Analysis
-
max time kernel
9s -
max time network
141s -
platform
windows10-2004_x64 -
resource
win10v2004-20250410-en -
resource tags
arch:x64arch:x86image:win10v2004-20250410-enlocale:en-usos:windows10-2004-x64system -
submitted
13/04/2025, 04:22
Static task
static1
Behavioral task
behavioral1
Sample
Anti-AFK.exe
Resource
win10v2004-20250410-en
General
-
Target
Anti-AFK.exe
-
Size
1.0MB
-
MD5
d123427182e9ec7b19765f32fc159719
-
SHA1
3c171e57af9aec12bbe63065149b9a63a7d53e11
-
SHA256
07dfacdc603bb28beb153f81bb4519a7239bdcf8411e5c5f7c26b54ceb5a3865
-
SHA512
7efea1b0914bdd4c29363ca782495cb88fc4a81bcde2ce39b7cae83bd57bf27334eef3e08c3131250f8bbc4b4f466fcacab1c22c1369cc860ba87d43a1fa8534
-
SSDEEP
24576:ozbQfQjWKM072B6PUppfZkyE3ScFYTYwYkPBlIpFIa:ofQfiZ7q/ruyE3SSY0wYkZ
Malware Config
Signatures
-
RevengeRAT
Remote-access trojan with a wide range of capabilities.
-
Revengerat family
-
RevengeRat Executable 1 IoCs
resource yara_rule behavioral1/files/0x0007000000024287-30.dat revengerat -
Checks computer location settings 2 TTPs 51 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3078542121-369484597-920690335-1000\Control Panel\International\Geo\Nation ANTI-AFK.EXE Key value queried \REGISTRY\USER\S-1-5-21-3078542121-369484597-920690335-1000\Control Panel\International\Geo\Nation ANTI-AFK.EXE Key value queried \REGISTRY\USER\S-1-5-21-3078542121-369484597-920690335-1000\Control Panel\International\Geo\Nation ANTI-AFK.EXE Key value queried \REGISTRY\USER\S-1-5-21-3078542121-369484597-920690335-1000\Control Panel\International\Geo\Nation ANTI-AFK.EXE Key value queried \REGISTRY\USER\S-1-5-21-3078542121-369484597-920690335-1000\Control Panel\International\Geo\Nation ANTI-AFK.EXE Key value queried \REGISTRY\USER\S-1-5-21-3078542121-369484597-920690335-1000\Control Panel\International\Geo\Nation ANTI-AFK.EXE Key value queried \REGISTRY\USER\S-1-5-21-3078542121-369484597-920690335-1000\Control Panel\International\Geo\Nation ANTI-AFK.EXE Key value queried \REGISTRY\USER\S-1-5-21-3078542121-369484597-920690335-1000\Control Panel\International\Geo\Nation ANTI-AFK.EXE Key value queried \REGISTRY\USER\S-1-5-21-3078542121-369484597-920690335-1000\Control Panel\International\Geo\Nation ANTI-AFK.EXE Key value queried \REGISTRY\USER\S-1-5-21-3078542121-369484597-920690335-1000\Control Panel\International\Geo\Nation ANTI-AFK.EXE Key value queried \REGISTRY\USER\S-1-5-21-3078542121-369484597-920690335-1000\Control Panel\International\Geo\Nation ANTI-AFK.EXE Key value queried \REGISTRY\USER\S-1-5-21-3078542121-369484597-920690335-1000\Control Panel\International\Geo\Nation INSTALLER.EXE Key value queried \REGISTRY\USER\S-1-5-21-3078542121-369484597-920690335-1000\Control Panel\International\Geo\Nation ANTI-AFK.EXE Key value queried \REGISTRY\USER\S-1-5-21-3078542121-369484597-920690335-1000\Control Panel\International\Geo\Nation ANTI-AFK.EXE Key value queried \REGISTRY\USER\S-1-5-21-3078542121-369484597-920690335-1000\Control Panel\International\Geo\Nation ANTI-AFK.EXE Key value queried \REGISTRY\USER\S-1-5-21-3078542121-369484597-920690335-1000\Control Panel\International\Geo\Nation ANTI-AFK.EXE Key value queried \REGISTRY\USER\S-1-5-21-3078542121-369484597-920690335-1000\Control Panel\International\Geo\Nation ANTI-AFK.EXE Key value queried \REGISTRY\USER\S-1-5-21-3078542121-369484597-920690335-1000\Control Panel\International\Geo\Nation ANTI-AFK.EXE Key value queried \REGISTRY\USER\S-1-5-21-3078542121-369484597-920690335-1000\Control Panel\International\Geo\Nation ANTI-AFK.EXE Key value queried \REGISTRY\USER\S-1-5-21-3078542121-369484597-920690335-1000\Control Panel\International\Geo\Nation ANTI-AFK.EXE Key value queried \REGISTRY\USER\S-1-5-21-3078542121-369484597-920690335-1000\Control Panel\International\Geo\Nation Anti-AFK.exe Key value queried \REGISTRY\USER\S-1-5-21-3078542121-369484597-920690335-1000\Control Panel\International\Geo\Nation ANTI-AFK.EXE Key value queried \REGISTRY\USER\S-1-5-21-3078542121-369484597-920690335-1000\Control Panel\International\Geo\Nation ANTI-AFK.EXE Key value queried \REGISTRY\USER\S-1-5-21-3078542121-369484597-920690335-1000\Control Panel\International\Geo\Nation ANTI-AFK.EXE Key value queried \REGISTRY\USER\S-1-5-21-3078542121-369484597-920690335-1000\Control Panel\International\Geo\Nation ANTI-AFK.EXE Key value queried \REGISTRY\USER\S-1-5-21-3078542121-369484597-920690335-1000\Control Panel\International\Geo\Nation ANTI-AFK.EXE Key value queried \REGISTRY\USER\S-1-5-21-3078542121-369484597-920690335-1000\Control Panel\International\Geo\Nation ANTI-AFK.EXE Key value queried \REGISTRY\USER\S-1-5-21-3078542121-369484597-920690335-1000\Control Panel\International\Geo\Nation ANTI-AFK.EXE Key value queried \REGISTRY\USER\S-1-5-21-3078542121-369484597-920690335-1000\Control Panel\International\Geo\Nation ANTI-AFK.EXE Key value queried \REGISTRY\USER\S-1-5-21-3078542121-369484597-920690335-1000\Control Panel\International\Geo\Nation ANTI-AFK.EXE Key value queried \REGISTRY\USER\S-1-5-21-3078542121-369484597-920690335-1000\Control Panel\International\Geo\Nation ANTI-AFK.EXE Key value queried \REGISTRY\USER\S-1-5-21-3078542121-369484597-920690335-1000\Control Panel\International\Geo\Nation ANTI-AFK.EXE Key value queried \REGISTRY\USER\S-1-5-21-3078542121-369484597-920690335-1000\Control Panel\International\Geo\Nation ANTI-AFK.EXE Key value queried \REGISTRY\USER\S-1-5-21-3078542121-369484597-920690335-1000\Control Panel\International\Geo\Nation ANTI-AFK.EXE Key value queried \REGISTRY\USER\S-1-5-21-3078542121-369484597-920690335-1000\Control Panel\International\Geo\Nation ANTI-AFK.EXE Key value queried \REGISTRY\USER\S-1-5-21-3078542121-369484597-920690335-1000\Control Panel\International\Geo\Nation ANTI-AFK.EXE Key value queried \REGISTRY\USER\S-1-5-21-3078542121-369484597-920690335-1000\Control Panel\International\Geo\Nation ANTI-AFK.EXE Key value queried \REGISTRY\USER\S-1-5-21-3078542121-369484597-920690335-1000\Control Panel\International\Geo\Nation ANTI-AFK.EXE Key value queried \REGISTRY\USER\S-1-5-21-3078542121-369484597-920690335-1000\Control Panel\International\Geo\Nation ANTI-AFK.EXE Key value queried \REGISTRY\USER\S-1-5-21-3078542121-369484597-920690335-1000\Control Panel\International\Geo\Nation ANTI-AFK.EXE Key value queried \REGISTRY\USER\S-1-5-21-3078542121-369484597-920690335-1000\Control Panel\International\Geo\Nation ANTI-AFK.EXE Key value queried \REGISTRY\USER\S-1-5-21-3078542121-369484597-920690335-1000\Control Panel\International\Geo\Nation ANTI-AFK.EXE Key value queried \REGISTRY\USER\S-1-5-21-3078542121-369484597-920690335-1000\Control Panel\International\Geo\Nation ANTI-AFK.EXE Key value queried \REGISTRY\USER\S-1-5-21-3078542121-369484597-920690335-1000\Control Panel\International\Geo\Nation ANTI-AFK.EXE Key value queried \REGISTRY\USER\S-1-5-21-3078542121-369484597-920690335-1000\Control Panel\International\Geo\Nation ANTI-AFK.EXE Key value queried \REGISTRY\USER\S-1-5-21-3078542121-369484597-920690335-1000\Control Panel\International\Geo\Nation ANTI-AFK.EXE Key value queried \REGISTRY\USER\S-1-5-21-3078542121-369484597-920690335-1000\Control Panel\International\Geo\Nation ANTI-AFK.EXE Key value queried \REGISTRY\USER\S-1-5-21-3078542121-369484597-920690335-1000\Control Panel\International\Geo\Nation ANTI-AFK.EXE Key value queried \REGISTRY\USER\S-1-5-21-3078542121-369484597-920690335-1000\Control Panel\International\Geo\Nation ANTI-AFK.EXE Key value queried \REGISTRY\USER\S-1-5-21-3078542121-369484597-920690335-1000\Control Panel\International\Geo\Nation ANTI-AFK.EXE Key value queried \REGISTRY\USER\S-1-5-21-3078542121-369484597-920690335-1000\Control Panel\International\Geo\Nation ANTI-AFK.EXE -
Executes dropped EXE 52 IoCs
pid Process 2352 INSTALLER.EXE 5808 1.exe 1128 2.exe 5164 INSTALLER.EXE 1568 INSTALLER.EXE 4632 INSTALLER.EXE 4788 INSTALLER.EXE 5968 INSTALLER.EXE 4772 INSTALLER.EXE 4940 INSTALLER.EXE 2988 INSTALLER.EXE 3240 INSTALLER.EXE 2652 INSTALLER.EXE 2820 INSTALLER.EXE 1116 INSTALLER.EXE 3112 INSTALLER.EXE 5516 INSTALLER.EXE 3632 INSTALLER.EXE 5300 INSTALLER.EXE 3236 INSTALLER.EXE 924 INSTALLER.EXE 5340 INSTALLER.EXE 1780 INSTALLER.EXE 5460 INSTALLER.EXE 4088 INSTALLER.EXE 6032 INSTALLER.EXE 3904 INSTALLER.EXE 2448 INSTALLER.EXE 2152 INSTALLER.EXE 2344 INSTALLER.EXE 4340 INSTALLER.EXE 1196 INSTALLER.EXE 1188 INSTALLER.EXE 4736 INSTALLER.EXE 4520 INSTALLER.EXE 2824 INSTALLER.EXE 2768 INSTALLER.EXE 4776 INSTALLER.EXE 5616 INSTALLER.EXE 5856 INSTALLER.EXE 4764 INSTALLER.EXE 2360 INSTALLER.EXE 1144 INSTALLER.EXE 3216 INSTALLER.EXE 3504 INSTALLER.EXE 5796 INSTALLER.EXE 772 INSTALLER.EXE 3232 INSTALLER.EXE 4460 INSTALLER.EXE 5040 INSTALLER.EXE 3716 INSTALLER.EXE 1524 INSTALLER.EXE -
Uses the VBS compiler for execution 1 TTPs
-
Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\1.exe INSTALLER.EXE File created C:\Windows\SysWOW64\1.exe INSTALLER.EXE File created C:\Windows\SysWOW64\1.exe INSTALLER.EXE File created C:\Windows\SysWOW64\1.exe INSTALLER.EXE File created C:\Windows\SysWOW64\2.exe INSTALLER.EXE File opened for modification C:\Windows\SysWOW64\system.EXE INSTALLER.EXE File created C:\Windows\SysWOW64\1.exe INSTALLER.EXE File created C:\Windows\SysWOW64\1.exe INSTALLER.EXE File opened for modification C:\Windows\SysWOW64\system.EXE INSTALLER.EXE File created C:\Windows\SysWOW64\1.exe INSTALLER.EXE File opened for modification C:\Windows\SysWOW64\system.EXE INSTALLER.EXE File created C:\Windows\SysWOW64\1.exe INSTALLER.EXE File opened for modification C:\Windows\SysWOW64\system.EXE INSTALLER.EXE File opened for modification C:\Windows\SysWOW64\system.EXE INSTALLER.EXE File created C:\Windows\SysWOW64\1.exe INSTALLER.EXE File opened for modification C:\Windows\SysWOW64\system.EXE INSTALLER.EXE File opened for modification C:\Windows\SysWOW64\system.EXE INSTALLER.EXE File opened for modification C:\Windows\SysWOW64\system.EXE INSTALLER.EXE File created C:\Windows\SysWOW64\1.exe INSTALLER.EXE File opened for modification C:\Windows\SysWOW64\system.EXE INSTALLER.EXE File created C:\Windows\SysWOW64\1.exe INSTALLER.EXE File created C:\Windows\SysWOW64\1.exe INSTALLER.EXE File opened for modification C:\Windows\SysWOW64\system.EXE INSTALLER.EXE File opened for modification C:\Windows\SysWOW64\system.EXE INSTALLER.EXE File created C:\Windows\SysWOW64\1.exe INSTALLER.EXE File created C:\Windows\SysWOW64\1.exe INSTALLER.EXE File opened for modification C:\Windows\SysWOW64\system.EXE INSTALLER.EXE File opened for modification C:\Windows\SysWOW64\system.EXE INSTALLER.EXE File opened for modification C:\Windows\SysWOW64\system.EXE INSTALLER.EXE File opened for modification C:\Windows\SysWOW64\system.EXE INSTALLER.EXE File created C:\Windows\SysWOW64\1.exe INSTALLER.EXE File opened for modification C:\Windows\SysWOW64\system.EXE INSTALLER.EXE File opened for modification C:\Windows\SysWOW64\system.EXE INSTALLER.EXE File created C:\Windows\SysWOW64\1.exe INSTALLER.EXE File created C:\Windows\SysWOW64\1.exe INSTALLER.EXE File created C:\Windows\SysWOW64\1.exe INSTALLER.EXE File created C:\Windows\SysWOW64\1.exe INSTALLER.EXE File opened for modification C:\Windows\SysWOW64\system.EXE INSTALLER.EXE File created C:\Windows\SysWOW64\1.exe INSTALLER.EXE File created C:\Windows\SysWOW64\1.exe INSTALLER.EXE File created C:\Windows\SysWOW64\1.exe INSTALLER.EXE File created C:\Windows\SysWOW64\1.exe INSTALLER.EXE File opened for modification C:\Windows\SysWOW64\system.EXE INSTALLER.EXE File created C:\Windows\SysWOW64\1.exe INSTALLER.EXE File opened for modification C:\Windows\SysWOW64\system.EXE INSTALLER.EXE File opened for modification C:\Windows\SysWOW64\system.EXE INSTALLER.EXE File created C:\Windows\SysWOW64\1.exe INSTALLER.EXE File opened for modification C:\Windows\SysWOW64\system.EXE INSTALLER.EXE File opened for modification C:\Windows\SysWOW64\system.EXE INSTALLER.EXE File created C:\Windows\SysWOW64\1.exe INSTALLER.EXE File created C:\Windows\SysWOW64\1.exe INSTALLER.EXE File opened for modification C:\Windows\SysWOW64\system.EXE INSTALLER.EXE File created C:\Windows\SysWOW64\1.exe INSTALLER.EXE File opened for modification C:\Windows\SysWOW64\system.EXE INSTALLER.EXE File opened for modification C:\Windows\SysWOW64\system.EXE INSTALLER.EXE File created C:\Windows\SysWOW64\1.exe INSTALLER.EXE File created C:\Windows\SysWOW64\1.exe INSTALLER.EXE File created C:\Windows\SysWOW64\1.exe INSTALLER.EXE File created C:\Windows\SysWOW64\system.EXE INSTALLER.EXE File opened for modification C:\Windows\SysWOW64\system.EXE INSTALLER.EXE File opened for modification C:\Windows\SysWOW64\system.EXE INSTALLER.EXE File created C:\Windows\SysWOW64\1.exe INSTALLER.EXE File opened for modification C:\Windows\SysWOW64\system.EXE INSTALLER.EXE File opened for modification C:\Windows\SysWOW64\system.EXE INSTALLER.EXE -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 1128 set thread context of 5940 1128 2.exe 93 PID 5940 set thread context of 4820 5940 InstallUtil.exe 99 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 56 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ANTI-AFK.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ANTI-AFK.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ANTI-AFK.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ANTI-AFK.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ANTI-AFK.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ANTI-AFK.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ANTI-AFK.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ANTI-AFK.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language InstallUtil.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ANTI-AFK.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ANTI-AFK.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ANTI-AFK.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ANTI-AFK.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ANTI-AFK.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ANTI-AFK.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ANTI-AFK.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ANTI-AFK.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ANTI-AFK.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ANTI-AFK.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ANTI-AFK.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ANTI-AFK.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ANTI-AFK.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ANTI-AFK.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ANTI-AFK.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ANTI-AFK.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ANTI-AFK.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ANTI-AFK.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ANTI-AFK.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ANTI-AFK.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language INSTALLER.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language InstallUtil.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ANTI-AFK.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ANTI-AFK.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ANTI-AFK.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ANTI-AFK.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ANTI-AFK.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ANTI-AFK.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ANTI-AFK.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ANTI-AFK.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ANTI-AFK.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ANTI-AFK.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ANTI-AFK.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ANTI-AFK.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ANTI-AFK.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Anti-AFK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language INSTALLER.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ANTI-AFK.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ANTI-AFK.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ANTI-AFK.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ANTI-AFK.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ANTI-AFK.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ANTI-AFK.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ANTI-AFK.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ANTI-AFK.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ANTI-AFK.EXE -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\SYSTEM\CENTRALPROCESSOR\0 InstallUtil.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString InstallUtil.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1128 2.exe Token: SeDebugPrivilege 5940 InstallUtil.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3244 wrote to memory of 3604 3244 Anti-AFK.exe 85 PID 3244 wrote to memory of 3604 3244 Anti-AFK.exe 85 PID 3244 wrote to memory of 3604 3244 Anti-AFK.exe 85 PID 3244 wrote to memory of 2352 3244 Anti-AFK.exe 86 PID 3244 wrote to memory of 2352 3244 Anti-AFK.exe 86 PID 3244 wrote to memory of 2352 3244 Anti-AFK.exe 86 PID 2352 wrote to memory of 5808 2352 INSTALLER.EXE 88 PID 2352 wrote to memory of 5808 2352 INSTALLER.EXE 88 PID 2352 wrote to memory of 1128 2352 INSTALLER.EXE 89 PID 2352 wrote to memory of 1128 2352 INSTALLER.EXE 89 PID 2352 wrote to memory of 1128 2352 INSTALLER.EXE 89 PID 3604 wrote to memory of 5804 3604 ANTI-AFK.EXE 90 PID 3604 wrote to memory of 5804 3604 ANTI-AFK.EXE 90 PID 3604 wrote to memory of 5804 3604 ANTI-AFK.EXE 90 PID 3604 wrote to memory of 5164 3604 ANTI-AFK.EXE 91 PID 3604 wrote to memory of 5164 3604 ANTI-AFK.EXE 91 PID 3604 wrote to memory of 5164 3604 ANTI-AFK.EXE 91 PID 5804 wrote to memory of 5736 5804 ANTI-AFK.EXE 92 PID 5804 wrote to memory of 5736 5804 ANTI-AFK.EXE 92 PID 5804 wrote to memory of 5736 5804 ANTI-AFK.EXE 92 PID 1128 wrote to memory of 5940 1128 2.exe 93 PID 1128 wrote to memory of 5940 1128 2.exe 93 PID 1128 wrote to memory of 5940 1128 2.exe 93 PID 1128 wrote to memory of 5940 1128 2.exe 93 PID 1128 wrote to memory of 5940 1128 2.exe 93 PID 1128 wrote to memory of 5940 1128 2.exe 93 PID 1128 wrote to memory of 5940 1128 2.exe 93 PID 1128 wrote to memory of 5940 1128 2.exe 93 PID 1128 wrote to memory of 5940 1128 2.exe 93 PID 5804 wrote to memory of 1568 5804 ANTI-AFK.EXE 94 PID 5804 wrote to memory of 1568 5804 ANTI-AFK.EXE 94 PID 5804 wrote to memory of 1568 5804 ANTI-AFK.EXE 94 PID 5736 wrote to memory of 4560 5736 ANTI-AFK.EXE 95 PID 5736 wrote to memory of 4560 5736 ANTI-AFK.EXE 95 PID 5736 wrote to memory of 4560 5736 ANTI-AFK.EXE 95 PID 5736 wrote to memory of 4632 5736 ANTI-AFK.EXE 96 PID 5736 wrote to memory of 4632 5736 ANTI-AFK.EXE 96 PID 5736 wrote to memory of 4632 5736 ANTI-AFK.EXE 96 PID 4560 wrote to memory of 4664 4560 ANTI-AFK.EXE 97 PID 4560 wrote to memory of 4664 4560 ANTI-AFK.EXE 97 PID 4560 wrote to memory of 4664 4560 ANTI-AFK.EXE 97 PID 4560 wrote to memory of 4788 4560 ANTI-AFK.EXE 98 PID 4560 wrote to memory of 4788 4560 ANTI-AFK.EXE 98 PID 4560 wrote to memory of 4788 4560 ANTI-AFK.EXE 98 PID 5940 wrote to memory of 4820 5940 InstallUtil.exe 99 PID 5940 wrote to memory of 4820 5940 InstallUtil.exe 99 PID 5940 wrote to memory of 4820 5940 InstallUtil.exe 99 PID 5940 wrote to memory of 4820 5940 InstallUtil.exe 99 PID 5940 wrote to memory of 4820 5940 InstallUtil.exe 99 PID 5940 wrote to memory of 4820 5940 InstallUtil.exe 99 PID 5940 wrote to memory of 4820 5940 InstallUtil.exe 99 PID 5940 wrote to memory of 4820 5940 InstallUtil.exe 99 PID 4664 wrote to memory of 1168 4664 ANTI-AFK.EXE 101 PID 4664 wrote to memory of 1168 4664 ANTI-AFK.EXE 101 PID 4664 wrote to memory of 1168 4664 ANTI-AFK.EXE 101 PID 4664 wrote to memory of 5968 4664 ANTI-AFK.EXE 102 PID 4664 wrote to memory of 5968 4664 ANTI-AFK.EXE 102 PID 4664 wrote to memory of 5968 4664 ANTI-AFK.EXE 102 PID 1168 wrote to memory of 4732 1168 ANTI-AFK.EXE 103 PID 1168 wrote to memory of 4732 1168 ANTI-AFK.EXE 103 PID 1168 wrote to memory of 4732 1168 ANTI-AFK.EXE 103 PID 1168 wrote to memory of 4772 1168 ANTI-AFK.EXE 104 PID 1168 wrote to memory of 4772 1168 ANTI-AFK.EXE 104 PID 1168 wrote to memory of 4772 1168 ANTI-AFK.EXE 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\Anti-AFK.exe"C:\Users\Admin\AppData\Local\Temp\Anti-AFK.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3244 -
C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"2⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3604 -
C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"3⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5804 -
C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"4⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5736 -
C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"5⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4560 -
C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"6⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4664 -
C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"7⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1168 -
C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"8⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
PID:4732 -
C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"9⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
PID:3400 -
C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"10⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
PID:3024 -
C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"11⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
PID:3216 -
C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"12⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
PID:1068 -
C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"13⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
PID:5440 -
C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"14⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
PID:4200 -
C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"15⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
PID:5660 -
C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"16⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
PID:4356 -
C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"17⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
PID:1708 -
C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"18⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
PID:1756 -
C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"19⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
PID:5276 -
C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"20⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
PID:5776 -
C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"21⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
PID:5252 -
C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"22⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
PID:404 -
C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"23⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
PID:880 -
C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"24⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
PID:3468 -
C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"25⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
PID:1784 -
C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"26⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
PID:768 -
C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"27⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
PID:1340 -
C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"28⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
PID:468 -
C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"29⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
PID:5952 -
C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"30⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
PID:6024 -
C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"31⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
PID:1328 -
C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"32⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
PID:3268 -
C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"33⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
PID:1344 -
C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"34⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
PID:5860 -
C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"35⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
PID:4548 -
C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"36⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
PID:4720 -
C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"37⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
PID:4468 -
C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"38⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
PID:5612 -
C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"39⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
PID:4044 -
C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"40⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
PID:4828 -
C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"41⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
PID:6120 -
C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"42⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
PID:6132 -
C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"43⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
PID:1748 -
C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"44⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
PID:1656 -
C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"45⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
PID:5440 -
C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"46⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
PID:3876 -
C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"47⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
PID:5004 -
C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"48⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
PID:1652 -
C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"49⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
PID:724 -
C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"50⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
PID:5308 -
C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"51⤵
- System Location Discovery: System Language Discovery
PID:5252 -
C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"52⤵PID:1112
-
C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"53⤵PID:4156
-
C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"54⤵PID:3524
-
C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"55⤵PID:3840
-
C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"56⤵PID:3652
-
C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"57⤵PID:2416
-
C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"58⤵PID:5952
-
C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"59⤵PID:4244
-
C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"60⤵PID:2352
-
C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"61⤵PID:3560
-
C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"62⤵PID:5860
-
C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"63⤵PID:4548
-
C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"64⤵PID:2860
-
C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"65⤵PID:4744
-
C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"66⤵PID:4968
-
C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"67⤵PID:5980
-
C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"68⤵PID:1484
-
C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"69⤵PID:2660
-
C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"70⤵PID:5492
-
C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"71⤵PID:5000
-
C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"72⤵PID:1708
-
C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"73⤵PID:5044
-
C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"74⤵PID:2608
-
C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"75⤵PID:4352
-
C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"76⤵PID:264
-
C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"77⤵PID:1784
-
C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"78⤵PID:5600
-
C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"79⤵PID:5064
-
C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"80⤵PID:3244
-
C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"81⤵PID:1596
-
C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"82⤵PID:5068
-
C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"83⤵PID:4040
-
C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"84⤵PID:4992
-
C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"85⤵PID:4588
-
C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"86⤵PID:632
-
C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"87⤵PID:1996
-
C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"88⤵PID:2052
-
C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"89⤵PID:4356
-
C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"90⤵PID:1708
-
C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"91⤵PID:2924
-
C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"92⤵PID:3140
-
C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"93⤵PID:5640
-
C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"94⤵PID:4380
-
C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"95⤵PID:3384
-
C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"96⤵PID:5876
-
C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"97⤵PID:3264
-
C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"98⤵PID:4560
-
C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"99⤵PID:4768
-
C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"100⤵PID:5980
-
C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"101⤵PID:3032
-
C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"102⤵PID:2928
-
C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"103⤵PID:724
-
C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"104⤵PID:4252
-
C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"105⤵PID:852
-
C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"106⤵PID:3120
-
C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"107⤵PID:2584
-
C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"108⤵PID:5952
-
C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"109⤵PID:5984
-
C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"110⤵PID:2952
-
C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"111⤵PID:1460
-
C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"112⤵PID:928
-
C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"113⤵PID:4652
-
C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"114⤵PID:644
-
C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"115⤵PID:4300
-
C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"116⤵PID:3288
-
C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"117⤵PID:920
-
C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"118⤵PID:4404
-
C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"119⤵PID:5952
-
C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"120⤵PID:4560
-
C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"121⤵PID:4068
-
C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"C:\Users\Admin\AppData\Local\Temp\ANTI-AFK.EXE"122⤵PID:928
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-