hxxps://gist[.]github[.]com/olafkoder/040f6c2c6c2badd773519ca329c7e4cd

Analysis

max time kernel
55s
max time network
72s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
16-06-2024 17:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://gist.github.com/olafkoder/040f6c2c6c2badd773519ca329c7e4cd

Score

10^/10

Malware Config

Extracted

Language

xlm4.0

Source

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 9 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Enumerates system info in registry 2 TTPs 15 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor	EXCEL.EXE

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\COMMAND	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\ = "&Edit"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\COMMAND	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\ = "&Edit"	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\MenuExt	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote	EXCEL.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55"	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell	EXCEL.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit	EXCEL.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105"	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000"	EXCEL.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1"	EXCEL.EXE

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shellex\IconHandler\ = "{42042206-2D85-11D3-8CFF-005004838597}"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\ = "&Open"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Old Icon	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\command	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version\14	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\ = "&Open"	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\command	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1"	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shellex\IconHandler	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application	EXCEL.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\ = "[open(\"%1\")]"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\command	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}	EXCEL.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Old Icon\htmlfile	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ = "&Open"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec	EXCEL.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\application	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\command	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\ = "&Open"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\ = "&Open"	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\ = "&Open"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\ShellEx	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shellex\IconHandler	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\application\ = "Excel"	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shellex\IconHandler\ = "{42042206-2D85-11D3-8CFF-005004838597}"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\ = "[open(\"%1\")]"	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\topic\ = "system"	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ = "&Open"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\command	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\DefaultIcon	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\ = "&Open"	EXCEL.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\command	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\command	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic\ = "system"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\InprocServer32	EXCEL.EXE

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\040f6c2c6c2badd773519ca329c7e4cd-ac413db2ff64d2d654ee041462ea286beed57285.zip:Zone.Identifier	firefox.exe

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
1728	EXCEL.EXE
1172	vlc.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1172	vlc.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1712	firefox.exe
Token: SeDebugPrivilege	1712	firefox.exe
Token: SeDebugPrivilege	1712	firefox.exe

Suspicious use of FindShellTrayWindow 12 IoCs

pid	Process
1712	firefox.exe
1712	firefox.exe
1712	firefox.exe
1712	firefox.exe
1172	vlc.exe
1172	vlc.exe
1172	vlc.exe
1172	vlc.exe
1172	vlc.exe
1172	vlc.exe
1172	vlc.exe
1172	vlc.exe

Suspicious use of SendNotifyMessage 10 IoCs

pid	Process
1712	firefox.exe
1712	firefox.exe
1712	firefox.exe
1172	vlc.exe
1172	vlc.exe
1172	vlc.exe
1172	vlc.exe
1172	vlc.exe
1172	vlc.exe
1172	vlc.exe

Suspicious use of SetWindowsHookEx 27 IoCs

pid	Process
1712	firefox.exe
1712	firefox.exe
1712	firefox.exe
1728	EXCEL.EXE
2536	xpsrchvw.exe
2420	EXCEL.EXE
2536	xpsrchvw.exe
1172	vlc.exe
2888	WINWORD.EXE
2888	WINWORD.EXE
2888	WINWORD.EXE
2900	EXCEL.EXE
2536	xpsrchvw.exe
2748	EXCEL.EXE
2536	xpsrchvw.exe
3236	EXCEL.EXE
4076	EXCEL.EXE
4992	EXCEL.EXE
6140	EXCEL.EXE
7596	EXCEL.EXE
9268	EXCEL.EXE
10996	EXCEL.EXE
13060	EXCEL.EXE
14624	EXCEL.EXE
17732	EXCEL.EXE
19004	EXCEL.EXE
21388	EXCEL.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2360 wrote to memory of 1712	2360	firefox.exe	28
PID 2360 wrote to memory of 1712	2360	firefox.exe	28
PID 2360 wrote to memory of 1712	2360	firefox.exe	28
PID 2360 wrote to memory of 1712	2360	firefox.exe	28
PID 2360 wrote to memory of 1712	2360	firefox.exe	28
PID 2360 wrote to memory of 1712	2360	firefox.exe	28
PID 2360 wrote to memory of 1712	2360	firefox.exe	28
PID 2360 wrote to memory of 1712	2360	firefox.exe	28
PID 2360 wrote to memory of 1712	2360	firefox.exe	28
PID 2360 wrote to memory of 1712	2360	firefox.exe	28
PID 2360 wrote to memory of 1712	2360	firefox.exe	28
PID 2360 wrote to memory of 1712	2360	firefox.exe	28
PID 1712 wrote to memory of 3012	1712	firefox.exe	29
PID 1712 wrote to memory of 3012	1712	firefox.exe	29
PID 1712 wrote to memory of 3012	1712	firefox.exe	29
PID 1712 wrote to memory of 2708	1712	firefox.exe	30
PID 1712 wrote to memory of 2708	1712	firefox.exe	30
PID 1712 wrote to memory of 2708	1712	firefox.exe	30
PID 1712 wrote to memory of 2708	1712	firefox.exe	30
PID 1712 wrote to memory of 2708	1712	firefox.exe	30
PID 1712 wrote to memory of 2708	1712	firefox.exe	30
PID 1712 wrote to memory of 2708	1712	firefox.exe	30
PID 1712 wrote to memory of 2708	1712	firefox.exe	30
PID 1712 wrote to memory of 2708	1712	firefox.exe	30
PID 1712 wrote to memory of 2708	1712	firefox.exe	30
PID 1712 wrote to memory of 2708	1712	firefox.exe	30
PID 1712 wrote to memory of 2708	1712	firefox.exe	30
PID 1712 wrote to memory of 2708	1712	firefox.exe	30
PID 1712 wrote to memory of 2708	1712	firefox.exe	30
PID 1712 wrote to memory of 2708	1712	firefox.exe	30
PID 1712 wrote to memory of 2708	1712	firefox.exe	30
PID 1712 wrote to memory of 2708	1712	firefox.exe	30
PID 1712 wrote to memory of 2708	1712	firefox.exe	30
PID 1712 wrote to memory of 2708	1712	firefox.exe	30
PID 1712 wrote to memory of 2708	1712	firefox.exe	30
PID 1712 wrote to memory of 2708	1712	firefox.exe	30
PID 1712 wrote to memory of 2708	1712	firefox.exe	30
PID 1712 wrote to memory of 2708	1712	firefox.exe	30
PID 1712 wrote to memory of 2708	1712	firefox.exe	30
PID 1712 wrote to memory of 2708	1712	firefox.exe	30
PID 1712 wrote to memory of 2708	1712	firefox.exe	30
PID 1712 wrote to memory of 2708	1712	firefox.exe	30
PID 1712 wrote to memory of 2708	1712	firefox.exe	30
PID 1712 wrote to memory of 2708	1712	firefox.exe	30
PID 1712 wrote to memory of 2708	1712	firefox.exe	30
PID 1712 wrote to memory of 2708	1712	firefox.exe	30
PID 1712 wrote to memory of 2708	1712	firefox.exe	30
PID 1712 wrote to memory of 2708	1712	firefox.exe	30
PID 1712 wrote to memory of 2708	1712	firefox.exe	30
PID 1712 wrote to memory of 2708	1712	firefox.exe	30
PID 1712 wrote to memory of 2708	1712	firefox.exe	30
PID 1712 wrote to memory of 2708	1712	firefox.exe	30
PID 1712 wrote to memory of 2708	1712	firefox.exe	30
PID 1712 wrote to memory of 2708	1712	firefox.exe	30
PID 1712 wrote to memory of 2708	1712	firefox.exe	30
PID 1712 wrote to memory of 2708	1712	firefox.exe	30
PID 1712 wrote to memory of 2708	1712	firefox.exe	30
PID 1712 wrote to memory of 2708	1712	firefox.exe	30
PID 1712 wrote to memory of 2708	1712	firefox.exe	30
PID 1712 wrote to memory of 2940	1712	firefox.exe	31
PID 1712 wrote to memory of 2940	1712	firefox.exe	31
PID 1712 wrote to memory of 2940	1712	firefox.exe	31
PID 1712 wrote to memory of 2940	1712	firefox.exe	31
PID 1712 wrote to memory of 2940	1712	firefox.exe	31

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "https://gist.github.com/olafkoder/040f6c2c6c2badd773519ca329c7e4cd"
1⤵
- Suspicious use of WriteProcessMemory
PID:2360
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url https://gist.github.com/olafkoder/040f6c2c6c2badd773519ca329c7e4cd
  2⤵
  - Checks processor information in registry
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1712
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1712.0.846817040\365991794" -parentBuildID 20221007134813 -prefsHandle 1252 -prefMapHandle 1160 -prefsLen 20600 -prefMapSize 233275 -appDir "C:\Program Files\Mozilla Firefox\browser" - {0949fee8-64fc-4958-945b-c0a0e1c2734c} 1712 "\\.\pipe\gecko-crash-server-pipe.1712" 1364 112f7158 gpu
    3⤵
    PID:3012
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1712.1.1897498513\681886532" -parentBuildID 20221007134813 -prefsHandle 1516 -prefMapHandle 1512 -prefsLen 21461 -prefMapSize 233275 -appDir "C:\Program Files\Mozilla Firefox\browser" - {18e34456-1f33-4959-8f12-8247f06a0860} 1712 "\\.\pipe\gecko-crash-server-pipe.1712" 1528 f5ec258 socket
    3⤵
    - Checks processor information in registry
    PID:2708
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1712.2.1242080172\855570439" -childID 1 -isForBrowser -prefsHandle 736 -prefMapHandle 1216 -prefsLen 21499 -prefMapSize 233275 -jsInitHandle 640 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {dd42de6d-50f9-4152-9839-e111f9647384} 1712 "\\.\pipe\gecko-crash-server-pipe.1712" 2136 1ad22358 tab
    3⤵
    PID:2940
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1712.3.477051244\1031824754" -childID 2 -isForBrowser -prefsHandle 2840 -prefMapHandle 2836 -prefsLen 25956 -prefMapSize 233275 -jsInitHandle 640 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {954d80db-dbbc-4197-9a64-f3ab3a608ec9} 1712 "\\.\pipe\gecko-crash-server-pipe.1712" 2852 1c73c658 tab
    3⤵
    PID:2620
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1712.4.777830465\2134443568" -childID 3 -isForBrowser -prefsHandle 3672 -prefMapHandle 3652 -prefsLen 26532 -prefMapSize 233275 -jsInitHandle 640 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {7f94815e-9cd1-4c1d-9f9e-00b150d0b0d6} 1712 "\\.\pipe\gecko-crash-server-pipe.1712" 3956 21bcae58 tab
    3⤵
    PID:2424
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1712.5.661189851\356265649" -childID 4 -isForBrowser -prefsHandle 4064 -prefMapHandle 4068 -prefsLen 26532 -prefMapSize 233275 -jsInitHandle 640 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {a3e688dc-881c-430d-ae21-967c6471875b} 1712 "\\.\pipe\gecko-crash-server-pipe.1712" 4052 21bca258 tab
    3⤵
    PID:320
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1712.6.1633169696\884438535" -childID 5 -isForBrowser -prefsHandle 4232 -prefMapHandle 4236 -prefsLen 26532 -prefMapSize 233275 -jsInitHandle 640 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {62287888-7a84-4faa-9bc9-404c2d69a9be} 1712 "\\.\pipe\gecko-crash-server-pipe.1712" 4220 21bc8d58 tab
    3⤵
    PID:356

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
1⤵
PID:972
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
  2⤵
  PID:2684
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:2592
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
      4⤵
      PID:19776
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
      4⤵
      PID:20332
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
      4⤵
      PID:20852
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
      4⤵
      PID:21464
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
      4⤵
      PID:21908
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
      4⤵
      PID:22448
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
      4⤵
      PID:22952
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
      4⤵
      PID:4612
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
      4⤵
      PID:24160
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
      4⤵
      PID:24632
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
      4⤵
      PID:25276
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
      4⤵
      PID:25712
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
      4⤵
      PID:26448
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
      4⤵
      PID:27020
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
      4⤵
      PID:9464
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
      4⤵
      PID:28292
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
      4⤵
      PID:28824
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
      4⤵
      PID:29124
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
      4⤵
      PID:30260
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
      4⤵
      PID:31108
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
      4⤵
      PID:17672
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
      4⤵
      PID:32728
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
      4⤵
      PID:33256
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
      4⤵
      PID:34004
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
      4⤵
      PID:22540
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
      4⤵
      PID:23064
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
      4⤵
      PID:36448
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
      4⤵
      PID:36928
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:892
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
      4⤵
      PID:21628
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
      4⤵
      PID:23040
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
      4⤵
      PID:5468
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
      4⤵
      PID:24304
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
      4⤵
      PID:24784
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
      4⤵
      PID:25452
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
      4⤵
      PID:25932
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
      4⤵
      PID:25852
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
      4⤵
      PID:27272
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
      4⤵
      PID:27832
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
      4⤵
      PID:28588
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
      4⤵
      PID:29280
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
      4⤵
      PID:13220
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
      4⤵
      PID:30456
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
      4⤵
      PID:31432
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
      4⤵
      PID:31916
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
      4⤵
      PID:19016
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
      4⤵
      PID:33444
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
      4⤵
      PID:34228
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
      4⤵
      PID:34956
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
      4⤵
      PID:35692
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
      4⤵
      PID:36644
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
      4⤵
      PID:37132
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:2512
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
      4⤵
      PID:28648
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
      4⤵
      PID:29392
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
      4⤵
      PID:29780
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
      4⤵
      PID:30572
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
      4⤵
      PID:31496
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
      4⤵
      PID:32192
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
      4⤵
      PID:19616
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
      4⤵
      PID:33556
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
      4⤵
      PID:34332
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
      4⤵
      PID:35080
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
      4⤵
      PID:1600
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
      4⤵
      PID:36744
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
      4⤵
      PID:37196
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:2660
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
      4⤵
      PID:31988
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
      4⤵
      PID:30840
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
      4⤵
      PID:33512
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
      4⤵
      PID:34260
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
      4⤵
      PID:35000
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
      4⤵
      PID:35716
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
      4⤵
      PID:36652
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
      4⤵
      PID:37140
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:1464
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:1940
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:1324
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:3176
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:3348
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:3496
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:3672
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:3848
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:4040
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:4112
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:4316
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:4500
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:4716
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:4956
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:5008
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:5304
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:5560
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:5820
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:6088
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:6240
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:6544
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:6768
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:6900
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:7360
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:7716
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:8076
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:8296
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:8684
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:9080
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:9452
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:9824
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:10212
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:10504
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:10884
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:10948
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:11656
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:12044
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:12332
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:13048
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:12716
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:13496
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:13992
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:14352
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:14864
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:14476
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:15772
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:16276
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:16660
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:17164
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:17520
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:18380
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:19240
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:19552
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:20052
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:20584
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:21252
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:21772
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:22348
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:22852
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:22648
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:24008
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:6272
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:25164
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:25764
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:26496
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:27072
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:27588
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:28360
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:28964
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:12516
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:30308
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:31116
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:15584
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:32716
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:33244
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:33996
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:34740
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:4588
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:36440
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:36936
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
  2⤵
  PID:2020
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:3648
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:3832
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:4060
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:4160
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:4364
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:4556
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:4788
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:5024
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:5180
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:5404
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:5676
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:5976
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:6172
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:6512
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:6824
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:6908
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:7336
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:7660
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:8004
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:7352
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:8484
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:8816
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:7208
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:9416
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:9788
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:10196
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:10516
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:10956
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:11296
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:11716
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:12192
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:12592
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:13208
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:13580
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:14112
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:14416
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:14940
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:14412
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:15816
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:16288
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:16784
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:16424
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:17824
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:18252
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:18424
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:18996
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:18880
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:20016
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:20504
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:21156
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:21632
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:21624
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:23020
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:5204
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:24240
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:24732
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:25404
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:25900
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:8340
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:27252
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:27840
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:28608
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:29300
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:29748
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:30520
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:31472
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:32004
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:32704
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:33528
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:34276
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:35028
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:35744
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:36688
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:37172
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
  2⤵
  PID:808
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:4464
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:4692
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:4916
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:4940
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:5320
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:5620
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:5868
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:5800
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:6436
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:6744
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:6872
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:7324
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:7652
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:8020
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:8228
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:8632
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:9004
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:9328
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:9736
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:10024
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:10348
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:10784
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:11216
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:11568
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:12020
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:12396
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:13096
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:13368
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:13848
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:14308
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:14724
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:15300
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:15728
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:16096
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:16568
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:17132
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:16868
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:17808
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:18312
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:18904
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:19372
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:19924
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:20440
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:20964
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:20896
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:22060
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:4196
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:23256
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:23716
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:24448
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:24916
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:6764
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:26112
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:26636
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:27392
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:27952
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:10636
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:29440
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:29884
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:30708
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:31656
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:32328
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:18772
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:33664
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:34468
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:34944
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:35456
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:36116
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:36636
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:37568
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
  2⤵
  PID:616
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:5488
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:5756
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:6020
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:5300
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:6448
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:6712
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:6536
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:7384
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:7744
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:8096
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:8360
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:8772
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:9156
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:9372
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:9800
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:10188
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:10484
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:10860
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:10776
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:11628
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:12004
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:12324
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:12996
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:13256
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:13484
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:13940
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:14268
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:14748
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:15272
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:15656
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:16056
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:16472
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:16936
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:17492
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:18324
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:18412
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:18548
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:19396
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:19900
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:20456
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:20928
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:2540
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:21972
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:3588
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:23068
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:23608
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:24424
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:24860
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:25552
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:26036
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:8304
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:27264
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:27808
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:28580
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:29264
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:13200
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:30508
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:31444
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:32260
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:20144
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:33624
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:34440
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:35144
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:24684
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:36820
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:37308
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
  2⤵
  PID:1892
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:6800
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:7028
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:7420
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:7672
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:7996
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:7296
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:8468
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:8724
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:9132
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:9596
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:9988
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:10320
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:10740
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:11196
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:11548
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:11984
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:12372
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:13072
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:13324
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:13792
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:13688
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:14804
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:15324
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:15780
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:16320
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:16820
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:17404
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:17816
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:18244
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:18656
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:19432
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:19988
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:20552
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:21196
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:21668
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:22280
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:22704
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:23400
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:23920
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:5420
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:25104
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:25652
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:26440
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:27008
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:27168
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:28284
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:28832
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:29104
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:30156
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:30868
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:31420
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:32604
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:33152
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:21608
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:33976
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:35552
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:36236
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:26404
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
  2⤵
  PID:2088
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:8272
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:8644
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:8996
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:9228
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:9572
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:9936
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:9780
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:10592
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:10976
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:11356
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:11752
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:12156
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:12488
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:12604
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:13236
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:13476
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:14044
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:14424
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:14884
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:14860
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:15860
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:16328
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:16720
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:17304
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:17628
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:17624
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:18420
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:19332
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:19856
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:20464
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:20936
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:20580
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:21988
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:21844
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:23076
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:23560
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:24360
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:24820
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:25512
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:26016
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:8836
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:27380
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:27936
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:27728
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:29400
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:29788
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:30584
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:31568
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:32244
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:19060
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:20212
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:34724
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:35432
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:36136
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:25944
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:37604
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
  2⤵
  PID:1588
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:10100
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:10420
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:10840
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:10340
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:11612
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:12080
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:12500
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:13124
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:13396
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:13880
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:14448
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:14972
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:15368
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:15852
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:15768
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:16924
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:17160
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:17800
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:18260
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:18392
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:18940
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:19440
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:19996
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:20560
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:21204
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:21680
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:22292
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:22752
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:23324
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:23824
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:6532
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:25016
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:25048
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:26188
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:26712
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:27432
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:27992
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:11036
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:29480
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:29944
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:13616
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:30824
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:32404
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:32884
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:33704
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:34504
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:35228
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:3112
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:36844
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:37328
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
  2⤵
  PID:2168
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:11908
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:12292
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:12956
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:12320
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:13564
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:13924
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:14480
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:14980
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:15396
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:15904
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:16376
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:16872
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:16520
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:17836
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:18212
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
  2⤵
  PID:2868
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:13896
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:14092
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:14512
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:14964
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:15148
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:15804
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:16304
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:16692
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:17244
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:17116
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:17772
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:18664
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:19500
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:20004
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:20492
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:21136
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:21640
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:3412
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:23004
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:4872
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:24200
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:24700
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:25420
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:25876
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:26620
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:27196
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:27768
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:28492
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:29240
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:12860
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:30392
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:31280
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:31824
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:18700
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:33360
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:34292
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:35068
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:6616
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:36780
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:37272
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
  2⤵
  PID:2252
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:16556
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:17120
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:16772
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:17788
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:18236
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:17340
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:18872
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:19800
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:20260
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:20712
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:21316
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:21808
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:22428
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:22892
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:4428
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:24064
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:24508
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:25188
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:25632
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:26428
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:27000
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:27116
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:28276
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:28808
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:11784
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:30204
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:31000
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:17036
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:32684
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:33180
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:33868
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:21920
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:35608
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:36272
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:4640
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
  2⤵
  PID:1908
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:20032
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:20600
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:21244
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:21736
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:22324
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:22732
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:23452
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:23960
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:23584
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:25176
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:25728
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:26584
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:27128
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:27664
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:28424
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:28988
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:29184
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:30320
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:31180
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:17688
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:32744
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:33264
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:33968
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:34476
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:2484
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:36352
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:26668
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
  2⤵
  PID:1688
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:7772
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:26280
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:26832
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:27620
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:28168
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:28688
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:29616
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:30036
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:14604
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:31104
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:32524
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:33020
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:20772
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:34660
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:35364
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:36008
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:3668
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:37496
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
  2⤵
  PID:3024
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:31620
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:32308
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:20220
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:33680
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:34540
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:35248
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:35920
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:25036
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:37400
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
  2⤵
  PID:556
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:33900
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:22460
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:35820
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:36344
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
    3⤵
    PID:2676
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
  2⤵
  PID:2164
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
  2⤵
  PID:2516
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
  2⤵
  PID:3104
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
  2⤵
  PID:3228
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
  2⤵
  PID:3420
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
  2⤵
  PID:3564
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
  2⤵
  PID:3728
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
  2⤵
  PID:3900
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
  2⤵
  PID:4068
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
  2⤵
  PID:4168
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
  2⤵
  PID:4356
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
  2⤵
  PID:4592
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
  2⤵
  PID:4804
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
  2⤵
  PID:5044
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
  2⤵
  PID:5208
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
  2⤵
  PID:5428
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
  2⤵
  PID:5688
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
  2⤵
  PID:5964
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
  2⤵
  PID:5900
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
  2⤵
  PID:6396
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
  2⤵
  PID:6668
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
  2⤵
  PID:7156
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
  2⤵
  PID:6920
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
  2⤵
  PID:7372
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
  2⤵
  PID:7732
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
  2⤵
  PID:8088
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
  2⤵
  PID:8344
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
  2⤵
  PID:8716
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
  2⤵
  PID:9088
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
  2⤵
  PID:9236
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
  2⤵
  PID:9616
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
  2⤵
  PID:9960
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
  2⤵
  PID:10272
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
  2⤵
  PID:10656
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
  2⤵
  PID:11052
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
  2⤵
  PID:11412
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
  2⤵
  PID:11804
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
  2⤵
  PID:12224
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
  2⤵
  PID:12580
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
  2⤵
  PID:13176
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
  2⤵
  PID:13512
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
  2⤵
  PID:14152
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
  2⤵
  PID:14628
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
  2⤵
  PID:15152
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
  2⤵
  PID:15552
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
  2⤵
  PID:16044
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
  2⤵
  PID:16416
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
  2⤵
  PID:16900
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
  2⤵
  PID:16932
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
  2⤵
  PID:17480
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
  2⤵
  PID:18112
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
  2⤵
  PID:19080
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
  2⤵
  PID:19468
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
  2⤵
  PID:19964
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
  2⤵
  PID:19908
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
  2⤵
  PID:21060
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
  2⤵
  PID:21460
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
  2⤵
  PID:22212
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
  2⤵
  PID:22660
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
  2⤵
  PID:23356
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
  2⤵
  PID:23856
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
  2⤵
  PID:24568
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
  2⤵
  PID:25056
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
  2⤵
  PID:25576
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
  2⤵
  PID:26344
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
  2⤵
  PID:26840
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
  2⤵
  PID:27592
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
  2⤵
  PID:28144
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
  2⤵
  PID:28704
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
  2⤵
  PID:29664
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
  2⤵
  PID:30092
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
  2⤵
  PID:30736
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
  2⤵
  PID:16024
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
  2⤵
  PID:32556
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
  2⤵
  PID:33068
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
  2⤵
  PID:33524
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
  2⤵
  PID:34748
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
  2⤵
  PID:35484
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
  2⤵
  PID:36168
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
  2⤵
  PID:26092
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
  2⤵
  PID:37640

C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding
1⤵
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:1728

C:\Windows\System32\xpsrchvw.exe
"C:\Windows\System32\xpsrchvw.exe" "C:\Users\Admin\Desktop\UninstallClear.easmx"
1⤵
- Suspicious use of SetWindowsHookEx
PID:2536

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
1⤵
PID:2808
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
  2⤵
  PID:536
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
  2⤵
  PID:1876
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
  2⤵
  PID:3184
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
  2⤵
  PID:3376
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
  2⤵
  PID:3516
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
  2⤵
  PID:3688
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
  2⤵
  PID:3864
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
  2⤵
  PID:4052
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
  2⤵
  PID:4144
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
  2⤵
  PID:4328
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
  2⤵
  PID:4544
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
  2⤵
  PID:4768
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
  2⤵
  PID:5016
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
  2⤵
  PID:5168
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
  2⤵
  PID:5392
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
  2⤵
  PID:5640
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
  2⤵
  PID:5908
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
  2⤵
  PID:5472
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
  2⤵
  PID:6328
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
  2⤵
  PID:6656
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
  2⤵
  PID:7108
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
  2⤵
  PID:6776
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
  2⤵
  PID:7316
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
  2⤵
  PID:7644
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
  2⤵
  PID:7988
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
  2⤵
  PID:8252
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
  2⤵
  PID:8612
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
  2⤵
  PID:8924
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
  2⤵
  PID:9148
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
  2⤵
  PID:9292
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
  2⤵
  PID:9700
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
  2⤵
  PID:10072
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
  2⤵
  PID:10368
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
  2⤵
  PID:10728
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
  2⤵
  PID:11024
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
  2⤵
  PID:11400
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
  2⤵
  PID:11792
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
  2⤵
  PID:12212
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
  2⤵
  PID:12552
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
  2⤵
  PID:13192
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
  2⤵
  PID:13444
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
  2⤵
  PID:13692
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
  2⤵
  PID:14168
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
  2⤵
  PID:14660
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
  2⤵
  PID:15176
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
  2⤵
  PID:15540
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
  2⤵
  PID:16036
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
  2⤵
  PID:16436
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
  2⤵
  PID:16916
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
  2⤵
  PID:16648
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
  2⤵
  PID:17756
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
  2⤵
  PID:17332
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
  2⤵
  PID:18492
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
  2⤵
  PID:19348
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
  2⤵
  PID:19884
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
  2⤵
  PID:19540
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
  2⤵
  PID:21004
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
  2⤵
  PID:21532
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
  2⤵
  PID:22128
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
  2⤵
  PID:3416
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
  2⤵
  PID:23184
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
  2⤵
  PID:23600
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
  2⤵
  PID:24408
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
  2⤵
  PID:24868
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
  2⤵
  PID:25560
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
  2⤵
  PID:26048
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
  2⤵
  PID:8172
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
  2⤵
  PID:27408
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
  2⤵
  PID:27964
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
  2⤵
  PID:10724
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
  2⤵
  PID:29452
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
  2⤵
  PID:29896
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
  2⤵
  PID:30716
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
  2⤵
  PID:31648
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
  2⤵
  PID:32336
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
  2⤵
  PID:32772
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
  2⤵
  PID:33672
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
  2⤵
  PID:34524
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
  2⤵
  PID:35240
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
  2⤵
  PID:35944
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
  2⤵
  PID:36124
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\PC_DESTROYER.vbs"
  2⤵
  PID:37416

C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\Desktop\MountConnect.odt"
1⤵
- Suspicious use of SetWindowsHookEx
PID:2888

C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding
1⤵
- Enumerates system info in registry
- Suspicious use of SetWindowsHookEx
PID:2420

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\EnterResolve.aif"
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1172

C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding
1⤵
- Enumerates system info in registry
- Suspicious use of SetWindowsHookEx
PID:2900

C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding
1⤵
- Enumerates system info in registry
- Suspicious use of SetWindowsHookEx
PID:2748

C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding
1⤵
- Enumerates system info in registry
- Suspicious use of SetWindowsHookEx
PID:3236

C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding
1⤵
- Enumerates system info in registry
- Suspicious use of SetWindowsHookEx
PID:4076

C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding
1⤵
- Enumerates system info in registry
- Suspicious use of SetWindowsHookEx
PID:4992

C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding
1⤵
- Enumerates system info in registry
- Suspicious use of SetWindowsHookEx
PID:6140

C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding
1⤵
- Enumerates system info in registry
- Suspicious use of SetWindowsHookEx
PID:7596

C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding
1⤵
- Enumerates system info in registry
- Suspicious use of SetWindowsHookEx
PID:9268

C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding
1⤵
- Enumerates system info in registry
- Suspicious use of SetWindowsHookEx
PID:10996

C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding
1⤵
- Enumerates system info in registry
- Suspicious use of SetWindowsHookEx
PID:13060

C:\Windows\system32\odbcad32.exe
"C:\Windows\system32\odbcad32.exe"
1⤵
PID:14900

C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding
1⤵
- Enumerates system info in registry
- Suspicious use of SetWindowsHookEx
PID:14624

C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding
1⤵
- Enumerates system info in registry
- Suspicious use of SetWindowsHookEx
PID:17732

C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding
1⤵
- Enumerates system info in registry
- Suspicious use of SetWindowsHookEx
PID:19004

C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:21388

C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding
1⤵
PID:23868

C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding
1⤵
PID:26028

C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding
1⤵
PID:29672

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
1⤵
PID:30552
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:30552 CREDAT:275457 /prefetch:2
  2⤵
  PID:30832

C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding
1⤵
PID:30988

C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding
1⤵
PID:18032

C:\Windows\helppane.exe
C:\Windows\helppane.exe -Embedding
1⤵
PID:20696

C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding
1⤵
PID:5072

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\lf4jobx9.default-release\activity-stream.discovery_stream.json.tmp

Filesize
25KB

MD5
ab3ff8bf5d6d48ab8e6c02eea69f67a8

SHA1
7123410ba3b0e7f484afad023b4f02c1774b9c08

SHA256
6e5d9131c54722ca9e3ddee8615e577ee3697ed513905cfa4d648ea806941f3b

SHA512
adcf33281a519ad046bdbeae3479d1c99b61a6f0bbfb1e08dd5ae7b5f1da5df21a46267262a433de5ea85889791c20204dd74b3b581fab88687cf08a0df76a98

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lf4jobx9.default-release\datareporting\glean\db\data.safe.bin

Filesize
2KB

MD5
4d0bd9e552ab4d398c67a5e00842b086

SHA1
b7745e8e9123565f6b2190ed6dddc97d06c491d9

SHA256
3d5639fceb32dcffe2360b5eb648bbed351950aecdd3bbb51a0aa38fa0e36ccb

SHA512
1f130b4b53e958d4cf19110f123c23aa1d18c4f3e86c1c66562adaa8ec9d03f952a8c4bb395ce4f6b64c0d3bf464c719833ddc1ed2534d9bd36989d6d16fe841

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lf4jobx9.default-release\datareporting\glean\pending_pings\7496b7f1-052d-491b-a72f-ce1b02ed117a

Filesize
668B

MD5
7f2f39342ad21673443fc18dd983979c

SHA1
ccb306899af5530cc83f22a9bdcc75252605b0af

SHA256
d8fef48a0831d28007eddca721f03f6dcb99dea53317f4cddcae12f5c541c6c5

SHA512
ac9367d0543cafee6ae9461e86f2af4e18217a9d802317b145105aa98c0eadf1907cd567849558e32a98960d162d1dc1f80618419f2658f870e5dd4dea8b22d9

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lf4jobx9.default-release\datareporting\glean\pending_pings\dd76ddab-bfa8-4514-8846-c437f264a937

Filesize
11KB

MD5
2e05a7cc9d47f78f6a0e24c90fec1367

SHA1
bbc9bcdd3a5a8465fe9aab8425601781567aa4aa

SHA256
470cf9499276e4d7d492da4fefb8b268643c841a98091c511cadd1fc43ed3943

SHA512
2494ec1987483ef269a9c375233274ff2237b2eaa79bb93ec80ea90ea3418398c166612e4338625100029f2ee3fdcc1bfb099269549afb66ac82772cdab3e662

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lf4jobx9.default-release\extensions.json.tmp

Filesize
41KB

MD5
d79b1281a7db3bf82da2610082a9410b

SHA1
54c69d923b6c4872109f246cb4c75a3a69956ca4

SHA256
ca347dcbd85b182c2fabf0a58d0228b97d4f001947308cc35ab913796e418d75

SHA512
d7f704daa322bf2523531bed770bf43cfacb0237f481341d14988dbf706b6d7c14dc17c70355b9bee6f6a783efea26bf5b746f9f5e92980d855edcc01434a3f5

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lf4jobx9.default-release\prefs-1.js

Filesize
6KB

MD5
0b133fedef164c0835276707624abb79

SHA1
8d6f0f7094d1e992aa79282dcb0dc4e6dbc2a938

SHA256
6a3d51b55fdb6b8e30cf5d69a8719fa92f1873c94d1bcf8cb94c8aea520045e5

SHA512
74ca23c895a774c2e3181f3dcc192b4b0463b1af49906aa012e5738f0a76c3960dec66bb71bae083dd25afcf4a39f35cdf7b1f3c159f6601e7717f99f1287c10

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lf4jobx9.default-release\prefs-1.js

Filesize
6KB

MD5
716a8993bb2f1eb08203d2013288827c

SHA1
6859371013ecff63cce00e3050e70b3a194d5942

SHA256
a5c4d5f71611f92ca7201b530941c9140b5ff4a813fa041f246626e595672ee3

SHA512
3cf32402426917595b24f777e6283faa57d304c4a0c92537e8fd654d782c460ef8b4598f682d2b3d0d3461db4e414cc5793bdd8a5c8c450a36c5a0b0acfc5902

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lf4jobx9.default-release\prefs.js

Filesize
5KB

MD5
e58668a53c7ea67ad21398793ed4b117

SHA1
135c826bba74660ff72f9fb5c5e86773950d4856

SHA256
476914fbe5ecf90884dbcb8840ba550e4107f9da8e743c55b9a236cf83ccc0a7

SHA512
dd34db8f149049a0818557231f5216af8328f35c7531bbb9b7f9b18829376cd0a168329fe23f530576c5cbe96ebed8479c237574b8c8d15ecbc0d038bff44d31

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lf4jobx9.default-release\sessionstore.jsonlz4

Filesize
2KB

MD5
7a556fa25d9be7371d01ec6d27010846

SHA1
6db03219c670ef6106b244a9a5aeebdc8a293ef5

SHA256
c9bcaf53512e40601fcfce41f0bab04ed0b2bd878dc022d2ac1d44b1c72560fe

SHA512
94f34ae9880e6c3ff1a5669ed5bc6ec054d8dbae50620f49bf264bfe47ea673504836f951dfaa2aa331c843ba81da9c2495da9fb107860f80ad367ee1f5f17ed

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lf4jobx9.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

Filesize
144KB

MD5
0f034bd699de8528910745839afcb6aa

SHA1
cec37bd256f13f8071f2af6fce3079fe975e8455

SHA256
d90746e8d81e31e2a7395ec0d8338efc53d9de3815d679e18bc0c9e94cc7ac4a

SHA512
aaaa8faa1a9a4b01b69badb93365f1f67a7591774fd5636306caaaebf24d9ecdc6dad2a3fc9ea1a44ee62188ec93c852d3353a8401266807bb657c8e0f2503c4

Download Submit
C:\Users\Admin\Desktop\MountConnect.odt

Filesize
539KB

MD5
1e5502fe012ebb7196c0afc47d415ba0

SHA1
26825d9f39ad3d7fd88d1f71b9d268ef19a5e13a

SHA256
020066f996826fb87805387eae026339eb4a1bfc137651fb1f94a4f25ea6697f

SHA512
8a4f3bdc4a4e072813201ed67d7322b1e0d09ff7832528db9b8e0b6bb7f3e92f73c7498738d8ff972359a046c848999c8fb5f2368a8ccfa108fdd535ee8496ce

Download Submit
C:\Users\Admin\Downloads\-2FENp4C.zip.part

Filesize
954B

MD5
4fb3f3b352f1d166059c3fbad0a8af89

SHA1
3e9e301e08620943e9e05d0255042a1ab684976b

SHA256
6b4c4578e60467af729caea2b1135cd53f617a81a96d69e8bf97c4daaaa7562f

SHA512
e027a2c58ea69a37e30597e7d722edfd82ad67d54d1de0a03a9c336a6393f6539d5857c9a25e6dea3a6c27c29732bbed8fdd157124944331ba5544a0f7f4c1ea

Download Submit
memory/1172-491-0x000007FEF5880000-0x000007FEF5891000-memory.dmp

Filesize
68KB

Download
memory/1172-482-0x000007FEF5A40000-0x000007FEF5AA7000-memory.dmp

Filesize
412KB

Download
memory/1172-484-0x000007FEF3A70000-0x000007FEF4B1B000-memory.dmp

Filesize
16.7MB

Download
memory/1172-461-0x000000013F430000-0x000000013F528000-memory.dmp

Filesize
992KB

Download
memory/1172-462-0x000007FEF6870000-0x000007FEF68A4000-memory.dmp

Filesize
208KB

Download
memory/1172-464-0x000007FEF7A10000-0x000007FEF7A28000-memory.dmp

Filesize
96KB

Download
memory/1172-465-0x000007FEF6E90000-0x000007FEF6EA7000-memory.dmp

Filesize
92KB

Download
memory/1172-466-0x000007FEF6A00000-0x000007FEF6A11000-memory.dmp

Filesize
68KB

Download
memory/1172-467-0x000007FEF6850000-0x000007FEF6867000-memory.dmp

Filesize
92KB

Download
memory/1172-468-0x000007FEF6830000-0x000007FEF6841000-memory.dmp

Filesize
68KB

Download
memory/1172-463-0x000007FEF5FA0000-0x000007FEF6254000-memory.dmp

Filesize
2.7MB

Download
memory/1172-469-0x000007FEF5E50000-0x000007FEF5E6D000-memory.dmp

Filesize
116KB

Download
memory/1172-470-0x000007FEF5C50000-0x000007FEF5E50000-memory.dmp

Filesize
2.0MB

Download
memory/1172-471-0x000007FEF5C30000-0x000007FEF5C41000-memory.dmp

Filesize
68KB

Download
memory/1172-472-0x000007FEF5BF0000-0x000007FEF5C2F000-memory.dmp

Filesize
252KB

Download
memory/1172-473-0x000007FEF5BC0000-0x000007FEF5BE1000-memory.dmp

Filesize
132KB

Download
memory/1172-474-0x000007FEF5BA0000-0x000007FEF5BB8000-memory.dmp

Filesize
96KB

Download
memory/1172-475-0x000007FEF5B80000-0x000007FEF5B91000-memory.dmp

Filesize
68KB

Download
memory/1172-476-0x000007FEF5B60000-0x000007FEF5B71000-memory.dmp

Filesize
68KB

Download
memory/1172-497-0x000007FEF1A10000-0x000007FEF1AD5000-memory.dmp

Filesize
788KB

Download
memory/1172-481-0x000007FEF5AB0000-0x000007FEF5AE0000-memory.dmp

Filesize
192KB

Download
memory/1172-480-0x000007FEF5AE0000-0x000007FEF5AF8000-memory.dmp

Filesize
96KB

Download
memory/1172-479-0x000007FEF5B00000-0x000007FEF5B11000-memory.dmp

Filesize
68KB

Download
memory/1172-478-0x000007FEF5B20000-0x000007FEF5B3B000-memory.dmp

Filesize
108KB

Download
memory/1172-477-0x000007FEF5B40000-0x000007FEF5B51000-memory.dmp

Filesize
68KB

Download
memory/1172-483-0x000007FEF59D0000-0x000007FEF5A3F000-memory.dmp

Filesize
444KB

Download
memory/1172-485-0x000007FEF59B0000-0x000007FEF59C1000-memory.dmp

Filesize
68KB

Download
memory/1172-496-0x000007FEF1AE0000-0x000007FEF1AF6000-memory.dmp

Filesize
88KB

Download
memory/1172-492-0x000007FEF5860000-0x000007FEF5872000-memory.dmp

Filesize
72KB

Download
memory/1172-490-0x000007FEF58A0000-0x000007FEF58C3000-memory.dmp

Filesize
140KB

Download
memory/1172-489-0x000007FEF58D0000-0x000007FEF58E7000-memory.dmp

Filesize
92KB

Download
memory/1172-488-0x000007FEF58F0000-0x000007FEF5914000-memory.dmp

Filesize
144KB

Download
memory/1172-487-0x000007FEF5920000-0x000007FEF5948000-memory.dmp

Filesize
160KB

Download
memory/1172-493-0x000007FEF6E80000-0x000007FEF6E90000-memory.dmp

Filesize
64KB

Download
memory/1172-486-0x000007FEF5950000-0x000007FEF59A6000-memory.dmp

Filesize
344KB

Download
memory/1172-494-0x000007FEF1DB0000-0x000007FEF1DDF000-memory.dmp

Filesize
188KB

Download
memory/1172-495-0x000007FEF1D90000-0x000007FEF1DA1000-memory.dmp

Filesize
68KB

Download
memory/1728-443-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/1728-444-0x00000000727DD000-0x00000000727E8000-memory.dmp

Filesize
44KB

Download
memory/1728-458-0x00000000727DD000-0x00000000727E8000-memory.dmp

Filesize
44KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads