Analysis
-
max time kernel
17s -
max time network
205s -
platform
windows10-ltsc_2021_x64 -
resource
win10ltsc2021-20250410-en -
resource tags
arch:x64arch:x86image:win10ltsc2021-20250410-enlocale:en-usos:windows10-ltsc_2021-x64system -
submitted
13/04/2025, 03:20
General
-
Target
anti-anti-afk.exe
-
Size
1.6MB
-
MD5
65aa3c881c733d7dddb867f4df56c316
-
SHA1
568313bc4a3eaba39da891becee3b752cec87337
-
SHA256
02d23f91859aa28a823d9b082129137836289a5bb11bae498689515a22072b16
-
SHA512
adaac864a3c834bd7bd48093d4f84e84117606cf154516292afb79bfad2ebfe80938ee88f2fff1b34fe3e17fe0305ffacd5d7132c8e1c12e0f69df05e182a2d2
-
SSDEEP
49152:aMfQfiZ7q/ruyE3SSY0wYkZvUwORp/sc:aMfT/iiYvUwOd
Malware Config
Extracted
quasar
1.4.0
colt
66.113.31.17:7547
KYS-INF&G^TT*^N
-
encryption_key
70241AEB531B22CC4A2F1CDAD4B909EAB6831EBD
-
install_name
svchost.exe
-
log_directory
colt logs
-
reconnect_delay
100
-
startup_key
svchost.exe
-
subdirectory
rundll32
Signatures
-
Quasar family
-
Quasar payload 2 IoCs
resource yara_rule behavioral1/files/0x00080000000280d8-15.dat family_quasar behavioral1/memory/4404-26-0x0000000000050000-0x00000000000D4000-memory.dmp family_quasar -
RevengeRAT
Remote-access trojan with a wide range of capabilities.
-
Revengerat family
-
RevengeRat Executable 1 IoCs
resource yara_rule behavioral1/files/0x00080000000280dc-77.dat revengerat -
Checks computer location settings 2 TTPs 64 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3276626056-3619442337-829025701-1000\Control Panel\International\Geo\Nation ANTI-AFK.EXE Key value queried \REGISTRY\USER\S-1-5-21-3276626056-3619442337-829025701-1000\Control Panel\International\Geo\Nation ANTI-AFK.EXE Key value queried \REGISTRY\USER\S-1-5-21-3276626056-3619442337-829025701-1000\Control Panel\International\Geo\Nation ANTI-AFK.EXE Key value queried \REGISTRY\USER\S-1-5-21-3276626056-3619442337-829025701-1000\Control Panel\International\Geo\Nation ANTI-AFK.EXE Key value queried \REGISTRY\USER\S-1-5-21-3276626056-3619442337-829025701-1000\Control Panel\International\Geo\Nation ANTI-AFK.EXE Key value queried \REGISTRY\USER\S-1-5-21-3276626056-3619442337-829025701-1000\Control Panel\International\Geo\Nation ANTI-AFK.EXE Key value queried \REGISTRY\USER\S-1-5-21-3276626056-3619442337-829025701-1000\Control Panel\International\Geo\Nation ANTI-AFK.EXE Key value queried \REGISTRY\USER\S-1-5-21-3276626056-3619442337-829025701-1000\Control Panel\International\Geo\Nation ANTI-AFK.EXE Key value queried \REGISTRY\USER\S-1-5-21-3276626056-3619442337-829025701-1000\Control Panel\International\Geo\Nation ANTI-AFK.EXE Key value queried \REGISTRY\USER\S-1-5-21-3276626056-3619442337-829025701-1000\Control Panel\International\Geo\Nation ANTI-AFK.EXE Key value queried \REGISTRY\USER\S-1-5-21-3276626056-3619442337-829025701-1000\Control Panel\International\Geo\Nation ANTI-AFK.EXE Key value queried \REGISTRY\USER\S-1-5-21-3276626056-3619442337-829025701-1000\Control Panel\International\Geo\Nation ANTI-AFK.EXE Key value queried \REGISTRY\USER\S-1-5-21-3276626056-3619442337-829025701-1000\Control Panel\International\Geo\Nation ANTI-AFK.EXE Key value queried \REGISTRY\USER\S-1-5-21-3276626056-3619442337-829025701-1000\Control Panel\International\Geo\Nation ANTI-AFK.EXE Key value queried \REGISTRY\USER\S-1-5-21-3276626056-3619442337-829025701-1000\Control Panel\International\Geo\Nation ANTI-AFK.EXE Key value queried \REGISTRY\USER\S-1-5-21-3276626056-3619442337-829025701-1000\Control Panel\International\Geo\Nation ANTI-AFK.EXE Key value queried \REGISTRY\USER\S-1-5-21-3276626056-3619442337-829025701-1000\Control Panel\International\Geo\Nation ANTI-AFK.EXE Key value queried \REGISTRY\USER\S-1-5-21-3276626056-3619442337-829025701-1000\Control Panel\International\Geo\Nation ANTI-AFK.EXE Key value queried \REGISTRY\USER\S-1-5-21-3276626056-3619442337-829025701-1000\Control Panel\International\Geo\Nation ANTI-AFK.EXE Key value queried \REGISTRY\USER\S-1-5-21-3276626056-3619442337-829025701-1000\Control Panel\International\Geo\Nation ANTI-AFK.EXE Key value queried \REGISTRY\USER\S-1-5-21-3276626056-3619442337-829025701-1000\Control Panel\International\Geo\Nation ANTI-AFK.EXE Key value queried \REGISTRY\USER\S-1-5-21-3276626056-3619442337-829025701-1000\Control Panel\International\Geo\Nation ANTI-AFK.EXE Key value queried \REGISTRY\USER\S-1-5-21-3276626056-3619442337-829025701-1000\Control Panel\International\Geo\Nation ANTI-AFK.EXE Key value queried \REGISTRY\USER\S-1-5-21-3276626056-3619442337-829025701-1000\Control Panel\International\Geo\Nation ANTI-AFK.EXE Key value queried \REGISTRY\USER\S-1-5-21-3276626056-3619442337-829025701-1000\Control Panel\International\Geo\Nation ANTI-AFK.EXE Key value queried \REGISTRY\USER\S-1-5-21-3276626056-3619442337-829025701-1000\Control Panel\International\Geo\Nation ANTI-AFK.EXE Key value queried \REGISTRY\USER\S-1-5-21-3276626056-3619442337-829025701-1000\Control Panel\International\Geo\Nation ANTI-AFK.EXE Key value queried \REGISTRY\USER\S-1-5-21-3276626056-3619442337-829025701-1000\Control Panel\International\Geo\Nation ANTI-AFK.EXE Key value queried \REGISTRY\USER\S-1-5-21-3276626056-3619442337-829025701-1000\Control Panel\International\Geo\Nation ANTI-AFK.EXE Key value queried \REGISTRY\USER\S-1-5-21-3276626056-3619442337-829025701-1000\Control Panel\International\Geo\Nation INSTALLER.EXE Key value queried \REGISTRY\USER\S-1-5-21-3276626056-3619442337-829025701-1000\Control Panel\International\Geo\Nation ANTI-AFK.EXE Key value queried \REGISTRY\USER\S-1-5-21-3276626056-3619442337-829025701-1000\Control Panel\International\Geo\Nation ANTI-AFK.EXE Key value queried \REGISTRY\USER\S-1-5-21-3276626056-3619442337-829025701-1000\Control Panel\International\Geo\Nation ANTI-AFK.EXE Key value queried \REGISTRY\USER\S-1-5-21-3276626056-3619442337-829025701-1000\Control Panel\International\Geo\Nation ANTI-AFK.EXE Key value queried \REGISTRY\USER\S-1-5-21-3276626056-3619442337-829025701-1000\Control Panel\International\Geo\Nation ANTI-AFK.EXE Key value queried \REGISTRY\USER\S-1-5-21-3276626056-3619442337-829025701-1000\Control Panel\International\Geo\Nation ANTI-AFK.EXE Key value queried \REGISTRY\USER\S-1-5-21-3276626056-3619442337-829025701-1000\Control Panel\International\Geo\Nation ANTI-AFK.EXE Key value queried \REGISTRY\USER\S-1-5-21-3276626056-3619442337-829025701-1000\Control Panel\International\Geo\Nation ANTI-AFK.EXE Key value queried \REGISTRY\USER\S-1-5-21-3276626056-3619442337-829025701-1000\Control Panel\International\Geo\Nation ANTI-AFK.EXE Key value queried \REGISTRY\USER\S-1-5-21-3276626056-3619442337-829025701-1000\Control Panel\International\Geo\Nation ANTI-AFK.EXE Key value queried \REGISTRY\USER\S-1-5-21-3276626056-3619442337-829025701-1000\Control Panel\International\Geo\Nation ANTI-AFK.EXE Key value queried \REGISTRY\USER\S-1-5-21-3276626056-3619442337-829025701-1000\Control Panel\International\Geo\Nation ANTI-AFK.EXE Key value queried \REGISTRY\USER\S-1-5-21-3276626056-3619442337-829025701-1000\Control Panel\International\Geo\Nation ANTI-AFK.EXE Key value queried \REGISTRY\USER\S-1-5-21-3276626056-3619442337-829025701-1000\Control Panel\International\Geo\Nation ANTI-AFK.EXE Key value queried \REGISTRY\USER\S-1-5-21-3276626056-3619442337-829025701-1000\Control Panel\International\Geo\Nation ANTI-AFK.EXE Key value queried \REGISTRY\USER\S-1-5-21-3276626056-3619442337-829025701-1000\Control Panel\International\Geo\Nation ANTI-AFK.EXE Key value queried \REGISTRY\USER\S-1-5-21-3276626056-3619442337-829025701-1000\Control Panel\International\Geo\Nation ANTI-AFK.EXE Key value queried \REGISTRY\USER\S-1-5-21-3276626056-3619442337-829025701-1000\Control Panel\International\Geo\Nation ANTI-AFK.EXE Key value queried \REGISTRY\USER\S-1-5-21-3276626056-3619442337-829025701-1000\Control Panel\International\Geo\Nation ANTI-AFK.EXE Key value queried \REGISTRY\USER\S-1-5-21-3276626056-3619442337-829025701-1000\Control Panel\International\Geo\Nation ANTI-AFK.EXE Key value queried \REGISTRY\USER\S-1-5-21-3276626056-3619442337-829025701-1000\Control Panel\International\Geo\Nation ANTI-AFK.EXE Key value queried \REGISTRY\USER\S-1-5-21-3276626056-3619442337-829025701-1000\Control Panel\International\Geo\Nation ANTI-AFK.EXE Key value queried \REGISTRY\USER\S-1-5-21-3276626056-3619442337-829025701-1000\Control Panel\International\Geo\Nation ANTI-AFK.EXE Key value queried \REGISTRY\USER\S-1-5-21-3276626056-3619442337-829025701-1000\Control Panel\International\Geo\Nation ANTI-AFK.EXE Key value queried \REGISTRY\USER\S-1-5-21-3276626056-3619442337-829025701-1000\Control Panel\International\Geo\Nation ANTI-AFK.EXE Key value queried \REGISTRY\USER\S-1-5-21-3276626056-3619442337-829025701-1000\Control Panel\International\Geo\Nation ANTI-AFK.EXE Key value queried \REGISTRY\USER\S-1-5-21-3276626056-3619442337-829025701-1000\Control Panel\International\Geo\Nation ANTI-AFK.EXE Key value queried \REGISTRY\USER\S-1-5-21-3276626056-3619442337-829025701-1000\Control Panel\International\Geo\Nation ANTI-AFK.EXE Key value queried \REGISTRY\USER\S-1-5-21-3276626056-3619442337-829025701-1000\Control Panel\International\Geo\Nation ANTI-AFK.EXE Key value queried \REGISTRY\USER\S-1-5-21-3276626056-3619442337-829025701-1000\Control Panel\International\Geo\Nation ANTI-AFK.EXE Key value queried \REGISTRY\USER\S-1-5-21-3276626056-3619442337-829025701-1000\Control Panel\International\Geo\Nation ANTI-AFK.EXE Key value queried \REGISTRY\USER\S-1-5-21-3276626056-3619442337-829025701-1000\Control Panel\International\Geo\Nation ANTI-AFK.EXE Key value queried \REGISTRY\USER\S-1-5-21-3276626056-3619442337-829025701-1000\Control Panel\International\Geo\Nation ANTI-AFK.EXE Key value queried \REGISTRY\USER\S-1-5-21-3276626056-3619442337-829025701-1000\Control Panel\International\Geo\Nation ANTI-AFK.EXE -
Executes dropped EXE 64 IoCs
pid Process 3004 ANTI-AFK.EXE 4404 UPDATER.EXE 1820 ANTI-AFK.EXE 5688 INSTALLER.EXE 1748 ANTI-AFK.EXE 4968 INSTALLER.EXE 5668 1.exe 4216 2.exe 4312 ANTI-AFK.EXE 3612 INSTALLER.EXE 4648 ANTI-AFK.EXE 4660 INSTALLER.EXE 5988 ANTI-AFK.EXE 4836 INSTALLER.EXE 2536 svchost.exe 2256 ANTI-AFK.EXE 4224 INSTALLER.EXE 1124 ANTI-AFK.EXE 4232 INSTALLER.EXE 3232 ANTI-AFK.EXE 2172 INSTALLER.EXE 5948 ANTI-AFK.EXE 5484 INSTALLER.EXE 5372 ANTI-AFK.EXE 3544 INSTALLER.EXE 4156 ANTI-AFK.EXE 1840 INSTALLER.EXE 1360 ANTI-AFK.EXE 3608 INSTALLER.EXE 5712 ANTI-AFK.EXE 1604 INSTALLER.EXE 4420 ANTI-AFK.EXE 1276 INSTALLER.EXE 3768 ANTI-AFK.EXE 5768 INSTALLER.EXE 1716 ANTI-AFK.EXE 2820 INSTALLER.EXE 4200 ANTI-AFK.EXE 1132 INSTALLER.EXE 4076 ANTI-AFK.EXE 4472 INSTALLER.EXE 3920 ANTI-AFK.EXE 3432 INSTALLER.EXE 236 ANTI-AFK.EXE 3088 INSTALLER.EXE 3352 ANTI-AFK.EXE 1908 INSTALLER.EXE 2236 ANTI-AFK.EXE 4704 INSTALLER.EXE 1900 ANTI-AFK.EXE 1392 INSTALLER.EXE 6056 ANTI-AFK.EXE 3196 INSTALLER.EXE 3000 ANTI-AFK.EXE 4588 INSTALLER.EXE 780 ANTI-AFK.EXE 2580 INSTALLER.EXE 4484 ANTI-AFK.EXE 1372 INSTALLER.EXE 1740 ANTI-AFK.EXE 5116 INSTALLER.EXE 3980 ANTI-AFK.EXE 4708 INSTALLER.EXE 3096 ANTI-AFK.EXE -
Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\1.exe INSTALLER.EXE File opened for modification C:\Windows\SysWOW64\system.EXE INSTALLER.EXE File created C:\Windows\SysWOW64\1.exe INSTALLER.EXE File opened for modification C:\Windows\SysWOW64\system.EXE INSTALLER.EXE File opened for modification C:\Windows\SysWOW64\system.EXE INSTALLER.EXE File created C:\Windows\SysWOW64\1.exe INSTALLER.EXE File opened for modification C:\Windows\SysWOW64\system.EXE INSTALLER.EXE File opened for modification C:\Windows\SysWOW64\system.EXE INSTALLER.EXE File opened for modification C:\Windows\SysWOW64\system.EXE INSTALLER.EXE File created C:\Windows\SysWOW64\1.exe INSTALLER.EXE File created C:\Windows\SysWOW64\1.exe INSTALLER.EXE File opened for modification C:\Windows\SysWOW64\system.EXE INSTALLER.EXE File created C:\Windows\SysWOW64\1.exe INSTALLER.EXE File opened for modification C:\Windows\SysWOW64\system.EXE INSTALLER.EXE File opened for modification C:\Windows\SysWOW64\system.EXE INSTALLER.EXE File created C:\Windows\SysWOW64\1.exe INSTALLER.EXE File created C:\Windows\SysWOW64\1.exe INSTALLER.EXE File opened for modification C:\Windows\SysWOW64\system.EXE INSTALLER.EXE File created C:\Windows\SysWOW64\1.exe INSTALLER.EXE File created C:\Windows\SysWOW64\1.exe INSTALLER.EXE File opened for modification C:\Windows\SysWOW64\system.EXE INSTALLER.EXE File opened for modification C:\Windows\SysWOW64\system.EXE INSTALLER.EXE File created C:\Windows\SysWOW64\1.exe INSTALLER.EXE File created C:\Windows\SysWOW64\2.exe INSTALLER.EXE File created C:\Windows\SysWOW64\1.exe INSTALLER.EXE File created C:\Windows\SysWOW64\1.exe INSTALLER.EXE File created C:\Windows\SysWOW64\1.exe INSTALLER.EXE File created C:\Windows\SysWOW64\1.exe INSTALLER.EXE File opened for modification C:\Windows\SysWOW64\system.EXE INSTALLER.EXE File created C:\Windows\SysWOW64\1.exe INSTALLER.EXE File created C:\Windows\SysWOW64\1.exe INSTALLER.EXE File opened for modification C:\Windows\SysWOW64\system.EXE INSTALLER.EXE File opened for modification C:\Windows\SysWOW64\system.EXE INSTALLER.EXE File opened for modification C:\Windows\SysWOW64\system.EXE INSTALLER.EXE File opened for modification C:\Windows\SysWOW64\system.EXE INSTALLER.EXE File created C:\Windows\SysWOW64\1.exe INSTALLER.EXE File opened for modification C:\Windows\SysWOW64\system.EXE INSTALLER.EXE File created C:\Windows\SysWOW64\1.exe INSTALLER.EXE File created C:\Windows\SysWOW64\1.exe INSTALLER.EXE File opened for modification C:\Windows\SysWOW64\system.EXE INSTALLER.EXE File created C:\Windows\SysWOW64\1.exe INSTALLER.EXE File created C:\Windows\SysWOW64\1.exe INSTALLER.EXE File opened for modification C:\Windows\SysWOW64\system.EXE INSTALLER.EXE File created C:\Windows\SysWOW64\1.exe INSTALLER.EXE File created C:\Windows\SysWOW64\1.exe INSTALLER.EXE File created C:\Windows\SysWOW64\1.exe INSTALLER.EXE File created C:\Windows\SysWOW64\1.exe INSTALLER.EXE File opened for modification C:\Windows\SysWOW64\system.EXE INSTALLER.EXE File opened for modification C:\Windows\SysWOW64\system.EXE INSTALLER.EXE File created C:\Windows\SysWOW64\1.exe INSTALLER.EXE File created C:\Windows\SysWOW64\1.exe INSTALLER.EXE File created C:\Windows\SysWOW64\1.exe INSTALLER.EXE File opened for modification C:\Windows\SysWOW64\system.EXE INSTALLER.EXE File opened for modification C:\Windows\SysWOW64\system.EXE INSTALLER.EXE File created C:\Windows\SysWOW64\1.exe INSTALLER.EXE File created C:\Windows\SysWOW64\1.exe INSTALLER.EXE File created C:\Windows\SysWOW64\1.exe INSTALLER.EXE File opened for modification C:\Windows\SysWOW64\system.EXE INSTALLER.EXE File created C:\Windows\SysWOW64\1.exe INSTALLER.EXE File opened for modification C:\Windows\SysWOW64\system.EXE INSTALLER.EXE File created C:\Windows\SysWOW64\1.exe INSTALLER.EXE File opened for modification C:\Windows\SysWOW64\system.EXE INSTALLER.EXE File created C:\Windows\SysWOW64\1.exe INSTALLER.EXE File created C:\Windows\SysWOW64\1.exe INSTALLER.EXE -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4216 set thread context of 4752 4216 2.exe 92 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
pid pid_target Process procid_target 5076 4752 WerFault.exe 92 -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ANTI-AFK.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ANTI-AFK.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ANTI-AFK.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ANTI-AFK.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ANTI-AFK.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ANTI-AFK.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ANTI-AFK.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ANTI-AFK.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ANTI-AFK.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ANTI-AFK.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ANTI-AFK.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ANTI-AFK.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ANTI-AFK.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ANTI-AFK.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ANTI-AFK.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ANTI-AFK.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language INSTALLER.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ANTI-AFK.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ANTI-AFK.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ANTI-AFK.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ANTI-AFK.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ANTI-AFK.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ANTI-AFK.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ANTI-AFK.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ANTI-AFK.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ANTI-AFK.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ANTI-AFK.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ANTI-AFK.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ANTI-AFK.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ANTI-AFK.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ANTI-AFK.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ANTI-AFK.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ANTI-AFK.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ANTI-AFK.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ANTI-AFK.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ANTI-AFK.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ANTI-AFK.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ANTI-AFK.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ANTI-AFK.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ANTI-AFK.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ANTI-AFK.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ANTI-AFK.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ANTI-AFK.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ANTI-AFK.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ANTI-AFK.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ANTI-AFK.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ANTI-AFK.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ANTI-AFK.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ANTI-AFK.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ANTI-AFK.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ANTI-AFK.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ANTI-AFK.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ANTI-AFK.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ANTI-AFK.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ANTI-AFK.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ANTI-AFK.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ANTI-AFK.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ANTI-AFK.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ANTI-AFK.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ANTI-AFK.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ANTI-AFK.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ANTI-AFK.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ANTI-AFK.EXE -
Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4756 schtasks.exe 5532 schtasks.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 4404 UPDATER.EXE Token: SeDebugPrivilege 4216 2.exe Token: SeDebugPrivilege 2536 svchost.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2536 svchost.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5288 wrote to memory of 3004 5288 anti-anti-afk.exe 80 PID 5288 wrote to memory of 3004 5288 anti-anti-afk.exe 80 PID 5288 wrote to memory of 3004 5288 anti-anti-afk.exe 80 PID 5288 wrote to memory of 4404 5288 anti-anti-afk.exe 81 PID 5288 wrote to memory of 4404 5288 anti-anti-afk.exe 81 PID 3004 wrote to memory of 1820 3004 ANTI-AFK.EXE 82 PID 3004 wrote to memory of 1820 3004 ANTI-AFK.EXE 82 PID 3004 wrote to memory of 1820 3004 ANTI-AFK.EXE 82 PID 3004 wrote to memory of 5688 3004 ANTI-AFK.EXE 83 PID 3004 wrote to memory of 5688 3004 ANTI-AFK.EXE 83 PID 3004 wrote to memory of 5688 3004 ANTI-AFK.EXE 83 PID 1820 wrote to memory of 1748 1820 ANTI-AFK.EXE 84 PID 1820 wrote to memory of 1748 1820 ANTI-AFK.EXE 84 PID 1820 wrote to memory of 1748 1820 ANTI-AFK.EXE 84 PID 1820 wrote to memory of 4968 1820 ANTI-AFK.EXE 85 PID 1820 wrote to memory of 4968 1820 ANTI-AFK.EXE 85 PID 1820 wrote to memory of 4968 1820 ANTI-AFK.EXE 85 PID 5688 wrote to memory of 5668 5688 INSTALLER.EXE 86 PID 5688 wrote to memory of 5668 5688 INSTALLER.EXE 86 PID 5688 wrote to memory of 4216 5688 INSTALLER.EXE 87 PID 5688 wrote to memory of 4216 5688 INSTALLER.EXE 87 PID 5688 wrote to memory of 4216 5688 INSTALLER.EXE 87 PID 1748 wrote to memory of 4312 1748 ANTI-AFK.EXE 88 PID 1748 wrote to memory of 4312 1748 ANTI-AFK.EXE 88 PID 1748 wrote to memory of 4312 1748 ANTI-AFK.EXE 88 PID 1748 wrote to memory of 3612 1748 ANTI-AFK.EXE 89 PID 1748 wrote to memory of 3612 1748 ANTI-AFK.EXE 89 PID 1748 wrote to memory of 3612 1748 ANTI-AFK.EXE 89 PID 4312 wrote to memory of 4648 4312 ANTI-AFK.EXE 90 PID 4312 wrote to memory of 4648 4312 ANTI-AFK.EXE 90 PID 4312 wrote to memory of 4648 4312 ANTI-AFK.EXE 90 PID 4312 wrote to memory of 4660 4312 ANTI-AFK.EXE 91 PID 4312 wrote to memory of 4660 4312 ANTI-AFK.EXE 91 PID 4312 wrote to memory of 4660 4312 ANTI-AFK.EXE 91 PID 4216 wrote to memory of 4752 4216 2.exe 92 PID 4216 wrote to memory of 4752 4216 2.exe 92 PID 4216 wrote to memory of 4752 4216 2.exe 92 PID 4216 wrote to memory of 4752 4216 2.exe 92 PID 4216 wrote to memory of 4752 4216 2.exe 92 PID 4216 wrote to memory of 4752 4216 2.exe 92 PID 4216 wrote to memory of 4752 4216 2.exe 92 PID 4216 wrote to memory of 4752 4216 2.exe 92 PID 4216 wrote to memory of 4752 4216 2.exe 92 PID 4404 wrote to memory of 4756 4404 UPDATER.EXE 94 PID 4404 wrote to memory of 4756 4404 UPDATER.EXE 94 PID 4648 wrote to memory of 5988 4648 ANTI-AFK.EXE 97 PID 4648 wrote to memory of 5988 4648 ANTI-AFK.EXE 97 PID 4648 wrote to memory of 5988 4648 ANTI-AFK.EXE 97 PID 4648 wrote to memory of 4836 4648 ANTI-AFK.EXE 98 PID 4648 wrote to memory of 4836 4648 ANTI-AFK.EXE 98 PID 4648 wrote to memory of 4836 4648 ANTI-AFK.EXE 98 PID 4404 wrote to memory of 2536 4404 UPDATER.EXE 100 PID 4404 wrote to memory of 2536 4404 UPDATER.EXE 100 PID 5988 wrote to memory of 2256 5988 ANTI-AFK.EXE 101 PID 5988 wrote to memory of 2256 5988 ANTI-AFK.EXE 101 PID 5988 wrote to memory of 2256 5988 ANTI-AFK.EXE 101 PID 5988 wrote to memory of 4224 5988 ANTI-AFK.EXE 102 PID 5988 wrote to memory of 4224 5988 ANTI-AFK.EXE 102 PID 5988 wrote to memory of 4224 5988 ANTI-AFK.EXE 102 PID 2256 wrote to memory of 1124 2256 ANTI-AFK.EXE 103 PID 2256 wrote to memory of 1124 2256 ANTI-AFK.EXE 103 PID 2256 wrote to memory of 1124 2256 ANTI-AFK.EXE 103 PID 2256 wrote to memory of 4232 2256 ANTI-AFK.EXE 104 PID 2256 wrote to memory of 4232 2256 ANTI-AFK.EXE 104 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\anti-anti-afk.exe"C:\Users\Admin\AppData\Local\Temp\anti-anti-afk.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:5288 -
C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"2⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3004 -
C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1820 -
C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1748 -
C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4312 -
C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"6⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4648 -
C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5988 -
C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"8⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2256 -
C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"9⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1124 -
C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"10⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3232 -
C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"11⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5948 -
C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"12⤵
- Checks computer location settings
- Executes dropped EXE
PID:5372 -
C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"13⤵
- Executes dropped EXE
PID:4156 -
C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"14⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1360 -
C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"15⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5712 -
C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"16⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4420 -
C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"17⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3768 -
C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"18⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1716 -
C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"19⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4200 -
C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"20⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4076 -
C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"21⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3920 -
C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"22⤵
- Checks computer location settings
- Executes dropped EXE
PID:236 -
C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"23⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3352 -
C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"24⤵
- Checks computer location settings
- Executes dropped EXE
PID:2236 -
C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"25⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1900 -
C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"26⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:6056 -
C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"27⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3000 -
C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"28⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:780 -
C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"29⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4484 -
C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"30⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1740 -
C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"31⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3980 -
C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"32⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3096 -
C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"33⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
PID:5344 -
C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"34⤵
- Checks computer location settings
PID:5680 -
C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"35⤵PID:3336
-
C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"36⤵PID:1432
-
C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"37⤵PID:2516
-
C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"38⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
PID:2900 -
C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"39⤵
- Checks computer location settings
PID:3880 -
C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"40⤵
- System Location Discovery: System Language Discovery
PID:4764 -
C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"41⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
PID:4768 -
C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"42⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
PID:3840 -
C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"43⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
PID:1752 -
C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"44⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
PID:2068 -
C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"45⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
PID:6128 -
C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"46⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
PID:4800 -
C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"47⤵
- System Location Discovery: System Language Discovery
PID:5504 -
C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"48⤵
- System Location Discovery: System Language Discovery
PID:3232 -
C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"49⤵PID:5320
-
C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"50⤵PID:5160
-
C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"51⤵PID:1860
-
C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"52⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
PID:3256 -
C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"53⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
PID:1176 -
C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"54⤵
- System Location Discovery: System Language Discovery
PID:1192 -
C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"55⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
PID:5324 -
C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"56⤵
- System Location Discovery: System Language Discovery
PID:3384 -
C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"57⤵
- Checks computer location settings
PID:3176 -
C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"58⤵
- Checks computer location settings
PID:824 -
C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"59⤵
- Checks computer location settings
PID:548 -
C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"60⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
PID:1944 -
C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"61⤵
- System Location Discovery: System Language Discovery
PID:1600 -
C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"62⤵PID:2768
-
C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"63⤵
- System Location Discovery: System Language Discovery
PID:4028 -
C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"64⤵PID:3588
-
C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"65⤵
- Checks computer location settings
PID:5208 -
C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"66⤵
- System Location Discovery: System Language Discovery
PID:116 -
C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"67⤵
- Checks computer location settings
PID:2936 -
C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"68⤵
- System Location Discovery: System Language Discovery
PID:5344 -
C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"69⤵
- Checks computer location settings
PID:2016 -
C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"70⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
PID:5608 -
C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"71⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
PID:3052 -
C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"72⤵
- System Location Discovery: System Language Discovery
PID:5632 -
C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"73⤵
- Checks computer location settings
PID:4780 -
C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"74⤵
- System Location Discovery: System Language Discovery
PID:4892 -
C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"75⤵PID:4936
-
C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"76⤵PID:5096
-
C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"77⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
PID:6028 -
C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"78⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
PID:5076 -
C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"79⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
PID:3724 -
C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"80⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
PID:5700 -
C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"81⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
PID:4860 -
C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"82⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
PID:3788 -
C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"83⤵
- Checks computer location settings
PID:776 -
C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"84⤵
- Checks computer location settings
PID:2400 -
C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"85⤵
- Checks computer location settings
PID:3268 -
C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"86⤵
- System Location Discovery: System Language Discovery
PID:4076 -
C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"87⤵
- System Location Discovery: System Language Discovery
PID:4732 -
C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"88⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
PID:4724 -
C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"89⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
PID:2396 -
C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"90⤵
- Checks computer location settings
PID:2152 -
C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"91⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
PID:2996 -
C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"92⤵
- Checks computer location settings
PID:2428 -
C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"93⤵
- Checks computer location settings
PID:4500 -
C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"94⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
PID:2640 -
C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"95⤵
- System Location Discovery: System Language Discovery
PID:524 -
C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"96⤵
- Checks computer location settings
PID:668 -
C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"97⤵PID:3504
-
C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"98⤵
- System Location Discovery: System Language Discovery
PID:4680 -
C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"99⤵PID:5992
-
C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"100⤵PID:4928
-
C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"101⤵PID:6028
-
C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"102⤵PID:5336
-
C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"103⤵PID:1384
-
C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"104⤵PID:564
-
C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"105⤵PID:5172
-
C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"106⤵PID:5804
-
C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"107⤵PID:1616
-
C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"108⤵PID:4076
-
C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"109⤵PID:2236
-
C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"110⤵PID:4268
-
C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"111⤵PID:5980
-
C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"112⤵PID:924
-
C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"113⤵PID:4504
-
C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"114⤵PID:1580
-
C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"115⤵PID:2900
-
C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"116⤵PID:5688
-
C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"117⤵PID:2980
-
C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"118⤵PID:4780
-
C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"119⤵PID:5992
-
C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"120⤵PID:5872
-
C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"121⤵PID:5788
-
C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"122⤵PID:5496
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-