Overview
overview
10Static
static
10XPloit.zip
windows7-x64
3XPloit.zip
windows10-2004-x64
1ForlornApi.dll
windows7-x64
1ForlornApi.dll
windows10-2004-x64
1ForlornInject.dll
windows7-x64
1ForlornInject.dll
windows10-2004-x64
7XPloit.deps.json
windows7-x64
3XPloit.deps.json
windows10-2004-x64
3XPloit.exe
windows7-x64
10XPloit.exe
windows10-2004-x64
10XPloit.exe
windows7-x64
10XPloit.exe
windows10-2004-x64
10main.pyc
windows7-x64
3main.pyc
windows10-2004-x64
3XPloit.pdb
windows7-x64
3XPloit.pdb
windows10-2004-x64
3XPloit.run...g.json
windows7-x64
3XPloit.run...g.json
windows10-2004-x64
3workspace/IY_FE.iy
windows7-x64
3workspace/IY_FE.iy
windows10-2004-x64
3workspace/...s.json
windows7-x64
3workspace/...s.json
windows10-2004-x64
3Resubmissions
21-12-2024 17:42
241221-v9y3xavlaz 1020-12-2024 23:19
241220-3bbtqawpat 1020-12-2024 19:29
241220-x7fjwssqdm 10Analysis
-
max time kernel
42s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
21-12-2024 17:42
Behavioral task
behavioral1
Sample
XPloit.zip
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
XPloit.zip
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
ForlornApi.dll
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
ForlornApi.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
ForlornInject.dll
Resource
win7-20241010-en
Behavioral task
behavioral6
Sample
ForlornInject.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral7
Sample
XPloit.deps.json
Resource
win7-20240903-en
Behavioral task
behavioral8
Sample
XPloit.deps.json
Resource
win10v2004-20241007-en
Behavioral task
behavioral9
Sample
XPloit.exe
Resource
win7-20240708-en
Behavioral task
behavioral10
Sample
XPloit.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral11
Sample
XPloit.exe
Resource
win7-20241010-en
Behavioral task
behavioral12
Sample
XPloit.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral13
Sample
main.pyc
Resource
win7-20240903-en
Behavioral task
behavioral14
Sample
main.pyc
Resource
win10v2004-20241007-en
Behavioral task
behavioral15
Sample
XPloit.pdb
Resource
win7-20240903-en
Behavioral task
behavioral16
Sample
XPloit.pdb
Resource
win10v2004-20241007-en
Behavioral task
behavioral17
Sample
XPloit.runtimeconfig.json
Resource
win7-20241023-en
Behavioral task
behavioral18
Sample
XPloit.runtimeconfig.json
Resource
win10v2004-20241007-en
Behavioral task
behavioral19
Sample
workspace/IY_FE.iy
Resource
win7-20241010-en
Behavioral task
behavioral20
Sample
workspace/IY_FE.iy
Resource
win10v2004-20241007-en
Behavioral task
behavioral21
Sample
workspace/MercurySettings.json
Resource
win7-20240903-en
Behavioral task
behavioral22
Sample
workspace/MercurySettings.json
Resource
win10v2004-20241007-en
General
-
Target
XPloit.exe
-
Size
74KB
-
MD5
5331a85d98acdf41a0aab7c46f00ae04
-
SHA1
24c858bb95a6b0dbc0fce9fac98e9f9698bc7bd9
-
SHA256
825ebf8702679cb5e0899308499b5efb7bdafc9c60e822c9599b50b7afb8cd28
-
SHA512
161e341a18178f2c68a64d8e808f80e57b957c4d9741c24e1bd06eb37a3739ece2d1d46e32645be707cce4c70b660564c6bd606762aca8701bf2411d5bb654e2
-
SSDEEP
768:EBqw+t+VBh0QLFEJESSSF5M4faQmzQ4QZwuz+3jsnRVRE:8P4cBlKJj5tvmzaal4E
Malware Config
Extracted
darkcomet
Sazan
127.0.0.1:1604
DC_MUTEX-R2MY49E
-
gencode
0JGDeNqTa1iX
-
install
false
-
offline_keylogger
true
-
persistence
false
Signatures
-
Darkcomet family
-
Executes dropped EXE 64 IoCs
pid Process 2128 BUILT.EXE 2704 BUILT.EXE 2860 BUILT.EXE 2804 BUILT.EXE 872 BUILT.EXE 2408 BUILT.EXE 1696 BUILT.EXE 1352 BUILT.EXE 1784 BUILT.EXE 2588 BUILT.EXE 2236 BUILT.EXE 2060 BUILT.EXE 3044 BUILT.EXE 2620 BUILT.EXE 840 BUILT.EXE 2756 BUILT.EXE 1916 BUILT.EXE 3220 BUILT.EXE 3392 BUILT.EXE 3896 BUILT.EXE 2964 BUILT.EXE 3244 BUILT.EXE 2068 BUILT.EXE 3112 BUILT.EXE 3484 BUILT.EXE 2368 BUILT.EXE 3828 BUILT.EXE 3096 BUILT.EXE 2628 BUILT.EXE 2432 BUILT.EXE 1560 BUILT.EXE 1348 BUILT.EXE 2352 BUILT.EXE 4056 BUILT.EXE 2836 BUILT.EXE 2768 BUILT.EXE 1216 Process not Found 2520 BUILT.EXE 3464 BUILT.EXE 3456 BUILT.EXE 1492 BUILT.EXE 3632 BUILT.EXE 2184 BUILT.EXE 3648 BUILT.EXE 3376 BUILT.EXE 4236 BUILT.EXE 4940 BUILT.EXE 2536 BUILT.EXE 3772 BUILT.EXE 2684 BUILT.EXE 2296 BUILT.EXE 3784 BUILT.EXE 3876 BUILT.EXE 1920 BUILT.EXE 3856 BUILT.EXE 2900 BUILT.EXE 536 BUILT.EXE 3712 BUILT.EXE 2760 BUILT.EXE 4336 BUILT.EXE 4444 BUILT.EXE 4816 BUILT.EXE 4860 BUILT.EXE 4712 BUILT.EXE -
Loads dropped DLL 64 IoCs
pid Process 1300 XPloit.exe 2116 XPLOIT.EXE 1300 XPloit.exe 320 XPLOIT.EXE 1056 XPLOIT.EXE 2128 BUILT.EXE 2704 BUILT.EXE 2804 BUILT.EXE 2860 BUILT.EXE 872 BUILT.EXE 264 XPLOIT.EXE 1036 XPLOIT.EXE 2588 BUILT.EXE 2236 BUILT.EXE 2100 XPLOIT.EXE 1696 BUILT.EXE 2564 XPLOIT.EXE 2408 BUILT.EXE 1932 XPLOIT.EXE 1352 BUILT.EXE 2156 XPLOIT.EXE 1444 XPLOIT.EXE 608 XPLOIT.EXE 1692 XPLOIT.EXE 3260 XPLOIT.EXE 3916 XPLOIT.EXE 3420 XPLOIT.EXE 3044 BUILT.EXE 2068 BUILT.EXE 2536 XPLOIT.EXE 2060 BUILT.EXE 3068 XPLOIT.EXE 968 XPLOIT.EXE 2756 BUILT.EXE 3828 BUILT.EXE 840 BUILT.EXE 3220 BUILT.EXE 3740 XPLOIT.EXE 1720 XPLOIT.EXE 2432 BUILT.EXE 4060 XPLOIT.EXE 1392 XPLOIT.EXE 3148 XPLOIT.EXE 3096 BUILT.EXE 2628 BUILT.EXE 1916 BUILT.EXE 3392 BUILT.EXE 2768 BUILT.EXE 4036 XPLOIT.EXE 4016 XPLOIT.EXE 2520 BUILT.EXE 3216 XPLOIT.EXE 3896 BUILT.EXE 1784 BUILT.EXE 2904 XPLOIT.EXE 3632 BUILT.EXE 2964 BUILT.EXE 3376 BUILT.EXE 3244 BUILT.EXE 3648 BUILT.EXE 1328 XPLOIT.EXE 1156 XPLOIT.EXE 4236 BUILT.EXE 4992 XPLOIT.EXE -
resource yara_rule behavioral9/files/0x000400000001cf27-184.dat upx behavioral9/files/0x000400000001cfbf-195.dat upx behavioral9/files/0x000400000001d39a-235.dat upx behavioral9/files/0x000400000001d776-264.dat upx behavioral9/files/0x000400000001d989-293.dat upx behavioral9/files/0x000400000001d9b8-310.dat upx behavioral9/files/0x000400000001da04-332.dat upx behavioral9/files/0x000400000001dab5-363.dat upx behavioral9/files/0x000400000001dbfb-402.dat upx behavioral9/files/0x000400000001dc86-425.dat upx behavioral9/files/0x000400000001dcc3-428.dat upx behavioral9/files/0x000400000001dc6a-419.dat upx behavioral9/files/0x000400000001dd9f-442.dat upx behavioral9/files/0x000400000001ddba-449.dat upx behavioral9/files/0x000400000001ddf0-462.dat upx behavioral9/files/0x000400000001de67-484.dat upx behavioral9/files/0x000400000001deb4-499.dat upx behavioral9/files/0x000400000001defe-512.dat upx behavioral9/files/0x000400000001df67-520.dat upx behavioral9/files/0x000400000001df19-516.dat upx behavioral9/files/0x000400000001df0f-513.dat upx behavioral9/files/0x000400000001de16-591.dat upx behavioral9/memory/3828-1857-0x000007FEF3C20000-0x000007FEF408E000-memory.dmp upx behavioral9/memory/2432-1979-0x000007FEF37B0000-0x000007FEF3C1E000-memory.dmp upx behavioral9/memory/2768-2070-0x000007FEF2ED0000-0x000007FEF333E000-memory.dmp upx behavioral9/memory/3632-2581-0x000007FEF25F0000-0x000007FEF2A5E000-memory.dmp upx behavioral9/memory/3648-2744-0x000007FEF1D10000-0x000007FEF217E000-memory.dmp upx behavioral9/memory/5068-4180-0x000007FEEDBC0000-0x000007FEEE02E000-memory.dmp upx behavioral9/memory/2004-4219-0x000007FEED2E0000-0x000007FEED74E000-memory.dmp upx behavioral9/memory/4712-3207-0x000007FEEE030000-0x000007FEEE49E000-memory.dmp upx behavioral9/memory/1920-2899-0x000007FEEE850000-0x000007FEEECBE000-memory.dmp upx behavioral9/memory/2684-2796-0x000007FEF1430000-0x000007FEF189E000-memory.dmp upx behavioral9/memory/4236-2745-0x000007FEF18A0000-0x000007FEF1D0E000-memory.dmp upx behavioral9/memory/3376-2604-0x000007FEF2180000-0x000007FEF25EE000-memory.dmp upx behavioral9/memory/2520-2086-0x000007FEF2A60000-0x000007FEF2ECE000-memory.dmp upx behavioral9/memory/2628-1985-0x000007FEF3340000-0x000007FEF37AE000-memory.dmp upx behavioral9/memory/2068-1737-0x000007FEF4090000-0x000007FEF44FE000-memory.dmp upx behavioral9/memory/1352-982-0x000007FEF4970000-0x000007FEF4DDE000-memory.dmp upx behavioral9/memory/2408-923-0x000007FEF4500000-0x000007FEF496E000-memory.dmp upx behavioral9/memory/1696-800-0x000007FEF4DE0000-0x000007FEF524E000-memory.dmp upx behavioral9/memory/2588-662-0x000007FEF56C0000-0x000007FEF5B2E000-memory.dmp upx behavioral9/memory/2236-719-0x000007FEF5250000-0x000007FEF56BE000-memory.dmp upx behavioral9/files/0x000400000001deee-509.dat upx behavioral9/files/0x000400000001dec6-504.dat upx behavioral9/files/0x000400000001debe-501.dat upx behavioral9/files/0x000400000001dea6-497.dat upx behavioral9/files/0x000400000001de9a-494.dat upx behavioral9/files/0x000400000001de90-491.dat upx behavioral9/files/0x000400000001de65-483.dat upx behavioral9/files/0x000400000001de3f-477.dat upx behavioral9/files/0x000400000001de0a-464.dat upx behavioral9/files/0x000400000001ddcc-457.dat upx behavioral9/files/0x000400000001ddc8-453.dat upx behavioral9/files/0x000400000001ddb4-447.dat upx behavioral9/files/0x000400000001dcd8-441.dat upx behavioral9/files/0x000400000001dc5c-418.dat upx behavioral9/files/0x000400000001dc50-416.dat upx behavioral9/files/0x000400000001dc42-414.dat upx behavioral9/files/0x000400000001dc36-412.dat upx behavioral9/files/0x000400000001dc27-409.dat upx behavioral9/files/0x000400000001dc1b-406.dat upx behavioral9/files/0x000400000001dc0c-404.dat upx behavioral9/files/0x000400000001dbeb-398.dat upx behavioral9/files/0x000400000001dbdb-394.dat upx -
Detects Pyinstaller 1 IoCs
resource yara_rule behavioral9/files/0x00090000000120fb-3.dat pyinstaller -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XPLOIT.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XPLOIT.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XPLOIT.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XPLOIT.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XPLOIT.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XPLOIT.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XPLOIT.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XPLOIT.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XPLOIT.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XPLOIT.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XPLOIT.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XPLOIT.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XPLOIT.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XPLOIT.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XPLOIT.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XPLOIT.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XPLOIT.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XPLOIT.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XPLOIT.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XPLOIT.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XPLOIT.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XPLOIT.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XPLOIT.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XPLOIT.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XPLOIT.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XPLOIT.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XPLOIT.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XPLOIT.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XPLOIT.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XPLOIT.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XPLOIT.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XPLOIT.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XPLOIT.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XPLOIT.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XPLOIT.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XPLOIT.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XPLOIT.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XPLOIT.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XPLOIT.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XPLOIT.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XPLOIT.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XPLOIT.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XPLOIT.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XPLOIT.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XPLOIT.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XPLOIT.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XPLOIT.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XPLOIT.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XPLOIT.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XPLOIT.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XPLOIT.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XPLOIT.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XPLOIT.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XPLOIT.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XPLOIT.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XPLOIT.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XPLOIT.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XPLOIT.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XPLOIT.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XPLOIT.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XPloit.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XPLOIT.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XPLOIT.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XPLOIT.EXE -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 1300 XPloit.exe Token: SeSecurityPrivilege 1300 XPloit.exe Token: SeTakeOwnershipPrivilege 1300 XPloit.exe Token: SeLoadDriverPrivilege 1300 XPloit.exe Token: SeSystemProfilePrivilege 1300 XPloit.exe Token: SeSystemtimePrivilege 1300 XPloit.exe Token: SeProfSingleProcessPrivilege 1300 XPloit.exe Token: SeIncBasePriorityPrivilege 1300 XPloit.exe Token: SeCreatePagefilePrivilege 1300 XPloit.exe Token: SeBackupPrivilege 1300 XPloit.exe Token: SeRestorePrivilege 1300 XPloit.exe Token: SeShutdownPrivilege 1300 XPloit.exe Token: SeDebugPrivilege 1300 XPloit.exe Token: SeSystemEnvironmentPrivilege 1300 XPloit.exe Token: SeChangeNotifyPrivilege 1300 XPloit.exe Token: SeRemoteShutdownPrivilege 1300 XPloit.exe Token: SeUndockPrivilege 1300 XPloit.exe Token: SeManageVolumePrivilege 1300 XPloit.exe Token: SeImpersonatePrivilege 1300 XPloit.exe Token: SeCreateGlobalPrivilege 1300 XPloit.exe Token: 33 1300 XPloit.exe Token: 34 1300 XPloit.exe Token: 35 1300 XPloit.exe Token: SeIncreaseQuotaPrivilege 2116 XPLOIT.EXE Token: SeSecurityPrivilege 2116 XPLOIT.EXE Token: SeTakeOwnershipPrivilege 2116 XPLOIT.EXE Token: SeLoadDriverPrivilege 2116 XPLOIT.EXE Token: SeSystemProfilePrivilege 2116 XPLOIT.EXE Token: SeSystemtimePrivilege 2116 XPLOIT.EXE Token: SeProfSingleProcessPrivilege 2116 XPLOIT.EXE Token: SeIncBasePriorityPrivilege 2116 XPLOIT.EXE Token: SeCreatePagefilePrivilege 2116 XPLOIT.EXE Token: SeBackupPrivilege 2116 XPLOIT.EXE Token: SeRestorePrivilege 2116 XPLOIT.EXE Token: SeShutdownPrivilege 2116 XPLOIT.EXE Token: SeDebugPrivilege 2116 XPLOIT.EXE Token: SeSystemEnvironmentPrivilege 2116 XPLOIT.EXE Token: SeChangeNotifyPrivilege 2116 XPLOIT.EXE Token: SeRemoteShutdownPrivilege 2116 XPLOIT.EXE Token: SeUndockPrivilege 2116 XPLOIT.EXE Token: SeManageVolumePrivilege 2116 XPLOIT.EXE Token: SeImpersonatePrivilege 2116 XPLOIT.EXE Token: SeCreateGlobalPrivilege 2116 XPLOIT.EXE Token: 33 2116 XPLOIT.EXE Token: 34 2116 XPLOIT.EXE Token: 35 2116 XPLOIT.EXE Token: SeIncreaseQuotaPrivilege 320 XPLOIT.EXE Token: SeSecurityPrivilege 320 XPLOIT.EXE Token: SeTakeOwnershipPrivilege 320 XPLOIT.EXE Token: SeLoadDriverPrivilege 320 XPLOIT.EXE Token: SeSystemProfilePrivilege 320 XPLOIT.EXE Token: SeSystemtimePrivilege 320 XPLOIT.EXE Token: SeProfSingleProcessPrivilege 320 XPLOIT.EXE Token: SeIncBasePriorityPrivilege 320 XPLOIT.EXE Token: SeCreatePagefilePrivilege 320 XPLOIT.EXE Token: SeBackupPrivilege 320 XPLOIT.EXE Token: SeRestorePrivilege 320 XPLOIT.EXE Token: SeShutdownPrivilege 320 XPLOIT.EXE Token: SeDebugPrivilege 320 XPLOIT.EXE Token: SeSystemEnvironmentPrivilege 320 XPLOIT.EXE Token: SeChangeNotifyPrivilege 320 XPLOIT.EXE Token: SeRemoteShutdownPrivilege 320 XPLOIT.EXE Token: SeUndockPrivilege 320 XPLOIT.EXE Token: SeManageVolumePrivilege 320 XPLOIT.EXE -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1300 XPloit.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1300 wrote to memory of 2128 1300 XPloit.exe 349 PID 1300 wrote to memory of 2128 1300 XPloit.exe 349 PID 1300 wrote to memory of 2128 1300 XPloit.exe 349 PID 1300 wrote to memory of 2128 1300 XPloit.exe 349 PID 1300 wrote to memory of 2116 1300 XPloit.exe 379 PID 1300 wrote to memory of 2116 1300 XPloit.exe 379 PID 1300 wrote to memory of 2116 1300 XPloit.exe 379 PID 1300 wrote to memory of 2116 1300 XPloit.exe 379 PID 2116 wrote to memory of 2704 2116 XPLOIT.EXE 32 PID 2116 wrote to memory of 2704 2116 XPLOIT.EXE 32 PID 2116 wrote to memory of 2704 2116 XPLOIT.EXE 32 PID 2116 wrote to memory of 2704 2116 XPLOIT.EXE 32 PID 2116 wrote to memory of 320 2116 XPLOIT.EXE 33 PID 2116 wrote to memory of 320 2116 XPLOIT.EXE 33 PID 2116 wrote to memory of 320 2116 XPLOIT.EXE 33 PID 2116 wrote to memory of 320 2116 XPLOIT.EXE 33 PID 1300 wrote to memory of 2860 1300 XPloit.exe 381 PID 1300 wrote to memory of 2860 1300 XPloit.exe 381 PID 1300 wrote to memory of 2860 1300 XPloit.exe 381 PID 1300 wrote to memory of 2860 1300 XPloit.exe 381 PID 1300 wrote to memory of 1056 1300 XPloit.exe 35 PID 1300 wrote to memory of 1056 1300 XPloit.exe 35 PID 1300 wrote to memory of 1056 1300 XPloit.exe 35 PID 1300 wrote to memory of 1056 1300 XPloit.exe 35 PID 320 wrote to memory of 2804 320 XPLOIT.EXE 344 PID 320 wrote to memory of 2804 320 XPLOIT.EXE 344 PID 320 wrote to memory of 2804 320 XPLOIT.EXE 344 PID 320 wrote to memory of 2804 320 XPLOIT.EXE 344 PID 320 wrote to memory of 1036 320 XPLOIT.EXE 37 PID 320 wrote to memory of 1036 320 XPLOIT.EXE 37 PID 320 wrote to memory of 1036 320 XPLOIT.EXE 37 PID 320 wrote to memory of 1036 320 XPLOIT.EXE 37 PID 1056 wrote to memory of 872 1056 XPLOIT.EXE 532 PID 1056 wrote to memory of 872 1056 XPLOIT.EXE 532 PID 1056 wrote to memory of 872 1056 XPLOIT.EXE 532 PID 1056 wrote to memory of 872 1056 XPLOIT.EXE 532 PID 1056 wrote to memory of 264 1056 XPLOIT.EXE 39 PID 1056 wrote to memory of 264 1056 XPLOIT.EXE 39 PID 1056 wrote to memory of 264 1056 XPLOIT.EXE 39 PID 1056 wrote to memory of 264 1056 XPLOIT.EXE 39 PID 2128 wrote to memory of 2408 2128 BUILT.EXE 40 PID 2128 wrote to memory of 2408 2128 BUILT.EXE 40 PID 2128 wrote to memory of 2408 2128 BUILT.EXE 40 PID 2804 wrote to memory of 1696 2804 BUILT.EXE 42 PID 2804 wrote to memory of 1696 2804 BUILT.EXE 42 PID 2804 wrote to memory of 1696 2804 BUILT.EXE 42 PID 2704 wrote to memory of 2588 2704 BUILT.EXE 41 PID 2704 wrote to memory of 2588 2704 BUILT.EXE 41 PID 2704 wrote to memory of 2588 2704 BUILT.EXE 41 PID 2860 wrote to memory of 2236 2860 BUILT.EXE 283 PID 2860 wrote to memory of 2236 2860 BUILT.EXE 283 PID 2860 wrote to memory of 2236 2860 BUILT.EXE 283 PID 872 wrote to memory of 1352 872 BUILT.EXE 491 PID 872 wrote to memory of 1352 872 BUILT.EXE 491 PID 872 wrote to memory of 1352 872 BUILT.EXE 491 PID 264 wrote to memory of 2060 264 XPLOIT.EXE 45 PID 264 wrote to memory of 2060 264 XPLOIT.EXE 45 PID 264 wrote to memory of 2060 264 XPLOIT.EXE 45 PID 264 wrote to memory of 2060 264 XPLOIT.EXE 45 PID 1036 wrote to memory of 1784 1036 XPLOIT.EXE 46 PID 1036 wrote to memory of 1784 1036 XPLOIT.EXE 46 PID 1036 wrote to memory of 1784 1036 XPLOIT.EXE 46 PID 1036 wrote to memory of 1784 1036 XPLOIT.EXE 46 PID 264 wrote to memory of 2100 264 XPLOIT.EXE 47
Processes
-
C:\Users\Admin\AppData\Local\Temp\XPloit.exe"C:\Users\Admin\AppData\Local\Temp\XPloit.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1300 -
C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2128 -
C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2408
-
-
-
C:\Users\Admin\AppData\Local\Temp\XPLOIT.EXE"C:\Users\Admin\AppData\Local\Temp\XPLOIT.EXE"2⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2116 -
C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2704 -
C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"4⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2588
-
-
-
C:\Users\Admin\AppData\Local\Temp\XPLOIT.EXE"C:\Users\Admin\AppData\Local\Temp\XPLOIT.EXE"3⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:320 -
C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2804 -
C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"5⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1696
-
-
-
C:\Users\Admin\AppData\Local\Temp\XPLOIT.EXE"C:\Users\Admin\AppData\Local\Temp\XPLOIT.EXE"4⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1036 -
C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"5⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1784 -
C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"6⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3648
-
-
-
C:\Users\Admin\AppData\Local\Temp\XPLOIT.EXE"C:\Users\Admin\AppData\Local\Temp\XPLOIT.EXE"5⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2564 -
C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"6⤵
- Executes dropped EXE
PID:2620 -
C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"7⤵
- Executes dropped EXE
PID:4712
-
-
-
C:\Users\Admin\AppData\Local\Temp\XPLOIT.EXE"C:\Users\Admin\AppData\Local\Temp\XPLOIT.EXE"6⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1932 -
C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"7⤵
- Executes dropped EXE
- Loads dropped DLL
PID:840 -
C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"8⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2628
-
-
-
C:\Users\Admin\AppData\Local\Temp\XPLOIT.EXE"C:\Users\Admin\AppData\Local\Temp\XPLOIT.EXE"7⤵
- Loads dropped DLL
PID:1444 -
C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"8⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1916 -
C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"9⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2768
-
-
-
C:\Users\Admin\AppData\Local\Temp\XPLOIT.EXE"C:\Users\Admin\AppData\Local\Temp\XPLOIT.EXE"8⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1692 -
C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"9⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3392 -
C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"10⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2520
-
-
-
C:\Users\Admin\AppData\Local\Temp\XPLOIT.EXE"C:\Users\Admin\AppData\Local\Temp\XPLOIT.EXE"9⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:3420 -
C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"10⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3244 -
C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"11⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4236
-
-
-
C:\Users\Admin\AppData\Local\Temp\XPLOIT.EXE"C:\Users\Admin\AppData\Local\Temp\XPLOIT.EXE"10⤵
- Loads dropped DLL
PID:968 -
C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"11⤵
- Executes dropped EXE
PID:3484 -
C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"12⤵
- Executes dropped EXE
PID:2684
-
-
-
C:\Users\Admin\AppData\Local\Temp\XPLOIT.EXE"C:\Users\Admin\AppData\Local\Temp\XPLOIT.EXE"11⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:3740 -
C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"12⤵
- Executes dropped EXE
PID:2352 -
C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"13⤵PID:3980
-
-
-
C:\Users\Admin\AppData\Local\Temp\XPLOIT.EXE"C:\Users\Admin\AppData\Local\Temp\XPLOIT.EXE"12⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1720 -
C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"13⤵
- Executes dropped EXE
PID:4056 -
C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"14⤵PID:4908
-
-
-
C:\Users\Admin\AppData\Local\Temp\XPLOIT.EXE"C:\Users\Admin\AppData\Local\Temp\XPLOIT.EXE"13⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4060 -
C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"14⤵
- Executes dropped EXE
PID:2836 -
C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"15⤵PID:4856
-
-
-
C:\Users\Admin\AppData\Local\Temp\XPLOIT.EXE"C:\Users\Admin\AppData\Local\Temp\XPLOIT.EXE"14⤵
- Loads dropped DLL
PID:1392 -
C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"15⤵
- Executes dropped EXE
PID:1560 -
C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"16⤵PID:2004
-
-
-
C:\Users\Admin\AppData\Local\Temp\XPLOIT.EXE"C:\Users\Admin\AppData\Local\Temp\XPLOIT.EXE"15⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4016 -
C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"16⤵
- Executes dropped EXE
PID:3456 -
C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"17⤵PID:2320
-
-
-
C:\Users\Admin\AppData\Local\Temp\XPLOIT.EXE"C:\Users\Admin\AppData\Local\Temp\XPLOIT.EXE"16⤵
- Loads dropped DLL
PID:2904 -
C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"17⤵
- Executes dropped EXE
PID:2184 -
C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"18⤵PID:4936
-
-
-
C:\Users\Admin\AppData\Local\Temp\XPLOIT.EXE"C:\Users\Admin\AppData\Local\Temp\XPLOIT.EXE"17⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1156 -
C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"18⤵
- Executes dropped EXE
PID:2536 -
C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"19⤵PID:2884
-
-
-
C:\Users\Admin\AppData\Local\Temp\XPLOIT.EXE"C:\Users\Admin\AppData\Local\Temp\XPLOIT.EXE"18⤵PID:1304
-
C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"19⤵
- Executes dropped EXE
PID:2296 -
C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"20⤵PID:1484
-
-
-
C:\Users\Admin\AppData\Local\Temp\XPLOIT.EXE"C:\Users\Admin\AppData\Local\Temp\XPLOIT.EXE"19⤵
- System Location Discovery: System Language Discovery
PID:2932 -
C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"20⤵
- Executes dropped EXE
PID:3876 -
C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"21⤵PID:4044
-
-
-
C:\Users\Admin\AppData\Local\Temp\XPLOIT.EXE"C:\Users\Admin\AppData\Local\Temp\XPLOIT.EXE"20⤵
- System Location Discovery: System Language Discovery
PID:1924 -
C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"21⤵
- Executes dropped EXE
PID:2900 -
C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"22⤵PID:4232
-
-
-
C:\Users\Admin\AppData\Local\Temp\XPLOIT.EXE"C:\Users\Admin\AppData\Local\Temp\XPLOIT.EXE"21⤵PID:3720
-
C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"22⤵
- Executes dropped EXE
PID:3712 -
C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"23⤵PID:3008
-
-
-
C:\Users\Admin\AppData\Local\Temp\XPLOIT.EXE"C:\Users\Admin\AppData\Local\Temp\XPLOIT.EXE"22⤵
- System Location Discovery: System Language Discovery
PID:1796 -
C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"23⤵
- Executes dropped EXE
PID:4336 -
C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"24⤵PID:2656
-
-
-
C:\Users\Admin\AppData\Local\Temp\XPLOIT.EXE"C:\Users\Admin\AppData\Local\Temp\XPLOIT.EXE"23⤵
- System Location Discovery: System Language Discovery
PID:4416 -
C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"24⤵
- Executes dropped EXE
PID:4816 -
C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"25⤵PID:2496
-
-
-
C:\Users\Admin\AppData\Local\Temp\XPLOIT.EXE"C:\Users\Admin\AppData\Local\Temp\XPLOIT.EXE"24⤵PID:4828
-
C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"25⤵PID:3844
-
C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"26⤵PID:5064
-
-
-
C:\Users\Admin\AppData\Local\Temp\XPLOIT.EXE"C:\Users\Admin\AppData\Local\Temp\XPLOIT.EXE"25⤵
- System Location Discovery: System Language Discovery
PID:2792 -
C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"26⤵PID:3964
-
C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"27⤵PID:3316
-
-
-
C:\Users\Admin\AppData\Local\Temp\XPLOIT.EXE"C:\Users\Admin\AppData\Local\Temp\XPLOIT.EXE"26⤵PID:3136
-
C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"27⤵PID:3088
-
C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"28⤵PID:4420
-
-
-
C:\Users\Admin\AppData\Local\Temp\XPLOIT.EXE"C:\Users\Admin\AppData\Local\Temp\XPLOIT.EXE"27⤵
- System Location Discovery: System Language Discovery
PID:2504 -
C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"28⤵PID:4468
-
C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"29⤵PID:3404
-
-
-
C:\Users\Admin\AppData\Local\Temp\XPLOIT.EXE"C:\Users\Admin\AppData\Local\Temp\XPLOIT.EXE"28⤵
- System Location Discovery: System Language Discovery
PID:4508 -
C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"29⤵PID:4312
-
C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"30⤵PID:2416
-
-
-
C:\Users\Admin\AppData\Local\Temp\XPLOIT.EXE"C:\Users\Admin\AppData\Local\Temp\XPLOIT.EXE"29⤵
- System Location Discovery: System Language Discovery
PID:3832 -
C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"30⤵PID:5092
-
C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"31⤵PID:3636
-
-
-
C:\Users\Admin\AppData\Local\Temp\XPLOIT.EXE"C:\Users\Admin\AppData\Local\Temp\XPLOIT.EXE"30⤵
- System Location Discovery: System Language Discovery
PID:3972 -
C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"31⤵PID:1996
-
C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"32⤵PID:5008
-
-
-
C:\Users\Admin\AppData\Local\Temp\XPLOIT.EXE"C:\Users\Admin\AppData\Local\Temp\XPLOIT.EXE"31⤵
- System Location Discovery: System Language Discovery
PID:960 -
C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"32⤵PID:3348
-
C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"33⤵PID:2236
-
-
-
C:\Users\Admin\AppData\Local\Temp\XPLOIT.EXE"C:\Users\Admin\AppData\Local\Temp\XPLOIT.EXE"32⤵
- System Location Discovery: System Language Discovery
PID:4660 -
C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"33⤵PID:2228
-
C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"34⤵PID:3824
-
-
-
C:\Users\Admin\AppData\Local\Temp\XPLOIT.EXE"C:\Users\Admin\AppData\Local\Temp\XPLOIT.EXE"33⤵
- System Location Discovery: System Language Discovery
PID:3368 -
C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"34⤵PID:4188
-
C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"35⤵PID:2556
-
-
-
C:\Users\Admin\AppData\Local\Temp\XPLOIT.EXE"C:\Users\Admin\AppData\Local\Temp\XPLOIT.EXE"34⤵
- System Location Discovery: System Language Discovery
PID:4768 -
C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"35⤵PID:4476
-
C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"36⤵PID:4688
-
-
-
C:\Users\Admin\AppData\Local\Temp\XPLOIT.EXE"C:\Users\Admin\AppData\Local\Temp\XPLOIT.EXE"35⤵
- System Location Discovery: System Language Discovery
PID:4360 -
C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"36⤵PID:4504
-
C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"37⤵PID:5044
-
-
-
C:\Users\Admin\AppData\Local\Temp\XPLOIT.EXE"C:\Users\Admin\AppData\Local\Temp\XPLOIT.EXE"36⤵
- System Location Discovery: System Language Discovery
PID:4636 -
C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"37⤵PID:3532
-
C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"38⤵PID:4156
-
-
-
C:\Users\Admin\AppData\Local\Temp\XPLOIT.EXE"C:\Users\Admin\AppData\Local\Temp\XPLOIT.EXE"37⤵
- System Location Discovery: System Language Discovery
PID:4956 -
C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"38⤵PID:4248
-
C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"39⤵PID:3544
-
-
-
C:\Users\Admin\AppData\Local\Temp\XPLOIT.EXE"C:\Users\Admin\AppData\Local\Temp\XPLOIT.EXE"38⤵
- System Location Discovery: System Language Discovery
PID:4600 -
C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"39⤵PID:4224
-
C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"40⤵PID:1488
-
-
-
C:\Users\Admin\AppData\Local\Temp\XPLOIT.EXE"C:\Users\Admin\AppData\Local\Temp\XPLOIT.EXE"39⤵PID:3188
-
C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"40⤵PID:4284
-
C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"41⤵PID:2044
-
-
-
C:\Users\Admin\AppData\Local\Temp\XPLOIT.EXE"C:\Users\Admin\AppData\Local\Temp\XPLOIT.EXE"40⤵
- System Location Discovery: System Language Discovery
PID:4260 -
C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"41⤵PID:4732
-
C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"42⤵PID:5056
-
-
-
C:\Users\Admin\AppData\Local\Temp\XPLOIT.EXE"C:\Users\Admin\AppData\Local\Temp\XPLOIT.EXE"41⤵
- System Location Discovery: System Language Discovery
PID:4808 -
C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"42⤵PID:4812
-
C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"43⤵PID:4388
-
-
-
C:\Users\Admin\AppData\Local\Temp\XPLOIT.EXE"C:\Users\Admin\AppData\Local\Temp\XPLOIT.EXE"42⤵
- System Location Discovery: System Language Discovery
PID:2544 -
C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"43⤵PID:4640
-
C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"44⤵PID:3508
-
-
-
C:\Users\Admin\AppData\Local\Temp\XPLOIT.EXE"C:\Users\Admin\AppData\Local\Temp\XPLOIT.EXE"43⤵
- System Location Discovery: System Language Discovery
PID:3504 -
C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"44⤵PID:3700
-
C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"45⤵PID:1680
-
-
-
C:\Users\Admin\AppData\Local\Temp\XPLOIT.EXE"C:\Users\Admin\AppData\Local\Temp\XPLOIT.EXE"44⤵
- System Location Discovery: System Language Discovery
PID:316 -
C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"45⤵PID:3768
-
C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"46⤵PID:1224
-
-
-
C:\Users\Admin\AppData\Local\Temp\XPLOIT.EXE"C:\Users\Admin\AppData\Local\Temp\XPLOIT.EXE"45⤵
- System Location Discovery: System Language Discovery
PID:2792 -
C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"46⤵PID:1100
-
C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"47⤵PID:3892
-
-
-
C:\Users\Admin\AppData\Local\Temp\XPLOIT.EXE"C:\Users\Admin\AppData\Local\Temp\XPLOIT.EXE"46⤵PID:3820
-
C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"47⤵PID:2676
-
C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"48⤵PID:3080
-
-
-
C:\Users\Admin\AppData\Local\Temp\XPLOIT.EXE"C:\Users\Admin\AppData\Local\Temp\XPLOIT.EXE"47⤵PID:2700
-
C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"48⤵PID:4016
-
C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"49⤵PID:4884
-
-
-
C:\Users\Admin\AppData\Local\Temp\XPLOIT.EXE"C:\Users\Admin\AppData\Local\Temp\XPLOIT.EXE"48⤵PID:4168
-
C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"49⤵PID:2700
-
C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"50⤵PID:3184
-
-
-
C:\Users\Admin\AppData\Local\Temp\XPLOIT.EXE"C:\Users\Admin\AppData\Local\Temp\XPLOIT.EXE"49⤵PID:3620
-
C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"50⤵PID:3616
-
C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"51⤵PID:2764
-
-
-
C:\Users\Admin\AppData\Local\Temp\XPLOIT.EXE"C:\Users\Admin\AppData\Local\Temp\XPLOIT.EXE"50⤵PID:3556
-
C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"51⤵PID:4992
-
C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"52⤵PID:4784
-
-
-
C:\Users\Admin\AppData\Local\Temp\XPLOIT.EXE"C:\Users\Admin\AppData\Local\Temp\XPLOIT.EXE"51⤵PID:1652
-
C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"52⤵PID:2660
-
C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"53⤵PID:2000
-
-
-
C:\Users\Admin\AppData\Local\Temp\XPLOIT.EXE"C:\Users\Admin\AppData\Local\Temp\XPLOIT.EXE"52⤵PID:2688
-
C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"53⤵PID:896
-
C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"54⤵PID:5644
-
-
-
C:\Users\Admin\AppData\Local\Temp\XPLOIT.EXE"C:\Users\Admin\AppData\Local\Temp\XPLOIT.EXE"53⤵PID:4760
-
C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"54⤵PID:2788
-
C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"55⤵PID:5876
-
-
-
C:\Users\Admin\AppData\Local\Temp\XPLOIT.EXE"C:\Users\Admin\AppData\Local\Temp\XPLOIT.EXE"54⤵PID:4552
-
C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"55⤵PID:4680
-
C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"56⤵PID:3820
-
-
-
C:\Users\Admin\AppData\Local\Temp\XPLOIT.EXE"C:\Users\Admin\AppData\Local\Temp\XPLOIT.EXE"55⤵PID:4472
-
C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"56⤵PID:2128
-
C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"57⤵PID:3644
-
-
-
C:\Users\Admin\AppData\Local\Temp\XPLOIT.EXE"C:\Users\Admin\AppData\Local\Temp\XPLOIT.EXE"56⤵PID:2860
-
C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"57⤵PID:4744
-
C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"58⤵PID:5212
-
-
-
C:\Users\Admin\AppData\Local\Temp\XPLOIT.EXE"C:\Users\Admin\AppData\Local\Temp\XPLOIT.EXE"57⤵PID:3196
-
C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"58⤵PID:960
-
C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"59⤵PID:4216
-
-
-
C:\Users\Admin\AppData\Local\Temp\XPLOIT.EXE"C:\Users\Admin\AppData\Local\Temp\XPLOIT.EXE"58⤵PID:1692
-
C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"59⤵PID:3064
-
C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"60⤵PID:5596
-
-
-
C:\Users\Admin\AppData\Local\Temp\XPLOIT.EXE"C:\Users\Admin\AppData\Local\Temp\XPLOIT.EXE"59⤵PID:3684
-
C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"60⤵PID:5032
-
C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"61⤵PID:5724
-
-
-
C:\Users\Admin\AppData\Local\Temp\XPLOIT.EXE"C:\Users\Admin\AppData\Local\Temp\XPLOIT.EXE"60⤵PID:3652
-
C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"61⤵PID:3196
-
C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"62⤵PID:5716
-
-
-
C:\Users\Admin\AppData\Local\Temp\XPLOIT.EXE"C:\Users\Admin\AppData\Local\Temp\XPLOIT.EXE"61⤵PID:2440
-
C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"62⤵PID:4836
-
C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"63⤵PID:6024
-
-
-
C:\Users\Admin\AppData\Local\Temp\XPLOIT.EXE"C:\Users\Admin\AppData\Local\Temp\XPLOIT.EXE"62⤵PID:4748
-
C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"63⤵PID:316
-
C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"64⤵PID:6072
-
-
-
C:\Users\Admin\AppData\Local\Temp\XPLOIT.EXE"C:\Users\Admin\AppData\Local\Temp\XPLOIT.EXE"63⤵PID:5136
-
C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"64⤵PID:5820
-
C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"65⤵PID:5776
-
-
-
C:\Users\Admin\AppData\Local\Temp\XPLOIT.EXE"C:\Users\Admin\AppData\Local\Temp\XPLOIT.EXE"64⤵PID:6004
-
C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"65⤵PID:5300
-
C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"66⤵PID:2248
-
-
-
C:\Users\Admin\AppData\Local\Temp\XPLOIT.EXE"C:\Users\Admin\AppData\Local\Temp\XPLOIT.EXE"65⤵PID:5444
-
C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"66⤵PID:6132
-
C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"67⤵PID:1660
-
-
-
C:\Users\Admin\AppData\Local\Temp\XPLOIT.EXE"C:\Users\Admin\AppData\Local\Temp\XPLOIT.EXE"66⤵PID:2248
-
C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"67⤵PID:2740
-
C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"68⤵PID:1728
-
-
-
C:\Users\Admin\AppData\Local\Temp\XPLOIT.EXE"C:\Users\Admin\AppData\Local\Temp\XPLOIT.EXE"67⤵PID:3696
-
C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"68⤵PID:5532
-
C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"69⤵PID:4532
-
-
-
C:\Users\Admin\AppData\Local\Temp\XPLOIT.EXE"C:\Users\Admin\AppData\Local\Temp\XPLOIT.EXE"68⤵PID:5684
-
C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"69⤵PID:2444
-
C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"70⤵PID:5900
-
-
-
C:\Users\Admin\AppData\Local\Temp\XPLOIT.EXE"C:\Users\Admin\AppData\Local\Temp\XPLOIT.EXE"69⤵PID:6024
-
C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"70⤵PID:5960
-
C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"71⤵PID:2136
-
-
-
C:\Users\Admin\AppData\Local\Temp\XPLOIT.EXE"C:\Users\Admin\AppData\Local\Temp\XPLOIT.EXE"70⤵PID:4132
-
C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"71⤵PID:5572
-
C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"72⤵PID:3216
-
-
-
C:\Users\Admin\AppData\Local\Temp\XPLOIT.EXE"C:\Users\Admin\AppData\Local\Temp\XPLOIT.EXE"71⤵PID:5784
-
C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"72⤵PID:5480
-
C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"73⤵PID:2056
-
-
-
C:\Users\Admin\AppData\Local\Temp\XPLOIT.EXE"C:\Users\Admin\AppData\Local\Temp\XPLOIT.EXE"72⤵PID:5764
-
C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"73⤵PID:5832
-
C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"74⤵PID:2968
-
-
-
C:\Users\Admin\AppData\Local\Temp\XPLOIT.EXE"C:\Users\Admin\AppData\Local\Temp\XPLOIT.EXE"73⤵PID:3696
-
C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"74⤵PID:5852
-
C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"75⤵PID:3620
-
-
-
C:\Users\Admin\AppData\Local\Temp\XPLOIT.EXE"C:\Users\Admin\AppData\Local\Temp\XPLOIT.EXE"74⤵PID:6080
-
C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"75⤵PID:2972
-
C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"76⤵PID:2332
-
-
-
C:\Users\Admin\AppData\Local\Temp\XPLOIT.EXE"C:\Users\Admin\AppData\Local\Temp\XPLOIT.EXE"75⤵PID:6008
-
C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"76⤵PID:5468
-
C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"77⤵PID:3480
-
-
-
C:\Users\Admin\AppData\Local\Temp\XPLOIT.EXE"C:\Users\Admin\AppData\Local\Temp\XPLOIT.EXE"76⤵PID:2056
-
C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"77⤵PID:5124
-
C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"78⤵PID:6036
-
-
-
C:\Users\Admin\AppData\Local\Temp\XPLOIT.EXE"C:\Users\Admin\AppData\Local\Temp\XPLOIT.EXE"77⤵PID:5688
-
C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"78⤵PID:5156
-
C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"79⤵PID:3372
-
-
-
C:\Users\Admin\AppData\Local\Temp\XPLOIT.EXE"C:\Users\Admin\AppData\Local\Temp\XPLOIT.EXE"78⤵PID:5332
-
C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"79⤵PID:5340
-
C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"80⤵PID:3840
-
-
-
C:\Users\Admin\AppData\Local\Temp\XPLOIT.EXE"C:\Users\Admin\AppData\Local\Temp\XPLOIT.EXE"79⤵PID:5276
-
C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"80⤵PID:2716
-
C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"81⤵PID:1692
-
-
-
C:\Users\Admin\AppData\Local\Temp\XPLOIT.EXE"C:\Users\Admin\AppData\Local\Temp\XPLOIT.EXE"80⤵PID:5684
-
C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"81⤵PID:5144
-
C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"82⤵PID:6532
-
-
-
C:\Users\Admin\AppData\Local\Temp\XPLOIT.EXE"C:\Users\Admin\AppData\Local\Temp\XPLOIT.EXE"81⤵PID:3908
-
C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"82⤵PID:1352
-
C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"83⤵PID:3240
-
-
-
C:\Users\Admin\AppData\Local\Temp\XPLOIT.EXE"C:\Users\Admin\AppData\Local\Temp\XPLOIT.EXE"82⤵PID:1544
-
C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"83⤵PID:1748
-
C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"84⤵PID:6360
-
-
-
C:\Users\Admin\AppData\Local\Temp\XPLOIT.EXE"C:\Users\Admin\AppData\Local\Temp\XPLOIT.EXE"83⤵PID:5260
-
C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"84⤵PID:2412
-
C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"85⤵PID:6876
-
-
-
C:\Users\Admin\AppData\Local\Temp\XPLOIT.EXE"C:\Users\Admin\AppData\Local\Temp\XPLOIT.EXE"84⤵PID:5528
-
C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"85⤵PID:4764
-
C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"86⤵PID:6608
-
-
-
C:\Users\Admin\AppData\Local\Temp\XPLOIT.EXE"C:\Users\Admin\AppData\Local\Temp\XPLOIT.EXE"85⤵PID:5264
-
C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"86⤵PID:304
-
C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"87⤵PID:6828
-
-
-
C:\Users\Admin\AppData\Local\Temp\XPLOIT.EXE"C:\Users\Admin\AppData\Local\Temp\XPLOIT.EXE"86⤵PID:2440
-
C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"87⤵PID:5456
-
C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"88⤵PID:6156
-
-
-
C:\Users\Admin\AppData\Local\Temp\XPLOIT.EXE"C:\Users\Admin\AppData\Local\Temp\XPLOIT.EXE"87⤵PID:3056
-
C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"88⤵PID:5828
-
C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"89⤵PID:6732
-
-
-
C:\Users\Admin\AppData\Local\Temp\XPLOIT.EXE"C:\Users\Admin\AppData\Local\Temp\XPLOIT.EXE"88⤵PID:5940
-
C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"89⤵PID:5664
-
C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"90⤵PID:6392
-
-
-
C:\Users\Admin\AppData\Local\Temp\XPLOIT.EXE"C:\Users\Admin\AppData\Local\Temp\XPLOIT.EXE"89⤵PID:2612
-
C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"90⤵PID:4472
-
C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"91⤵PID:6436
-
-
-
C:\Users\Admin\AppData\Local\Temp\XPLOIT.EXE"C:\Users\Admin\AppData\Local\Temp\XPLOIT.EXE"90⤵PID:5052
-
C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"91⤵PID:3556
-
C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"92⤵PID:6044
-
-
-
C:\Users\Admin\AppData\Local\Temp\XPLOIT.EXE"C:\Users\Admin\AppData\Local\Temp\XPLOIT.EXE"91⤵PID:6044
-
C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"92⤵PID:4160
-
C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"93⤵PID:6656
-
-
-
C:\Users\Admin\AppData\Local\Temp\XPLOIT.EXE"C:\Users\Admin\AppData\Local\Temp\XPLOIT.EXE"92⤵PID:1040
-
C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"93⤵PID:5392
-
C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"94⤵PID:2400
-
-
-
C:\Users\Admin\AppData\Local\Temp\XPLOIT.EXE"C:\Users\Admin\AppData\Local\Temp\XPLOIT.EXE"93⤵PID:2164
-
C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"94⤵PID:5600
-
C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"95⤵PID:7084
-
-
-
C:\Users\Admin\AppData\Local\Temp\XPLOIT.EXE"C:\Users\Admin\AppData\Local\Temp\XPLOIT.EXE"94⤵PID:5132
-
C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"95⤵PID:7132
-
C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"96⤵PID:3468
-
-
-
C:\Users\Admin\AppData\Local\Temp\XPLOIT.EXE"C:\Users\Admin\AppData\Local\Temp\XPLOIT.EXE"95⤵PID:860
-
C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"96⤵PID:6764
-
C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"97⤵PID:1972
-
-
-
C:\Users\Admin\AppData\Local\Temp\XPLOIT.EXE"C:\Users\Admin\AppData\Local\Temp\XPLOIT.EXE"96⤵PID:4596
-
C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"97⤵PID:6576
-
C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"98⤵PID:7124
-
-
-
C:\Users\Admin\AppData\Local\Temp\XPLOIT.EXE"C:\Users\Admin\AppData\Local\Temp\XPLOIT.EXE"97⤵PID:6656
-
C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"98⤵PID:5568
-
C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"99⤵PID:6660
-
-
-
C:\Users\Admin\AppData\Local\Temp\XPLOIT.EXE"C:\Users\Admin\AppData\Local\Temp\XPLOIT.EXE"98⤵PID:6148
-
C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"99⤵PID:6288
-
C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"100⤵PID:6496
-
-
-
C:\Users\Admin\AppData\Local\Temp\XPLOIT.EXE"C:\Users\Admin\AppData\Local\Temp\XPLOIT.EXE"99⤵PID:6584
-
C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"100⤵PID:6412
-
C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"101⤵PID:7152
-
-
-
C:\Users\Admin\AppData\Local\Temp\XPLOIT.EXE"C:\Users\Admin\AppData\Local\Temp\XPLOIT.EXE"100⤵PID:4324
-
C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"101⤵PID:6832
-
C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"102⤵PID:6188
-
-
-
C:\Users\Admin\AppData\Local\Temp\XPLOIT.EXE"C:\Users\Admin\AppData\Local\Temp\XPLOIT.EXE"101⤵PID:6840
-
C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"102⤵PID:2300
-
C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"103⤵PID:872
-
-
-
C:\Users\Admin\AppData\Local\Temp\XPLOIT.EXE"C:\Users\Admin\AppData\Local\Temp\XPLOIT.EXE"102⤵PID:2784
-
C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"103⤵PID:6652
-
C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"104⤵PID:5372
-
-
-
C:\Users\Admin\AppData\Local\Temp\XPLOIT.EXE"C:\Users\Admin\AppData\Local\Temp\XPLOIT.EXE"103⤵PID:6644
-
C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"104⤵PID:6460
-
C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"105⤵PID:7360
-
-
-
C:\Users\Admin\AppData\Local\Temp\XPLOIT.EXE"C:\Users\Admin\AppData\Local\Temp\XPLOIT.EXE"104⤵PID:6464
-
C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"105⤵PID:7128
-
C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"106⤵PID:6748
-
-
-
C:\Users\Admin\AppData\Local\Temp\XPLOIT.EXE"C:\Users\Admin\AppData\Local\Temp\XPLOIT.EXE"105⤵PID:7144
-
C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"106⤵PID:6644
-
C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"107⤵PID:7944
-
-
-
C:\Users\Admin\AppData\Local\Temp\XPLOIT.EXE"C:\Users\Admin\AppData\Local\Temp\XPLOIT.EXE"106⤵PID:1612
-
C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"107⤵PID:6640
-
C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"108⤵PID:7468
-
-
-
C:\Users\Admin\AppData\Local\Temp\XPLOIT.EXE"C:\Users\Admin\AppData\Local\Temp\XPLOIT.EXE"107⤵PID:6160
-
C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"108⤵PID:6972
-
C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"109⤵PID:8004
-
-
-
C:\Users\Admin\AppData\Local\Temp\XPLOIT.EXE"C:\Users\Admin\AppData\Local\Temp\XPLOIT.EXE"108⤵PID:6452
-
C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"109⤵PID:6692
-
C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"110⤵PID:8012
-
-
-
C:\Users\Admin\AppData\Local\Temp\XPLOIT.EXE"C:\Users\Admin\AppData\Local\Temp\XPLOIT.EXE"109⤵PID:6776
-
C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"110⤵PID:6856
-
C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"111⤵PID:6704
-
-
-
C:\Users\Admin\AppData\Local\Temp\XPLOIT.EXE"C:\Users\Admin\AppData\Local\Temp\XPLOIT.EXE"110⤵PID:5192
-
C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"111⤵PID:6400
-
C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"112⤵PID:7248
-
-
-
C:\Users\Admin\AppData\Local\Temp\XPLOIT.EXE"C:\Users\Admin\AppData\Local\Temp\XPLOIT.EXE"111⤵PID:6780
-
C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"112⤵PID:6776
-
C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"113⤵PID:7748
-
-
-
C:\Users\Admin\AppData\Local\Temp\XPLOIT.EXE"C:\Users\Admin\AppData\Local\Temp\XPLOIT.EXE"112⤵PID:6236
-
C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"113⤵PID:1168
-
C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"114⤵PID:7712
-
-
-
C:\Users\Admin\AppData\Local\Temp\XPLOIT.EXE"C:\Users\Admin\AppData\Local\Temp\XPLOIT.EXE"113⤵PID:2784
-
C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"114⤵PID:2852
-
C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"115⤵PID:7604
-
-
-
C:\Users\Admin\AppData\Local\Temp\XPLOIT.EXE"C:\Users\Admin\AppData\Local\Temp\XPLOIT.EXE"114⤵PID:6244
-
C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"115⤵PID:3148
-
C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"116⤵PID:7576
-
-
-
C:\Users\Admin\AppData\Local\Temp\XPLOIT.EXE"C:\Users\Admin\AppData\Local\Temp\XPLOIT.EXE"115⤵PID:6148
-
C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"116⤵PID:6560
-
C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"117⤵PID:7960
-
-
-
C:\Users\Admin\AppData\Local\Temp\XPLOIT.EXE"C:\Users\Admin\AppData\Local\Temp\XPLOIT.EXE"116⤵PID:4596
-
C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"117⤵PID:6432
-
C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"118⤵PID:7332
-
-
-
C:\Users\Admin\AppData\Local\Temp\XPLOIT.EXE"C:\Users\Admin\AppData\Local\Temp\XPLOIT.EXE"117⤵PID:5184
-
C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"118⤵PID:2424
-
C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"119⤵PID:3056
-
-
-
C:\Users\Admin\AppData\Local\Temp\XPLOIT.EXE"C:\Users\Admin\AppData\Local\Temp\XPLOIT.EXE"118⤵PID:1368
-
C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"119⤵PID:7520
-
C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"120⤵PID:7368
-
-
-
C:\Users\Admin\AppData\Local\Temp\XPLOIT.EXE"C:\Users\Admin\AppData\Local\Temp\XPLOIT.EXE"119⤵PID:7784
-
C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"120⤵PID:7456
-
C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"121⤵PID:7988
-
-
-
C:\Users\Admin\AppData\Local\Temp\XPLOIT.EXE"C:\Users\Admin\AppData\Local\Temp\XPLOIT.EXE"120⤵PID:7756
-
C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"121⤵PID:7480
-
C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"C:\Users\Admin\AppData\Local\Temp\BUILT.EXE"122⤵PID:7352
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-