Security.exe Token: 33 1316 Microsoft OneDriveFile Co-Authoring Executable Security.exe Token: SeIncBasePriorityPrivilege 1316 Microsoft OneDriveFile Co-Authoring Executable Security.exe Token: 33 1316 Microsoft OneDriveFile Co-Authoring Executable Security.exe Token: SeIncBasePriorityPrivilege 1316 Microsoft OneDriveFile Co-Authoring Executable Security.exe Token: 33 1316 Microsoft OneDriveFile Co-Authoring Executable Security.exe Token: SeIncBasePriorityPrivilege 1316 Microsoft OneDriveFile Co-Authoring Executable Security.exe Token: SeDebugPrivilege 16232 taskmgr.exe Token: SeSystemProfilePrivilege 16232 taskmgr.exe Token: SeCreateGlobalPrivilege 16232 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 16232 taskmgr.exe 16232 taskmgr.exe 16232 taskmgr.exe 16232 taskmgr.exe 16232 taskmgr.exe 16232 taskmgr.exe 16232 taskmgr.exe 16232 taskmgr.exe 16232 taskmgr.exe 16232 taskmgr.exe 16232 taskmgr.exe 16232 taskmgr.exe 16232 taskmgr.exe 16232 taskmgr.exe 16232 taskmgr.exe 16232 taskmgr.exe 16232 taskmgr.exe 16232 taskmgr.exe 16232 taskmgr.exe 16232 taskmgr.exe 16232 taskmgr.exe 16232 taskmgr.exe 16232 taskmgr.exe 16232 taskmgr.exe 16232 taskmgr.exe 16232 taskmgr.exe 16232 taskmgr.exe 16232 taskmgr.exe 16232 taskmgr.exe 16232 taskmgr.exe 16232 taskmgr.exe 16232 taskmgr.exe 16232 taskmgr.exe 16232 taskmgr.exe 16232 taskmgr.exe 16232 taskmgr.exe 16232 taskmgr.exe 16232 taskmgr.exe 16232 taskmgr.exe 16232 taskmgr.exe 16232 taskmgr.exe 16232 taskmgr.exe 16232 taskmgr.exe 16232 taskmgr.exe 16232 taskmgr.exe 16232 taskmgr.exe 16232 taskmgr.exe 16232 taskmgr.exe 16232 taskmgr.exe 16232 taskmgr.exe 16232 taskmgr.exe 16232 taskmgr.exe 16232 taskmgr.exe 16232 taskmgr.exe 16232 taskmgr.exe 16232 taskmgr.exe 16232 taskmgr.exe 16232 taskmgr.exe 16232 taskmgr.exe 16232 taskmgr.exe 16232 taskmgr.exe 16232 taskmgr.exe 16232 taskmgr.exe 16232 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 16232 taskmgr.exe 16232 taskmgr.exe 16232 taskmgr.exe 16232 taskmgr.exe 16232 taskmgr.exe 16232 taskmgr.exe 16232 taskmgr.exe 16232 taskmgr.exe 16232 taskmgr.exe 16232 taskmgr.exe 16232 taskmgr.exe 16232 taskmgr.exe 16232 taskmgr.exe 16232 taskmgr.exe 16232 taskmgr.exe 16232 taskmgr.exe 16232 taskmgr.exe 16232 taskmgr.exe 16232 taskmgr.exe 16232 taskmgr.exe 16232 taskmgr.exe 16232 taskmgr.exe 16232 taskmgr.exe 16232 taskmgr.exe 16232 taskmgr.exe 16232 taskmgr.exe 16232 taskmgr.exe 16232 taskmgr.exe 16232 taskmgr.exe 16232 taskmgr.exe 16232 taskmgr.exe 16232 taskmgr.exe 16232 taskmgr.exe 16232 taskmgr.exe 16232 taskmgr.exe 16232 taskmgr.exe 16232 taskmgr.exe 16232 taskmgr.exe 16232 taskmgr.exe 16232 taskmgr.exe 16232 taskmgr.exe 16232 taskmgr.exe 16232 taskmgr.exe 16232 taskmgr.exe 16232 taskmgr.exe 16232 taskmgr.exe 16232 taskmgr.exe 16232 taskmgr.exe 16232 taskmgr.exe 16232 taskmgr.exe 16232 taskmgr.exe 16232 taskmgr.exe 16232 taskmgr.exe 16232 taskmgr.exe 16232 taskmgr.exe 16232 taskmgr.exe 16232 taskmgr.exe 16232 taskmgr.exe 16232 taskmgr.exe 16232 taskmgr.exe 16232 taskmgr.exe 16232 taskmgr.exe 16232 taskmgr.exe 16232 taskmgr.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3124 wrote to memory of 4548 3124 Cheat(crack).exe 77 PID 3124 wrote to memory of 4548 3124 Cheat(crack).exe 77 PID 3124 wrote to memory of 336 3124 Cheat(crack).exe 80 PID 3124 wrote to memory of 336 3124 Cheat(crack).exe 80 PID 3124 wrote to memory of 2844 3124 Cheat(crack).exe 81 PID 3124 wrote to memory of 2844 3124 Cheat(crack).exe 81 PID 3124 wrote to memory of 2844 3124 Cheat(crack).exe 81 PID 336 wrote to memory of 3248 336 44.exe 82 PID 336 wrote to memory of 3248 336 44.exe 82 PID 4548 wrote to memory of 1056 4548 1.exe 83 PID 4548 wrote to memory of 1056 4548 1.exe 83 PID 1056 wrote to memory of 580 1056 1.exe 84 PID 1056 wrote to memory of 580 1056 1.exe 84 PID 580 wrote to memory of 3168 580 1.exe 85 PID 580 wrote to memory of 3168 580 1.exe 85 PID 3168 wrote to memory of 1040 3168 1.exe 86 PID 3168 wrote to memory of 1040 3168 1.exe 86 PID 1040 wrote to memory of 1600 1040 1.exe 87 PID 1040 wrote to memory of 1600 1040 1.exe 87 PID 1600 wrote to memory of 2352 1600 1.exe 88 PID 1600 wrote to memory of 2352 1600 1.exe 88 PID 3248 wrote to memory of 3592 3248 44.exe 89 PID 3248 wrote to memory of 3592 3248 44.exe 89 PID 3248 wrote to memory of 5104 3248 44.exe 90 PID 3248 wrote to memory of 5104 3248 44.exe 90 PID 3248 wrote to memory of 2192 3248 44.exe 93 PID 3248 wrote to memory of 2192 3248 44.exe 93 PID 3248 wrote to memory of 1036 3248 44.exe 95 PID 3248 wrote to memory of 1036 3248 44.exe 95 PID 2352 wrote to memory of 4316 2352 1.exe 96 PID 2352 wrote to memory of 4316 2352 1.exe 96 PID 2192 wrote to memory of 1360 2192 cmd.exe 98 PID 2192 wrote to memory of 1360 2192 cmd.exe 98 PID 5104 wrote to memory of 1200 5104 cmd.exe 99 PID 5104 wrote to memory of 1200 5104 cmd.exe 99 PID 3592 wrote to memory of 4268 3592 cmd.exe 100 PID 3592 wrote to memory of 4268 3592 cmd.exe 100 PID 1036 wrote to memory of 4148 1036 cmd.exe 101 PID 1036 wrote to memory of 4148 1036 cmd.exe 101 PID 4316 wrote to memory of 4836 4316 1.exe 102 PID 4316 wrote to memory of 4836 4316 1.exe 102 PID 4836 wrote to memory of 4480 4836 1.exe 143 PID 4836 wrote to memory of 4480 4836 1.exe 143 PID 4480 wrote to memory of 1804 4480 1.exe 105 PID 4480 wrote to memory of 1804 4480 1.exe 105 PID 1804 wrote to memory of 4064 1804 1.exe 106 PID 1804 wrote to memory of 4064 1804 1.exe 106 PID 4064 wrote to memory of 4724 4064 1.exe 107 PID 4064 wrote to memory of 4724 4064 1.exe 107 PID 4724 wrote to memory of 3944 4724 1.exe 108 PID 4724 wrote to memory of 3944 4724 1.exe 108 PID 3944 wrote to memory of 248 3944 1.exe 109 PID 3944 wrote to memory of 248 3944 1.exe 109 PID 248 wrote to memory of 340 248 1.exe 110 PID 248 wrote to memory of 340 248 1.exe 110 PID 340 wrote to memory of 2864 340 1.exe 111 PID 340 wrote to memory of 2864 340 1.exe 111 PID 2864 wrote to memory of 3188 2864 1.exe 112 PID 2864 wrote to memory of 3188 2864 1.exe 112 PID 3188 wrote to memory of 3160 3188 1.exe 113 PID 3188 wrote to memory of 3160 3188 1.exe 113 PID 3160 wrote to memory of 4568 3160 1.exe 114 PID 3160 wrote to memory of 4568 3160 1.exe 114 PID 4568 wrote to memory of 3292 4568 1.exe 115
Processes
-
C:\Users\Admin\AppData\Local\Temp\cheat(crack)\Cheat(crack).exe"C:\Users\Admin\AppData\Local\Temp\cheat(crack)\Cheat(crack).exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3124 -
C:\Users\Admin\AppData\Local\Temp\1.exe"C:\Users\Admin\AppData\Local\Temp\1.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4548 -
C:\Users\Admin\AppData\Local\Temp\1.exe"C:\Users\Admin\AppData\Local\Temp\1.exe"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1056 -
C:\Users\Admin\AppData\Local\Temp\1.exe"C:\Users\Admin\AppData\Local\Temp\1.exe"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:580 -
C:\Users\Admin\AppData\Local\Temp\1.exe"C:\Users\Admin\AppData\Local\Temp\1.exe"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3168 -
C:\Users\Admin\AppData\Local\Temp\1.exe"C:\Users\Admin\AppData\Local\Temp\1.exe"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1040 -
C:\Users\Admin\AppData\Local\Temp\1.exe"C:\Users\Admin\AppData\Local\Temp\1.exe"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1600 -
C:\Users\Admin\AppData\Local\Temp\1.exe"C:\Users\Admin\AppData\Local\Temp\1.exe"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2352 -
C:\Users\Admin\AppData\Local\Temp\1.exe"C:\Users\Admin\AppData\Local\Temp\1.exe"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4316 -
C:\Users\Admin\AppData\Local\Temp\1.exe"C:\Users\Admin\AppData\Local\Temp\1.exe"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4836 -
C:\Users\Admin\AppData\Local\Temp\1.exe"C:\Users\Admin\AppData\Local\Temp\1.exe"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4480 -
C:\Users\Admin\AppData\Local\Temp\1.exe"C:\Users\Admin\AppData\Local\Temp\1.exe"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1804 -
C:\Users\Admin\AppData\Local\Temp\1.exe"C:\Users\Admin\AppData\Local\Temp\1.exe"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4064 -
C:\Users\Admin\AppData\Local\Temp\1.exe"C:\Users\Admin\AppData\Local\Temp\1.exe"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4724 -
C:\Users\Admin\AppData\Local\Temp\1.exe"C:\Users\Admin\AppData\Local\Temp\1.exe"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3944 -
C:\Users\Admin\AppData\Local\Temp\1.exe"C:\Users\Admin\AppData\Local\Temp\1.exe"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:248 -
C:\Users\Admin\AppData\Local\Temp\1.exe"C:\Users\Admin\AppData\Local\Temp\1.exe"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:340 -
C:\Users\Admin\AppData\Local\Temp\1.exe"C:\Users\Admin\AppData\Local\Temp\1.exe"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2864 -
C:\Users\Admin\AppData\Local\Temp\1.exe"C:\Users\Admin\AppData\Local\Temp\1.exe"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3188 -
C:\Users\Admin\AppData\Local\Temp\1.exe"C:\Users\Admin\AppData\Local\Temp\1.exe"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3160 -
C:\Users\Admin\AppData\Local\Temp\1.exe"C:\Users\Admin\AppData\Local\Temp\1.exe"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4568 -
C:\Users\Admin\AppData\Local\Temp\1.exe"C:\Users\Admin\AppData\Local\Temp\1.exe"22⤵
- Executes dropped EXE
PID:3292 -
C:\Users\Admin\AppData\Local\Temp\1.exe"C:\Users\Admin\AppData\Local\Temp\1.exe"23⤵
- Executes dropped EXE
PID:1124 -
C:\Users\Admin\AppData\Local\Temp\1.exe"C:\Users\Admin\AppData\Local\Temp\1.exe"24⤵
- Executes dropped EXE
PID:540 -
C:\Users\Admin\AppData\Local\Temp\1.exe"C:\Users\Admin\AppData\Local\Temp\1.exe"25⤵
- Executes dropped EXE
PID:1192 -
C:\Users\Admin\AppData\Local\Temp\1.exe"C:\Users\Admin\AppData\Local\Temp\1.exe"26⤵
- Executes dropped EXE
PID:1048 -
C:\Users\Admin\AppData\Local\Temp\1.exe"C:\Users\Admin\AppData\Local\Temp\1.exe"27⤵
- Executes dropped EXE
PID:3984 -
C:\Users\Admin\AppData\Local\Temp\1.exe"C:\Users\Admin\AppData\Local\Temp\1.exe"28⤵
- Executes dropped EXE
PID:3004 -
C:\Users\Admin\AppData\Local\Temp\1.exe"C:\Users\Admin\AppData\Local\Temp\1.exe"29⤵
- Executes dropped EXE
PID:1448 -
C:\Users\Admin\AppData\Local\Temp\1.exe"C:\Users\Admin\AppData\Local\Temp\1.exe"30⤵
- Executes dropped EXE
PID:4936 -
C:\Users\Admin\AppData\Local\Temp\1.exe"C:\Users\Admin\AppData\Local\Temp\1.exe"31⤵
- Executes dropped EXE
PID:1960 -
C:\Users\Admin\AppData\Local\Temp\1.exe"C:\Users\Admin\AppData\Local\Temp\1.exe"32⤵
- Executes dropped EXE
PID:4556 -
C:\Users\Admin\AppData\Local\Temp\1.exe"C:\Users\Admin\AppData\Local\Temp\1.exe"33⤵
- Executes dropped EXE
PID:3428 -
C:\Users\Admin\AppData\Local\Temp\1.exe"C:\Users\Admin\AppData\Local\Temp\1.exe"34⤵
- Executes dropped EXE
PID:1756 -
C:\Users\Admin\AppData\Local\Temp\1.exe"C:\Users\Admin\AppData\Local\Temp\1.exe"35⤵
- Executes dropped EXE
PID:4660 -
C:\Users\Admin\AppData\Local\Temp\1.exe"C:\Users\Admin\AppData\Local\Temp\1.exe"36⤵
- Executes dropped EXE
PID:4764 -
C:\Users\Admin\AppData\Local\Temp\1.exe"C:\Users\Admin\AppData\Local\Temp\1.exe"37⤵
- Executes dropped EXE
PID:4740 -
C:\Users\Admin\AppData\Local\Temp\1.exe"C:\Users\Admin\AppData\Local\Temp\1.exe"38⤵
- Executes dropped EXE
PID:492 -
C:\Users\Admin\AppData\Local\Temp\1.exe"C:\Users\Admin\AppData\Local\Temp\1.exe"39⤵
- Executes dropped EXE
PID:2344 -
C:\Users\Admin\AppData\Local\Temp\1.exe"C:\Users\Admin\AppData\Local\Temp\1.exe"40⤵
- Executes dropped EXE
PID:952 -
C:\Users\Admin\AppData\Local\Temp\1.exe"C:\Users\Admin\AppData\Local\Temp\1.exe"41⤵
- Executes dropped EXE
PID:2064 -
C:\Users\Admin\AppData\Local\Temp\1.exe"C:\Users\Admin\AppData\Local\Temp\1.exe"42⤵
- Executes dropped EXE
PID:1152 -
C:\Users\Admin\AppData\Local\Temp\1.exe"C:\Users\Admin\AppData\Local\Temp\1.exe"43⤵
- Executes dropped EXE
PID:2696 -
C:\Users\Admin\AppData\Local\Temp\1.exe"C:\Users\Admin\AppData\Local\Temp\1.exe"44⤵
- Executes dropped EXE
PID:2132 -
C:\Users\Admin\AppData\Local\Temp\1.exe"C:\Users\Admin\AppData\Local\Temp\1.exe"45⤵
- Executes dropped EXE
PID:1216 -
C:\Users\Admin\AppData\Local\Temp\1.exe"C:\Users\Admin\AppData\Local\Temp\1.exe"46⤵
- Executes dropped EXE
PID:680 -
C:\Users\Admin\AppData\Local\Temp\1.exe"C:\Users\Admin\AppData\Local\Temp\1.exe"47⤵
- Executes dropped EXE
PID:1852 -
C:\Users\Admin\AppData\Local\Temp\1.exe"C:\Users\Admin\AppData\Local\Temp\1.exe"48⤵
- Executes dropped EXE
PID:3792 -
C:\Users\Admin\AppData\Local\Temp\1.exe"C:\Users\Admin\AppData\Local\Temp\1.exe"49⤵
- Executes dropped EXE
PID:4480 -
C:\Users\Admin\AppData\Local\Temp\1.exe"C:\Users\Admin\AppData\Local\Temp\1.exe"50⤵
- Executes dropped EXE
PID:4296 -
C:\Users\Admin\AppData\Local\Temp\1.exe"C:\Users\Admin\AppData\Local\Temp\1.exe"51⤵
- Executes dropped EXE
PID:1604 -
C:\Users\Admin\AppData\Local\Temp\1.exe"C:\Users\Admin\AppData\Local\Temp\1.exe"52⤵
- Executes dropped EXE
PID:3532 -
C:\Users\Admin\AppData\Local\Temp\1.exe"C:\Users\Admin\AppData\Local\Temp\1.exe"53⤵
- Executes dropped EXE
PID:4800 -
C:\Users\Admin\AppData\Local\Temp\1.exe"C:\Users\Admin\AppData\Local\Temp\1.exe"54⤵
- Executes dropped EXE
PID:1528 -
C:\Users\Admin\AppData\Local\Temp\1.exe"C:\Users\Admin\AppData\Local\Temp\1.exe"55⤵
- Executes dropped EXE
PID:3232 -
C:\Users\Admin\AppData\Local\Temp\1.exe"C:\Users\Admin\AppData\Local\Temp\1.exe"56⤵
- Executes dropped EXE
PID:4680 -
C:\Users\Admin\AppData\Local\Temp\1.exe"C:\Users\Admin\AppData\Local\Temp\1.exe"57⤵
- Executes dropped EXE
PID:5124 -
C:\Users\Admin\AppData\Local\Temp\1.exe"C:\Users\Admin\AppData\Local\Temp\1.exe"58⤵
- Executes dropped EXE
PID:5168 -
C:\Users\Admin\AppData\Local\Temp\1.exe"C:\Users\Admin\AppData\Local\Temp\1.exe"59⤵
- Executes dropped EXE
PID:5212 -
C:\Users\Admin\AppData\Local\Temp\1.exe"C:\Users\Admin\AppData\Local\Temp\1.exe"60⤵
- Executes dropped EXE
PID:5252 -
C:\Users\Admin\AppData\Local\Temp\1.exe"C:\Users\Admin\AppData\Local\Temp\1.exe"61⤵
- Executes dropped EXE
PID:5328 -
C:\Users\Admin\AppData\Local\Temp\1.exe"C:\Users\Admin\AppData\Local\Temp\1.exe"62⤵PID:5440
-
C:\Users\Admin\AppData\Local\Temp\1.exe"C:\Users\Admin\AppData\Local\Temp\1.exe"63⤵PID:5528
-
C:\Users\Admin\AppData\Local\Temp\1.exe"C:\Users\Admin\AppData\Local\Temp\1.exe"64⤵PID:5580
-
C:\Users\Admin\AppData\Local\Temp\1.exe"C:\Users\Admin\AppData\Local\Temp\1.exe"65⤵PID:5640
-
C:\Users\Admin\AppData\Local\Temp\1.exe"C:\Users\Admin\AppData\Local\Temp\1.exe"66⤵PID:5680
-
C:\Users\Admin\AppData\Local\Temp\1.exe"C:\Users\Admin\AppData\Local\Temp\1.exe"67⤵PID:5724
-
C:\Users\Admin\AppData\Local\Temp\1.exe"C:\Users\Admin\AppData\Local\Temp\1.exe"68⤵PID:5764
-
C:\Users\Admin\AppData\Local\Temp\1.exe"C:\Users\Admin\AppData\Local\Temp\1.exe"69⤵PID:5804
-
C:\Users\Admin\AppData\Local\Temp\1.exe"C:\Users\Admin\AppData\Local\Temp\1.exe"70⤵PID:5844
-
C:\Users\Admin\AppData\Local\Temp\1.exe"C:\Users\Admin\AppData\Local\Temp\1.exe"71⤵PID:5884
-
C:\Users\Admin\AppData\Local\Temp\1.exe"C:\Users\Admin\AppData\Local\Temp\1.exe"72⤵PID:5928
-
C:\Users\Admin\AppData\Local\Temp\1.exe"C:\Users\Admin\AppData\Local\Temp\1.exe"73⤵PID:5968
-
C:\Users\Admin\AppData\Local\Temp\1.exe"C:\Users\Admin\AppData\Local\Temp\1.exe"74⤵PID:6012
-
C:\Users\Admin\AppData\Local\Temp\1.exe"C:\Users\Admin\AppData\Local\Temp\1.exe"75⤵PID:6052
-
C:\Users\Admin\AppData\Local\Temp\1.exe"C:\Users\Admin\AppData\Local\Temp\1.exe"76⤵PID:6096
-
C:\Users\Admin\AppData\Local\Temp\1.exe"C:\Users\Admin\AppData\Local\Temp\1.exe"77⤵PID:6136
-
C:\Users\Admin\AppData\Local\Temp\1.exe"C:\Users\Admin\AppData\Local\Temp\1.exe"78⤵PID:5412
-
C:\Users\Admin\AppData\Local\Temp\1.exe"C:\Users\Admin\AppData\Local\Temp\1.exe"79⤵PID:5516
-
C:\Users\Admin\AppData\Local\Temp\1.exe"C:\Users\Admin\AppData\Local\Temp\1.exe"80⤵PID:5324
-
C:\Users\Admin\AppData\Local\Temp\1.exe"C:\Users\Admin\AppData\Local\Temp\1.exe"81⤵PID:6160
-
C:\Users\Admin\AppData\Local\Temp\1.exe"C:\Users\Admin\AppData\Local\Temp\1.exe"82⤵PID:6200
-
C:\Users\Admin\AppData\Local\Temp\1.exe"C:\Users\Admin\AppData\Local\Temp\1.exe"83⤵PID:6244
-
C:\Users\Admin\AppData\Local\Temp\1.exe"C:\Users\Admin\AppData\Local\Temp\1.exe"84⤵PID:6288
-
C:\Users\Admin\AppData\Local\Temp\1.exe"C:\Users\Admin\AppData\Local\Temp\1.exe"85⤵PID:6328
-
C:\Users\Admin\AppData\Local\Temp\1.exe"C:\Users\Admin\AppData\Local\Temp\1.exe"86⤵PID:6368
-
C:\Users\Admin\AppData\Local\Temp\1.exe"C:\Users\Admin\AppData\Local\Temp\1.exe"87⤵PID:6408
-
C:\Users\Admin\AppData\Local\Temp\1.exe"C:\Users\Admin\AppData\Local\Temp\1.exe"88⤵PID:6448
-
C:\Users\Admin\AppData\Local\Temp\1.exe"C:\Users\Admin\AppData\Local\Temp\1.exe"89⤵PID:6488
-
C:\Users\Admin\AppData\Local\Temp\1.exe"C:\Users\Admin\AppData\Local\Temp\1.exe"90⤵PID:6528
-
C:\Users\Admin\AppData\Local\Temp\1.exe"C:\Users\Admin\AppData\Local\Temp\1.exe"91⤵PID:6572
-
C:\Users\Admin\AppData\Local\Temp\1.exe"C:\Users\Admin\AppData\Local\Temp\1.exe"92⤵PID:6612
-
C:\Users\Admin\AppData\Local\Temp\1.exe"C:\Users\Admin\AppData\Local\Temp\1.exe"93⤵PID:6656
-
C:\Users\Admin\AppData\Local\Temp\1.exe"C:\Users\Admin\AppData\Local\Temp\1.exe"94⤵PID:6704
-
C:\Users\Admin\AppData\Local\Temp\1.exe"C:\Users\Admin\AppData\Local\Temp\1.exe"95⤵PID:6748
-
C:\Users\Admin\AppData\Local\Temp\1.exe"C:\Users\Admin\AppData\Local\Temp\1.exe"96⤵PID:6792
-
C:\Users\Admin\AppData\Local\Temp\1.exe"C:\Users\Admin\AppData\Local\Temp\1.exe"97⤵PID:6832
-
C:\Users\Admin\AppData\Local\Temp\1.exe"C:\Users\Admin\AppData\Local\Temp\1.exe"98⤵PID:6876
-
C:\Users\Admin\AppData\Local\Temp\1.exe"C:\Users\Admin\AppData\Local\Temp\1.exe"99⤵PID:6920
-
C:\Users\Admin\AppData\Local\Temp\1.exe"C:\Users\Admin\AppData\Local\Temp\1.exe"100⤵PID:6960
-
C:\Users\Admin\AppData\Local\Temp\1.exe"C:\Users\Admin\AppData\Local\Temp\1.exe"101⤵PID:7004
-
C:\Users\Admin\AppData\Local\Temp\1.exe"C:\Users\Admin\AppData\Local\Temp\1.exe"102⤵PID:7048
-
C:\Users\Admin\AppData\Local\Temp\1.exe"C:\Users\Admin\AppData\Local\Temp\1.exe"103⤵PID:7088
-
C:\Users\Admin\AppData\Local\Temp\1.exe"C:\Users\Admin\AppData\Local\Temp\1.exe"104⤵PID:7128
-
C:\Users\Admin\AppData\Local\Temp\1.exe"C:\Users\Admin\AppData\Local\Temp\1.exe"105⤵PID:4720
-
C:\Users\Admin\AppData\Local\Temp\1.exe"C:\Users\Admin\AppData\Local\Temp\1.exe"106⤵PID:7208
-
C:\Users\Admin\AppData\Local\Temp\1.exe"C:\Users\Admin\AppData\Local\Temp\1.exe"107⤵PID:7252
-
C:\Users\Admin\AppData\Local\Temp\1.exe"C:\Users\Admin\AppData\Local\Temp\1.exe"108⤵PID:7296
-
C:\Users\Admin\AppData\Local\Temp\1.exe"C:\Users\Admin\AppData\Local\Temp\1.exe"109⤵PID:7340
-
C:\Users\Admin\AppData\Local\Temp\1.exe"C:\Users\Admin\AppData\Local\Temp\1.exe"110⤵PID:7384
-
C:\Users\Admin\AppData\Local\Temp\1.exe"C:\Users\Admin\AppData\Local\Temp\1.exe"111⤵PID:7428
-
C:\Users\Admin\AppData\Local\Temp\1.exe"C:\Users\Admin\AppData\Local\Temp\1.exe"112⤵PID:7468
-
C:\Users\Admin\AppData\Local\Temp\1.exe"C:\Users\Admin\AppData\Local\Temp\1.exe"113⤵PID:7508
-
C:\Users\Admin\AppData\Local\Temp\1.exe"C:\Users\Admin\AppData\Local\Temp\1.exe"114⤵PID:7548
-
C:\Users\Admin\AppData\Local\Temp\1.exe"C:\Users\Admin\AppData\Local\Temp\1.exe"115⤵PID:7592
-
C:\Users\Admin\AppData\Local\Temp\1.exe"C:\Users\Admin\AppData\Local\Temp\1.exe"116⤵PID:7636
-
C:\Users\Admin\AppData\Local\Temp\1.exe"C:\Users\Admin\AppData\Local\Temp\1.exe"117⤵PID:7676
-
C:\Users\Admin\AppData\Local\Temp\1.exe"C:\Users\Admin\AppData\Local\Temp\1.exe"118⤵PID:7720
-
C:\Users\Admin\AppData\Local\Temp\1.exe"C:\Users\Admin\AppData\Local\Temp\1.exe"119⤵PID:7768
-
C:\Users\Admin\AppData\Local\Temp\1.exe"C:\Users\Admin\AppData\Local\Temp\1.exe"120⤵PID:7812
-
C:\Users\Admin\AppData\Local\Temp\1.exe"C:\Users\Admin\AppData\Local\Temp\1.exe"121⤵PID:7856
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-