quasar | d580d7cf10f4eb1cd8aa0cbf80c30f832a0f052c33cdc3d1cf3710e6b67528a8

Analysis

max time kernel
291s
max time network
417s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
04-08-2023 22:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Remote Administration Tool.exe
Size

3.1MB
MD5

73dcb3b3b59192b45f1975fc7a8e9d08
SHA1

5fdaa30f92acc816c3b43db076f98c91391a3588
SHA256

d580d7cf10f4eb1cd8aa0cbf80c30f832a0f052c33cdc3d1cf3710e6b67528a8
SHA512

adce937291bf7c34e255d4b9785884552828cc07fc00b78842402e72e5addb31f61265c2aec593f5bdc1f041bdafd93758bfbc102c8ab25e4bbc7819c16aacc7
SSDEEP

49152:zv2I22SsaNYfdPBldt698dBcjHPby3EfsAk/WPPoGdfTHHB72eh2NT:zvb22SsaNYfdPBldt6+dBcjHPby2H

Score

10^/10

quasar infected spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Infected

AmirAmir8565-20409.portmap.host:20409

Mutex

ff410ede-beff-4970-8e12-7d251057f1fd

Attributes

encryption_key
1B172706DED462B59F2A5056AB06A8DD1EE8491B
install_name
Client.exe
log_directory
Logs
reconnect_delay
3000
startup_key
Realtek Audio
subdirectory
SubDir

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 3 IoCs

Processes:

resource	yara_rule
behavioral2/memory/1608-133-0x0000000000E50000-0x0000000001174000-memory.dmp	family_quasar
C:\Users\Admin\AppData\Roaming\SubDir\Client.exe	family_quasar
C:\Users\Admin\AppData\Roaming\SubDir\Client.exe	family_quasar

Drops file in Drivers directory 4 IoCs

Processes:

xKom0sZaO6bP.exeIeiMZOiQEQMY.exe

description	ioc	process
File opened for modification	C:\Windows\system32\drivers\myfault.sys	xKom0sZaO6bP.exe
File created	C:\Windows\system32\drivers\myfault.sys	xKom0sZaO6bP.exe
File opened for modification	C:\Windows\SysWOW64\drivers\myfault.sys	IeiMZOiQEQMY.exe
File created	C:\Windows\SysWOW64\drivers\myfault.sys	IeiMZOiQEQMY.exe

Executes dropped EXE 3 IoCs

Processes:

Client.exexKom0sZaO6bP.exeIeiMZOiQEQMY.exe

pid process

5088 Client.exe
3240 xKom0sZaO6bP.exe
2984 IeiMZOiQEQMY.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exeschtasks.exe

pid process

1932 schtasks.exe
3456 schtasks.exe
Suspicious behavior: LoadsDriver 4 IoCs

Processes:

pid process

656
656
656
656
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

Remote Administration Tool.exeClient.exe

description pid process

Token: SeDebugPrivilege 1608 Remote Administration Tool.exe
Token: SeDebugPrivilege 5088 Client.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

Client.exe

pid process

5088 Client.exe

pid	process
5088	Client.exe
3240	xKom0sZaO6bP.exe
2984	IeiMZOiQEQMY.exe

pid	process
1932	schtasks.exe
3456	schtasks.exe

pid	process
656
656
656
656

description	pid	process
Token: SeDebugPrivilege	1608	Remote Administration Tool.exe
Token: SeDebugPrivilege	5088	Client.exe

pid	process
5088	Client.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

Remote Administration Tool.exeClient.exeWScript.exeWScript.exe

description	pid	process	target process
PID 1608 wrote to memory of 1932	1608	Remote Administration Tool.exe	schtasks.exe
PID 1608 wrote to memory of 1932	1608	Remote Administration Tool.exe	schtasks.exe
PID 1608 wrote to memory of 5088	1608	Remote Administration Tool.exe	Client.exe
PID 1608 wrote to memory of 5088	1608	Remote Administration Tool.exe	Client.exe
PID 5088 wrote to memory of 3456	5088	Client.exe	schtasks.exe
PID 5088 wrote to memory of 3456	5088	Client.exe	schtasks.exe
PID 5088 wrote to memory of 3240	5088	Client.exe	xKom0sZaO6bP.exe
PID 5088 wrote to memory of 3240	5088	Client.exe	xKom0sZaO6bP.exe
PID 5088 wrote to memory of 2984	5088	Client.exe	IeiMZOiQEQMY.exe
PID 5088 wrote to memory of 2984	5088	Client.exe	IeiMZOiQEQMY.exe
PID 5088 wrote to memory of 2984	5088	Client.exe	IeiMZOiQEQMY.exe
PID 4696 wrote to memory of 4156	4696	WScript.exe	WScript.exe
PID 4696 wrote to memory of 4156	4696	WScript.exe	WScript.exe
PID 4696 wrote to memory of 5100	4696	WScript.exe	WScript.exe
PID 4696 wrote to memory of 5100	4696	WScript.exe	WScript.exe
PID 4696 wrote to memory of 972	4696	WScript.exe	WScript.exe
PID 4696 wrote to memory of 972	4696	WScript.exe	WScript.exe
PID 4696 wrote to memory of 544	4696	WScript.exe	WScript.exe
PID 4696 wrote to memory of 544	4696	WScript.exe	WScript.exe
PID 4696 wrote to memory of 5072	4696	WScript.exe	WScript.exe
PID 4696 wrote to memory of 5072	4696	WScript.exe	WScript.exe
PID 4696 wrote to memory of 4868	4696	WScript.exe	WScript.exe
PID 4696 wrote to memory of 4868	4696	WScript.exe	WScript.exe
PID 4696 wrote to memory of 1400	4696	WScript.exe	WScript.exe
PID 4696 wrote to memory of 1400	4696	WScript.exe	WScript.exe
PID 4696 wrote to memory of 2852	4696	WScript.exe	WScript.exe
PID 4696 wrote to memory of 2852	4696	WScript.exe	WScript.exe
PID 4512 wrote to memory of 2744	4512	WScript.exe	WScript.exe
PID 4512 wrote to memory of 2744	4512	WScript.exe	WScript.exe
PID 4696 wrote to memory of 2392	4696	WScript.exe	WScript.exe
PID 4696 wrote to memory of 2392	4696	WScript.exe	WScript.exe
PID 4512 wrote to memory of 4920	4512	WScript.exe	WScript.exe
PID 4512 wrote to memory of 4920	4512	WScript.exe	WScript.exe
PID 4696 wrote to memory of 4388	4696	WScript.exe	WScript.exe
PID 4696 wrote to memory of 4388	4696	WScript.exe	WScript.exe
PID 4512 wrote to memory of 3516	4512	WScript.exe	WScript.exe
PID 4512 wrote to memory of 3516	4512	WScript.exe	WScript.exe
PID 4696 wrote to memory of 4772	4696	WScript.exe	WScript.exe
PID 4696 wrote to memory of 4772	4696	WScript.exe	WScript.exe
PID 4512 wrote to memory of 3484	4512	WScript.exe	WScript.exe
PID 4512 wrote to memory of 3484	4512	WScript.exe	WScript.exe
PID 4696 wrote to memory of 808	4696	WScript.exe	WScript.exe
PID 4696 wrote to memory of 808	4696	WScript.exe	WScript.exe
PID 4512 wrote to memory of 3028	4512	WScript.exe	WScript.exe
PID 4512 wrote to memory of 3028	4512	WScript.exe	WScript.exe
PID 4696 wrote to memory of 2588	4696	WScript.exe	WScript.exe
PID 4696 wrote to memory of 2588	4696	WScript.exe	WScript.exe
PID 4512 wrote to memory of 2304	4512	WScript.exe	WScript.exe
PID 4512 wrote to memory of 2304	4512	WScript.exe	WScript.exe
PID 4696 wrote to memory of 3760	4696	WScript.exe	WScript.exe
PID 4696 wrote to memory of 3760	4696	WScript.exe	WScript.exe
PID 4512 wrote to memory of 3460	4512	WScript.exe	WScript.exe
PID 4512 wrote to memory of 3460	4512	WScript.exe	WScript.exe
PID 4696 wrote to memory of 4392	4696	WScript.exe	WScript.exe
PID 4696 wrote to memory of 4392	4696	WScript.exe	WScript.exe
PID 4512 wrote to memory of 2412	4512	WScript.exe	WScript.exe
PID 4512 wrote to memory of 2412	4512	WScript.exe	WScript.exe
PID 4696 wrote to memory of 2040	4696	WScript.exe	WScript.exe
PID 4696 wrote to memory of 2040	4696	WScript.exe	WScript.exe
PID 4512 wrote to memory of 3012	4512	WScript.exe	WScript.exe
PID 4512 wrote to memory of 3012	4512	WScript.exe	WScript.exe
PID 4696 wrote to memory of 520	4696	WScript.exe	WScript.exe
PID 4696 wrote to memory of 520	4696	WScript.exe	WScript.exe
PID 4512 wrote to memory of 2436	4512	WScript.exe	WScript.exe

C:\Users\Admin\AppData\Local\Temp\Remote Administration Tool.exe
"C:\Users\Admin\AppData\Local\Temp\Remote Administration Tool.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1608

C:\Windows\SYSTEM32\schtasks.exe
"schtasks" /create /tn "Realtek Audio" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
2⤵
- Creates scheduled task(s)
PID:1932

C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
"C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5088

C:\Windows\SYSTEM32\schtasks.exe
"schtasks" /create /tn "Realtek Audio" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
3⤵
- Creates scheduled task(s)
PID:3456

C:\Users\Admin\AppData\Local\Temp\xKom0sZaO6bP.exe
"C:\Users\Admin\AppData\Local\Temp\xKom0sZaO6bP.exe"
3⤵
- Drops file in Drivers directory
- Executes dropped EXE
PID:3240

C:\Users\Admin\AppData\Local\Temp\IeiMZOiQEQMY.exe
"C:\Users\Admin\AppData\Local\Temp\IeiMZOiQEQMY.exe"
3⤵
- Drops file in Drivers directory
- Executes dropped EXE
PID:2984

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs"
1⤵
- Suspicious use of WriteProcessMemory
PID:4696

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:4156

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:5100

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:972

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:544

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:5072

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:4868

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:1400

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:2852

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:2392

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:4388

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:4772

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:808

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:2588

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:3760

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:4392

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:2040

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:520

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:1748

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:4252

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:3764

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:1704

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:2196

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:1860

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:1904

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:4960

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:1956

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:1076

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:1324

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:4808

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:1540

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:3972

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:1200

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:2980

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:4024

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:432

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:1656

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:1404

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:3636

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:2924

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:3740

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:5024

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:2092

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:2312

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:3236

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:3704

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:4072

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:1612

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:4744

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:4504

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:2972

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:2864

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:2508

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:672

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:4220

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:4308

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:5116

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:3560

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:1840

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:4640

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:1524

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:3216

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:4488

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:4304

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:2736

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:3328

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:1540

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:3452

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:2488

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:3556

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:1480

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:3488

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:4828

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:4800

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:3636

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:2924

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:2984

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:2116

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:4332

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:376

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:2392

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:4732

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:3028

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:2096

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:4124

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:3184

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:2040

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:3976

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:1256

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:2720

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:4416

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:4716

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:3804

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:3788

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:1356

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:1524

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:2996

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:400

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:4304

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:4052

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:1232

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:5028

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:4264

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:3240

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:976

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:3492

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:2112

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:1900

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:1052

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:448

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:4588

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:5068

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:3604

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:4928

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:1604

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:760

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:1196

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:1172

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:4884

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:184

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:2460

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:2040

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:2708

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:3024

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:4308

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:928

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:2900

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:3804

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:4016

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:2904

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:1600

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:4980

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:1708

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:4216

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:228

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:3964

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:3872

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:4548

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:232

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:4024

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:1252

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:1656

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:1408

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:2076

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:4788

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:4460

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:4164

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:4948

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:1312

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:640

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:3516

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:1108

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:2588

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:3784

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:1736

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:508

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:628

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:672

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:5036

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:3816

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:1704

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:2900

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:3804

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:3540

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:1956

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:696

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:3628

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:1596

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:4100

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:4052

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:1232

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:2512

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:3316

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:4784

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:432

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:3196

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:2108

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:4156

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:4816

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:4328

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:1400

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:1756

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:2892

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:5064

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:4576

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:1196

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:3768

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:3988

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:1684

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:4504

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:520

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:2708

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:3764

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:3260

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:4340

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:3008

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:1800

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:1716

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:2448

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:1976

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:764

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:4944

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:4432

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:780

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:4052

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:536

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:3452

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:2364

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:4516

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:812

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:4688

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:1900

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:3312

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:4664

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:4968

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:4868

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:2092

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:4388

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:348

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:4992

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:116

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:3512

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:700

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:2168

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:4212

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:2328

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:1652

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:5036

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:4348

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:1860

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:2152

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:1800

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:2836

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:460

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:1976

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:1600

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:2728

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:1596

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:3944

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:5092

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:5052

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:4280

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:4780

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:4060

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:1916

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:1676

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:4800

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:972

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:4588

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:4832

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:888

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:4956

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:1312

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:3852

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:4576

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:836

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:864

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:908

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:2828

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:3976

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:2016

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:672

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:4236

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:4308

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:4416

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:1136

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:2256

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:1440

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:1356

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:4064

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:3432

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:1428

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:4288

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:4100

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:1232

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:3972

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:3240

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:4496

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:4784

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:3848

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:1656

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:3444

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:4816

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:4788

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:4004

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:5084

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:4680

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:4772

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:3252

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:808

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:2096

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:1172

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:4444

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:1844

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:508

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:4864

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:616

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:672

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:4464

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:1828

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:3480

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:1560

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:4492

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:2904

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:1356

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:3064

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:4432

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:1428

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:4288

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:4100

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:5052

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:1200

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:1940

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:2300

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:1252

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:4448

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:3196

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:3444

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:4248

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:448

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:1648

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:4928

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:3324

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:4580

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:3364

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:4744

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:836

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:4392

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:2588

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:5104

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:1256

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:3812

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:4252

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:3764

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:4984

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:1984

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:2748

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:1800

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:2032

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:3540

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:4488

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:980

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:1372

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:3736

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:2636

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:4528

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:2936

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:1200

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:3556

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:2300

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:4784

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:1900

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:3172

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:4564

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:3424

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:1400

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:4968

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:888

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:4388

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:2092

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:3364

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:4732

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:2672

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:532

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:3824

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:4320

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:4212

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:4272

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:1188

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:672

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:3912

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:3008

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:2152

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:3788

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:964

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:1992

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:696

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:1076

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:780

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:2064

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:5092

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:4260

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:4880

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:2488

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:4132

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:3856

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:4784

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:4800

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:972

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:3444

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:4788

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:1648

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:2248

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:3704

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:5064

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:3852

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:2472

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:4992

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:1572

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:4884

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:4768

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:4320

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:4212

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:4272

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:4308

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:4016

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:1704

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:2256

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:3140

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:460

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:3668

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:4944

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:4304

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:764

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:536

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:4908

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:3932

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:2704

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:3036

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:812

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:2108

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:1404

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:3196

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:3248

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:4344

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:5032

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:5072

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:3236

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:2852

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:3704

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:5064

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:3768

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:864

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:4992

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:1912

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:3784

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:4768

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:3980

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:2328

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:2876

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:1828

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:880

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:1524

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:1440

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:2836

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:2700

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:3048

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:912

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:780

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:3504

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:4264

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:2424

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:4548

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:1200

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:3036

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:3492

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:4828

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:4692

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:1112

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:4456

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:4832

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:4164

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:4228

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:4680

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:4580

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:2092

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:3124

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:2020

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:2468

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:184

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:2460

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:2884

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:4708

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:3700

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:3260

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:4464

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:1960

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:3008

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:3480

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:3212

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:2836

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:1356

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:980

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:1076

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:4980

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:536

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:3328

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:744

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:4880

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:976

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:3556

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:1212

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:4784

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:3196

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:5024

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:3444

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:5084

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:4332

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:4920

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:4440

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:2716

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:4276

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:2304

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:1392

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:2168

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:832

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:2460

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:4444

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:4212

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:2508

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:672

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:2156

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:4984

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs"
1⤵
- Suspicious use of WriteProcessMemory
PID:4512

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:2744

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:4920

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:3516

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:3484

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:3028

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:2304

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:3460

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:2412

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:3012

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:2436

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:4272

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:3648

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:1180

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:1240

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:4892

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:2756

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:3668

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:1992

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:400

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:2736

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:872

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:780

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:1132

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:3256

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:232

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:4280

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:3492

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:1940

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:3352

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:2320

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:4848

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:4832

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:5012

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:5084

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:2248

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:1604

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:4584

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:1196

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:3784

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:4444

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:1736

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:1168

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:2444

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:616

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:2740

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:4340

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:4348

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:1960

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:1440

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:4644

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:964

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:3212

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:5080

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:3048

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:228

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:872

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:4528

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:3972

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:1200

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:3036

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:1252

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:4592

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:1900

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:1052

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:448

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:5032

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:4832

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:5012

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:4928

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:640

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:4576

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:3484

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:2712

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:1912

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:4444

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:4212

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:2412

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:3012

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:3040

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:3816

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:2404

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:4372

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:2152

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:3140

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:4640

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:1976

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:3216

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:1248

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:4216

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:2064

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:4284

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:1048

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:5052

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:1200

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:2896

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:1252

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:3856

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:4828

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:2076

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:4788

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:1112

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:3424

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:1756

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:4332

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:4276

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:3336

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:116

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:1392

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:3784

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:2168

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:2972

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:2884

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:1652

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:616

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:3812

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:4416

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:404

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:3780

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:2448

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:2756

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:1976

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:3216

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:1596

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:1792

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:2064

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:4312

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:1048

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:2704

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:4672

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:3924

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:5000

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:3352

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:4828

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:4664

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:972

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:1112

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:3424

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:2172

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:2312

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:3364

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:2716

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:636

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:3124

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:4364

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:1328

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:4504

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:1168

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:2016

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:1296

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:2720

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:4340

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:1828

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:2196

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:4932

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:4960

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:3716

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:3728

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:3216

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:4160

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:2192

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:4452

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:1540

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:2936

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:2364

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:2980

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:812

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:4020

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:3352

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:2320

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:5100

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:4344

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:624

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:4164

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:4680

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:4276

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:1612

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:2716

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:2420

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:2020

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:1548

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:4212

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:4860

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:4708

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:3980

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:4220

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:2720

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:3652

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:1704

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:2900

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:3804

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:4960

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:2072

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:2996

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:4808

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:3736

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:872

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:4376

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:3376

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:2424

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:4780

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:1804

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:2288

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:5000

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:3392

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:4564

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:5032

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:544

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:4460

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:376

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:4920

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:4440

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:1636

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:3516

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:2472

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:4392

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:1328

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:1736

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:3796

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:2884

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:2708

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:4736

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:5116

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:404

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:3780

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:3140

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:4684

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:3668

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:4064

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:980

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:4980

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:4160

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:2192

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:3328

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:3376

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:1504

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:4496

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:2980

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:1252

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:3196

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:2632

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:1484

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:4456

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:5032

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:4968

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:4460

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:2092

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:4580

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:3364

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:1308

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:3484

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:1912

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:700

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:4320

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:3460

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:2412

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:3024

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:1892

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:2720

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:2196

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:3780

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:3140

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:4092

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:3668

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:2216

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:2996

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:3048

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:3736

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:4284

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:1540

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:4908

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:3452

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:976

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:4516

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:2772

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:1616

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:3172

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:4248

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:2868

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:2504

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:1528

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:3224

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:1584

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:3336

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:3852

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:4992

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:1572

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:2588

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:2460

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:1748

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:1344

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:3012

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:2876

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:1680

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:1860

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:2152

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:3660

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:3140

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:4092

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:3668

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:4064

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:764

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:1236

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:3368

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:4452

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:2936

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:1504

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:1144

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:1480

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:4784

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:2772

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:4848

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:1052

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:4816

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:2868

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:888

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:4956

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:5064

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:1312

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:2468

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:1308

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:1572

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:3824

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:2444

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:2864

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:628

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:1652

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:1260

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:2720

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:4892

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:4416

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:3780

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:2836

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:460

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:2660

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:4064

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:764

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:1428

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:4288

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:3328

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:5028

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:2488

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:5016

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:4592

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:1404

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:408

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:2320

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:4952

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:5012

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:2504

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:4332

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:2892

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:4772

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:1196

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:2468

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:4124

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:4884

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:4444

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:3460

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:508

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:1344

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:2740

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:2404

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:2156

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:880

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:3480

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:3356

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:2032

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:4092

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:3216

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:3064

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:4980

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:1428

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:4376

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:744

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:2512

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:3972

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:2896

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:1212

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:4648

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:1900

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:4156

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:4564

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:4952

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:2868

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:4968

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:888

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:2892

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:4772

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:3364

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:2468

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:2672

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:700

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:4444

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:1168

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:2328

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:4236

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:4464

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:1136

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:2756

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:2264

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:1716

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:3356

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:3628

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:4488

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:1744

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:1372

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:3736

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:3256

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:4204

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:3000

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:4516

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:2112

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:4060

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:1408

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:3312

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:3740

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:4844

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:4248

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:4948

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:3224

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:640

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:4276

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:4584

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:2420

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:3988

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:512

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:3824

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:4444

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:1168

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:3012

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:1820

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:3652

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:2156

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:4984

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:1704

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:3660

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:4640

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:1992

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:3668

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:2100

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:1744

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:872

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:4536

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:3944

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:5028

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:1940

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:1660

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:1916

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:1252

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:1900

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:2320

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:544

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:448

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:2312

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:1528

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:348

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:3516

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:4772

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:4584

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:1172

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:2168

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:2588

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:1748

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:4912

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:2412

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:3816

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:3764

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:1260

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:1828

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:2756

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:2256

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:1440

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:400

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:2700

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:3064

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:1708

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:764

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:1540

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:4376

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:4672

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:960

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:1940

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:2112

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:3848

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:4828

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:3312

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:2320

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:3384

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:2868

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:3324

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:2248

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:888

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:1636

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:4732

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:4584

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:4392

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:1572

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:3784

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:1256

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:1344

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:3012

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:4716

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:3648

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\crash.vbs" "/task"
2⤵
PID:3468

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IeiMZOiQEQMY.exe
Filesize
299KB

MD5
833d5bbdf80d17a384e9b27798ea4d6c

SHA1
4ab55a97e76fd2cdb55ed305c984d87e9a06b1b1

SHA256
41ddb886060471d702693cbff1e7aa73c8ada5b29d9ee313de9972ab663a100d

SHA512
ae0011fd58b09f752d2c1a926b8740780798cd17b2704adb666826d8334e07208ceaac661122c8d7ac82178f3f39aee2ac2724776e96dfd3ee526d9e98a82ec8

Download Submit
C:\Users\Admin\AppData\Local\Temp\IeiMZOiQEQMY.exe
Filesize
299KB

MD5
833d5bbdf80d17a384e9b27798ea4d6c

SHA1
4ab55a97e76fd2cdb55ed305c984d87e9a06b1b1

SHA256
41ddb886060471d702693cbff1e7aa73c8ada5b29d9ee313de9972ab663a100d

SHA512
ae0011fd58b09f752d2c1a926b8740780798cd17b2704adb666826d8334e07208ceaac661122c8d7ac82178f3f39aee2ac2724776e96dfd3ee526d9e98a82ec8

Download Submit
C:\Users\Admin\AppData\Local\Temp\IeiMZOiQEQMY.exe
Filesize
299KB

MD5
833d5bbdf80d17a384e9b27798ea4d6c

SHA1
4ab55a97e76fd2cdb55ed305c984d87e9a06b1b1

SHA256
41ddb886060471d702693cbff1e7aa73c8ada5b29d9ee313de9972ab663a100d

SHA512
ae0011fd58b09f752d2c1a926b8740780798cd17b2704adb666826d8334e07208ceaac661122c8d7ac82178f3f39aee2ac2724776e96dfd3ee526d9e98a82ec8

Download Submit
C:\Users\Admin\AppData\Local\Temp\KRSMOt981dki.exe
Filesize
336KB

MD5
2f215d219aeab3d6b3ff357a0fbe53e7

SHA1
1fd769b02426ad459c5af6a77b3f2dad3b7388e0

SHA256
9526f9d840f43f702181d5f77d201f27bf2ec38274ac73703a8df6d6264b68a5

SHA512
b2ad375986f55b30ffc154b7452b622bba2d825ec7f8d5cca29927c01af8cc867c712ca6ba8c76ae8cc8b8657aadcb68ddbda8e717e810c386dfb71bad21e162

Download Submit
C:\Users\Admin\AppData\Local\Temp\xKom0sZaO6bP.exe
Filesize
339KB

MD5
c338b6fd5b568411039d8a46394133cf

SHA1
06a684c8e8ec66396db2685c0419c8bfb78b1220

SHA256
817cd2e8846c5d90782017a7f29daf7915e5e38e6dd165fb81cdd4642e90f218

SHA512
161f6746bb526a9a1af8d581ccec796119ea0f2d6d7608a12248c698ec9fc1803afd79f162cdc59357a75a3744ad9363c9ba92ed73dc7c04b14523d54a584b18

Download Submit
C:\Users\Admin\AppData\Local\Temp\xKom0sZaO6bP.exe
Filesize
339KB

MD5
c338b6fd5b568411039d8a46394133cf

SHA1
06a684c8e8ec66396db2685c0419c8bfb78b1220

SHA256
817cd2e8846c5d90782017a7f29daf7915e5e38e6dd165fb81cdd4642e90f218

SHA512
161f6746bb526a9a1af8d581ccec796119ea0f2d6d7608a12248c698ec9fc1803afd79f162cdc59357a75a3744ad9363c9ba92ed73dc7c04b14523d54a584b18

Download Submit
C:\Users\Admin\AppData\Local\Temp\xKom0sZaO6bP.exe
Filesize
339KB

MD5
c338b6fd5b568411039d8a46394133cf

SHA1
06a684c8e8ec66396db2685c0419c8bfb78b1220

SHA256
817cd2e8846c5d90782017a7f29daf7915e5e38e6dd165fb81cdd4642e90f218

SHA512
161f6746bb526a9a1af8d581ccec796119ea0f2d6d7608a12248c698ec9fc1803afd79f162cdc59357a75a3744ad9363c9ba92ed73dc7c04b14523d54a584b18

Download Submit
C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
Filesize
3.1MB

MD5
73dcb3b3b59192b45f1975fc7a8e9d08

SHA1
5fdaa30f92acc816c3b43db076f98c91391a3588

SHA256
d580d7cf10f4eb1cd8aa0cbf80c30f832a0f052c33cdc3d1cf3710e6b67528a8

SHA512
adce937291bf7c34e255d4b9785884552828cc07fc00b78842402e72e5addb31f61265c2aec593f5bdc1f041bdafd93758bfbc102c8ab25e4bbc7819c16aacc7

Download Submit
C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
Filesize
3.1MB

MD5
73dcb3b3b59192b45f1975fc7a8e9d08

SHA1
5fdaa30f92acc816c3b43db076f98c91391a3588

SHA256
d580d7cf10f4eb1cd8aa0cbf80c30f832a0f052c33cdc3d1cf3710e6b67528a8

SHA512
adce937291bf7c34e255d4b9785884552828cc07fc00b78842402e72e5addb31f61265c2aec593f5bdc1f041bdafd93758bfbc102c8ab25e4bbc7819c16aacc7

Download Submit
C:\Users\Admin\Desktop\New Text Document.bat
Filesize
18B

MD5
e738db84c2b41a9630f341304f614f5d

SHA1
f723a459d852646201d3a202b452bc989c3f78a6

SHA256
44a09f68b3e46ca99c4729ba8644a2d4816bf62227af61a16c8286588206c378

SHA512
a8d2185c605d4053887798fafbc842385806fce175cddfe80be544f6b903b4557518e50ed32a3846800f17ceccb21f6cd2f5ad21caa3ed3844a9aaa1347ae405

Download Submit
C:\Users\Admin\Desktop\crash.vbs
Filesize
307B

MD5
8899c5aac2273b585a823ed111b779c6

SHA1
9543c2bcbed13a7bc89d6af60178ec948573e5e8

SHA256
78f5f5b29114095799ba9a4c6a2954b684dd4c9bfcff1d96a929e16af989cf23

SHA512
23d7f91a495733b8836c5b6a6eab364bc9f817e351dfefcf82d37c7f5d1bbd90bcaccdb7a5c0ae8074920314955791e2eaba176ec3edca165f02696850693546

Download Submit
C:\Windows\SysWOW64\drivers\myfault.sys
Filesize
21KB

MD5
d5adea32410f975ea943521da0f7f31f

SHA1
835896d28dbe897fe11c8605f59588741389c152

SHA256
49c93b06246d47522e1a9cb9b1f5e0513db736bc466983eebfbf4445479d9419

SHA512
5f4814e3de3cfecaf3f4b2a9daea783e8d61a516b2ef3298205fca050a4674bdc5f38c2823b33e8aee24346efcd56a75a92409be9ee2414cc2b178b95322743a

Download Submit
memory/696-194-0x00007FFF334F6000-0x00007FFF334F8000-memory.dmp

Filesize
8KB

Download
memory/1608-143-0x00007FFF16F10000-0x00007FFF179D1000-memory.dmp

Filesize
10.8MB

Download
memory/1608-133-0x0000000000E50000-0x0000000001174000-memory.dmp

Filesize
3.1MB

Download
memory/1608-135-0x000000001BD60000-0x000000001BD70000-memory.dmp

Filesize
64KB

Download
memory/1608-134-0x00007FFF16F10000-0x00007FFF179D1000-memory.dmp

Filesize
10.8MB

Download
memory/5088-152-0x000000001B710000-0x000000001B720000-memory.dmp

Filesize
64KB

Download
memory/5088-151-0x00007FFF16F10000-0x00007FFF179D1000-memory.dmp

Filesize
10.8MB

Download
memory/5088-150-0x000000001B660000-0x000000001B69C000-memory.dmp

Filesize
240KB

Download
memory/5088-149-0x000000001B4E0000-0x000000001B4F2000-memory.dmp

Filesize
72KB

Download
memory/5088-146-0x000000001C070000-0x000000001C122000-memory.dmp

Filesize
712KB

Download
memory/5088-145-0x0000000002B90000-0x0000000002BE0000-memory.dmp

Filesize
320KB

Download
memory/5088-144-0x000000001B710000-0x000000001B720000-memory.dmp

Filesize
64KB

Download
memory/5088-142-0x00007FFF16F10000-0x00007FFF179D1000-memory.dmp

Filesize
10.8MB

Download
memory/5088-196-0x000000001E370000-0x000000001E898000-memory.dmp

Filesize
5.2MB

Download