Windows Analysis Report
Aimbot.exe

Overview

General Information

Sample name: Aimbot.exe
Analysis ID: 1431572
MD5: b121a204d1da912895072b38471e6165
SHA1: 4d0d7ae81f2b4713a313b16d48aaa89eedce9492
SHA256: 54d1845b815984ae78d8dc18c6bb75b2249d49b60048fd8d3de4352c0f459b38
Tags: exeRansomware
Infos:

Detection

Score: 32
Range: 0 - 100
Whitelisted: false
Confidence: 0%

Signatures

Found pyInstaller with non standard icon
Contains functionality for read data from the clipboard
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to check if a window is minimized (may be used to check if an application is visible)
Contains functionality to dynamically determine API calls
Contains functionality to modify clipboard data
Contains functionality to query CPU information (cpuid)
Contains functionality to query locales information (e.g. system language)
Contains functionality to read the clipboard data
Contains functionality to retrieve information about pressed keystrokes
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Drops PE files
Extensive use of GetProcAddress (often used to hide API calls)
Found dropped PE file which has not been started or loaded
Found evasive API chain checking for process token information
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
PE file contains executable resources (Code or Archives)
PE file contains more sections than normal
PE file contains sections with non-standard names
PE file does not import any functions
Potential key logger detected (key state polling based)
Queries the volume information (name, serial number etc) of a device
Sample file is different than original file name gathered from version info

Classification

Source: Aimbot.exe, 00000001.00000002.2910091904.000001C6894E4000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: -----BEGIN PUBLIC KEY----- memstr_f87e303b-8
Source: Aimbot.exe Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
Source: Binary string: D:\a\1\b\bin\amd64\select.pdb source: Aimbot.exe, 00000000.00000003.1671751784.0000020132766000.00000004.00000020.00020000.00000000.sdmp, Aimbot.exe, 00000001.00000002.2916798867.00007FFE148E3000.00000002.00000001.01000000.0000000E.sdmp, select.pyd.0.dr
Source: Binary string: D:\a\1\b\bin\amd64\python312.pdb source: Aimbot.exe, 00000001.00000002.2914645148.00007FFDFB812000.00000002.00000001.01000000.00000004.sdmp
Source: Binary string: D:\a\1\b\libcrypto-3.pdb| source: Aimbot.exe, 00000001.00000002.2913131498.00007FFDFAAF1000.00000002.00000001.01000000.00000010.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_hashlib.pdb source: Aimbot.exe, 00000000.00000003.1663107498.000002013275D000.00000004.00000020.00020000.00000000.sdmp, Aimbot.exe, 00000001.00000002.2915760786.00007FFE11EB7000.00000002.00000001.01000000.0000000F.sdmp, _hashlib.pyd.0.dr
Source: Binary string: D:\a\1\b\bin\amd64\_decimal.pdb$$ source: _decimal.pyd.0.dr
Source: Binary string: crypto\engine\tb_digest.cENGINE_get_digestcrypto\buffer\buffer.cBUF_MEM_growBUF_MEM_grow_cleancrypto\packet.ccompiler: cl /Zi /Fdossl_static.pdb /MT /Zl /Gs0 /GF /Gy /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG";CPUINFO: OPENSSL_ia32cap=0x%llx:0x%llxOPENSSL_ia32cap env:%sos-specific.dllCPUINFO: crypto\initthread.cOPENSSL_ia32cap source: Aimbot.exe, 00000001.00000002.2913893772.00007FFDFB0E8000.00000002.00000001.01000000.0000000B.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_lzma.pdbNN source: Aimbot.exe, 00000000.00000003.1663264315.000002013275D000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: tRSA_PRIME_INFOeqdmp1dmq1iqmpprime_infosRSAPrivateKeyRSAPublicKeyhashAlgorithmmaskGenAlgorithmsaltLengthtrailerFieldRSA_PSS_PARAMShashFuncmaskGenFuncpSourceFuncRSA_OAEP_PARAMScompiler: cl /Zi /Fdossl_static.pdb /MT /Zl /Gs0 /GF /Gy /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG"3.2.1built on: Fri Feb 23 00:13:44 2024 UTCplatform: VC-WIN64AOPENSSLDIR: "C:\Program Files\Common Files\SSL"ENGINESDIR: "C:\Program Files\OpenSSL\lib\engines-3"MODULESDIR: "C:\Program Files\OpenSSL\lib\ossl-modules"CPUINFO: N/Anot availablecrypto\init.cOPENSSL_init_cryptocrypto\bio\bio_lib.cBIO_new_exbio_read_internbio_write_internBIO_sendmmsgBIO_recvmmsgBIO_putsBIO_getsBIO_get_line BIO_ctrlBIO_callback_ctrlBIO_find_type source: Aimbot.exe, 00000001.00000002.2913893772.00007FFDFB0E8000.00000002.00000001.01000000.0000000B.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_decimal.pdb source: _decimal.pyd.0.dr
Source: Binary string: C:\Users\runneradmin\AppData\Local\Temp\pip-req-build-csg7dlje\src\rust\target\release\deps\cryptography_rust.pdb source: Aimbot.exe, 00000001.00000002.2913893772.00007FFDFB0E8000.00000002.00000001.01000000.0000000B.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_lzma.pdb source: Aimbot.exe, 00000000.00000003.1663264315.000002013275D000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_bz2.pdb source: Aimbot.exe, 00000000.00000003.1662224656.000002013275D000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: @ compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG"OpenSSL 3.0.13 30 Jan 20243.0.13built on: Mon Feb 5 17:39:09 2024 UTCplatform: VC-WIN64A-masmOPENSSLDIR: "C:\Program Files\Common Files\SSL"ENGINESDIR: "C:\Program Files\OpenSSL\lib\engines-3"MODULESDIR: "C:\Program Files\OpenSSL\lib\ossl-modules"CPUINFO: N/Anot availableget_and_lock..\s\crypto\ex_data.cossl_crypto_get_ex_new_index_exossl_crypto_new_ex_data_exCRYPTO_dup_ex_dataCRYPTO_set_ex_dataOPENSSL_WIN32_UTF8..\s\crypto\getenv.ccompiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG";CPUINFO: OPENSSL_ia32cap=0x%llx:0x%llxOPENSSL_ia32cap env:%sos-specificC:\Program Files\Common Files\SSLC:\Program Files\OpenSSL\lib\ossl-modules.dllCPUINFO: ..\s\crypto\init.cOPENSSL_init_cryptoOPENSSL_atexit..\s\crypto\initthread.c..\s\crypto\mem_sec.cassertion failed: (bit & 1) == 0assertion failed: list >= 0 && list < sh.freelist_sizeassertion failed: ((ptr - sh.arena) & ((sh.arena_size >> list) - 1)) == 0assertion failed: bit > 0 && bit < sh.bittable_sizeassertion failed: TESTBIT(table, bit)assertion failed: !TESTBIT(table, bit)assertion failed: WITHIN_FREELIST(list)assertion failed: WITHIN_ARENA(ptr)assertion failed: temp->next == NULL || WITHIN_ARENA(temp->next)assertion failed: (char **)temp->next->p_next == listassertion failed: WITHIN_FREELIST(temp2->p_next) || WITHIN_ARENA(temp2->p_next)assertion failed: size > 0assertion failed: (size & (size - 1)) == 0assertion failed: (minsize & (minsize - 1)) == 0assertion failed: sh.freelist != NULLassertion failed: sh.bittable != NULLassertion failed: sh.bitmalloc != NULLassertion failed: !sh_testbit(temp, slist, sh.bitmalloc)assertion failed: temp != sh.freelist[slist]assertion failed: sh.freelist[slist] == tempassertion failed: temp-(sh.arena_size >> slist) == sh_find_my_buddy(temp, slist)assertion failed: sh_testbit(chunk, list, sh.bittable)assertion failed: WITHIN_ARENA(chunk)assertion failed: sh_testbit(ptr, list, sh.bittable)assertion failed: ptr == sh_find_my_buddy(buddy, list)assertion failed: ptr != NULLassertion failed: !sh_testbit(ptr, list, sh.bitmalloc)assertion failed: sh.freelist[list] == ptr/*0123456789ABCDEFCRYPTO_memdup..\s\crypto\o_str.chexstr2buf_sepossl_hexstr2buf_sepbuf2hexstr_sepossl_buf2hexstr_sep..\s\crypto\packet.cwpacket_intern_init_lenWPACKET_start_sub_packet_len__..\s\crypto\param_build.cparam_pushparam_push_numOSSL_PARAM_BLD_push_BN_padNegative big numbers are unsupported for OSSL_PARAMOSSL_PARAM_BLD_push_utf8_stringOSSL_PARAM_BLD_push_utf8_ptrOSSL_PARAM_BLD_push_octet_stringOSSL_PARAM_BLD_
Source: Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdb source: Aimbot.exe, 00000000.00000003.1662087768.000002013275D000.00000004.00000020.00020000.00000000.sdmp, Aimbot.exe, 00000001.00000002.2916569171.00007FFE13313000.00000002.00000001.01000000.00000005.sdmp, VCRUNTIME140.dll.0.dr
Source: Binary string: C:\Users\runneradmin\AppData\Local\Temp\pip-req-build-csg7dlje\src\rust\target\release\deps\cryptography_rust.pdbo source: Aimbot.exe, 00000001.00000002.2913893772.00007FFDFB0E8000.00000002.00000001.01000000.0000000B.sdmp
Source: Binary string: compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG" source: Aimbot.exe, 00000001.00000002.2913131498.00007FFDFAA59000.00000002.00000001.01000000.00000010.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_tkinter.pdb source: Aimbot.exe, 00000000.00000003.1663538195.000002013275D000.00000004.00000020.00020000.00000000.sdmp, Aimbot.exe, 00000001.00000002.2916422110.00007FFE13238000.00000002.00000001.01000000.00000007.sdmp
Source: Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdbGCTL source: Aimbot.exe, 00000000.00000003.1662087768.000002013275D000.00000004.00000020.00020000.00000000.sdmp, Aimbot.exe, 00000001.00000002.2916569171.00007FFE13313000.00000002.00000001.01000000.00000005.sdmp, VCRUNTIME140.dll.0.dr
Source: Binary string: D:\a\1\b\libcrypto-3.pdb source: Aimbot.exe, 00000001.00000002.2913131498.00007FFDFAAF1000.00000002.00000001.01000000.00000010.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_socket.pdb source: Aimbot.exe, 00000000.00000003.1663406733.000002013275D000.00000004.00000020.00020000.00000000.sdmp, Aimbot.exe, 00000001.00000002.2915901227.00007FFE11ED9000.00000002.00000001.01000000.0000000D.sdmp, _socket.pyd.0.dr
Source: Binary string: D:\a\1\b\bin\amd64\python3.pdb source: Aimbot.exe, 00000000.00000003.1669451270.0000020132766000.00000004.00000020.00020000.00000000.sdmp, Aimbot.exe, 00000001.00000002.2910062502.000001C689150000.00000002.00000001.01000000.00000006.sdmp
Source: Binary string: compiler: cl /Zi /Fdossl_static.pdb /MT /Zl /Gs0 /GF /Gy /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG" source: Aimbot.exe, 00000001.00000002.2913893772.00007FFDFB0E8000.00000002.00000001.01000000.0000000B.sdmp
Source: C:\Users\user\Desktop\Aimbot.exe Code function: 0_2_00007FF74B4D8D00 FindFirstFileExW,FindClose, 0_2_00007FF74B4D8D00
Source: C:\Users\user\Desktop\Aimbot.exe Code function: 0_2_00007FF74B4E8670 _invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_invalid_parameter_noinfo,FindNextFileW,GetLastError, 0_2_00007FF74B4E8670
Source: C:\Users\user\Desktop\Aimbot.exe Code function: 0_2_00007FF74B4E8670 _invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_invalid_parameter_noinfo,FindNextFileW,GetLastError, 0_2_00007FF74B4E8670
Source: C:\Users\user\Desktop\Aimbot.exe Code function: 0_2_00007FF74B4F26C4 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose, 0_2_00007FF74B4F26C4
Source: C:\Users\user\Desktop\Aimbot.exe File opened: C:\Users\user\AppData\Local\Temp\ Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe File opened: C:\Users\user\AppData\Local\ Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe File opened: C:\Users\user\AppData\ Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe File opened: C:\Users\user\AppData\Local\Temp\_MEI73442\ Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe File opened: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl\ Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe File opened: C:\Users\user\ Jump to behavior
Source: Aimbot.exe, 00000000.00000002.2908628806.000002013276E000.00000004.00000020.00020000.00000000.sdmp, Aimbot.exe, 00000000.00000003.1723516414.0000020132761000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://cacerts.digicert.co
Source: Aimbot.exe, 00000000.00000003.1672886748.000002013276D000.00000004.00000020.00020000.00000000.sdmp, Aimbot.exe, 00000000.00000003.1663538195.000002013275D000.00000004.00000020.00020000.00000000.sdmp, Aimbot.exe, 00000000.00000003.1668088239.000002013276D000.00000004.00000020.00020000.00000000.sdmp, Aimbot.exe, 00000000.00000003.1672127130.000002013276D000.00000004.00000020.00020000.00000000.sdmp, Aimbot.exe, 00000000.00000003.1669476901.0000020132760000.00000004.00000020.00020000.00000000.sdmp, Aimbot.exe, 00000000.00000002.2908628806.000002013276E000.00000004.00000020.00020000.00000000.sdmp, Aimbot.exe, 00000000.00000003.1672097559.0000020132766000.00000004.00000020.00020000.00000000.sdmp, Aimbot.exe, 00000000.00000003.1662224656.000002013275D000.00000004.00000020.00020000.00000000.sdmp, Aimbot.exe, 00000000.00000003.1663406733.000002013275D000.00000004.00000020.00020000.00000000.sdmp, Aimbot.exe, 00000000.00000003.1670270253.0000020132760000.00000004.00000020.00020000.00000000.sdmp, Aimbot.exe, 00000000.00000003.1668157588.000002013276D000.00000004.00000020.00020000.00000000.sdmp, Aimbot.exe, 00000000.00000003.1671778196.0000020132760000.00000004.00000020.00020000.00000000.sdmp, Aimbot.exe, 00000000.00000003.1663264315.000002013275D000.00000004.00000020.00020000.00000000.sdmp, Aimbot.exe, 00000000.00000003.1668157588.0000020132760000.00000004.00000020.00020000.00000000.sdmp, Aimbot.exe, 00000000.00000003.1669451270.0000020132766000.00000004.00000020.00020000.00000000.sdmp, Aimbot.exe, 00000000.00000003.1669476901.000002013276D000.00000004.00000020.00020000.00000000.sdmp, Aimbot.exe, 00000000.00000003.1663107498.000002013275D000.00000004.00000020.00020000.00000000.sdmp, Aimbot.exe, 00000000.00000003.1671778196.000002013276D000.00000004.00000020.00020000.00000000.sdmp, Aimbot.exe, 00000000.00000003.1723516414.0000020132761000.00000004.00000020.00020000.00000000.sdmp, Aimbot.exe, 00000000.00000003.1670225045.0000020132766000.00000004.00000020.00020000.00000000.sdmp, Aimbot.exe, 00000000.00000003.1662912486.000002013275D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: Aimbot.exe, 00000000.00000003.1663538195.000002013275D000.00000004.00000020.00020000.00000000.sdmp, Aimbot.exe, 00000000.00000003.1669476901.0000020132760000.00000004.00000020.00020000.00000000.sdmp, Aimbot.exe, 00000000.00000003.1672097559.0000020132766000.00000004.00000020.00020000.00000000.sdmp, Aimbot.exe, 00000000.00000003.1662224656.000002013275D000.00000004.00000020.00020000.00000000.sdmp, Aimbot.exe, 00000000.00000003.1663406733.000002013275D000.00000004.00000020.00020000.00000000.sdmp, Aimbot.exe, 00000000.00000003.1670270253.0000020132760000.00000004.00000020.00020000.00000000.sdmp, Aimbot.exe, 00000000.00000003.1668088239.0000020132766000.00000004.00000020.00020000.00000000.sdmp, Aimbot.exe, 00000000.00000003.1671778196.0000020132760000.00000004.00000020.00020000.00000000.sdmp, Aimbot.exe, 00000000.00000003.1663264315.000002013275D000.00000004.00000020.00020000.00000000.sdmp, Aimbot.exe, 00000000.00000003.1668157588.0000020132760000.00000004.00000020.00020000.00000000.sdmp, Aimbot.exe, 00000000.00000003.1669451270.0000020132766000.00000004.00000020.00020000.00000000.sdmp, Aimbot.exe, 00000000.00000003.1669476901.000002013276D000.00000004.00000020.00020000.00000000.sdmp, Aimbot.exe, 00000000.00000003.1663107498.000002013275D000.00000004.00000020.00020000.00000000.sdmp, Aimbot.exe, 00000000.00000003.1723516414.0000020132761000.00000004.00000020.00020000.00000000.sdmp, Aimbot.exe, 00000000.00000003.1670225045.0000020132766000.00000004.00000020.00020000.00000000.sdmp, Aimbot.exe, 00000000.00000003.1662912486.000002013275D000.00000004.00000020.00020000.00000000.sdmp, Aimbot.exe, 00000000.00000003.1671751784.0000020132766000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _decimal.pyd.0.dr, _socket.pyd.0.dr, _hashlib.pyd.0.dr String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: Aimbot.exe, 00000000.00000003.1663538195.000002013275D000.00000004.00000020.00020000.00000000.sdmp, Aimbot.exe, 00000000.00000003.1669476901.0000020132760000.00000004.00000020.00020000.00000000.sdmp, Aimbot.exe, 00000000.00000003.1662224656.000002013275D000.00000004.00000020.00020000.00000000.sdmp, Aimbot.exe, 00000000.00000003.1663406733.000002013275D000.00000004.00000020.00020000.00000000.sdmp, Aimbot.exe, 00000000.00000003.1670270253.0000020132760000.00000004.00000020.00020000.00000000.sdmp, Aimbot.exe, 00000000.00000003.1668088239.0000020132766000.00000004.00000020.00020000.00000000.sdmp, Aimbot.exe, 00000000.00000003.1663264315.000002013275D000.00000004.00000020.00020000.00000000.sdmp, Aimbot.exe, 00000000.00000003.1668157588.0000020132760000.00000004.00000020.00020000.00000000.sdmp, Aimbot.exe, 00000000.00000003.1669451270.0000020132766000.00000004.00000020.00020000.00000000.sdmp, Aimbot.exe, 00000000.00000003.1663107498.000002013275D000.00000004.00000020.00020000.00000000.sdmp, Aimbot.exe, 00000000.00000003.1723516414.0000020132761000.00000004.00000020.00020000.00000000.sdmp, Aimbot.exe, 00000000.00000003.1670225045.0000020132766000.00000004.00000020.00020000.00000000.sdmp, Aimbot.exe, 00000000.00000003.1662912486.000002013275D000.00000004.00000020.00020000.00000000.sdmp, Aimbot.exe, 00000000.00000003.1672127130.0000020132760000.00000004.00000020.00020000.00000000.sdmp, Aimbot.exe, 00000000.00000003.1671751784.0000020132766000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _decimal.pyd.0.dr, _socket.pyd.0.dr, _hashlib.pyd.0.dr, tcl86t.dll.0.dr String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: Aimbot.exe, 00000000.00000003.1672886748.000002013276D000.00000004.00000020.00020000.00000000.sdmp, Aimbot.exe, 00000000.00000003.1663538195.000002013275D000.00000004.00000020.00020000.00000000.sdmp, Aimbot.exe, 00000000.00000003.1668088239.000002013276D000.00000004.00000020.00020000.00000000.sdmp, Aimbot.exe, 00000000.00000003.1672127130.000002013276D000.00000004.00000020.00020000.00000000.sdmp, Aimbot.exe, 00000000.00000003.1669476901.0000020132760000.00000004.00000020.00020000.00000000.sdmp, Aimbot.exe, 00000000.00000002.2908628806.000002013276E000.00000004.00000020.00020000.00000000.sdmp, Aimbot.exe, 00000000.00000003.1672097559.0000020132766000.00000004.00000020.00020000.00000000.sdmp, Aimbot.exe, 00000000.00000003.1662224656.000002013275D000.00000004.00000020.00020000.00000000.sdmp, Aimbot.exe, 00000000.00000003.1663406733.000002013275D000.00000004.00000020.00020000.00000000.sdmp, Aimbot.exe, 00000000.00000003.1670270253.0000020132760000.00000004.00000020.00020000.00000000.sdmp, Aimbot.exe, 00000000.00000003.1668088239.0000020132766000.00000004.00000020.00020000.00000000.sdmp, Aimbot.exe, 00000000.00000003.1668157588.000002013276D000.00000004.00000020.00020000.00000000.sdmp, Aimbot.exe, 00000000.00000003.1671778196.0000020132760000.00000004.00000020.00020000.00000000.sdmp, Aimbot.exe, 00000000.00000003.1663264315.000002013275D000.00000004.00000020.00020000.00000000.sdmp, Aimbot.exe, 00000000.00000003.1668157588.0000020132760000.00000004.00000020.00020000.00000000.sdmp, Aimbot.exe, 00000000.00000003.1669451270.0000020132766000.00000004.00000020.00020000.00000000.sdmp, Aimbot.exe, 00000000.00000003.1669476901.000002013276D000.00000004.00000020.00020000.00000000.sdmp, Aimbot.exe, 00000000.00000003.1663107498.000002013275D000.00000004.00000020.00020000.00000000.sdmp, Aimbot.exe, 00000000.00000003.1671778196.000002013276D000.00000004.00000020.00020000.00000000.sdmp, Aimbot.exe, 00000000.00000003.1723516414.0000020132761000.00000004.00000020.00020000.00000000.sdmp, Aimbot.exe, 00000000.00000003.1670225045.0000020132766000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: Aimbot.exe, 00000000.00000003.1672886748.000002013276D000.00000004.00000020.00020000.00000000.sdmp, Aimbot.exe, 00000000.00000003.1663538195.000002013275D000.00000004.00000020.00020000.00000000.sdmp, Aimbot.exe, 00000000.00000003.1668088239.000002013276D000.00000004.00000020.00020000.00000000.sdmp, Aimbot.exe, 00000000.00000003.1672127130.000002013276D000.00000004.00000020.00020000.00000000.sdmp, Aimbot.exe, 00000000.00000003.1669476901.0000020132760000.00000004.00000020.00020000.00000000.sdmp, Aimbot.exe, 00000000.00000002.2908628806.000002013276E000.00000004.00000020.00020000.00000000.sdmp, Aimbot.exe, 00000000.00000003.1672097559.0000020132766000.00000004.00000020.00020000.00000000.sdmp, Aimbot.exe, 00000000.00000003.1662224656.000002013275D000.00000004.00000020.00020000.00000000.sdmp, Aimbot.exe, 00000000.00000003.1663406733.000002013275D000.00000004.00000020.00020000.00000000.sdmp, Aimbot.exe, 00000000.00000003.1670270253.0000020132760000.00000004.00000020.00020000.00000000.sdmp, Aimbot.exe, 00000000.00000003.1668157588.000002013276D000.00000004.00000020.00020000.00000000.sdmp, Aimbot.exe, 00000000.00000003.1671778196.0000020132760000.00000004.00000020.00020000.00000000.sdmp, Aimbot.exe, 00000000.00000003.1663264315.000002013275D000.00000004.00000020.00020000.00000000.sdmp, Aimbot.exe, 00000000.00000003.1668157588.0000020132760000.00000004.00000020.00020000.00000000.sdmp, Aimbot.exe, 00000000.00000003.1669451270.0000020132766000.00000004.00000020.00020000.00000000.sdmp, Aimbot.exe, 00000000.00000003.1669476901.000002013276D000.00000004.00000020.00020000.00000000.sdmp, Aimbot.exe, 00000000.00000003.1663107498.000002013275D000.00000004.00000020.00020000.00000000.sdmp, Aimbot.exe, 00000000.00000003.1671778196.000002013276D000.00000004.00000020.00020000.00000000.sdmp, Aimbot.exe, 00000000.00000003.1723516414.0000020132761000.00000004.00000020.00020000.00000000.sdmp, Aimbot.exe, 00000000.00000003.1670225045.0000020132766000.00000004.00000020.00020000.00000000.sdmp, Aimbot.exe, 00000000.00000003.1662912486.000002013275D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: Aimbot.exe, 00000000.00000003.1663538195.000002013275D000.00000004.00000020.00020000.00000000.sdmp, Aimbot.exe, 00000000.00000003.1669476901.0000020132760000.00000004.00000020.00020000.00000000.sdmp, Aimbot.exe, 00000000.00000002.2908628806.000002013276E000.00000004.00000020.00020000.00000000.sdmp, Aimbot.exe, 00000000.00000003.1672097559.0000020132766000.00000004.00000020.00020000.00000000.sdmp, Aimbot.exe, 00000000.00000003.1662224656.000002013275D000.00000004.00000020.00020000.00000000.sdmp, Aimbot.exe, 00000000.00000003.1663406733.000002013275D000.00000004.00000020.00020000.00000000.sdmp, Aimbot.exe, 00000000.00000003.1670270253.0000020132760000.00000004.00000020.00020000.00000000.sdmp, Aimbot.exe, 00000000.00000003.1668088239.0000020132766000.00000004.00000020.00020000.00000000.sdmp, Aimbot.exe, 00000000.00000003.1671778196.0000020132760000.00000004.00000020.00020000.00000000.sdmp, Aimbot.exe, 00000000.00000003.1663264315.000002013275D000.00000004.00000020.00020000.00000000.sdmp, Aimbot.exe, 00000000.00000003.1668157588.0000020132760000.00000004.00000020.00020000.00000000.sdmp, Aimbot.exe, 00000000.00000003.1669451270.0000020132766000.00000004.00000020.00020000.00000000.sdmp, Aimbot.exe, 00000000.00000003.1669476901.000002013276D000.00000004.00000020.00020000.00000000.sdmp, Aimbot.exe, 00000000.00000003.1663107498.000002013275D000.00000004.00000020.00020000.00000000.sdmp, Aimbot.exe, 00000000.00000003.1723516414.0000020132761000.00000004.00000020.00020000.00000000.sdmp, Aimbot.exe, 00000000.00000003.1670225045.0000020132766000.00000004.00000020.00020000.00000000.sdmp, Aimbot.exe, 00000000.00000003.1662912486.000002013275D000.00000004.00000020.00020000.00000000.sdmp, Aimbot.exe, 00000000.00000003.1671751784.0000020132766000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _decimal.pyd.0.dr, _socket.pyd.0.dr String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: Aimbot.exe, 00000000.00000003.1663538195.000002013275D000.00000004.00000020.00020000.00000000.sdmp, Aimbot.exe, 00000000.00000003.1669476901.0000020132760000.00000004.00000020.00020000.00000000.sdmp, Aimbot.exe, 00000000.00000003.1662224656.000002013275D000.00000004.00000020.00020000.00000000.sdmp, Aimbot.exe, 00000000.00000003.1663406733.000002013275D000.00000004.00000020.00020000.00000000.sdmp, Aimbot.exe, 00000000.00000003.1670270253.0000020132760000.00000004.00000020.00020000.00000000.sdmp, Aimbot.exe, 00000000.00000003.1668088239.0000020132766000.00000004.00000020.00020000.00000000.sdmp, Aimbot.exe, 00000000.00000003.1663264315.000002013275D000.00000004.00000020.00020000.00000000.sdmp, Aimbot.exe, 00000000.00000003.1668157588.0000020132760000.00000004.00000020.00020000.00000000.sdmp, Aimbot.exe, 00000000.00000003.1669451270.0000020132766000.00000004.00000020.00020000.00000000.sdmp, Aimbot.exe, 00000000.00000003.1663107498.000002013275D000.00000004.00000020.00020000.00000000.sdmp, Aimbot.exe, 00000000.00000003.1723516414.0000020132761000.00000004.00000020.00020000.00000000.sdmp, Aimbot.exe, 00000000.00000003.1670225045.0000020132766000.00000004.00000020.00020000.00000000.sdmp, Aimbot.exe, 00000000.00000003.1662912486.000002013275D000.00000004.00000020.00020000.00000000.sdmp, Aimbot.exe, 00000000.00000003.1672127130.0000020132760000.00000004.00000020.00020000.00000000.sdmp, Aimbot.exe, 00000000.00000003.1671751784.0000020132766000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _decimal.pyd.0.dr, _socket.pyd.0.dr, _hashlib.pyd.0.dr, tcl86t.dll.0.dr String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: Aimbot.exe, 00000000.00000003.1663538195.000002013275D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.c
Source: tcl86t.dll.0.dr String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: Aimbot.exe, 00000000.00000003.1663538195.000002013275D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.ct
Source: Aimbot.exe, 00000000.00000003.1663538195.000002013275D000.00000004.00000020.00020000.00000000.sdmp, Aimbot.exe, 00000000.00000003.1669476901.0000020132760000.00000004.00000020.00020000.00000000.sdmp, Aimbot.exe, 00000000.00000002.2908628806.000002013276E000.00000004.00000020.00020000.00000000.sdmp, Aimbot.exe, 00000000.00000003.1672097559.0000020132766000.00000004.00000020.00020000.00000000.sdmp, Aimbot.exe, 00000000.00000003.1662224656.000002013275D000.00000004.00000020.00020000.00000000.sdmp, Aimbot.exe, 00000000.00000003.1663406733.000002013275D000.00000004.00000020.00020000.00000000.sdmp, Aimbot.exe, 00000000.00000003.1670270253.0000020132760000.00000004.00000020.00020000.00000000.sdmp, Aimbot.exe, 00000000.00000003.1668088239.0000020132766000.00000004.00000020.00020000.00000000.sdmp, Aimbot.exe, 00000000.00000003.1671778196.0000020132760000.00000004.00000020.00020000.00000000.sdmp, Aimbot.exe, 00000000.00000003.1663264315.000002013275D000.00000004.00000020.00020000.00000000.sdmp, Aimbot.exe, 00000000.00000003.1668157588.0000020132760000.00000004.00000020.00020000.00000000.sdmp, Aimbot.exe, 00000000.00000003.1669451270.0000020132766000.00000004.00000020.00020000.00000000.sdmp, Aimbot.exe, 00000000.00000003.1669476901.000002013276D000.00000004.00000020.00020000.00000000.sdmp, Aimbot.exe, 00000000.00000003.1663107498.000002013275D000.00000004.00000020.00020000.00000000.sdmp, Aimbot.exe, 00000000.00000003.1723516414.0000020132761000.00000004.00000020.00020000.00000000.sdmp, Aimbot.exe, 00000000.00000003.1670225045.0000020132766000.00000004.00000020.00020000.00000000.sdmp, Aimbot.exe, 00000000.00000003.1662912486.000002013275D000.00000004.00000020.00020000.00000000.sdmp, Aimbot.exe, 00000000.00000003.1671751784.0000020132766000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _decimal.pyd.0.dr, _socket.pyd.0.dr String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: Aimbot.exe, 00000000.00000003.1663538195.000002013275D000.00000004.00000020.00020000.00000000.sdmp, Aimbot.exe, 00000000.00000003.1669476901.0000020132760000.00000004.00000020.00020000.00000000.sdmp, Aimbot.exe, 00000000.00000002.2908628806.000002013276E000.00000004.00000020.00020000.00000000.sdmp, Aimbot.exe, 00000000.00000003.1672097559.0000020132766000.00000004.00000020.00020000.00000000.sdmp, Aimbot.exe, 00000000.00000003.1662224656.000002013275D000.00000004.00000020.00020000.00000000.sdmp, Aimbot.exe, 00000000.00000003.1663406733.000002013275D000.00000004.00000020.00020000.00000000.sdmp, Aimbot.exe, 00000000.00000003.1670270253.0000020132760000.00000004.00000020.00020000.00000000.sdmp, Aimbot.exe, 00000000.00000003.1668088239.0000020132766000.00000004.00000020.00020000.00000000.sdmp, Aimbot.exe, 00000000.00000003.1671778196.0000020132760000.00000004.00000020.00020000.00000000.sdmp, Aimbot.exe, 00000000.00000003.1663264315.000002013275D000.00000004.00000020.00020000.00000000.sdmp, Aimbot.exe, 00000000.00000003.1668157588.0000020132760000.00000004.00000020.00020000.00000000.sdmp, Aimbot.exe, 00000000.00000003.1669451270.0000020132766000.00000004.00000020.00020000.00000000.sdmp, Aimbot.exe, 00000000.00000003.1669476901.000002013276D000.00000004.00000020.00020000.00000000.sdmp, Aimbot.exe, 00000000.00000003.1663107498.000002013275D000.00000004.00000020.00020000.00000000.sdmp, Aimbot.exe, 00000000.00000003.1723516414.0000020132761000.00000004.00000020.00020000.00000000.sdmp, Aimbot.exe, 00000000.00000003.1670225045.0000020132766000.00000004.00000020.00020000.00000000.sdmp, Aimbot.exe, 00000000.00000003.1662912486.000002013275D000.00000004.00000020.00020000.00000000.sdmp, Aimbot.exe, 00000000.00000003.1671751784.0000020132766000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _decimal.pyd.0.dr, _socket.pyd.0.dr String found in binary or memory: http://ocsp.digicert.com0
Source: Aimbot.exe, 00000000.00000003.1672886748.000002013276D000.00000004.00000020.00020000.00000000.sdmp, Aimbot.exe, 00000000.00000003.1663538195.000002013275D000.00000004.00000020.00020000.00000000.sdmp, Aimbot.exe, 00000000.00000003.1668088239.000002013276D000.00000004.00000020.00020000.00000000.sdmp, Aimbot.exe, 00000000.00000003.1672127130.000002013276D000.00000004.00000020.00020000.00000000.sdmp, Aimbot.exe, 00000000.00000003.1669476901.0000020132760000.00000004.00000020.00020000.00000000.sdmp, Aimbot.exe, 00000000.00000002.2908628806.000002013276E000.00000004.00000020.00020000.00000000.sdmp, Aimbot.exe, 00000000.00000003.1672097559.0000020132766000.00000004.00000020.00020000.00000000.sdmp, Aimbot.exe, 00000000.00000003.1662224656.000002013275D000.00000004.00000020.00020000.00000000.sdmp, Aimbot.exe, 00000000.00000003.1663406733.000002013275D000.00000004.00000020.00020000.00000000.sdmp, Aimbot.exe, 00000000.00000003.1670270253.0000020132760000.00000004.00000020.00020000.00000000.sdmp, Aimbot.exe, 00000000.00000003.1668088239.0000020132766000.00000004.00000020.00020000.00000000.sdmp, Aimbot.exe, 00000000.00000003.1668157588.000002013276D000.00000004.00000020.00020000.00000000.sdmp, Aimbot.exe, 00000000.00000003.1671778196.0000020132760000.00000004.00000020.00020000.00000000.sdmp, Aimbot.exe, 00000000.00000003.1663264315.000002013275D000.00000004.00000020.00020000.00000000.sdmp, Aimbot.exe, 00000000.00000003.1668157588.0000020132760000.00000004.00000020.00020000.00000000.sdmp, Aimbot.exe, 00000000.00000003.1669451270.0000020132766000.00000004.00000020.00020000.00000000.sdmp, Aimbot.exe, 00000000.00000003.1669476901.000002013276D000.00000004.00000020.00020000.00000000.sdmp, Aimbot.exe, 00000000.00000003.1663107498.000002013275D000.00000004.00000020.00020000.00000000.sdmp, Aimbot.exe, 00000000.00000003.1671778196.000002013276D000.00000004.00000020.00020000.00000000.sdmp, Aimbot.exe, 00000000.00000003.1723516414.0000020132761000.00000004.00000020.00020000.00000000.sdmp, Aimbot.exe, 00000000.00000003.1670225045.0000020132766000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.digicert.com0A
Source: Aimbot.exe, 00000000.00000003.1672886748.000002013276D000.00000004.00000020.00020000.00000000.sdmp, Aimbot.exe, 00000000.00000003.1663538195.000002013275D000.00000004.00000020.00020000.00000000.sdmp, Aimbot.exe, 00000000.00000003.1668088239.000002013276D000.00000004.00000020.00020000.00000000.sdmp, Aimbot.exe, 00000000.00000003.1672127130.000002013276D000.00000004.00000020.00020000.00000000.sdmp, Aimbot.exe, 00000000.00000003.1669476901.0000020132760000.00000004.00000020.00020000.00000000.sdmp, Aimbot.exe, 00000000.00000002.2908628806.000002013276E000.00000004.00000020.00020000.00000000.sdmp, Aimbot.exe, 00000000.00000003.1672097559.0000020132766000.00000004.00000020.00020000.00000000.sdmp, Aimbot.exe, 00000000.00000003.1662224656.000002013275D000.00000004.00000020.00020000.00000000.sdmp, Aimbot.exe, 00000000.00000003.1663406733.000002013275D000.00000004.00000020.00020000.00000000.sdmp, Aimbot.exe, 00000000.00000003.1670270253.0000020132760000.00000004.00000020.00020000.00000000.sdmp, Aimbot.exe, 00000000.00000003.1668157588.000002013276D000.00000004.00000020.00020000.00000000.sdmp, Aimbot.exe, 00000000.00000003.1671778196.0000020132760000.00000004.00000020.00020000.00000000.sdmp, Aimbot.exe, 00000000.00000003.1663264315.000002013275D000.00000004.00000020.00020000.00000000.sdmp, Aimbot.exe, 00000000.00000003.1668157588.0000020132760000.00000004.00000020.00020000.00000000.sdmp, Aimbot.exe, 00000000.00000003.1669451270.0000020132766000.00000004.00000020.00020000.00000000.sdmp, Aimbot.exe, 00000000.00000003.1669476901.000002013276D000.00000004.00000020.00020000.00000000.sdmp, Aimbot.exe, 00000000.00000003.1663107498.000002013275D000.00000004.00000020.00020000.00000000.sdmp, Aimbot.exe, 00000000.00000003.1671778196.000002013276D000.00000004.00000020.00020000.00000000.sdmp, Aimbot.exe, 00000000.00000003.1723516414.0000020132761000.00000004.00000020.00020000.00000000.sdmp, Aimbot.exe, 00000000.00000003.1670225045.0000020132766000.00000004.00000020.00020000.00000000.sdmp, Aimbot.exe, 00000000.00000003.1662912486.000002013275D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.digicert.com0C
Source: Aimbot.exe, 00000000.00000003.1663538195.000002013275D000.00000004.00000020.00020000.00000000.sdmp, Aimbot.exe, 00000000.00000003.1669476901.0000020132760000.00000004.00000020.00020000.00000000.sdmp, Aimbot.exe, 00000000.00000003.1662224656.000002013275D000.00000004.00000020.00020000.00000000.sdmp, Aimbot.exe, 00000000.00000003.1663406733.000002013275D000.00000004.00000020.00020000.00000000.sdmp, Aimbot.exe, 00000000.00000003.1670270253.0000020132760000.00000004.00000020.00020000.00000000.sdmp, Aimbot.exe, 00000000.00000003.1668088239.0000020132766000.00000004.00000020.00020000.00000000.sdmp, Aimbot.exe, 00000000.00000003.1663264315.000002013275D000.00000004.00000020.00020000.00000000.sdmp, Aimbot.exe, 00000000.00000003.1668157588.0000020132760000.00000004.00000020.00020000.00000000.sdmp, Aimbot.exe, 00000000.00000003.1669451270.0000020132766000.00000004.00000020.00020000.00000000.sdmp, Aimbot.exe, 00000000.00000003.1663107498.000002013275D000.00000004.00000020.00020000.00000000.sdmp, Aimbot.exe, 00000000.00000003.1723516414.0000020132761000.00000004.00000020.00020000.00000000.sdmp, Aimbot.exe, 00000000.00000003.1670225045.0000020132766000.00000004.00000020.00020000.00000000.sdmp, Aimbot.exe, 00000000.00000003.1662912486.000002013275D000.00000004.00000020.00020000.00000000.sdmp, Aimbot.exe, 00000000.00000003.1672127130.0000020132760000.00000004.00000020.00020000.00000000.sdmp, Aimbot.exe, 00000000.00000003.1671751784.0000020132766000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _decimal.pyd.0.dr, _socket.pyd.0.dr, _hashlib.pyd.0.dr, tcl86t.dll.0.dr String found in binary or memory: http://ocsp.digicert.com0X
Source: Aimbot.exe, 00000000.00000003.1663538195.000002013275D000.00000004.00000020.00020000.00000000.sdmp, Aimbot.exe, 00000000.00000003.1669476901.0000020132760000.00000004.00000020.00020000.00000000.sdmp, Aimbot.exe, 00000000.00000002.2908628806.000002013276E000.00000004.00000020.00020000.00000000.sdmp, Aimbot.exe, 00000000.00000003.1672097559.0000020132766000.00000004.00000020.00020000.00000000.sdmp, Aimbot.exe, 00000000.00000003.1662224656.000002013275D000.00000004.00000020.00020000.00000000.sdmp, Aimbot.exe, 00000000.00000003.1663406733.000002013275D000.00000004.00000020.00020000.00000000.sdmp, Aimbot.exe, 00000000.00000003.1670270253.0000020132760000.00000004.00000020.00020000.00000000.sdmp, Aimbot.exe, 00000000.00000003.1668088239.0000020132766000.00000004.00000020.00020000.00000000.sdmp, Aimbot.exe, 00000000.00000003.1671778196.0000020132760000.00000004.00000020.00020000.00000000.sdmp, Aimbot.exe, 00000000.00000003.1663264315.000002013275D000.00000004.00000020.00020000.00000000.sdmp, Aimbot.exe, 00000000.00000003.1668157588.0000020132760000.00000004.00000020.00020000.00000000.sdmp, Aimbot.exe, 00000000.00000003.1669451270.0000020132766000.00000004.00000020.00020000.00000000.sdmp, Aimbot.exe, 00000000.00000003.1669476901.000002013276D000.00000004.00000020.00020000.00000000.sdmp, Aimbot.exe, 00000000.00000003.1663107498.000002013275D000.00000004.00000020.00020000.00000000.sdmp, Aimbot.exe, 00000000.00000003.1723516414.0000020132761000.00000004.00000020.00020000.00000000.sdmp, Aimbot.exe, 00000000.00000003.1670225045.0000020132766000.00000004.00000020.00020000.00000000.sdmp, Aimbot.exe, 00000000.00000003.1662912486.000002013275D000.00000004.00000020.00020000.00000000.sdmp, Aimbot.exe, 00000000.00000003.1671751784.0000020132766000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _decimal.pyd.0.dr, _socket.pyd.0.dr String found in binary or memory: http://www.digicert.com/CPS0
Source: Aimbot.exe, 00000001.00000002.2916314500.00007FFE13228000.00000008.00000001.01000000.0000000A.sdmp String found in binary or memory: http://www.zlib.net/D
Source: Aimbot.exe, Aimbot.exe, 00000001.00000002.2916044592.00007FFE126DD000.00000002.00000001.01000000.0000000C.sdmp String found in binary or memory: https://cffi.readthedocs.io/en/latest/using.html#callbacks
Source: Aimbot.exe, 00000000.00000003.1664574476.0000020132763000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr String found in binary or memory: https://cryptography.io
Source: METADATA.0.dr String found in binary or memory: https://cryptography.io/
Source: Aimbot.exe, 00000000.00000003.1664574476.0000020132763000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr String found in binary or memory: https://cryptography.io/en/latest/changelog/
Source: Aimbot.exe, 00000001.00000002.2913893772.00007FFDFB0E8000.00000002.00000001.01000000.0000000B.sdmp String found in binary or memory: https://cryptography.io/en/latest/faq/#why-can-t-i-import-my-pem-file
Source: Aimbot.exe, 00000000.00000003.1664574476.0000020132763000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr String found in binary or memory: https://cryptography.io/en/latest/installation/
Source: Aimbot.exe, 00000000.00000003.1664574476.0000020132763000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr String found in binary or memory: https://cryptography.io/en/latest/security/
Source: Aimbot.exe, 00000001.00000002.2910091904.000001C6894FB000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://datatracker.ietf.org/doc/html/rfc5246#section-7.4.1.4.1
Source: Aimbot.exe, 00000000.00000003.1673490397.0000020132761000.00000004.00000020.00020000.00000000.sdmp, http-2.9.8.tm.0.dr String found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Connection
Source: Aimbot.exe, 00000001.00000002.2909205336.000001C688A10000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://docs.python.org/3.11/library/binascii.html#binascii.a2b_base64
Source: Aimbot.exe, 00000001.00000002.2908766495.000001C687021000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/Unidata/MetPy/blob/a3424de66a44bf3a92b0dcacf4dff82ad7b86712/src/metpy/plots/wx_sy
Source: Aimbot.exe, 00000000.00000003.1664574476.0000020132763000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr String found in binary or memory: https://github.com/pyca/cryptography
Source: Aimbot.exe, 00000000.00000003.1664574476.0000020132763000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr String found in binary or memory: https://github.com/pyca/cryptography/
Source: Aimbot.exe, 00000000.00000003.1664574476.0000020132763000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr String found in binary or memory: https://github.com/pyca/cryptography/actions?query=workflow%3ACI
Source: METADATA.0.dr String found in binary or memory: https://github.com/pyca/cryptography/issues
Source: Aimbot.exe, 00000001.00000002.2913893772.00007FFDFB0E8000.00000002.00000001.01000000.0000000B.sdmp String found in binary or memory: https://github.com/pyca/cryptography/issues/8996
Source: Aimbot.exe, 00000001.00000002.2913893772.00007FFDFB0E8000.00000002.00000001.01000000.0000000B.sdmp String found in binary or memory: https://github.com/pyca/cryptography/issues/9253
Source: Aimbot.exe, 00000000.00000003.1664574476.0000020132763000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr String found in binary or memory: https://github.com/pyca/cryptography/workflows/CI/badge.svg?branch=main
Source: Aimbot.exe, 00000001.00000002.2909009086.000001C68897C000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/python/cpython/blob/3.9/Lib/importlib/_bootstrap_external.py#L679-L688
Source: Aimbot.exe, 00000001.00000002.2908766495.000001C687021000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/abc.py
Source: Aimbot.exe, 00000001.00000002.2908766495.000001C687021000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/reader
Source: Aimbot.exe, 00000001.00000002.2909511969.000001C688E9A000.00000004.00000020.00020000.00000000.sdmp, Aimbot.exe, 00000001.00000003.1736464563.000001C688FDD000.00000004.00000020.00020000.00000000.sdmp, Aimbot.exe, 00000001.00000003.1736537132.000001C688F6D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/python/cpython/issues/86361.
Source: Aimbot.exe, 00000001.00000002.2908766495.000001C687021000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py#
Source: Aimbot.exe, 00000000.00000003.1664574476.0000020132763000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr String found in binary or memory: https://img.shields.io/pypi/v/cryptography.svg
Source: Aimbot.exe, 00000000.00000003.1728020864.0000020132761000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://linuxreviews.org/HOWTO_change_the_mouse_speed_in_X
Source: Aimbot.exe, 00000000.00000003.1664574476.0000020132763000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr String found in binary or memory: https://mail.python.org/mailman/listinfo/cryptography-dev
Source: Aimbot.exe, 00000001.00000002.2909951399.000001C6890D8000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://peps.python.org/pep-0205/
Source: Aimbot.exe, 00000001.00000002.2914645148.00007FFDFB812000.00000002.00000001.01000000.00000004.sdmp String found in binary or memory: https://peps.python.org/pep-0263/
Source: Aimbot.exe, 00000000.00000003.1664574476.0000020132763000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr String found in binary or memory: https://pypi.org/project/cryptography/
Source: Aimbot.exe, 00000000.00000003.1664574476.0000020132763000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr String found in binary or memory: https://readthedocs.org/projects/cryptography/badge/?version=latest
Source: Aimbot.exe, 00000001.00000002.2911088825.000001C68982D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://support.apple.com/en-us/HT200
Source: Aimbot.exe, 00000000.00000003.1728140426.0000020132761000.00000004.00000020.00020000.00000000.sdmp, tk.tcl.0.dr String found in binary or memory: https://support.apple.com/en-us/HT201236
Source: Aimbot.exe, 00000000.00000003.1664416001.0000020132760000.00000004.00000020.00020000.00000000.sdmp, LICENSE.APACHE.0.dr String found in binary or memory: https://www.apache.org/licenses/
Source: Aimbot.exe, 00000000.00000003.1664472258.000002013276E000.00000004.00000020.00020000.00000000.sdmp, Aimbot.exe, 00000000.00000003.1664373166.000002013276D000.00000004.00000020.00020000.00000000.sdmp, Aimbot.exe, 00000000.00000003.1664416001.0000020132760000.00000004.00000020.00020000.00000000.sdmp, LICENSE.APACHE.0.dr String found in binary or memory: https://www.apache.org/licenses/LICENSE-2.0
Source: Aimbot.exe, 00000001.00000002.2913429275.00007FFDFAB9A000.00000002.00000001.01000000.00000010.sdmp String found in binary or memory: https://www.openssl.org/H
Source: Aimbot.exe, 00000001.00000002.2909009086.000001C688900000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.python.org/download/releases/2.3/mro/.
Source: Aimbot.exe, 00000001.00000002.2915072045.00007FFDFB989000.00000008.00000001.01000000.00000004.sdmp String found in binary or memory: https://www.python.org/psf/license/
Source: Aimbot.exe, 00000001.00000002.2914645148.00007FFDFB812000.00000002.00000001.01000000.00000004.sdmp String found in binary or memory: https://www.python.org/psf/license/)
Contains functionality for read data from the clipboard
Source: C:\Users\user\Desktop\Aimbot.exe Code function: 1_2_00007FFDFB2C7560 SendMessageW,ClientToScreen,WindowFromPoint,OpenClipboard,GetClipboardOwner,CloseClipboard, 1_2_00007FFDFB2C7560
Contains functionality to modify clipboard data
Source: C:\Users\user\Desktop\Aimbot.exe Code function: 1_2_00007FFDFB2A8BA0 GlobalAlloc,GlobalLock,memcpy,GlobalUnlock,SetClipboardData, 1_2_00007FFDFB2A8BA0
Source: C:\Users\user\Desktop\Aimbot.exe Code function: 1_2_00007FFDFB2A8D70 OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard, 1_2_00007FFDFB2A8D70
Contains functionality to read the clipboard data
Source: C:\Users\user\Desktop\Aimbot.exe Code function: 1_2_00007FFDFB2A8660 OpenClipboard,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GetLocaleInfoA,GlobalUnlock,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,CloseClipboard, 1_2_00007FFDFB2A8660
Contains functionality to retrieve information about pressed keystrokes
Source: C:\Users\user\Desktop\Aimbot.exe Code function: 1_2_00007FFDFB2B77F0 ClientToScreen,GetSystemMetrics,GetAsyncKeyState,GetAsyncKeyState,TrackPopupMenu,GetCursorPos,WindowFromPoint, 1_2_00007FFDFB2B77F0
Potential key logger detected (key state polling based)
Source: C:\Users\user\Desktop\Aimbot.exe Code function: 1_2_00007FFDFB2BB830 GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState, 1_2_00007FFDFB2BB830
Detected potential crypto function
Source: C:\Users\user\Desktop\Aimbot.exe Code function: 0_2_00007FF74B4D7B60 0_2_00007FF74B4D7B60
Source: C:\Users\user\Desktop\Aimbot.exe Code function: 0_2_00007FF74B4F6B50 0_2_00007FF74B4F6B50
Source: C:\Users\user\Desktop\Aimbot.exe Code function: 0_2_00007FF74B4F7A9C 0_2_00007FF74B4F7A9C
Source: C:\Users\user\Desktop\Aimbot.exe Code function: 0_2_00007FF74B4D1000 0_2_00007FF74B4D1000
Source: C:\Users\user\Desktop\Aimbot.exe Code function: 0_2_00007FF74B4D9D9B 0_2_00007FF74B4D9D9B
Source: C:\Users\user\Desktop\Aimbot.exe Code function: 0_2_00007FF74B4E2480 0_2_00007FF74B4E2480
Source: C:\Users\user\Desktop\Aimbot.exe Code function: 0_2_00007FF74B4EAC50 0_2_00007FF74B4EAC50
Source: C:\Users\user\Desktop\Aimbot.exe Code function: 0_2_00007FF74B4EECA0 0_2_00007FF74B4EECA0
Source: C:\Users\user\Desktop\Aimbot.exe Code function: 0_2_00007FF74B4E84BC 0_2_00007FF74B4E84BC
Source: C:\Users\user\Desktop\Aimbot.exe Code function: 0_2_00007FF74B4EF320 0_2_00007FF74B4EF320
Source: C:\Users\user\Desktop\Aimbot.exe Code function: 0_2_00007FF74B4E2274 0_2_00007FF74B4E2274
Source: C:\Users\user\Desktop\Aimbot.exe Code function: 0_2_00007FF74B4F4A60 0_2_00007FF74B4F4A60
Source: C:\Users\user\Desktop\Aimbot.exe Code function: 0_2_00007FF74B4E2A94 0_2_00007FF74B4E2A94
Source: C:\Users\user\Desktop\Aimbot.exe Code function: 0_2_00007FF74B4F1720 0_2_00007FF74B4F1720
Source: C:\Users\user\Desktop\Aimbot.exe Code function: 0_2_00007FF74B4E42D4 0_2_00007FF74B4E42D4
Source: C:\Users\user\Desktop\Aimbot.exe Code function: 0_2_00007FF74B4D92D0 0_2_00007FF74B4D92D0
Source: C:\Users\user\Desktop\Aimbot.exe Code function: 0_2_00007FF74B4E2070 0_2_00007FF74B4E2070
Source: C:\Users\user\Desktop\Aimbot.exe Code function: 0_2_00007FF74B4E2890 0_2_00007FF74B4E2890
Source: C:\Users\user\Desktop\Aimbot.exe Code function: 0_2_00007FF74B4DA76D 0_2_00007FF74B4DA76D
Source: C:\Users\user\Desktop\Aimbot.exe Code function: 0_2_00007FF74B4F1720 0_2_00007FF74B4F1720
Source: C:\Users\user\Desktop\Aimbot.exe Code function: 0_2_00007FF74B4E6750 0_2_00007FF74B4E6750
Source: C:\Users\user\Desktop\Aimbot.exe Code function: 0_2_00007FF74B4D9F3B 0_2_00007FF74B4D9F3B
Source: C:\Users\user\Desktop\Aimbot.exe Code function: 0_2_00007FF74B4FA7D8 0_2_00007FF74B4FA7D8
Source: C:\Users\user\Desktop\Aimbot.exe Code function: 0_2_00007FF74B4EE80C 0_2_00007FF74B4EE80C
Source: C:\Users\user\Desktop\Aimbot.exe Code function: 0_2_00007FF74B4E8670 0_2_00007FF74B4E8670
Source: C:\Users\user\Desktop\Aimbot.exe Code function: 0_2_00007FF74B4E8670 0_2_00007FF74B4E8670
Source: C:\Users\user\Desktop\Aimbot.exe Code function: 0_2_00007FF74B4E2684 0_2_00007FF74B4E2684
Source: C:\Users\user\Desktop\Aimbot.exe Code function: 0_2_00007FF74B4E8EF4 0_2_00007FF74B4E8EF4
Source: C:\Users\user\Desktop\Aimbot.exe Code function: 0_2_00007FF74B4F4EFC 0_2_00007FF74B4F4EFC
Source: C:\Users\user\Desktop\Aimbot.exe Code function: 0_2_00007FF74B4E3ED0 0_2_00007FF74B4E3ED0
Source: C:\Users\user\Desktop\Aimbot.exe Code function: 0_2_00007FF74B4F26C4 0_2_00007FF74B4F26C4
Source: C:\Users\user\Desktop\Aimbot.exe Code function: 0_2_00007FF74B4F7550 0_2_00007FF74B4F7550
Source: C:\Users\user\Desktop\Aimbot.exe Code function: 0_2_00007FF74B4E3540 0_2_00007FF74B4E3540
Source: C:\Users\user\Desktop\Aimbot.exe Code function: 0_2_00007FF74B4F6DCC 0_2_00007FF74B4F6DCC
Source: C:\Users\user\Desktop\Aimbot.exe Code function: 1_2_00007FFDFB31F910 1_2_00007FFDFB31F910
Source: C:\Users\user\Desktop\Aimbot.exe Code function: 1_2_00007FFDFB2D3D00 1_2_00007FFDFB2D3D00
Source: C:\Users\user\Desktop\Aimbot.exe Code function: 1_2_00007FFDFB2B1310 1_2_00007FFDFB2B1310
Source: C:\Users\user\Desktop\Aimbot.exe Code function: 1_2_00007FFDFB377230 1_2_00007FFDFB377230
Source: C:\Users\user\Desktop\Aimbot.exe Code function: 1_2_00007FFDFB2B5080 1_2_00007FFDFB2B5080
Source: C:\Users\user\Desktop\Aimbot.exe Code function: 1_2_00007FFDFB37568E 1_2_00007FFDFB37568E
Source: C:\Users\user\Desktop\Aimbot.exe Code function: 1_2_00007FFDFB386370 1_2_00007FFDFB386370
Source: C:\Users\user\Desktop\Aimbot.exe Code function: 1_2_00007FFDFB2ADBA0 1_2_00007FFDFB2ADBA0
Source: C:\Users\user\Desktop\Aimbot.exe Code function: 1_2_00007FFDFB35FBF0 1_2_00007FFDFB35FBF0
Source: C:\Users\user\Desktop\Aimbot.exe Code function: 1_2_00007FFDFB35BAA0 1_2_00007FFDFB35BAA0
Source: C:\Users\user\Desktop\Aimbot.exe Code function: 1_2_00007FFDFB305A70 1_2_00007FFDFB305A70
Source: C:\Users\user\Desktop\Aimbot.exe Code function: 1_2_00007FFDFB34FAD0 1_2_00007FFDFB34FAD0
Source: C:\Users\user\Desktop\Aimbot.exe Code function: 1_2_00007FFDFB351A70 1_2_00007FFDFB351A70
Source: C:\Users\user\Desktop\Aimbot.exe Code function: 1_2_00007FFDFB365AF0 1_2_00007FFDFB365AF0
Source: C:\Users\user\Desktop\Aimbot.exe Code function: 1_2_00007FFDFB385B10 1_2_00007FFDFB385B10
Source: C:\Users\user\Desktop\Aimbot.exe Code function: 1_2_00007FFDFB3899A0 1_2_00007FFDFB3899A0
Source: C:\Users\user\Desktop\Aimbot.exe Code function: 1_2_00007FFDFB34D960 1_2_00007FFDFB34D960
Source: C:\Users\user\Desktop\Aimbot.exe Code function: 1_2_00007FFDFB3139E0 1_2_00007FFDFB3139E0
Source: C:\Users\user\Desktop\Aimbot.exe Code function: 1_2_00007FFDFB2E5A50 1_2_00007FFDFB2E5A50
Source: C:\Users\user\Desktop\Aimbot.exe Code function: 1_2_00007FFDFB2DB910 1_2_00007FFDFB2DB910
Source: C:\Users\user\Desktop\Aimbot.exe Code function: 1_2_00007FFDFB38BF70 1_2_00007FFDFB38BF70
Source: C:\Users\user\Desktop\Aimbot.exe Code function: 1_2_00007FFDFB2B5FB0 1_2_00007FFDFB2B5FB0
Source: C:\Users\user\Desktop\Aimbot.exe Code function: 1_2_00007FFDFB329E90 1_2_00007FFDFB329E90
Source: C:\Users\user\Desktop\Aimbot.exe Code function: 1_2_00007FFDFB2DFEE0 1_2_00007FFDFB2DFEE0
Source: C:\Users\user\Desktop\Aimbot.exe Code function: 1_2_00007FFDFB359D60 1_2_00007FFDFB359D60
Source: C:\Users\user\Desktop\Aimbot.exe Code function: 1_2_00007FFDFB32FE20 1_2_00007FFDFB32FE20
Source: C:\Users\user\Desktop\Aimbot.exe Code function: 1_2_00007FFDFB34BD40 1_2_00007FFDFB34BD40
Source: C:\Users\user\Desktop\Aimbot.exe Code function: 1_2_00007FFDFB2A3D30 1_2_00007FFDFB2A3D30
Source: C:\Users\user\Desktop\Aimbot.exe Code function: 1_2_00007FFDFB30F370 1_2_00007FFDFB30F370
Source: C:\Users\user\Desktop\Aimbot.exe Code function: 1_2_00007FFDFB319380 1_2_00007FFDFB319380
Source: C:\Users\user\Desktop\Aimbot.exe Code function: 1_2_00007FFDFB36B270 1_2_00007FFDFB36B270
Source: C:\Users\user\Desktop\Aimbot.exe Code function: 1_2_00007FFDFB34D290 1_2_00007FFDFB34D290
Source: C:\Users\user\Desktop\Aimbot.exe Code function: 1_2_00007FFDFB37D2E0 1_2_00007FFDFB37D2E0
Source: C:\Users\user\Desktop\Aimbot.exe Code function: 1_2_00007FFDFB343250 1_2_00007FFDFB343250
Source: C:\Users\user\Desktop\Aimbot.exe Code function: 1_2_00007FFDFB32325B 1_2_00007FFDFB32325B
Source: C:\Users\user\Desktop\Aimbot.exe Code function: 1_2_00007FFDFB305070 1_2_00007FFDFB305070
Source: C:\Users\user\Desktop\Aimbot.exe Code function: 1_2_00007FFDFB2E9100 1_2_00007FFDFB2E9100
Source: C:\Users\user\Desktop\Aimbot.exe Code function: 1_2_00007FFDFB2E3100 1_2_00007FFDFB2E3100
Source: C:\Users\user\Desktop\Aimbot.exe Code function: 1_2_00007FFDFB2A10E0 1_2_00007FFDFB2A10E0
Source: C:\Users\user\Desktop\Aimbot.exe Code function: 1_2_00007FFDFB3717C0 1_2_00007FFDFB3717C0
Source: C:\Users\user\Desktop\Aimbot.exe Code function: 1_2_00007FFDFB399790 1_2_00007FFDFB399790
Source: C:\Users\user\Desktop\Aimbot.exe Code function: 1_2_00007FFDFB353850 1_2_00007FFDFB353850
Source: C:\Users\user\Desktop\Aimbot.exe Code function: 1_2_00007FFDFB2C7840 1_2_00007FFDFB2C7840
Source: C:\Users\user\Desktop\Aimbot.exe Code function: 1_2_00007FFDFB2AD830 1_2_00007FFDFB2AD830
Source: C:\Users\user\Desktop\Aimbot.exe Code function: 1_2_00007FFDFB2B5820 1_2_00007FFDFB2B5820
Source: C:\Users\user\Desktop\Aimbot.exe Code function: 1_2_00007FFDFB2E3820 1_2_00007FFDFB2E3820
Source: C:\Users\user\Desktop\Aimbot.exe Code function: 1_2_00007FFDFB2FB6A0 1_2_00007FFDFB2FB6A0
Source: C:\Users\user\Desktop\Aimbot.exe Code function: 1_2_00007FFDFB327720 1_2_00007FFDFB327720
Source: C:\Users\user\Desktop\Aimbot.exe Code function: 1_2_00007FFDFB32373C 1_2_00007FFDFB32373C
Source: C:\Users\user\Desktop\Aimbot.exe Code function: 1_2_00007FFDFB321710 1_2_00007FFDFB321710
Source: C:\Users\user\Desktop\Aimbot.exe Code function: 1_2_00007FFDFB35CBC0 1_2_00007FFDFB35CBC0
Source: C:\Users\user\Desktop\Aimbot.exe Code function: 1_2_00007FFDFB394C20 1_2_00007FFDFB394C20
Source: C:\Users\user\Desktop\Aimbot.exe Code function: 1_2_00007FFDFB2AAC50 1_2_00007FFDFB2AAC50
Source: C:\Users\user\Desktop\Aimbot.exe Code function: 1_2_00007FFDFB34CBF0 1_2_00007FFDFB34CBF0
Source: C:\Users\user\Desktop\Aimbot.exe Code function: 1_2_00007FFDFB2B2AE0 1_2_00007FFDFB2B2AE0
Source: C:\Users\user\Desktop\Aimbot.exe Code function: 1_2_00007FFDFB2B0B50 1_2_00007FFDFB2B0B50
Source: C:\Users\user\Desktop\Aimbot.exe Code function: 1_2_00007FFDFB2D6B40 1_2_00007FFDFB2D6B40
Source: C:\Users\user\Desktop\Aimbot.exe Code function: 1_2_00007FFDFB2FA9A0 1_2_00007FFDFB2FA9A0
Source: C:\Users\user\Desktop\Aimbot.exe Code function: 1_2_00007FFDFB2A6A00 1_2_00007FFDFB2A6A00
Source: C:\Users\user\Desktop\Aimbot.exe Code function: 1_2_00007FFDFB32A9F0 1_2_00007FFDFB32A9F0
Source: C:\Users\user\Desktop\Aimbot.exe Code function: 1_2_00007FFDFB386A00 1_2_00007FFDFB386A00
Source: C:\Users\user\Desktop\Aimbot.exe Code function: 1_2_00007FFDFB2B8A30 1_2_00007FFDFB2B8A30
Source: C:\Users\user\Desktop\Aimbot.exe Code function: 1_2_00007FFDFB2AC8AC 1_2_00007FFDFB2AC8AC
Source: C:\Users\user\Desktop\Aimbot.exe Code function: 1_2_00007FFDFB384F90 1_2_00007FFDFB384F90
Source: C:\Users\user\Desktop\Aimbot.exe Code function: 1_2_00007FFDFB323050 1_2_00007FFDFB323050
Source: C:\Users\user\Desktop\Aimbot.exe Code function: 1_2_00007FFDFB314FE0 1_2_00007FFDFB314FE0
Source: C:\Users\user\Desktop\Aimbot.exe Code function: 1_2_00007FFDFB326E90 1_2_00007FFDFB326E90
Source: C:\Users\user\Desktop\Aimbot.exe Code function: 1_2_00007FFDFB2A4EE0 1_2_00007FFDFB2A4EE0
Source: C:\Users\user\Desktop\Aimbot.exe Code function: 1_2_00007FFDFB35EF00 1_2_00007FFDFB35EF00
Source: C:\Users\user\Desktop\Aimbot.exe Code function: 1_2_00007FFDFB324DA0 1_2_00007FFDFB324DA0
Source: C:\Users\user\Desktop\Aimbot.exe Code function: 1_2_00007FFDFB398D80 1_2_00007FFDFB398D80
Source: C:\Users\user\Desktop\Aimbot.exe Code function: 1_2_00007FFDFB31AE20 1_2_00007FFDFB31AE20
Source: C:\Users\user\Desktop\Aimbot.exe Code function: 1_2_00007FFDFB320E40 1_2_00007FFDFB320E40
Source: C:\Users\user\Desktop\Aimbot.exe Code function: 1_2_00007FFDFB35ADF0 1_2_00007FFDFB35ADF0
Source: C:\Users\user\Desktop\Aimbot.exe Code function: 1_2_00007FFDFB362E10 1_2_00007FFDFB362E10
Source: C:\Users\user\Desktop\Aimbot.exe Code function: 1_2_00007FFDFB31ACD0 1_2_00007FFDFB31ACD0
Source: C:\Users\user\Desktop\Aimbot.exe Code function: 1_2_00007FFDFB2C0C60 1_2_00007FFDFB2C0C60
Source: C:\Users\user\Desktop\Aimbot.exe Code function: 1_2_00007FFDFB348C90 1_2_00007FFDFB348C90
Source: C:\Users\user\Desktop\Aimbot.exe Code function: 1_2_00007FFDFB364D30 1_2_00007FFDFB364D30
Source: C:\Users\user\Desktop\Aimbot.exe Code function: 1_2_00007FFDFB318D40 1_2_00007FFDFB318D40
Source: C:\Users\user\Desktop\Aimbot.exe Code function: 1_2_00007FFDFB358D50 1_2_00007FFDFB358D50
Source: C:\Users\user\Desktop\Aimbot.exe Code function: 1_2_00007FFDFB354190 1_2_00007FFDFB354190
Source: C:\Users\user\Desktop\Aimbot.exe Code function: 1_2_00007FFDFB2B4200 1_2_00007FFDFB2B4200
Source: C:\Users\user\Desktop\Aimbot.exe Code function: 1_2_00007FFDFB3241F0 1_2_00007FFDFB3241F0
Source: C:\Users\user\Desktop\Aimbot.exe Code function: 1_2_00007FFDFB2E4110 1_2_00007FFDFB2E4110
Source: C:\Users\user\Desktop\Aimbot.exe Code function: 1_2_00007FFDFB2A20F0 1_2_00007FFDFB2A20F0
Source: C:\Users\user\Desktop\Aimbot.exe Code function: 1_2_00007FFDFB3106B0 1_2_00007FFDFB3106B0
Source: C:\Users\user\Desktop\Aimbot.exe Code function: 1_2_00007FFDFB2DC6C0 1_2_00007FFDFB2DC6C0
Source: C:\Users\user\Desktop\Aimbot.exe Code function: 1_2_00007FFDFB35E730 1_2_00007FFDFB35E730
Source: C:\Users\user\Desktop\Aimbot.exe Code function: 1_2_00007FFDFB35C730 1_2_00007FFDFB35C730
Source: C:\Users\user\Desktop\Aimbot.exe Code function: 1_2_00007FFDFB2C2580 1_2_00007FFDFB2C2580
Source: C:\Users\user\Desktop\Aimbot.exe Code function: 1_2_00007FFDFB2CC618 1_2_00007FFDFB2CC618
Found potential string decryption / allocating functions
Source: C:\Users\user\Desktop\Aimbot.exe Code function: String function: 00007FF74B4D2B10 appears 47 times
Source: C:\Users\user\Desktop\Aimbot.exe Code function: String function: 00007FFDFB393540 appears 53 times
PE file contains executable resources (Code or Archives)
Source: unicodedata.pyd.0.dr Static PE information: Resource name: RT_VERSION type: COM executable for DOS
PE file contains more sections than normal
Source: zlib1.dll.0.dr Static PE information: Number of sections : 12 > 10
PE file does not import any functions
Source: python3.dll.0.dr Static PE information: No import functions for PE file found
Sample file is different than original file name gathered from version info
Source: Aimbot.exe, 00000000.00000003.1663538195.000002013275D000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilename_tkinter.pyd. vs Aimbot.exe
Source: Aimbot.exe, 00000000.00000003.1672097559.0000020132766000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenametcl86.dllP vs Aimbot.exe
Source: Aimbot.exe, 00000000.00000003.1662224656.000002013275D000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilename_bz2.pyd. vs Aimbot.exe
Source: Aimbot.exe, 00000000.00000003.1663406733.000002013275D000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilename_socket.pyd. vs Aimbot.exe
Source: Aimbot.exe, 00000000.00000003.1663264315.000002013275D000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilename_lzma.pyd. vs Aimbot.exe
Source: Aimbot.exe, 00000000.00000003.1669451270.0000020132766000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenamepython3.dll. vs Aimbot.exe
Source: Aimbot.exe, 00000000.00000003.1662087768.000002013275D000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenamevcruntime140.dllT vs Aimbot.exe
Source: Aimbot.exe, 00000000.00000003.1663107498.000002013275D000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilename_hashlib.pyd. vs Aimbot.exe
Source: Aimbot.exe, 00000000.00000003.1662912486.000002013275D000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilename_decimal.pyd. vs Aimbot.exe
Source: Aimbot.exe, 00000000.00000003.1671751784.0000020132766000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameselect.pyd. vs Aimbot.exe
Source: Aimbot.exe Binary or memory string: OriginalFilename vs Aimbot.exe
Source: Aimbot.exe, 00000001.00000002.2916652415.00007FFE13319000.00000002.00000001.01000000.00000005.sdmp Binary or memory string: OriginalFilenamevcruntime140.dllT vs Aimbot.exe
Source: Aimbot.exe, 00000001.00000002.2914406567.00007FFDFB3F5000.00000002.00000001.01000000.00000009.sdmp Binary or memory string: OriginalFilenametk86.dllP vs Aimbot.exe
Source: Aimbot.exe, 00000001.00000002.2915440494.00007FFDFBAB2000.00000002.00000001.01000000.00000004.sdmp Binary or memory string: OriginalFilenamepython312.dll. vs Aimbot.exe
Source: Aimbot.exe, 00000001.00000002.2915669907.00007FFDFF2FB000.00000002.00000001.01000000.00000008.sdmp Binary or memory string: OriginalFilenametcl86.dllP vs Aimbot.exe
Source: Aimbot.exe, 00000001.00000002.2916900033.00007FFE148E6000.00000002.00000001.01000000.0000000E.sdmp Binary or memory string: OriginalFilenameselect.pyd. vs Aimbot.exe
Source: Aimbot.exe, 00000001.00000002.2916478374.00007FFE1323E000.00000002.00000001.01000000.00000007.sdmp Binary or memory string: OriginalFilename_tkinter.pyd. vs Aimbot.exe
Source: Aimbot.exe, 00000001.00000002.2910062502.000001C689150000.00000002.00000001.01000000.00000006.sdmp Binary or memory string: OriginalFilenamepython3.dll. vs Aimbot.exe
Source: Aimbot.exe, 00000001.00000002.2916314500.00007FFE13228000.00000008.00000001.01000000.0000000A.sdmp Binary or memory string: OriginalFilenamezlib1.dll* vs Aimbot.exe
Source: Aimbot.exe, 00000001.00000002.2915956720.00007FFE11EE3000.00000002.00000001.01000000.0000000D.sdmp Binary or memory string: OriginalFilename_socket.pyd. vs Aimbot.exe
Source: Aimbot.exe, 00000001.00000002.2915817712.00007FFE11EBE000.00000002.00000001.01000000.0000000F.sdmp Binary or memory string: OriginalFilename_hashlib.pyd. vs Aimbot.exe
Source: Aimbot.exe, 00000001.00000002.2913429275.00007FFDFAB9A000.00000002.00000001.01000000.00000010.sdmp Binary or memory string: OriginalFilenamelibcryptoH vs Aimbot.exe
Source: classification engine Classification label: sus32.winEXE@3/951@0/0
Source: C:\Users\user\Desktop\Aimbot.exe Code function: 0_2_00007FF74B4D8770 GetLastError,FormatMessageW,WideCharToMultiByte, 0_2_00007FF74B4D8770
Source: C:\Users\user\Desktop\Aimbot.exe Code function: 1_2_00007FFDFB2AA3B0 CoCreateInstance,EnableWindow,CoTaskMemFree,CoTaskMemFree, 1_2_00007FFDFB2AA3B0
Source: C:\Users\user\Desktop\Aimbot.exe Code function: 1_2_00007FFDFB2A7CE0 GetModuleHandleW,FindResourceW,LoadResource,LockResource,memcpy, 1_2_00007FFDFB2A7CE0
Source: C:\Users\user\Desktop\Aimbot.exe File created: C:\Users\user\Desktop\private_key.pem Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe File created: C:\Users\user\AppData\Local\Temp\_MEI73442 Jump to behavior
Source: Aimbot.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\Aimbot.exe Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: Aimbot.exe String found in binary or memory: -help
Source: Aimbot.exe String found in binary or memory: -startline must be less than or equal to -endline
Source: C:\Users\user\Desktop\Aimbot.exe File read: C:\Users\user\Desktop\Aimbot.exe Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\Aimbot.exe "C:\Users\user\Desktop\Aimbot.exe"
Source: C:\Users\user\Desktop\Aimbot.exe Process created: C:\Users\user\Desktop\Aimbot.exe "C:\Users\user\Desktop\Aimbot.exe"
Source: C:\Users\user\Desktop\Aimbot.exe Process created: C:\Users\user\Desktop\Aimbot.exe "C:\Users\user\Desktop\Aimbot.exe" Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Section loaded: vcruntime140.dll Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Section loaded: tcl86t.dll Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Section loaded: tk86t.dll Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Section loaded: zlib1.dll Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Section loaded: logoncli.dll Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Section loaded: samcli.dll Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Section loaded: libcrypto-3.dll Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Section loaded: textinputframework.dll Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Section loaded: coreuicomponents.dll Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Section loaded: wintypes.dll Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
Source: Aimbot.exe Static PE information: Image base 0x140000000 > 0x60000000
Source: Aimbot.exe Static file information: File size 13439784 > 1048576
Source: Aimbot.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: Aimbot.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: Aimbot.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: Aimbot.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Aimbot.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: Aimbot.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT
Source: Aimbot.exe Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
Source: Aimbot.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Binary string: D:\a\1\b\bin\amd64\select.pdb source: Aimbot.exe, 00000000.00000003.1671751784.0000020132766000.00000004.00000020.00020000.00000000.sdmp, Aimbot.exe, 00000001.00000002.2916798867.00007FFE148E3000.00000002.00000001.01000000.0000000E.sdmp, select.pyd.0.dr
Source: Binary string: D:\a\1\b\bin\amd64\python312.pdb source: Aimbot.exe, 00000001.00000002.2914645148.00007FFDFB812000.00000002.00000001.01000000.00000004.sdmp
Source: Binary string: D:\a\1\b\libcrypto-3.pdb| source: Aimbot.exe, 00000001.00000002.2913131498.00007FFDFAAF1000.00000002.00000001.01000000.00000010.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_hashlib.pdb source: Aimbot.exe, 00000000.00000003.1663107498.000002013275D000.00000004.00000020.00020000.00000000.sdmp, Aimbot.exe, 00000001.00000002.2915760786.00007FFE11EB7000.00000002.00000001.01000000.0000000F.sdmp, _hashlib.pyd.0.dr
Source: Binary string: D:\a\1\b\bin\amd64\_decimal.pdb$$ source: _decimal.pyd.0.dr
Source: Binary string: crypto\engine\tb_digest.cENGINE_get_digestcrypto\buffer\buffer.cBUF_MEM_growBUF_MEM_grow_cleancrypto\packet.ccompiler: cl /Zi /Fdossl_static.pdb /MT /Zl /Gs0 /GF /Gy /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG";CPUINFO: OPENSSL_ia32cap=0x%llx:0x%llxOPENSSL_ia32cap env:%sos-specific.dllCPUINFO: crypto\initthread.cOPENSSL_ia32cap source: Aimbot.exe, 00000001.00000002.2913893772.00007FFDFB0E8000.00000002.00000001.01000000.0000000B.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_lzma.pdbNN source: Aimbot.exe, 00000000.00000003.1663264315.000002013275D000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: tRSA_PRIME_INFOeqdmp1dmq1iqmpprime_infosRSAPrivateKeyRSAPublicKeyhashAlgorithmmaskGenAlgorithmsaltLengthtrailerFieldRSA_PSS_PARAMShashFuncmaskGenFuncpSourceFuncRSA_OAEP_PARAMScompiler: cl /Zi /Fdossl_static.pdb /MT /Zl /Gs0 /GF /Gy /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG"3.2.1built on: Fri Feb 23 00:13:44 2024 UTCplatform: VC-WIN64AOPENSSLDIR: "C:\Program Files\Common Files\SSL"ENGINESDIR: "C:\Program Files\OpenSSL\lib\engines-3"MODULESDIR: "C:\Program Files\OpenSSL\lib\ossl-modules"CPUINFO: N/Anot availablecrypto\init.cOPENSSL_init_cryptocrypto\bio\bio_lib.cBIO_new_exbio_read_internbio_write_internBIO_sendmmsgBIO_recvmmsgBIO_putsBIO_getsBIO_get_line BIO_ctrlBIO_callback_ctrlBIO_find_type source: Aimbot.exe, 00000001.00000002.2913893772.00007FFDFB0E8000.00000002.00000001.01000000.0000000B.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_decimal.pdb source: _decimal.pyd.0.dr
Source: Binary string: C:\Users\runneradmin\AppData\Local\Temp\pip-req-build-csg7dlje\src\rust\target\release\deps\cryptography_rust.pdb source: Aimbot.exe, 00000001.00000002.2913893772.00007FFDFB0E8000.00000002.00000001.01000000.0000000B.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_lzma.pdb source: Aimbot.exe, 00000000.00000003.1663264315.000002013275D000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_bz2.pdb source: Aimbot.exe, 00000000.00000003.1662224656.000002013275D000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: @ compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG"OpenSSL 3.0.13 30 Jan 20243.0.13built on: Mon Feb 5 17:39:09 2024 UTCplatform: VC-WIN64A-masmOPENSSLDIR: "C:\Program Files\Common Files\SSL"ENGINESDIR: "C:\Program Files\OpenSSL\lib\engines-3"MODULESDIR: "C:\Program Files\OpenSSL\lib\ossl-modules"CPUINFO: N/Anot availableget_and_lock..\s\crypto\ex_data.cossl_crypto_get_ex_new_index_exossl_crypto_new_ex_data_exCRYPTO_dup_ex_dataCRYPTO_set_ex_dataOPENSSL_WIN32_UTF8..\s\crypto\getenv.ccompiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG";CPUINFO: OPENSSL_ia32cap=0x%llx:0x%llxOPENSSL_ia32cap env:%sos-specificC:\Program Files\Common Files\SSLC:\Program Files\OpenSSL\lib\ossl-modules.dllCPUINFO: ..\s\crypto\init.cOPENSSL_init_cryptoOPENSSL_atexit..\s\crypto\initthread.c..\s\crypto\mem_sec.cassertion failed: (bit & 1) == 0assertion failed: list >= 0 && list < sh.freelist_sizeassertion failed: ((ptr - sh.arena) & ((sh.arena_size >> list) - 1)) == 0assertion failed: bit > 0 && bit < sh.bittable_sizeassertion failed: TESTBIT(table, bit)assertion failed: !TESTBIT(table, bit)assertion failed: WITHIN_FREELIST(list)assertion failed: WITHIN_ARENA(ptr)assertion failed: temp->next == NULL || WITHIN_ARENA(temp->next)assertion failed: (char **)temp->next->p_next == listassertion failed: WITHIN_FREELIST(temp2->p_next) || WITHIN_ARENA(temp2->p_next)assertion failed: size > 0assertion failed: (size & (size - 1)) == 0assertion failed: (minsize & (minsize - 1)) == 0assertion failed: sh.freelist != NULLassertion failed: sh.bittable != NULLassertion failed: sh.bitmalloc != NULLassertion failed: !sh_testbit(temp, slist, sh.bitmalloc)assertion failed: temp != sh.freelist[slist]assertion failed: sh.freelist[slist] == tempassertion failed: temp-(sh.arena_size >> slist) == sh_find_my_buddy(temp, slist)assertion failed: sh_testbit(chunk, list, sh.bittable)assertion failed: WITHIN_ARENA(chunk)assertion failed: sh_testbit(ptr, list, sh.bittable)assertion failed: ptr == sh_find_my_buddy(buddy, list)assertion failed: ptr != NULLassertion failed: !sh_testbit(ptr, list, sh.bitmalloc)assertion failed: sh.freelist[list] == ptr/*0123456789ABCDEFCRYPTO_memdup..\s\crypto\o_str.chexstr2buf_sepossl_hexstr2buf_sepbuf2hexstr_sepossl_buf2hexstr_sep..\s\crypto\packet.cwpacket_intern_init_lenWPACKET_start_sub_packet_len__..\s\crypto\param_build.cparam_pushparam_push_numOSSL_PARAM_BLD_push_BN_padNegative big numbers are unsupported for OSSL_PARAMOSSL_PARAM_BLD_push_utf8_stringOSSL_PARAM_BLD_push_utf8_ptrOSSL_PARAM_BLD_push_octet_stringOSSL_PARAM_BLD_
Source: Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdb source: Aimbot.exe, 00000000.00000003.1662087768.000002013275D000.00000004.00000020.00020000.00000000.sdmp, Aimbot.exe, 00000001.00000002.2916569171.00007FFE13313000.00000002.00000001.01000000.00000005.sdmp, VCRUNTIME140.dll.0.dr
Source: Binary string: C:\Users\runneradmin\AppData\Local\Temp\pip-req-build-csg7dlje\src\rust\target\release\deps\cryptography_rust.pdbo source: Aimbot.exe, 00000001.00000002.2913893772.00007FFDFB0E8000.00000002.00000001.01000000.0000000B.sdmp
Source: Binary string: compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG" source: Aimbot.exe, 00000001.00000002.2913131498.00007FFDFAA59000.00000002.00000001.01000000.00000010.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_tkinter.pdb source: Aimbot.exe, 00000000.00000003.1663538195.000002013275D000.00000004.00000020.00020000.00000000.sdmp, Aimbot.exe, 00000001.00000002.2916422110.00007FFE13238000.00000002.00000001.01000000.00000007.sdmp
Source: Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdbGCTL source: Aimbot.exe, 00000000.00000003.1662087768.000002013275D000.00000004.00000020.00020000.00000000.sdmp, Aimbot.exe, 00000001.00000002.2916569171.00007FFE13313000.00000002.00000001.01000000.00000005.sdmp, VCRUNTIME140.dll.0.dr
Source: Binary string: D:\a\1\b\libcrypto-3.pdb source: Aimbot.exe, 00000001.00000002.2913131498.00007FFDFAAF1000.00000002.00000001.01000000.00000010.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_socket.pdb source: Aimbot.exe, 00000000.00000003.1663406733.000002013275D000.00000004.00000020.00020000.00000000.sdmp, Aimbot.exe, 00000001.00000002.2915901227.00007FFE11ED9000.00000002.00000001.01000000.0000000D.sdmp, _socket.pyd.0.dr
Source: Binary string: D:\a\1\b\bin\amd64\python3.pdb source: Aimbot.exe, 00000000.00000003.1669451270.0000020132766000.00000004.00000020.00020000.00000000.sdmp, Aimbot.exe, 00000001.00000002.2910062502.000001C689150000.00000002.00000001.01000000.00000006.sdmp
Source: Binary string: compiler: cl /Zi /Fdossl_static.pdb /MT /Zl /Gs0 /GF /Gy /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG" source: Aimbot.exe, 00000001.00000002.2913893772.00007FFDFB0E8000.00000002.00000001.01000000.0000000B.sdmp
Source: Aimbot.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: Aimbot.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: Aimbot.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: Aimbot.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: Aimbot.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata
Contains functionality to dynamically determine API calls
Source: C:\Users\user\Desktop\Aimbot.exe Code function: 1_2_00007FFDFB329E90 abort,strcmp,strcmp,GetModuleHandleW,GetModuleFileNameW,LoadLibraryW,GetProcAddress,strncmp, 1_2_00007FFDFB329E90
PE file contains sections with non-standard names
Source: Aimbot.exe Static PE information: section name: _RDATA
Source: VCRUNTIME140.dll.0.dr Static PE information: section name: fothk
Source: VCRUNTIME140.dll.0.dr Static PE information: section name: _RDATA
Source: zlib1.dll.0.dr Static PE information: section name: .xdata
Source: libcrypto-3.dll.0.dr Static PE information: section name: .00cfg
Source: python312.dll.0.dr Static PE information: section name: PyRuntim

Persistence and Installation Behavior
barindex
Found pyInstaller with non standard icon
Source: C:\Users\user\Desktop\Aimbot.exe Process created: "C:\Users\user\Desktop\Aimbot.exe"
Drops PE files
Source: C:\Users\user\Desktop\Aimbot.exe File created: C:\Users\user\AppData\Local\Temp\_MEI73442\python312.dll Jump to dropped file
Source: C:\Users\user\Desktop\Aimbot.exe File created: C:\Users\user\AppData\Local\Temp\_MEI73442\libcrypto-3.dll Jump to dropped file
Source: C:\Users\user\Desktop\Aimbot.exe File created: C:\Users\user\AppData\Local\Temp\_MEI73442\zlib1.dll Jump to dropped file
Source: C:\Users\user\Desktop\Aimbot.exe File created: C:\Users\user\AppData\Local\Temp\_MEI73442\cryptography\hazmat\bindings\_rust.pyd Jump to dropped file
Source: C:\Users\user\Desktop\Aimbot.exe File created: C:\Users\user\AppData\Local\Temp\_MEI73442\VCRUNTIME140.dll Jump to dropped file
Source: C:\Users\user\Desktop\Aimbot.exe File created: C:\Users\user\AppData\Local\Temp\_MEI73442\_cffi_backend.cp312-win_amd64.pyd Jump to dropped file
Source: C:\Users\user\Desktop\Aimbot.exe File created: C:\Users\user\AppData\Local\Temp\_MEI73442\_socket.pyd Jump to dropped file
Source: C:\Users\user\Desktop\Aimbot.exe File created: C:\Users\user\AppData\Local\Temp\_MEI73442\_tkinter.pyd Jump to dropped file
Source: C:\Users\user\Desktop\Aimbot.exe File created: C:\Users\user\AppData\Local\Temp\_MEI73442\unicodedata.pyd Jump to dropped file
Source: C:\Users\user\Desktop\Aimbot.exe File created: C:\Users\user\AppData\Local\Temp\_MEI73442\_decimal.pyd Jump to dropped file
Source: C:\Users\user\Desktop\Aimbot.exe File created: C:\Users\user\AppData\Local\Temp\_MEI73442\_bz2.pyd Jump to dropped file
Source: C:\Users\user\Desktop\Aimbot.exe File created: C:\Users\user\AppData\Local\Temp\_MEI73442\_hashlib.pyd Jump to dropped file
Source: C:\Users\user\Desktop\Aimbot.exe File created: C:\Users\user\AppData\Local\Temp\_MEI73442\tk86t.dll Jump to dropped file
Source: C:\Users\user\Desktop\Aimbot.exe File created: C:\Users\user\AppData\Local\Temp\_MEI73442\python3.dll Jump to dropped file
Source: C:\Users\user\Desktop\Aimbot.exe File created: C:\Users\user\AppData\Local\Temp\_MEI73442\select.pyd Jump to dropped file
Source: C:\Users\user\Desktop\Aimbot.exe File created: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl86t.dll Jump to dropped file
Source: C:\Users\user\Desktop\Aimbot.exe File created: C:\Users\user\AppData\Local\Temp\_MEI73442\_lzma.pyd Jump to dropped file
Contains functionality to check if a window is minimized (may be used to check if an application is visible)
Source: C:\Users\user\Desktop\Aimbot.exe Code function: 1_2_00007FFDFB2C41F0 IsIconic,IsZoomed,AdjustWindowRectEx,SendMessageW,SendMessageW,GetSystemMetrics,MoveWindow,GetWindowRect,GetClientRect,MoveWindow,GetWindowRect,MoveWindow,DrawMenuBar, 1_2_00007FFDFB2C41F0
Extensive use of GetProcAddress (often used to hide API calls)
Source: C:\Users\user\Desktop\Aimbot.exe Code function: 0_2_00007FF74B4D53F0 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress, 0_2_00007FF74B4D53F0
Found dropped PE file which has not been started or loaded
Source: C:\Users\user\Desktop\Aimbot.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73442\python312.dll Jump to dropped file
Source: C:\Users\user\Desktop\Aimbot.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73442\cryptography\hazmat\bindings\_rust.pyd Jump to dropped file
Source: C:\Users\user\Desktop\Aimbot.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73442\_socket.pyd Jump to dropped file
Source: C:\Users\user\Desktop\Aimbot.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73442\_cffi_backend.cp312-win_amd64.pyd Jump to dropped file
Source: C:\Users\user\Desktop\Aimbot.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73442\_tkinter.pyd Jump to dropped file
Source: C:\Users\user\Desktop\Aimbot.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73442\unicodedata.pyd Jump to dropped file
Source: C:\Users\user\Desktop\Aimbot.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73442\_decimal.pyd Jump to dropped file
Source: C:\Users\user\Desktop\Aimbot.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73442\_bz2.pyd Jump to dropped file
Source: C:\Users\user\Desktop\Aimbot.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73442\_hashlib.pyd Jump to dropped file
Source: C:\Users\user\Desktop\Aimbot.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73442\python3.dll Jump to dropped file
Source: C:\Users\user\Desktop\Aimbot.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73442\select.pyd Jump to dropped file
Source: C:\Users\user\Desktop\Aimbot.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73442\_lzma.pyd Jump to dropped file
Found evasive API chain checking for process token information
Source: C:\Users\user\Desktop\Aimbot.exe Check user administrative privileges: GetTokenInformation,DecisionNodes
Found large amount of non-executed APIs
Source: C:\Users\user\Desktop\Aimbot.exe API coverage: 4.2 %
Source: C:\Users\user\Desktop\Aimbot.exe Code function: 0_2_00007FF74B4D8D00 FindFirstFileExW,FindClose, 0_2_00007FF74B4D8D00
Source: C:\Users\user\Desktop\Aimbot.exe Code function: 0_2_00007FF74B4E8670 _invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_invalid_parameter_noinfo,FindNextFileW,GetLastError, 0_2_00007FF74B4E8670
Source: C:\Users\user\Desktop\Aimbot.exe Code function: 0_2_00007FF74B4E8670 _invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_invalid_parameter_noinfo,FindNextFileW,GetLastError, 0_2_00007FF74B4E8670
Source: C:\Users\user\Desktop\Aimbot.exe Code function: 0_2_00007FF74B4F26C4 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose, 0_2_00007FF74B4F26C4
Source: C:\Users\user\Desktop\Aimbot.exe File opened: C:\Users\user\AppData\Local\Temp\ Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe File opened: C:\Users\user\AppData\Local\ Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe File opened: C:\Users\user\AppData\ Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe File opened: C:\Users\user\AppData\Local\Temp\_MEI73442\ Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe File opened: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl\ Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe File opened: C:\Users\user\ Jump to behavior
Source: Aimbot.exe, 00000001.00000002.2909205336.000001C688A10000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Source: C:\Users\user\Desktop\Aimbot.exe Code function: 0_2_00007FF74B4EB3CC RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 0_2_00007FF74B4EB3CC
Contains functionality to dynamically determine API calls
Source: C:\Users\user\Desktop\Aimbot.exe Code function: 1_2_00007FFDFB329E90 abort,strcmp,strcmp,GetModuleHandleW,GetModuleFileNameW,LoadLibraryW,GetProcAddress,strncmp, 1_2_00007FFDFB329E90
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Source: C:\Users\user\Desktop\Aimbot.exe Code function: 0_2_00007FF74B4F42D0 GetProcessHeap, 0_2_00007FF74B4F42D0
Source: C:\Users\user\Desktop\Aimbot.exe Code function: 0_2_00007FF74B4EB3CC RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 0_2_00007FF74B4EB3CC
Source: C:\Users\user\Desktop\Aimbot.exe Code function: 0_2_00007FF74B4DCA9C SetUnhandledExceptionFilter, 0_2_00007FF74B4DCA9C
Source: C:\Users\user\Desktop\Aimbot.exe Code function: 0_2_00007FF74B4DC030 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 0_2_00007FF74B4DC030
Source: C:\Users\user\Desktop\Aimbot.exe Code function: 0_2_00007FF74B4DC8BC IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 0_2_00007FF74B4DC8BC
Source: C:\Users\user\Desktop\Aimbot.exe Code function: 1_2_00007FFDFB39DEDC IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 1_2_00007FFDFB39DEDC
Source: C:\Users\user\Desktop\Aimbot.exe Code function: 1_2_00007FFDFB39D4C0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 1_2_00007FFDFB39D4C0
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\Aimbot.exe Process created: C:\Users\user\Desktop\Aimbot.exe "C:\Users\user\Desktop\Aimbot.exe" Jump to behavior
Contains functionality to query CPU information (cpuid)
Source: C:\Users\user\Desktop\Aimbot.exe Code function: 0_2_00007FF74B4FA620 cpuid 0_2_00007FF74B4FA620
Contains functionality to query locales information (e.g. system language)
Source: C:\Users\user\Desktop\Aimbot.exe Code function: InitCommonControlsEx,RegisterClassW,GetKeyboardLayout,GetLocaleInfoW,TranslateCharsetInfo, 1_2_00007FFDFB2C6890
Source: C:\Users\user\Desktop\Aimbot.exe Code function: OpenClipboard,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GetLocaleInfoA,GlobalUnlock,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,CloseClipboard, 1_2_00007FFDFB2A8660
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\cryptography-42.0.5.dist-info VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\cryptography-42.0.5.dist-info VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\cryptography-42.0.5.dist-info VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\cryptography-42.0.5.dist-info VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\cryptography-42.0.5.dist-info VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\cryptography-42.0.5.dist-info VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\cryptography-42.0.5.dist-info VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\cryptography-42.0.5.dist-info VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl8 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl8\8.4 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl8 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl8\8.5 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl8 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl\encoding VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl\encoding VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl\encoding VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl\encoding VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl\encoding VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl\encoding VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl\encoding VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl\encoding VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl\encoding VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl\encoding VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl\encoding VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl\encoding VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl\encoding VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl\encoding VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl\encoding VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl\encoding VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl\encoding VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl\encoding VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl\encoding VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl\encoding VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl\encoding VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl\encoding VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl\http1.0 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl\msgs VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl\msgs VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl\msgs VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl\msgs VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl\msgs VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl\msgs VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl\msgs VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl\msgs VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl\msgs VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl\msgs VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl\msgs VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl\msgs VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl\msgs VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl\msgs VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl\msgs VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl\msgs VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl\msgs VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl\msgs VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl\msgs VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl\msgs VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl\msgs VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl\msgs VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl\msgs VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl\msgs VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl\msgs VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl\msgs VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl\msgs VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl\msgs VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl\msgs VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl\msgs VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl\msgs VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl\msgs VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl\msgs VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl\msgs VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl\msgs VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl\msgs VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl\msgs VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl\msgs VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl\msgs VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl\msgs VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl\msgs VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl\msgs VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl\msgs VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl\msgs VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl\msgs VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl\msgs VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl\msgs VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl\msgs VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl\msgs VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl\msgs VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl\msgs VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl\msgs VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl\msgs VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl\msgs VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl\msgs VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl\msgs VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl\msgs VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl\msgs VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl\msgs VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl\msgs VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl\msgs VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl\msgs VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl\msgs VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl\msgs VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl\msgs VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl\msgs VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl\msgs VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl\opt0.4 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl\tzdata VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl\tzdata\Africa VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl\tzdata VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl\tzdata VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl\tzdata VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl\tzdata\Africa VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl\tzdata VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl\tzdata\Africa VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl\tzdata VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl\tzdata VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl\tzdata VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl\tzdata\Africa VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl\tzdata VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl\tzdata\Africa VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl\tzdata VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl\tzdata\Africa VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl\tzdata VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl\tzdata\Africa VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl\tzdata VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl\tzdata\Africa VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl\tzdata VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl\tzdata VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl\tzdata\Africa VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl\tzdata VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl\tzdata VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl\tzdata\Africa VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl\tzdata VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl\tzdata VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl\tzdata VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl\tzdata VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl\tzdata VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl\tzdata VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl\tzdata VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl\tzdata\Africa VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl\tzdata VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl\tzdata VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl\tzdata\Africa VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl\tzdata VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl\tzdata\Africa VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl\tzdata\Africa VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl\tzdata VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl\tzdata\America VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl\tzdata\America VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl\tzdata VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl\tzdata VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl\tzdata VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl\tzdata\America VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl\tzdata VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl\tzdata\America VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl\tzdata\America\Argentina VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl\tzdata VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl\tzdata\America\Argentina VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl\tzdata\America VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl\tzdata\America\Argentina VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl\tzdata VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl\tzdata\America\Argentina VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl\tzdata VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl\tzdata\America VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl\tzdata\America\Argentina VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl\tzdata\America VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl\tzdata\America\Argentina VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl\tzdata\America VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl\tzdata\America\Argentina VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl\tzdata\America\Argentina VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl\tzdata VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl\tzdata\America\Argentina VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl\tzdata\America VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl\tzdata\America VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl\tzdata\America VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl\tzdata VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl\tzdata\America VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl\tzdata\America VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl\tzdata VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl\tzdata\America VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl\tzdata VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl\tzdata\America VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl\tzdata\America VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl\tzdata\America VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl\tzdata VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl\tzdata\America VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl\tzdata VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl\tzdata\America VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\Desktop\Aimbot.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\Desktop\Aimbot.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\Desktop\Aimbot.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\Desktop\Aimbot.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\Desktop\Aimbot.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\Desktop\Aimbot.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\Desktop\Aimbot.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\base_library.zip VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\Desktop\Aimbot.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\Desktop\Aimbot.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\Desktop\Aimbot.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442 VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\_tkinter.pyd VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73442\tcl\encoding VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\Desktop\Aimbot.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Queries volume information: C:\Users\user\Desktop\Aimbot.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Aimbot.exe Code function: 0_2_00007FF74B4DC7A0 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter, 0_2_00007FF74B4DC7A0
Source: C:\Users\user\Desktop\Aimbot.exe Code function: 0_2_00007FF74B4F6B50 _get_daylight,_get_daylight,_get_daylight,_get_daylight,_get_daylight,GetTimeZoneInformation, 0_2_00007FF74B4F6B50
Source: C:\Users\user\Desktop\Aimbot.exe Code function: 1_2_00007FFDFB2C6A90 GetVersionExW,memset,RegOpenKeyExW,RegQueryValueExW,RegCloseKey, 1_2_00007FFDFB2C6A90
Source: C:\Users\user\Desktop\Aimbot.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 process2 2 Behavior Graph ID: 1431572 Sample: Aimbot.exe Startdate: 25/04/2024 Architecture: WINDOWS Score: 32 5 Aimbot.exe 991 2->5         started        file3 11 C:\Users\user\AppData\Local\...\zlib1.dll, PE32+ 5->11 dropped 13 C:\Users\user\AppData\...\unicodedata.pyd, PE32+ 5->13 dropped 15 C:\Users\user\AppData\Local\...\tk86t.dll, PE32+ 5->15 dropped 17 14 other files (none is malicious) 5->17 dropped 19 Found pyInstaller with non standard icon 5->19 9 Aimbot.exe 2 5->9         started        signatures4 process5
⊘No contacted IP infos