d93f2af6693e7ff08fbb86489a655f5826770afbfdaaa1d92f3c95863fe4dddd

Analysis

max time kernel
56s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
17/02/2024, 07:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Gang gang.bat
Size

875B
MD5

ebf8147339252dd930d426233a2c3d11
SHA1

8e56aad7e0de85f5bc29d139923a15cc1c72163f
SHA256

d93f2af6693e7ff08fbb86489a655f5826770afbfdaaa1d92f3c95863fe4dddd
SHA512

519ed9558412e6e5dad43da9a8e9a0bf0f5d14c506923472c18eff3a587d834f9d717e9de8973bef7a832563fb344709866fdffb14f8189cbce25f18d12d95b6

Score

8^/10

Malware Config

Signatures

Blocklisted process makes network request 5 IoCs

flow	pid	Process
28	8884	WScript.exe
32	8884	WScript.exe
37	8884	WScript.exe
41	8884	WScript.exe
44	8884	WScript.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Control Panel\International\Geo\Nation	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000_Classes\Local Settings	cmd.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
744	cmd.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 744 wrote to memory of 1816	744	cmd.exe	86
PID 744 wrote to memory of 1816	744	cmd.exe	86
PID 744 wrote to memory of 4324	744	cmd.exe	87
PID 744 wrote to memory of 4324	744	cmd.exe	87
PID 744 wrote to memory of 976	744	cmd.exe	88
PID 744 wrote to memory of 976	744	cmd.exe	88
PID 744 wrote to memory of 216	744	cmd.exe	89
PID 744 wrote to memory of 216	744	cmd.exe	89
PID 744 wrote to memory of 3016	744	cmd.exe	90
PID 744 wrote to memory of 3016	744	cmd.exe	90
PID 744 wrote to memory of 3292	744	cmd.exe	91
PID 744 wrote to memory of 3292	744	cmd.exe	91
PID 744 wrote to memory of 3800	744	cmd.exe	93
PID 744 wrote to memory of 3800	744	cmd.exe	93
PID 744 wrote to memory of 4424	744	cmd.exe	92
PID 744 wrote to memory of 4424	744	cmd.exe	92
PID 744 wrote to memory of 3960	744	cmd.exe	94
PID 744 wrote to memory of 3960	744	cmd.exe	94
PID 744 wrote to memory of 4240	744	cmd.exe	95
PID 744 wrote to memory of 4240	744	cmd.exe	95
PID 744 wrote to memory of 468	744	cmd.exe	96
PID 744 wrote to memory of 468	744	cmd.exe	96
PID 744 wrote to memory of 1036	744	cmd.exe	97
PID 744 wrote to memory of 1036	744	cmd.exe	97
PID 744 wrote to memory of 4400	744	cmd.exe	98
PID 744 wrote to memory of 4400	744	cmd.exe	98
PID 744 wrote to memory of 4660	744	cmd.exe	99
PID 744 wrote to memory of 4660	744	cmd.exe	99
PID 744 wrote to memory of 3108	744	cmd.exe	100
PID 744 wrote to memory of 3108	744	cmd.exe	100
PID 744 wrote to memory of 3908	744	cmd.exe	101
PID 744 wrote to memory of 3908	744	cmd.exe	101
PID 744 wrote to memory of 4212	744	cmd.exe	102
PID 744 wrote to memory of 4212	744	cmd.exe	102
PID 744 wrote to memory of 3704	744	cmd.exe	103
PID 744 wrote to memory of 3704	744	cmd.exe	103
PID 744 wrote to memory of 1408	744	cmd.exe	104
PID 744 wrote to memory of 1408	744	cmd.exe	104
PID 744 wrote to memory of 2596	744	cmd.exe	105
PID 744 wrote to memory of 2596	744	cmd.exe	105
PID 744 wrote to memory of 4696	744	cmd.exe	106
PID 744 wrote to memory of 4696	744	cmd.exe	106
PID 744 wrote to memory of 3156	744	cmd.exe	107
PID 744 wrote to memory of 3156	744	cmd.exe	107
PID 744 wrote to memory of 3556	744	cmd.exe	108
PID 744 wrote to memory of 3556	744	cmd.exe	108
PID 744 wrote to memory of 3684	744	cmd.exe	109
PID 744 wrote to memory of 3684	744	cmd.exe	109
PID 744 wrote to memory of 4752	744	cmd.exe	110
PID 744 wrote to memory of 4752	744	cmd.exe	110
PID 744 wrote to memory of 3044	744	cmd.exe	111
PID 744 wrote to memory of 3044	744	cmd.exe	111
PID 744 wrote to memory of 2024	744	cmd.exe	112
PID 744 wrote to memory of 2024	744	cmd.exe	112
PID 744 wrote to memory of 5040	744	cmd.exe	113
PID 744 wrote to memory of 5040	744	cmd.exe	113
PID 744 wrote to memory of 852	744	cmd.exe	114
PID 744 wrote to memory of 852	744	cmd.exe	114
PID 744 wrote to memory of 1720	744	cmd.exe	115
PID 744 wrote to memory of 1720	744	cmd.exe	115
PID 744 wrote to memory of 4336	744	cmd.exe	116
PID 744 wrote to memory of 4336	744	cmd.exe	116
PID 744 wrote to memory of 3232	744	cmd.exe	117
PID 744 wrote to memory of 3232	744	cmd.exe	117

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Gang gang.bat"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:744
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:1816
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:4324
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:976
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:216
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:3016
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:3292
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:4424
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:3800
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:3960
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:4240
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:468
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:1036
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:4400
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:4660
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:3108
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:3908
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:4212
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:3704
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:1408
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:2596
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:4696
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:3156
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:3556
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:3684
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:4752
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:3044
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:2024
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:5040
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:852
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:1720
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:4336
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:3232
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:4260
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:4544
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:3504
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:4700
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:4416
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:4880
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:3248
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:4560
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:3888
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:1708
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:4500
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:4584
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:5004
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:624
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:3528
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:712
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:376
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:4060
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:4636
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:3356
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:4804
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:4568
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:4616
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:3972
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:3768
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:3600
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:3560
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:4376
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:4992
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:1460
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:4012
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:4548
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:2580
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:1296
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:864
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:4504
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:4580
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:1992
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:1916
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:4488
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:552
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:4448
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:3764
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:4060
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:3064
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:3480
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:3728
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:4920
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:3096
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:4200
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:3572
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:1668
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:1536
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:3040
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:2472
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:4312
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:624
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:548
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:1680
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:668
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:1868
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:2740
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:1460
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:448
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:2592
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:1300
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:2496
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:1544
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:3480
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:2620
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:3232
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:856
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:4488
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:464
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:2740
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:4444
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:4040
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:4756
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:4568
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:464
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:5184
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:5200
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:5256
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:5264
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:5344
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:5328
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:5416
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:5400
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:5476
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:5488
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:5548
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:5556
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:5672
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:5680
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:5828
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:5812
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:5920
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:5932
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:5992
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:6012
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:6072
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:6084
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:6140
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:4784
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:5212
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:5236
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:5316
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:5324
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:5416
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:5452
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:5512
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:5568
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:5756
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:5788
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:5908
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:5952
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:6044
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:6012
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:6128
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:4756
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:5236
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:5292
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:5456
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:5468
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:5832
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:5680
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:6012
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:6088
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:5304
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:1300
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:5380
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:5716
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:5172
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:6088
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:2180
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:5540
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:1748
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:5968
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:1860
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:3172
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:5388
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:3172
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:6184
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:6176
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:6256
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:6248
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:6324
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:6316
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:6388
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:6396
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:6456
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:6468
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:6532
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:6524
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:6600
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:6592
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:6672
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:6660
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:6728
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:6744
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:6800
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:6812
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:6868
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:6880
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:6948
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:6936
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:7012
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:7004
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:7080
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:7072
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:7148
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:7140
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:6168
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:6192
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:6240
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:6244
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:6328
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:6300
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:6472
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:6468
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:6652
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:6688
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:6852
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:6844
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:6964
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:6984
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:7068
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:7116
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:6184
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:6160
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:6244
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:6332
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:6604
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:1236
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:6852
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:6896
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:7056
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:7136
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:2248
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:6184
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:6520
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:6684
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:7000
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:7012
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:6292
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:6400
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:7148
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:6156
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:6448
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:7132
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:7204
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:7216
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:7300
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:7312
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:7380
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:7372
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:7460
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:7476
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:7536
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:7548
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:7628
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:7620
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:7688
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:7700
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:7768
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:7756
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:7824
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:7832
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:7900
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:7892
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:7964
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:7956
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:8040
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:8024
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:8104
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:8096
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:8164
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:8176
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:7220
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:7268
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:7360
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:7384
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:7492
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:6684
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:5124
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:7560
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:7592
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:7600
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:7700
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:7712
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:7816
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:7812
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:7940
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:7948
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:8040
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:8056
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:8180
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:8156
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:7352
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:7312
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:3992
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:5584
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:7604
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:7612
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:4468
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:7800
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:8012
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:7948
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:8144
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:7184
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:5156
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:7492
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:7732
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:7700
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:8088
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:8012
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:7520
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:7352
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:7912
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:7964
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:7520
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:5156
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:7684
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:7388
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:8196
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:5880
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:8260
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:8288
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:8328
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:8344
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:8404
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:8396
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:8464
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:8476
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:8540
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:8532
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:8608
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:8600
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:8672
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:8684
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:8748
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:8740
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:8808
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:8816
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:8884
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:8876
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:8956
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:8948
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:9024
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:9016
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:9088
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:9104
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:9168
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:9160
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:8216
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:7684
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:8320
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:8304
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:8444
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:8404
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:8552
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:8556
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:8648
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:8660
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:8748
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:8768
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:8888
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:8864
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:9008
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:9004
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:9104
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:9144
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:8208
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:8240
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:8424
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:8416
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:8608
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:8628
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:9132
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:8800
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:9112
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:9080
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:8480
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:8448
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:8856
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:8796
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:9144
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:8348
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:9084
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:9008
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:4728
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:452
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:9240
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:9232
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:9316
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:9352
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:9404
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:9416
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:9500
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:9492
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:9576
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:9568
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:9668
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:9692
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:9748
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:9768
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:9840
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:9832
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:9908
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:9920
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:10000
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:9992
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:10068
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:10080
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:10176
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:10168
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:9228
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:9220
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:9392
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:9364
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:9552
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:9500
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:9652
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:9660
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:9828
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:4612
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:9976
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:2436
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:10080
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:10092
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:4780
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:10236
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  - Blocklisted process makes network request
  PID:8884
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:9380
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:9576
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:9552
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:9812
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:9828
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:10060
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:1372
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:9000
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:4780
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:4600
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:1880
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:2512
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:9988
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:9512
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:9548
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:10148
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:8348
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:8520
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:1428
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:8348
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:10252
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:10312
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:10304
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:10404
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:10396
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:10492
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:10484
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:10568
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:10576
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:10660
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:10648
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:10732
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:10748
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:10824
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:10816
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:10908
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:10900
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:10996
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:10988
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:11072
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:11064
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:11148
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:11156
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:11232
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:11248
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:5228
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:10296
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:10456
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:10448
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:5836
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:10592
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:10728
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:10712
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:10880
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:5284
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:11008
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:11000
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:6100
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:11144
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:10284
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:10288
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:10476
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:10552
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:5292
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:6040
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:5664
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:6068
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:11144
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:11172
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:10404
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:6428
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:10892
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:10884
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:6356
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:10416
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:10892
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:6148
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:5292
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:6496
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:7044
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:11228
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:11328
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:11340
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:11416
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:11408
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:11492
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:11504
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:11576
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:11568
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:11644
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:11636
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:11720
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:11712
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:11788
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:11816
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:11876
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:11884
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:11952
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:11964
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:12036
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:12028
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:12120
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:12112
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:12196
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:12208
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:12284
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:12276
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:11404
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:11388
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:11508
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:11540
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:11644
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:11656
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:3680
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:11824
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:12012
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:6988
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:12184
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:12176
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:11352
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:11356
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:11552
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:7416
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:11768
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:7660
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:12012
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:12108
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:5292
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:11340
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:11616
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:2396
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:12104
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:12040
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:11488
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:11852
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:11340
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:7316
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:12304
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:12296
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:12400
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:12392
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:12476
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:12468
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:12552
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:12544
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:12628
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:12620
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:12696
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:12688
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:12772
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:12764
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:12848
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:12840
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:12920
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:12912
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:12996
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:12988
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:13072
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:13064
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:13140
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:13132
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:13216
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:13224
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:13300
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:13292
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:8124
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:12404
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:12532
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:12528
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:12680
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:12628
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:12792
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:556
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:12900
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:7904
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:12996
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:13060
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:1164
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:13140
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:13284
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:13268
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:12496
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:8124
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:12684
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:12760
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:12896
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:12972
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:13124
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:13116
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:8232
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:12384
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:2380
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:12756
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:13112
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:13192
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:8504
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:12632
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:13192
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:13124
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:13076
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:12436
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:13320
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:8848
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:13392
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:13384
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:13476
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:13468
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:13552
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:13544
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:13620
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:13612
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:13708
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:13700
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:13784
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:13776
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:13852
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:13844
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:13936
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:13928
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:14012
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:14004
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:14080
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:14072
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:14156
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:14148
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:14232
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:14224
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:14308
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:14300
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:13368
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:13376
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:13528
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:13520
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:13624
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:13632
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:13788
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:13768
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:13904
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:13908
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:14012
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:14032
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:14144
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:14168
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:14296
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:14284
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:13480
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:13464
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:13620
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:13728
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:13852
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:8324
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:14128
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:14256
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:13360
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:13320
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:13640
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:13788
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:13904
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:8696
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:14292
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:14280
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:372
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:3964
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:14232
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:8836
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:4624
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:13880
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:13856
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:2416
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:13856
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:1928
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:14340
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:2528
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:14408
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:14420
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:14476
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:14512
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:14560
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:14552
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:14640
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:14632
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:14700
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:14712
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:14776
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:14788
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:14860
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:14852
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:14928
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:14920
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:14996
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:15016
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:15088
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:15080
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:15156
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:15148
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:15224
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:15236
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:15292
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:15304
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:14344
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:14296
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:14456
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:14420
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:14548
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:14540
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:14676
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:3552
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:14772
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:14840
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:14900
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:14916
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:4660
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:15020
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:15132
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:15144
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:15248
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:15272
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:9616
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:9532
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:14520
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:14532
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:14680
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:14652
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:14880
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:14840
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:10124
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:15028
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:15220
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:15240
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:9616
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:14396
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:14644
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:14624
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:14880
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:2168
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:10224
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:15216
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:9396
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:9432
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:3236
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:14872
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:15352
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:3972
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:4504
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:9816
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:14660
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:14460
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:15348
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:10224
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:15368
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:4504
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:15436
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:15452
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:15516
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:15504
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:15576
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:15588
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:15652
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:15644
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:15728
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:15720
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:15796
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:15788
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:15872
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:15864
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:15940
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:15932
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:16016
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:16008
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:16092
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:16084
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:16160
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:16152
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:16236
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:16228
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:16304
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:16296
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:16372
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:4444
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:15460
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:15432
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:15564
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:15556
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:15704
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:15696
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:15780
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:15800
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:15884
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:15912
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:15996
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:15988
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:16092
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:16112
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:16220
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:16212
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:16308
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:16352
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:5472
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:5272
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:15652
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:15636
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:15800
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:15816
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:15984
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:16020
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:5264
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:16224
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:16364
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:16356
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:15600
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:15552
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:15876
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:15800
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:16128
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:16136
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:10856
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:16316
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:5484
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:15600
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:10912
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:16144
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:5304
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:10408
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:16224
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:16128
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:6060
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:16080
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:16392
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:10504
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:16468
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:16460
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:16536
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:16528
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:16604
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:16596
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:16680
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:16672
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:16752
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:16740
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:16816
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:16828
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:16900
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:16892
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:16968
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:16960
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:17044
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:17036
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:17112
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:17104
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:17188
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:17180
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:17264
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:17256
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:17332
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:17324
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:16020
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:17400
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:16488
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:16456
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:16592
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:16580
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:16724
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:16716
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:16828
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:16844
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:16944
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:16956
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:17056
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:17048
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:17176
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:17168
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:17300
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:17264
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:17388
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:17384
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:16556
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:16488
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:16724
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:16756
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:7096
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:16980
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:5824
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:1872
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:17268
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:17248
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:17388
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:11092
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:16680
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:16684
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:16988
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:12160
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:400
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:17188
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:17388
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:16572
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:16944
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:17032
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:3284
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:17376
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:716
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:7396
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:656
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:11992
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:6228
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:3284
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:11868
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:2100
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:11916
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:756
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:17032
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:4872
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:3284
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:12036
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:756
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:7972
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:17424
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:17416
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:17496
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:17488
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:17576
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:17568
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:17644
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:17636
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:17724
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:17712
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:17796
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:17788
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:17872
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:17864
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:17940
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:17932
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:18016
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:18008
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:18084
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:18076
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:18164
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:18156
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:18232
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:18224
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:18312
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:18304
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:18380
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:18372
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:8032
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:17428
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:7244
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:17552
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:17644
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:17672
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:17776
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:17808
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:17928
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:17912
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:18016
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:18020
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:11720
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:18152
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:18292
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:18284
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:18392
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:7844
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:17512
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:17496
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:17696
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:17764
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:17952
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:17908
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:18144
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:18140
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:18316
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:5752
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:4564
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:17468
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:17796
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:17688
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:18052
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:18124
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:7740
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:17472
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:7292
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:3328
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:9596
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:18252
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:12920
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:17796
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:3992
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:18272
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:17632
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:12572
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:18440
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:18452
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:18524
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:18516
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:18600
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:18592
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:18668
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:18676
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:18744

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\msg.vbs

Filesize
630B

MD5
08527c5b794a8a0856f9a126ec071464

SHA1
7c0dfc7e7834909d26955ffb7558e48d17e05e41

SHA256
7bfb660460046bfb0157e5d2a5c6162d3e35fdbde2a22d1415b8266ec69f3d57

SHA512
269fc6ecdf42ebd18cb67130dcd562af2e21414cb319df6f7e9d0b596e92fb5c99a8d41c0518311e343af9f2e6db4da455973d93cae43cb9be4874895f857fab

Download Submit
C:\Users\Admin\AppData\Local\Temp\msg.vbs

Filesize
672B

MD5
4a4d988afd04b18666c53fa660d34e0c

SHA1
4e32ae0a601003de8d2044dd649ae27a58367142

SHA256
e1d300291414aa5423396a17a453dd927074f8fe7a163ea0bde325fe061b2d7c

SHA512
2ea51654d05983c6642f48432f1bc1a5ea4b7f0c8ef23034c60a100e57138899169445636dfc512a29871c510d8c7a14850033eb1bc232f25dd1f44fd5ed6224

Download Submit
C:\Users\Admin\AppData\Local\Temp\msg.vbs

Filesize
714B

MD5
b4c3bc7bb962eb05d8cc24c41e0709cd

SHA1
7006fcd117a7dac3baf400ffb85c900b6098a9bb

SHA256
370a02e34e4a9023941bb2d93f38369b1fd63200520fe1f31e6f5b5d64c5ea59

SHA512
d7fce20bffd5290b9c1e68430eceab0073e4099e117748fb4716d2e1b86f49b9d555e348cb387f72d36c392d3018b0fbbf6a44883f9896575984a9c18b69be87

Download Submit
C:\Users\Admin\AppData\Local\Temp\msg.vbs

Filesize
756B

MD5
4bab8f7b2b20cf446416cb53a7cb6192

SHA1
e9c45e63c4d64c6ec668c0245f6af6ecbeac450f

SHA256
8d038a5d80a7571a4b5bbc7196ebbed81cebabdd8b50df696a47f964ddaf7744

SHA512
070976e15dc464783c343ef1f452a748404ada6b2ce9e3e88539e6abebc8dba0869eef20b0f9bf3d600feb11d5756102c88834dc07d9ded66ecc823b402f2fa2

Download Submit
C:\Users\Admin\AppData\Local\Temp\msg.vbs

Filesize
84B

MD5
359dcc929003ae1e4e39c9d180759fbb

SHA1
adc378601b36549891953f41b1b39ef3c7a5654a

SHA256
7469c8cdfb5eb37a86fa8a5b60c923e372f82a7dfd8067e50acc41bf82ce10d4

SHA512
517401c29be0a1866818d53e4e1994b9f715bf81ed675ce808636c43b333c8bd4cfd588f728efa0c48e057969ad47459d7ee1026e1bd0dc05789e90b60f13eb9

Download Submit
C:\Users\Admin\AppData\Local\Temp\msg.vbs

Filesize
798B

MD5
0fa394703013acc5dd6c8198aeb60f53

SHA1
f2f1b7dac19ab5b671996253c4da108303311a03

SHA256
8e0d6ba2f5736477622086e8f4aef472da8b6268f2f004c3a0bd663d8af9d5aa

SHA512
b32c3867e1622c36187a4c58d4c6c0e2fb47ab842b300e264433cc582a2c45480f49883d70c120252d3cd49c5ea2939cc71ef5ecee66b225fa8113f55891aa22

Download Submit
C:\Users\Admin\AppData\Local\Temp\msg.vbs

Filesize
840B

MD5
6628c45cd8e35d511a45416cb960912e

SHA1
84bec70b299510b0331093d68839f1eb04116e63

SHA256
8cb78377b1d89456267dcf6f812e62950495fabb33e94a77795338ac515fed89

SHA512
f6b138f6722acf87e7b61f64db44f8981597a4971a15dafc41d0acfded4dcc6bc5fa8af8db24ce66ae74a033a0ad6f4b6feaa1f630ab6c79cdfd9aedbd0d74bc

Download Submit
C:\Users\Admin\AppData\Local\Temp\msg.vbs

Filesize
882B

MD5
87fba40d645398da419ceaf9ae42abee

SHA1
a034f98111849500661a3cb5940c149c18f6e03d

SHA256
662c702a1dbfa4617f2d6597ebb72257cca623b0520cac404ec054592400f573

SHA512
fdde6b73df529b7d9d36fbd3173e7bfa0feb2bfebf8517d939c7c29fd6e2f2526df10a8083bc47baf09148d4cea37f52066f4989f9a07300087ae0acc6631e5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\msg.vbs

Filesize
920B

MD5
647eb1753d892feb2afa23b4cf628cfe

SHA1
c02c4c8ee343db9deb685b3ad8298f483645b62f

SHA256
6a655ce487c33b45a309799379eb535825c7df5d9295f7ebcb833f1816602640

SHA512
79d721d18b92a0ad43a882456c7d172d8c974e7c9df63cff4c323366623a46aa9dea0a518d7cd7d0e4d8eb0fe7ba3646bd7cf3a4815dd5defedf186e8b865516

Download Submit
C:\Users\Admin\AppData\Local\Temp\msg.vbs

Filesize
962B

MD5
9e31e5d56b91515775d6147ed190edc0

SHA1
bff300d3e33a494e8d726ee0a752d4dc38cbc49f

SHA256
aafe3d755aedbbfb4f892ec145e8c586eed278ab07d8f9f280505aad5e9d8f43

SHA512
e558f8fc2c7cb891e519e11072c8289245f0fe7d23aba4a50b34a1ddbe5e8584a48135422cf23611d59c8879be74f3830e7e27e12f299f37dbbe51a41fcf7835

Download Submit
C:\Users\Admin\AppData\Local\Temp\msg.vbs

Filesize
1004B

MD5
bf041d0d2231369af67eea8f0380ad99

SHA1
fc1a9f8048cdad58c6b6e0bea143d3f679e82ea8

SHA256
065e5225231aeadb6bbd24056d0bc08dbd8cf4f4832aecd50d2d4f6d8ea500c0

SHA512
58588026fbf824b8c58062391e7ffce758898dc15fad5aafa9580e87f638e8c34d58afffb413c09e4775f69af1f968bbb262f80c40e8e7c779f049933312e891

Download Submit
C:\Users\Admin\AppData\Local\Temp\msg.vbs

Filesize
1KB

MD5
22a0520c2ecafe19903613d5180cf020

SHA1
86e307b3d2803c25f1372c0786527949795cc990

SHA256
45e31e1dff5163ea778e0c43e0a493a1e2e4176a1c7ceb04f3391a512fce4f50

SHA512
1e2cb6f366bab94fd9618ecfc00accfe0d62d89032917d01d7571f454c8210322f09becbf28a3132785c87ea945bbbed4da2f46abf6597ca45360ca9fa641c5c

Download Submit
C:\Users\Admin\AppData\Local\Temp\msg.vbs

Filesize
1KB

MD5
de6ecb0d935fcbfa67ff2521e9377f5d

SHA1
598f4fcadb20985b32bdfce1b93b7fb018e11ffb

SHA256
7b620d0ace33f3964fda986fd21203a176ed7e4e851572c6576d759eb4ff7f69

SHA512
ab33f5c1a204dd1403224d14f659fd22f5210fe30afc25f7ca25e32c9404db1f1b7f87b86aacdbd179d67954f4e0d47ba9e1ec37d18d477a75f3be43ef97d0f9

Download Submit
C:\Users\Admin\AppData\Local\Temp\msg.vbs

Filesize
1KB

MD5
e99113728a34a4dc69b14683924d5760

SHA1
effcd16e3b0a82d09f6a3e36895ccd6b1afe05d8

SHA256
38434de7012183fbccaf973ce87967b68990c09e96c99b7974c537e44e47d680

SHA512
812dec4466c2e3386546e412f6bfc9ec8fd5f276af271744b9a5b839bb477a0866fc8494158ba283ee86810eaaab03138f4c4027313a64c204f620f99df55dff

Download Submit
C:\Users\Admin\AppData\Local\Temp\msg.vbs

Filesize
1KB

MD5
9189fe8bde678208e66fe53196372a56

SHA1
ae82eaa1cead041d0446e4b8702072c30ba39e5d

SHA256
2638e42bf42f175d4f98dc4a7173850322cc2f88261586bace89882d2f80266f

SHA512
124588228acb29834c7e8d261a3233a2fdb9beecbc81608557afd433b5fb11c7edd5879a41f8215da87da83d0ee7f0836486aa28c483957a168d43cff69a459b

Download Submit
C:\Users\Admin\AppData\Local\Temp\msg.vbs

Filesize
1KB

MD5
1930e7fa31f4e8bdac4db150da583c38

SHA1
fe6e34fae45f4e44908eecccf94bc89d03a5b68c

SHA256
ea1b4ae2dbc2ea950cdb9523ee15decb01492050d9f61feaa0c8f406dc5c19cc

SHA512
019695bf301a9d804a30209ee3b059c497495a70eaa82d64294eccaf8e496949cbfb8afe3da834a573c20795a144b20024fdcd90842445dbbc36fe6175a7ba2b

Download Submit
C:\Users\Admin\AppData\Local\Temp\msg.vbs

Filesize
126B

MD5
96fc1b2b3c7317ca7a262ac692a5bc78

SHA1
5383b05f7e1639313c3640648cba201a23293d05

SHA256
e3933dc08a25c0775aa6f4caf3f0a6d24cbb301b2dea26c1fd6d1b84b61acea1

SHA512
1fde31387f4d0fba3bc7b72cb003e6bace5647b8091e29a89ab3429b8d7afe084c7a997afb99c5df98e51df85431efe757eca04de3784de9aa28dc82a63139cb

Download Submit
C:\Users\Admin\AppData\Local\Temp\msg.vbs

Filesize
1KB

MD5
52e2d19a4fbc7ea4d77ffab3817ab1c2

SHA1
4bebe96fbafae2b66f6c18d4e0a9f462bc2d31d6

SHA256
4d274fed81398aeceea387015bbc4db7e3d1f48299b48b64f2bbb4aa88a44f64

SHA512
9ee68a0344ca5a2326a82d86bd940b0dfeba62ac48db9294d262e1f0e8eef50a89d0507004e9348bee0dc2b806422114197a788476fe6c20d70f4c47cc0e7197

Download Submit
C:\Users\Admin\AppData\Local\Temp\msg.vbs

Filesize
1KB

MD5
867df8db6e7781d04c6085c1df0017bb

SHA1
598b5ddcf9e8a99a2cc4c4dd40ae3db58b6ebab0

SHA256
b411bd09af68c86ed91e67ae3cb38aa38c0532d7f5226b43de86ba3cbf3b21f0

SHA512
71eb806ee2dbd957a62ebd5ccb80505e719c69d3c3fbb9db30738b61fa475ece8f37c826336600c097e72fb91173e7e91e0e9883f366094d5b38c73be19f6a51

Download Submit
C:\Users\Admin\AppData\Local\Temp\msg.vbs

Filesize
1KB

MD5
f0c3ae46873f6fc0639d1a40aa091090

SHA1
a132da9ca240c589498c3a9628fa9765c7e72325

SHA256
c3e5a8f2fbe6356bb0adea1c2d5c35a1d4e87dc26019abb7d79a1ba8c124833c

SHA512
6cf4dcef6b7ad90a5df05352df2d8048476bca4df55bb30a8d70f4fb26a44a38064a89a987d235d0599f92af4852ff32688bb533d9e05dc250ad21e7a5032acd

Download Submit
C:\Users\Admin\AppData\Local\Temp\msg.vbs

Filesize
1KB

MD5
ba504f1d6e05814234a62e87d247ddbe

SHA1
2c6f102045ae82601956d75d4070fd9bd118c4ba

SHA256
c9b808502c3b52f57f36a7b535c37db20ab71b1bf1e5c12851c60f9992da5ec9

SHA512
36101c0605407329f8f176982a952c27fa5709d844a94f52f67e6b50b1ee93e5f00ab7fd442f7c954e472c6c1d36fb517b59d93c67e5ccb61472808f8b0b5228

Download Submit
C:\Users\Admin\AppData\Local\Temp\msg.vbs

Filesize
1KB

MD5
784858314bc182d81a4c71988a921162

SHA1
2d5ecf9442317515cd51e319c7febb9010d7bf93

SHA256
5efbc8b85a3ba1b33cd0add6482826e6d1ebf5d853e519d2ae394a4176ef9df7

SHA512
a67212a6bf3cc1599e47c8b42ec72f8d5766b5dc325b3ace2bbbf2e774dded980ace5cfd1308db41229cf0283e3b8f08b456640bdcb11fdf6da61e51a53a038a

Download Submit
C:\Users\Admin\AppData\Local\Temp\msg.vbs

Filesize
1KB

MD5
a4ef81a2cf96b099ffb860e80cfb5df8

SHA1
e462ceeab6a059c6b6d74c596000749b5c39248c

SHA256
a687f66fd7518521824de8cdb2c3000c1057b10905dfc870995e4b07aadb72df

SHA512
95939bed034776ab2b4e001e0a047497eef4129f076b91eac66083facd0a9b6e43a7b767da0ae866954d7bbc853ce0e9772b252666fac025e9a2bc8028aff1fe

Download Submit
C:\Users\Admin\AppData\Local\Temp\msg.vbs

Filesize
1KB

MD5
977d25c0a0c2642db6ca5215df95d0a0

SHA1
00defa5a3f5db71e7f2882009f42cc9640c820ee

SHA256
b838fb30d134f83ce92227f2dd36ff1fc6179ddac4bc3c85ec4e17bbe75c10c6

SHA512
f991a6e1c94b76281edc1e47e7e3eef47f23b5d16935930942af8cce420d9f36d8909576911a6b4056cce67f2ff4ef7ce48da10e39d5e1e484f6bbcfd42ec3da

Download Submit
C:\Users\Admin\AppData\Local\Temp\msg.vbs

Filesize
1KB

MD5
33e081ab618d60eab56a19dee6b070a0

SHA1
ff047e31690a264ff4bc605f5c1acbfe57e73613

SHA256
c88a010af5bd81bd69ab6ea2446e69e20595c31ece23b22b664c885c390c4234

SHA512
6e125ea902d3f265d5a1df891c6d453cde12238a29a9936eb8d382dec342a8532863f3e070832d4291149c4bcbf48e176fe45cb49da6b6a9d22e56e4447789cb

Download Submit
C:\Users\Admin\AppData\Local\Temp\msg.vbs

Filesize
1KB

MD5
106eb6211547207674bb970dad0f432f

SHA1
2ca58c919476d64577fed4b3713a801876394618

SHA256
cc024ee0f5916f40e81678a9cc42856fd5a83ed88a17d318f66c300132b3867e

SHA512
ed6f815dd0cec5ba93be8633b6dcc15445980002dfb25e6eeeaf77f992c3d8d5d7a7d62a9de8d7b8b991ed4b67a6bcaca80bdce3f7d8d879b0a7e5d99941ffac

Download Submit
C:\Users\Admin\AppData\Local\Temp\msg.vbs

Filesize
168B

MD5
4c68fbf3463c9257ce0ed56c183128a8

SHA1
ebf5c257cf722c69d32242d3ccdb083190df63bb

SHA256
0831c778ec0f4f7d93004f93f51ed83aee73bf3f200806fe6f8f553449f30507

SHA512
20aefdc0cd769b168b35bdcb0e627ad3477de9cd344370f40b5eb5ff67dfd5b9b4963925736546316e91d91c1c83b4a5e2b56705991b7cf1076fa18b70b1a6c9

Download Submit
C:\Users\Admin\AppData\Local\Temp\msg.vbs

Filesize
1KB

MD5
23989e166b2f7d99b2296418e9fc7f94

SHA1
b4c91379f85dbbaeacd1f6f096cfbb15daa54571

SHA256
7b4b244c9601c90096624a109169e2a51cd5d5ad4ca662e34a4a39cbc8385ee1

SHA512
2c4281c341bc2165d77a4e7ed1c550d428997e32a6a5bfc9881e37b9aef4e357cdc6fe0db8ab5bbae4342bed4aa40ecca6576c96df7fbfb4894212c597480f07

Download Submit
C:\Users\Admin\AppData\Local\Temp\msg.vbs

Filesize
1KB

MD5
3f1da1e80faefd8467f00b4d382bbfe1

SHA1
097d564dbb416026a13703fdcdc57b7a1b7f899a

SHA256
e0424de4212da671203a2c1845feec818416723ae5d5f9269ca002db37279a03

SHA512
61b74d3c5c6737d078279d0bf5f243439f3c8923f0d40cd72cba8c43aad1cd6061ce5f8167f61dc80b86c44bddc730f932508acf6b8f5b8767aef82f0a5cf1ae

Download Submit
C:\Users\Admin\AppData\Local\Temp\msg.vbs

Filesize
1KB

MD5
5bd5b717413794ac25cacc27a77a717b

SHA1
b9cec184d9fb53c709a362119e5acba669a07430

SHA256
03c339e6cd5654f25aa303fcf05d5a8eef7ed3e95ea6b2b56250734f2cc233de

SHA512
ecb7e32dcf03622c5cffac60869492d244e9ef888f07d43d61d10100fcc39a7fede98307036af903804056611792d861c8fb364aa9788c9d7a4d29c3988484e9

Download Submit
C:\Users\Admin\AppData\Local\Temp\msg.vbs

Filesize
1KB

MD5
ecd673d36627a9eb4178805bf73e671c

SHA1
1f47663d475a943b2bb15ff520077e009ef0fc3a

SHA256
5e312e68f27fbf89759bdc0d503b9c42741ba8d29c1800a706d3f894aa632789

SHA512
8336c3e4af6043c14d336ef5050e29152cc2c8eb22654fc51a064df41bca9ac77a767fd3c29c53febf38b0ab9911ee9c6be752f7f3287a0f95b20e8e77ab7eb7

Download Submit
C:\Users\Admin\AppData\Local\Temp\msg.vbs

Filesize
1KB

MD5
7e1a86d33611350c6650c1867fe1e62f

SHA1
3f61ea0ca1b5972792d0345d7473401e97c4d692

SHA256
cabefc01bfe84d70821ae861790d16cf26b54f67e4531b02e1c8a141940fc9f7

SHA512
ecbafbaf7cdddaca6aea765dba8935a71edb6a61eea9ab4f14d6100854efb87d61d693bc1e948a398fa2f00ae1350edbe6dcc240b9803ff74ab7a14325446499

Download Submit
C:\Users\Admin\AppData\Local\Temp\msg.vbs

Filesize
1KB

MD5
636c1d1af680f0616637bcdcb6a6a24e

SHA1
483216ccf73338519fc8e143e7f188eff1ca9a5a

SHA256
ff0c0a38fc8d9905672e5663132f48044f993a9159a09294343fdea26e1e7ea9

SHA512
30be2d04cad1ce69a398cf6310222aae00a4264ee1fa8af947ef7e2df193fbabd55b86f57ea2f768385b550cc7a2cddb117b6321fc3dd2de2122ffedb63e473b

Download Submit
C:\Users\Admin\AppData\Local\Temp\msg.vbs

Filesize
1KB

MD5
9455d03d44191b26ba2a52778d2429d5

SHA1
3c2764179a396e03ea42fdfec32cd6535d011a39

SHA256
761c23d758a7441bbbb5e5c4f31904ce66cc4df8bdacbf22767a052b7a094399

SHA512
6a5d299053bc5c9aaaaa7e34a0e057deda77439c4dabdad8564e2712e1c9a613680e543b3ef202fcb84098bc212c5e73e6dfbe8e7b5b781adb1a300019e7a17f

Download Submit
C:\Users\Admin\AppData\Local\Temp\msg.vbs

Filesize
1KB

MD5
146fc3023965f59114bd7222c38f3340

SHA1
f58aaa1f78cf09772d8a2ecf5bfc271e90360165

SHA256
bdfdb404b5d6151d339f6c51309a920a6a47c7c8637d8b29db5db272dbf46af2

SHA512
08a56801b35af0baa96512ae1d9f5077b3007f3f42cb79f69935f658400d2b4fdb1e5a9926c6a30d780a002fcebff97c0c5f231be6949f5eb28ae2173561a4be

Download Submit
C:\Users\Admin\AppData\Local\Temp\msg.vbs

Filesize
1KB

MD5
f1d54f183e29790b513c0f9be16fd5e9

SHA1
f5c575176fb55429b7177df59764a325630ce1c8

SHA256
5c5b7c5dffe3c22d646395fab41c83ec91997a05248eb84df17cb97e05e6a812

SHA512
9f75adb03fb93ed8281fb30f570def4b34e3df9a95403f079af88d2b6f260e516392be4ee03507d6f00cd88a38a8e97aea964ebbcd9a18644d8eb7a449e48621

Download Submit
C:\Users\Admin\AppData\Local\Temp\msg.vbs

Filesize
1KB

MD5
204f0ba7cd7907c92454e2e850c2b17f

SHA1
a46f93cb02606dbd1756fc2c034c56af13699e47

SHA256
e62dbfbd248d1007869c30e61815c0cf5e6a8062f35f28b94c38ada46af01254

SHA512
eac5b3aff7cf71203933998187782ad368b0f80eeb32424e2e8eaf9e2d01fca411855d5025552647f1d6ae0303d76bcd8d233a8c3d0132570137f1ad3ef46eaf

Download Submit
C:\Users\Admin\AppData\Local\Temp\msg.vbs

Filesize
210B

MD5
dccce84d2bf7d6524ead33fe7fe562d0

SHA1
8d0ee2280c116b03450355f3805a56f4a86360e6

SHA256
24e95f3d509352e8dd0fbe1fd5ec0293de36a02ff6ed3cd2b6f500d4d01fdb41

SHA512
1b6fae82646d0613afaf0d4499b5b72adff59ac22d3c955fa317b5a6b1fe0c948e394e3d3f44885d498f43bac7be7687108e5e7046a6b7e8c20f50eb85bd9057

Download Submit
C:\Users\Admin\AppData\Local\Temp\msg.vbs

Filesize
2KB

MD5
1756d2c47080edec799711ec5f73e3d2

SHA1
e6b202fb1e6211e3c8cf301f8d75277414a1cf80

SHA256
0c23e8d5874a2371d5c0c6b40ae9ba06ddd59aa4e680f28137cff8d1832beb72

SHA512
b867609f94129bdcd60a763e198fb27e2f94eb4b0ea6dc7699b494a6ad4b34b4d40ae2c33ff0a95eefac3e7a43aa247d97119b7653379d576a6e975f8997fd70

Download Submit
C:\Users\Admin\AppData\Local\Temp\msg.vbs

Filesize
2KB

MD5
b2397127a4aae2c942e15f908d19ed18

SHA1
a2d93b39e6cbc8132b15b63e98499f962c1f481f

SHA256
42979a92523200ea731ff5b8b303b8f6692ec35d35f4c07aef2e12f8c05171be

SHA512
976bbca4c3af98ff4d306713226ae38be9fe1f2f355295d7b48ee08242cc5d394e06433b63524a39997b54e505db69b3757feacfe2b488ec08c19780cddb9f77

Download Submit
C:\Users\Admin\AppData\Local\Temp\msg.vbs

Filesize
2KB

MD5
b8fac6539b3468ca4609e49e66dc9186

SHA1
97647e7325c4ba70a53ef24e49ea8ae332f1220a

SHA256
cd6e762b021d73883dde356f2773fa5d55d4b36cd449a0fb40b5bc246fc33158

SHA512
1295bb6f5bb97fa9d51b78d492543c7560fe2684379be1fa9c45524c19f4353a0697571d70b34c2c2d57f24ea013ea02c00562dd15ffb6a8edc1aec44eaeb172

Download Submit
C:\Users\Admin\AppData\Local\Temp\msg.vbs

Filesize
2KB

MD5
4b7d403feab0e1cb8dc90eeac1fa00e5

SHA1
6d4b351cf17b86e3877b78f44e08b46c13c97ce7

SHA256
8a9dd69d339e32ed5f4427ff623cc445880d92e79abf2736516e0f80d02176a1

SHA512
2fd8b38f7bbbc811d2e5c75c1f63ea54c698d102d551d321dca450f41df7e4d7c6c1c38777c30b4c6cc30c3d17e8ff5c7da7159944c3091b3c7dc758b9811d8a

Download Submit
C:\Users\Admin\AppData\Local\Temp\msg.vbs

Filesize
2KB

MD5
7368a34f122403fb9e976d4db79d0de0

SHA1
5190dc6ea4a7f5b2fdb440bf0143c7b22394efe2

SHA256
6c1894d09d40ef7b724bb91dffc42be79aab286adbbb3c2bcdd9c669d066d2ce

SHA512
f64ab1acabf7ee6ff81c7a670752ab9b152e06c9ab8a99591388ecff6213cf151679b1675f43c11d59441ed8612be0c8a19ad5b8370983674a73a63280122978

Download Submit
C:\Users\Admin\AppData\Local\Temp\msg.vbs

Filesize
2KB

MD5
0d45ba76718d218a624d37eb70d01c05

SHA1
4ee0254adfa83964299cb3dc039c29e56ea21e15

SHA256
f0249db4166b2a662bf2d417a4903846d51f17254f3621fd96ad94939b1666a2

SHA512
868d0a733588cb1da357d7458cf8772c3f55b48f406d6d8bcfd6cd6bb1a46b15d6558086b708d830208eda886df888b8f5d87994cb4c9ad848df83061b9db316

Download Submit
C:\Users\Admin\AppData\Local\Temp\msg.vbs

Filesize
2KB

MD5
dd8db777545030c6f91ffcee81349f0a

SHA1
f7889d51db9f80de4e0ec9c1124ca875c939deb8

SHA256
86f048c043f01ec4ecb64e545635517379df0061df495178dac271d3aa1dc133

SHA512
471672306fca935e0e7a53332f2708a1c1d6c31156b1dba6c247dba3d857c7591aea639fed8b0cff33337b0de49cc2bad966f48e1ff96a035f071184f0570b7c

Download Submit
C:\Users\Admin\AppData\Local\Temp\msg.vbs

Filesize
2KB

MD5
499c3d86cf4a8c3a72ef2909199507bf

SHA1
fe2873c375dfe39e7deed7d29cc150a7ae1ba825

SHA256
c09f34ae54d0c88f3a009d5e1b1ee8f72528d7d1784d89607642265b5ecc7953

SHA512
69a5370300b85bd1ff2dfb24572facf60fc61f6cc1f55a47c15bcdee8dd0a0d8e5107808cf659de2ff0910cba2e8802767ee55b375de11227738ef2404493224

Download Submit
C:\Users\Admin\AppData\Local\Temp\msg.vbs

Filesize
2KB

MD5
33f088ebb093e1e8e860628e541e6aa6

SHA1
6aa73c9ed0a44e3354589002904e41509c19e8e8

SHA256
089ac30674e580a5ac80908286658d1370dee6424afa043e6ee30e5bab38b412

SHA512
eed74178c65b8da8a9305d606bb031715a1101a75d9afe2ae4eef5607e31c6e136869b67b7e14100a6e08c258982285015ffae2a1b95cbb11b04efbb360a8666

Download Submit
C:\Users\Admin\AppData\Local\Temp\msg.vbs

Filesize
256B

MD5
2491c1f91f6e8e83ffe43a6bd926a046

SHA1
d0711b4c1f5a53e0557ddcd4b23cb2cf9252c88e

SHA256
a7d082d824166820ce99361e7d3baf24ba1eb6bdf47a8b0b51906e65a21755f2

SHA512
ae80e3c5bc327ea6f221f4e554bdeb1fecae2d6a3dc21576ef2ce27aa2ab70482fa3d500d776dc1b5c6373a12d3f5d362b2aa855858da92eb90f2c3b828b233c

Download Submit
C:\Users\Admin\AppData\Local\Temp\msg.vbs

Filesize
2KB

MD5
91a04351a6890e969d5579f9345121de

SHA1
5b57358e07ae2f8c900e3125f81aef4cb9305154

SHA256
bd6029296876e771183fa3dead65ff525dfc6bdca94929284fbb14484ffad636

SHA512
61a198d541c086525248c922e6fb25a487f6229a3b921948800686a9e087857269375320aa092e6cefa76bd9144fe8370c4df745b5b6a66a6157dbac65eecc11

Download Submit
C:\Users\Admin\AppData\Local\Temp\msg.vbs

Filesize
2KB

MD5
aea0bf725b54a35c1e9840b2650ff7af

SHA1
572b0210da064be5595407d73a6861b771a6f1e7

SHA256
de137e2cfcee5660e785cd0fd3d7cf1ee85c5d8a2ce34d323cc29200ca07ec12

SHA512
3c74f926122f2f7460fc7dc51e5e42852ab3dbead8b52fda1f063938fc1f549b67968726769fce0e706754dfb9ae95eace6e8dfc817f7851872f0a173f10b10d

Download Submit
C:\Users\Admin\AppData\Local\Temp\msg.vbs

Filesize
2KB

MD5
6716d4e03cd73ffa9502738dbfb0740e

SHA1
98a42901d985bbb7d4c0af436952b4e25900da53

SHA256
cee3db0b44a37f83be599c36008bee21504f75e00e31d0448c7e99dd0a8e6b08

SHA512
8b8cf80079b67e4bd3dc77633a557ed27b3cea725e05277646a2af243c755b78edd1242f5f69d2d88574576a9fb7c6028b053ddb4a82aac639ddd06ff77ec654

Download Submit
C:\Users\Admin\AppData\Local\Temp\msg.vbs

Filesize
2KB

MD5
7b2f63615642edba4bbbee31fbf2cad6

SHA1
c451bc30af9e087bdb22d2854706c93fb5a92ad6

SHA256
f84089060ca99b45458adaa9473e1d3a47d93331f424d17326dbd280948390b7

SHA512
eba1e008f69447a123222bed6f44d8809ba1bdb3d8e53f1652de868899bc1a87352545fdeae71317df991f76b3d94331a481591850c3154970d85206a8825d0b

Download Submit
C:\Users\Admin\AppData\Local\Temp\msg.vbs

Filesize
2KB

MD5
e6e20c95f1982d0f6d91213ecdfb3558

SHA1
de6db394ea4d8cab7f179d9189ff2ec25f6cdc77

SHA256
e86e22b573e728fde179524602851dee2952b153323ca7b2ddab8334570e7886

SHA512
41ae48c23100a8305b36c0bc1098c9c8f568462bcffeb6a330580d0e7f1ba9a782e6cc9e3b4525227026463ef487166f44d94f3e821a89100fece1c99a531f68

Download Submit
C:\Users\Admin\AppData\Local\Temp\msg.vbs

Filesize
2KB

MD5
e5700a6c54f24c40d890ee99c0cae75e

SHA1
58eaa803a56ad9e70e57d793e526110794e0dbb2

SHA256
786e5210666f66ca5adbb2d89458fa8dd9082b673c0178613a7780fe9600c4a8

SHA512
0c04746ad4909a69930be2e26320a370603e35c96515f32d2581859c2d3ca60ab6229ad234561d4ba0f6d18736718ac096012b31e5e67b5e5c69721037cba182

Download Submit
C:\Users\Admin\AppData\Local\Temp\msg.vbs

Filesize
294B

MD5
9d950c4242239dbb8e54021e3aff92bb

SHA1
b5eb66e47d9b390aa8a9dc3d8e5dc57904348fa0

SHA256
5d373a92f0553ed21e411f22ab5cb0ea23e793f19beb3a43b2fc9c168532268f

SHA512
3a1ddfa081455fdc8cc3c4c9c92eb509e491c50f7f160342922fff7d87b30111f7d33c1bb47523429906b30201a4761e369735bff86243afa0de3a26a94a80ea

Download Submit
C:\Users\Admin\AppData\Local\Temp\msg.vbs

Filesize
2KB

MD5
804f21afe7c02bd6b10a5c55d5d844ac

SHA1
ff299a7089bed35863d822c731d97f7669215400

SHA256
48e08165f4b819ad96a783f8b47e4729303332ab6b7fbb69947ed681e77c02b9

SHA512
d742fe07b74773592e4878e10e3bddc74fcf4270e64452a14c80ed4f42250631da22fca9adfa7d67a33cda83df1104ab2916154b46b96eeaf07dd6f8cee83c3f

Download Submit
C:\Users\Admin\AppData\Local\Temp\msg.vbs

Filesize
2KB

MD5
447a609099c54fd870d5d83602925ab6

SHA1
80b65338531d8326520958204112cc737ed4e5ae

SHA256
ad93ef4563469f835ed01dde22d3e9dcbe71f789cfd486d67340fca7c19a52e5

SHA512
6b250ed24d70c78dee72506646cfb950347513f97a5150ce119c23277f1cba805eec7251c17a0197257aaf08c747be311d81d76f49b4ad9cb107958a1b59908e

Download Submit
C:\Users\Admin\AppData\Local\Temp\msg.vbs

Filesize
3KB

MD5
9d25f6a59e7a35d9a3ea4e18b9b3e267

SHA1
2b2c558f5a886d311f8217ad6ca954e59740fe93

SHA256
3a35487875e32a43c5b1fb630f6274f415e4fa6c23511d5124cb33f179c78b91

SHA512
746550db7295e33cfed4f1641827de599f687f53dece2818feadc77356d84a7972f26c0746a645b1515834a567a91fed2529e8faf551f06f788875a75a510336

Download Submit
C:\Users\Admin\AppData\Local\Temp\msg.vbs

Filesize
3KB

MD5
44bebfb9d819cf6cf6a3b3424979acd0

SHA1
75ce74280ab65592cdb35c8aeee06f0cb88cd091

SHA256
94d1c3cd996e1002522b52edf38da9c3c572a946cc108bf05d434f41f6221d4e

SHA512
d3ee978c67fbf3c86db46d68223d438fcbc8203b876d3b90cc609c3fbd4c5c1c683953437b94210f615e141ae9c72464d507f8976260311476d390fc9fe1fdc4

Download Submit
C:\Users\Admin\AppData\Local\Temp\msg.vbs

Filesize
3KB

MD5
8c1dd3ba2b31a6e8f2eaebda4499601b

SHA1
4d4350e0013406004e5bf3ccc7677d3330ab617a

SHA256
8fcaac177d57d0a79ebb272e397f1eaf6e198dc26eaea293801736176a041dbc

SHA512
dc130a205aaba25a405fc65fbdec20d889467864d679ba8c7a3001fb729610ab7eaabde9da7e922b3220b19650d28c0f916d726ccf99e2363160ce37b5357b1c

Download Submit
C:\Users\Admin\AppData\Local\Temp\msg.vbs

Filesize
336B

MD5
38f2431175cf209cce25595ecdef9beb

SHA1
5bb839409a26da519c26c245525034ae97975b9a

SHA256
500bf4c53fd916fb3bf77be835032562b81cb47d3227436fc443310ec2b77a17

SHA512
c470ce58d6bf2d2a2c0e0ee08e9800bbd3fd7011249f65a3f27e0e387c95956444da13393db1f06ef1712906c2b451ce444c20cc087d0e028386efd37e6f23e5

Download Submit
C:\Users\Admin\AppData\Local\Temp\msg.vbs

Filesize
3KB

MD5
e8f1715894d350fecce5c0b9fbc232c5

SHA1
f449f81bdf8692404702f770d15fc0ec08312963

SHA256
493be5eef8bd359b52f21267cbcf893d199e4d022ff9e33ab858cb172a95a774

SHA512
f42248c1f7c3958d37b9d2a66c54521c189eb1dfc2c452f67dc70bc7674e5a318d7cf88431abceac27478031b6d9cf9b6452efc0c8547ff423c424a54d0404bc

Download Submit
C:\Users\Admin\AppData\Local\Temp\msg.vbs

Filesize
3KB

MD5
35715e9dd320a2cd5e1b91c17729d1b6

SHA1
1ef31dc147730b7bb97fecc7b8d36d86d32577a2

SHA256
f11c3c79a57c5535178c424b5def9f24d4268dc862f8fb20c1775baa836ef8e0

SHA512
c72245b3067e1426acfcba31449ac1086dce9b605402941c378e8c054650ec704b52279ef18d2c148de04d1796c9d30bfc804a3fbd3366d5c406e5eb76013d7b

Download Submit
C:\Users\Admin\AppData\Local\Temp\msg.vbs

Filesize
3KB

MD5
f28d6aa42969ef2b78065f5846fde9f3

SHA1
69fc6338caa3248b3443896356c5f5d43c6a1d5e

SHA256
504ece5008e45b771cf45a251172daf906fbed8f841eee4f4b2791b331d8b273

SHA512
56bae884fb93085b31ab879a0fe4fb6d33adfd61a5c874afe5dc50452b96f2084850f2c7b2f78bb8305b5c43dfd8d2b9d16ed93263d4dcccf51b066cb805a714

Download Submit
C:\Users\Admin\AppData\Local\Temp\msg.vbs

Filesize
3KB

MD5
74087635a8e9094e0c26846a022090fc

SHA1
7cb210dafde3305162952ccf47cab45db420c820

SHA256
65cad3212d91d1c8ea5555a6734d82dd3813e879d76bd2b1c1a9e25fbdbbe127

SHA512
71f33fcb50520cf18f84b534be4e1dff2743afb45d4efb17a06d74ac8d53f628f1fb0e3abc88441e28baf03706b6c22213dbbd058d83bb73a9b52f58b4b59958

Download Submit
C:\Users\Admin\AppData\Local\Temp\msg.vbs

Filesize
42B

MD5
8e1b5b2d39789d545dd73e5a97a1a63c

SHA1
b2d37416d4e594ae403955da43dab9db197ec8e1

SHA256
b349d53e37a8022ff3682ca9380727674f801b82abd41d784a9e61a44d350cf5

SHA512
f1b62cb808f683996e5f846db876a6416d4aaf5d75cd6617fa270020d36c95e00bb355f5b18b56501cf3f1b16c967d08ef43a9961b5ada73cb1f7eee3f438478

Download Submit
C:\Users\Admin\AppData\Local\Temp\msg.vbs

Filesize
3KB

MD5
6985ae4698737083ff0714fac2f8baab

SHA1
9aa98ce2a8d1bbb6272d40a6b609f8702ec1b602

SHA256
c273af4011e7da2c30aae16117594b26bdea979f8032e6c33a2732e1a10f8c17

SHA512
32d89d7dd7a3729bdfd5176bf4e39cb226d1e331965ea544201ba4f91cda42e20286e0ff087bef4ac92b3c0e60faffd9dc00ffbae715dd8c1e5823cef0ec49ec

Download Submit
C:\Users\Admin\AppData\Local\Temp\msg.vbs

Filesize
378B

MD5
92c39bfc76c6650d6bf3c3f3d6ae3636

SHA1
8b16ba6322ac20e0abb7459b94e3997e9f824a8e

SHA256
a11d8fe9dfd6a041b652516fa47d09256770a0d571c630a8fed9c2c59daaa48a

SHA512
6e4374e8c98468c144ca9e48c785e807de3f0a7668e9af6f49306a2e132a87e8b9fe68f2ad75d7e23ab3ac14518bebf4dd27795c4ee6a48efa289b64992484f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\msg.vbs

Filesize
3KB

MD5
18aa981e5f91887fd9446f91d3260ac1

SHA1
834477487891b7f7eabe21f70800262aa7fc76fe

SHA256
4efeed9c0bb5eb841d9da87bc5ec43804c0917476b7da1393eebef35f4511bc7

SHA512
83e98e7620ff7930e8796c863ec4d2c3407313ffccd2175f56f0bf61a6a466f2134e915b51400ead8baa8dadf61b5514256f88b784f29a1db8cad4d32f9dcaed

Download Submit
C:\Users\Admin\AppData\Local\Temp\msg.vbs

Filesize
4KB

MD5
8bd67977c90e12f48cc3720b8ca2c006

SHA1
2c9a3d17642a34cf6695c3e4885e0b7d082d36df

SHA256
64201d47f200f74c92ecd77842d59a398acbbd949f2fc0e280d68f07f25ab5e1

SHA512
47fb9c0052f8418f20c889f1e1413a463217995618e0709c741a1236b895c8cf51372e78eecfdc8762c6718548bb8e3f44a2c2a32ddfdd4ff1e6c278e90cdfd5

Download Submit
C:\Users\Admin\AppData\Local\Temp\msg.vbs

Filesize
420B

MD5
f926025ab2948d0143a7bb737846f785

SHA1
07aba9026485ecdd4d81dd7cc112b05bfc1260ed

SHA256
ae3754c04ddf2f60bc7c168daa735f0e4e530a7bf06ab1dde732b1be52962fa4

SHA512
c744ddddeb714368a6d939e5a50b0260c10f6426cd30050edf1d03033fc1c0edbe8c8de3e15fd50981fe6157c2a46b3ca9fecc0efd6b4ca49174067ddaa9670f

Download Submit
C:\Users\Admin\AppData\Local\Temp\msg.vbs

Filesize
498B

MD5
df9eff169124d1bf680cd5ec0c2ab47f

SHA1
af4a0ed8752f749dffb340433fb998ebc57a343c

SHA256
9bfd1b56730177fed7a2d42f544d16004cfd57a815594c031ef7ad0cdf4a04ab

SHA512
bb6295d861ee57fa5b89767e36bc72833839772da723d05c134d70da5f1a431c8966c94fc5751c6744c235b7805eb5e743264190df6742a3efda5ef6b7279ea0

Download Submit
C:\Users\Admin\AppData\Local\Temp\msg.vbs

Filesize
508B

MD5
a04cc13120dd335a678651b2eb99d7ad

SHA1
4ea114075a4976ecc59c4e04b247839cb8fcc2a8

SHA256
e73c9d39d365743ea419a50f5ed660f3f5024d1e57d18da01955bc9914d5c2f9

SHA512
8977dd8a2317822323b3d9f8cba359ba059b7b0eb1c010e7f4e34188df0e4e43e1f9890798437247bd835802a7e9051e6e8d36f2e3e27b4264d9d0b3bddbe4de

Download Submit
C:\Users\Admin\AppData\Local\Temp\msg.vbs

Filesize
546B

MD5
d0824c0edb603f15bca4b4862a593092

SHA1
beb44756e5ca5fec1ae544d53b981a315e8c7be0

SHA256
3f3c649faebf359a405b71ba319ae87bce248a7d5dae5c0198221d8727f70e78

SHA512
d5b3a59bc7e72d99c1c270a84d073d045695d1257ec1d0074a3431d1830439121e98506dff84b126850070f8ecddfe372fd06781081eb840b08beebd5aee3f04

Download Submit
C:\Users\Admin\AppData\Local\Temp\msg.vbs

Filesize
592B

MD5
12a6f7fd1aedf646538b7ac14c80a90f

SHA1
f2ccf5f3d1a2991d200d8b902fc27be7fa48c73a

SHA256
4cc8ca520744a0adbebd48db2c87fda2c7cf7aa0e38e3bf762b3fba4978f0f35

SHA512
228f541caa301b40fcd7f96b12bb3f1a7d2162195b2c1969d0ebb592ab4df40a7c3adaccc91fba3aadb30d82ba67a038058ae4a49eed189688f08dbc06adf2ed

Download Submit
memory/2592-344-0x00007FFD15D20000-0x00007FFD15D8B000-memory.dmp

Filesize
428KB

Download