Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows11-21h2_x64 -
resource
win11-20240802-en -
resource tags
arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system -
submitted
20/08/2024, 02:22
Static task
static1
Behavioral task
behavioral1
Sample
Twitch Booster by back v6 cactus.exe
Resource
win11-20240802-en
General
-
Target
Twitch Booster by back v6 cactus.exe
-
Size
2.5MB
-
MD5
b9cd9a717a3c8617a23575c8a172986e
-
SHA1
7fdea9e41445e7997e785c5421cf5343255825e1
-
SHA256
e32615f5e1f4381f14a6bb9c776b8abf2a63e90fd9ef08472568ec09cbb6f1a6
-
SHA512
d32bc954b00e6cc596fdcde846dcd271d00d44ad9d636c8304d92ac2d2367a763cb0363d8d961170e5dccba01335bb053cda80b1fd0cd52b472bfa326d60d03e
-
SSDEEP
49152:yJRT3FWaXWRhWG7Mpzr36AedKbh4el7s2Hsrn5XTW5IYcKm+K:gRT3qRQG7Mp+YxZGYF8
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 1016 extension6.exe -
Enumerates connected drives 3 TTPs 47 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\G: WScript.exe File opened (read-only) \??\J: WScript.exe File opened (read-only) \??\L: WScript.exe File opened (read-only) \??\M: WScript.exe File opened (read-only) \??\D: WScript.exe File opened (read-only) \??\B: WScript.exe File opened (read-only) \??\W: WScript.exe File opened (read-only) \??\Z: WScript.exe File opened (read-only) \??\O: WScript.exe File opened (read-only) \??\W: WScript.exe File opened (read-only) \??\Q: WScript.exe File opened (read-only) \??\T: WScript.exe File opened (read-only) \??\N: WScript.exe File opened (read-only) \??\S: WScript.exe File opened (read-only) \??\Y: WScript.exe File opened (read-only) \??\A: WScript.exe File opened (read-only) \??\E: WScript.exe File opened (read-only) \??\H: WScript.exe File opened (read-only) \??\X: WScript.exe File opened (read-only) \??\O: WScript.exe File opened (read-only) \??\Q: WScript.exe File opened (read-only) \??\G: WScript.exe File opened (read-only) \??\N: WScript.exe File opened (read-only) \??\S: WScript.exe File opened (read-only) \??\Z: WScript.exe File opened (read-only) \??\A: WScript.exe File opened (read-only) \??\H: WScript.exe File opened (read-only) \??\M: WScript.exe File opened (read-only) \??\X: WScript.exe File opened (read-only) \??\B: WScript.exe File opened (read-only) \??\P: WScript.exe File opened (read-only) \??\R: WScript.exe File opened (read-only) \??\U: WScript.exe File opened (read-only) \??\V: WScript.exe File opened (read-only) \??\K: WScript.exe File opened (read-only) \??\P: WScript.exe File opened (read-only) \??\I: WScript.exe File opened (read-only) \??\K: WScript.exe File opened (read-only) \??\J: WScript.exe File opened (read-only) \??\L: WScript.exe File opened (read-only) \??\Y: WScript.exe File opened (read-only) \??\E: WScript.exe File opened (read-only) \??\T: WScript.exe File opened (read-only) \??\I: WScript.exe File opened (read-only) \??\R: WScript.exe File opened (read-only) \??\U: WScript.exe File opened (read-only) \??\V: WScript.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 16 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WScript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WScript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WScript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language extension6.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Twitch Booster by back v6 cactus.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WScript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WScript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WScript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WScript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WScript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe -
Kills process with taskkill 4 IoCs
pid Process 1188 taskkill.exe 1256 taskkill.exe 2176 taskkill.exe 2756 taskkill.exe -
Modifies registry class 3 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000_Classes\Local Settings WScript.exe Key created \REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000_Classes\Local Settings WScript.exe Key created \REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000_Classes\Local Settings Twitch Booster by back v6 cactus.exe -
Suspicious use of AdjustPrivilegeToken 10 IoCs
description pid Process Token: 33 1808 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 1808 AUDIODG.EXE Token: SeDebugPrivilege 1256 taskkill.exe Token: SeDebugPrivilege 2176 taskkill.exe Token: SeDebugPrivilege 2756 taskkill.exe Token: SeShutdownPrivilege 924 WScript.exe Token: SeCreatePagefilePrivilege 924 WScript.exe Token: SeShutdownPrivilege 4620 WScript.exe Token: SeCreatePagefilePrivilege 4620 WScript.exe Token: SeDebugPrivilege 1188 taskkill.exe -
Suspicious use of WriteProcessMemory 45 IoCs
description pid Process procid_target PID 2484 wrote to memory of 2712 2484 Twitch Booster by back v6 cactus.exe 83 PID 2484 wrote to memory of 2712 2484 Twitch Booster by back v6 cactus.exe 83 PID 2484 wrote to memory of 2712 2484 Twitch Booster by back v6 cactus.exe 83 PID 2712 wrote to memory of 1432 2712 WScript.exe 84 PID 2712 wrote to memory of 1432 2712 WScript.exe 84 PID 2712 wrote to memory of 1432 2712 WScript.exe 84 PID 2712 wrote to memory of 4152 2712 WScript.exe 86 PID 2712 wrote to memory of 4152 2712 WScript.exe 86 PID 2712 wrote to memory of 4152 2712 WScript.exe 86 PID 4152 wrote to memory of 2744 4152 WScript.exe 87 PID 4152 wrote to memory of 2744 4152 WScript.exe 87 PID 4152 wrote to memory of 2744 4152 WScript.exe 87 PID 2744 wrote to memory of 1256 2744 cmd.exe 89 PID 2744 wrote to memory of 1256 2744 cmd.exe 89 PID 2744 wrote to memory of 1256 2744 cmd.exe 89 PID 2744 wrote to memory of 2176 2744 cmd.exe 91 PID 2744 wrote to memory of 2176 2744 cmd.exe 91 PID 2744 wrote to memory of 2176 2744 cmd.exe 91 PID 2744 wrote to memory of 2756 2744 cmd.exe 92 PID 2744 wrote to memory of 2756 2744 cmd.exe 92 PID 2744 wrote to memory of 2756 2744 cmd.exe 92 PID 2712 wrote to memory of 1732 2712 WScript.exe 93 PID 2712 wrote to memory of 1732 2712 WScript.exe 93 PID 2712 wrote to memory of 1732 2712 WScript.exe 93 PID 2712 wrote to memory of 4620 2712 WScript.exe 94 PID 2712 wrote to memory of 4620 2712 WScript.exe 94 PID 2712 wrote to memory of 4620 2712 WScript.exe 94 PID 2712 wrote to memory of 1016 2712 WScript.exe 95 PID 2712 wrote to memory of 1016 2712 WScript.exe 95 PID 2712 wrote to memory of 1016 2712 WScript.exe 95 PID 2712 wrote to memory of 924 2712 WScript.exe 96 PID 2712 wrote to memory of 924 2712 WScript.exe 96 PID 2712 wrote to memory of 924 2712 WScript.exe 96 PID 2712 wrote to memory of 1348 2712 WScript.exe 97 PID 2712 wrote to memory of 1348 2712 WScript.exe 97 PID 2712 wrote to memory of 1348 2712 WScript.exe 97 PID 1732 wrote to memory of 1788 1732 WScript.exe 98 PID 1732 wrote to memory of 1788 1732 WScript.exe 98 PID 1732 wrote to memory of 1788 1732 WScript.exe 98 PID 1348 wrote to memory of 4272 1348 WScript.exe 100 PID 1348 wrote to memory of 4272 1348 WScript.exe 100 PID 1348 wrote to memory of 4272 1348 WScript.exe 100 PID 1788 wrote to memory of 1188 1788 cmd.exe 101 PID 1788 wrote to memory of 1188 1788 cmd.exe 101 PID 1788 wrote to memory of 1188 1788 cmd.exe 101
Processes
-
C:\Users\Admin\AppData\Local\Temp\Twitch Booster by back v6 cactus.exe"C:\Users\Admin\AppData\Local\Temp\Twitch Booster by back v6 cactus.exe"1⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2484 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\TwitchBooster.vbs"2⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2712 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\660.vbs"3⤵
- System Location Discovery: System Language Discovery
PID:1432
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7458.vbs"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4152 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\extension4.bat" "4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2744 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /IM chrome.exe5⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1256
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /IM firefox.exe5⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2176
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /IM javaw.exe5⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2756
-
-
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\extension110.vbs"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1732 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\589.bat" "4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1788 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /IM explorer.exe5⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1188
-
-
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\extension5.vbs"3⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4620
-
-
C:\Users\Admin\AppData\Local\Temp\extension6.exe"C:\Users\Admin\AppData\Local\Temp\extension6.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1016
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\4826.vbs"3⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:924
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\extension3.vbs"3⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1348 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\extension3.vbs"4⤵
- System Location Discovery: System Language Discovery
PID:4272 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\extension3.vbs"5⤵PID:2540
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\extension3.vbs"6⤵PID:944
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\extension3.vbs"7⤵PID:1872
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\extension3.vbs"8⤵PID:1064
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\extension3.vbs"9⤵PID:976
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\extension3.vbs"10⤵PID:1708
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\extension3.vbs"11⤵PID:860
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\extension3.vbs"12⤵PID:4532
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\extension3.vbs"13⤵PID:8
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\extension3.vbs"14⤵PID:2284
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\extension3.vbs"15⤵PID:2052
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\extension3.vbs"16⤵PID:4612
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\extension3.vbs"17⤵PID:2432
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\extension3.vbs"18⤵PID:5064
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\extension3.vbs"19⤵PID:2412
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\extension3.vbs"20⤵PID:3208
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\extension3.vbs"21⤵PID:3616
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\extension3.vbs"22⤵PID:3684
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\extension3.vbs"23⤵PID:4368
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\extension3.vbs"24⤵PID:4964
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\extension3.vbs"25⤵PID:4148
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\extension3.vbs"26⤵PID:3556
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\extension3.vbs"27⤵PID:2640
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\extension3.vbs"28⤵PID:3360
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\extension3.vbs"29⤵PID:3308
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\extension3.vbs"30⤵PID:5168
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\extension3.vbs"31⤵PID:5216
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\extension3.vbs"32⤵PID:5264
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\extension3.vbs"33⤵PID:5312
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\extension3.vbs"34⤵PID:5360
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\extension3.vbs"35⤵PID:5412
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\extension3.vbs"36⤵PID:5464
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\extension3.vbs"37⤵PID:5516
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\extension3.vbs"38⤵PID:5564
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\extension3.vbs"39⤵PID:5616
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\extension3.vbs"40⤵PID:5668
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\extension3.vbs"41⤵PID:5728
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\extension3.vbs"42⤵PID:5776
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\extension3.vbs"43⤵PID:5824
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\extension3.vbs"44⤵PID:5872
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\extension3.vbs"45⤵PID:5920
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\extension3.vbs"46⤵PID:5968
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\extension3.vbs"47⤵PID:6020
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\extension3.vbs"48⤵PID:6072
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\extension3.vbs"49⤵PID:6120
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\extension3.vbs"50⤵PID:5388
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\extension3.vbs"51⤵PID:5948
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\extension3.vbs"52⤵PID:768
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\extension3.vbs"53⤵PID:6156
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\extension3.vbs"54⤵PID:6208
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\extension3.vbs"55⤵PID:6260
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\extension3.vbs"56⤵PID:6308
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\extension3.vbs"57⤵PID:6360
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\extension3.vbs"58⤵PID:6408
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\extension3.vbs"59⤵PID:6456
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\extension3.vbs"60⤵PID:6504
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\extension3.vbs"61⤵PID:6552
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\extension3.vbs"62⤵PID:6600
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\extension3.vbs"63⤵PID:6648
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\extension3.vbs"64⤵PID:6696
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\extension3.vbs"65⤵PID:6748
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\extension3.vbs"66⤵PID:6796
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\extension3.vbs"67⤵PID:6844
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\extension3.vbs"68⤵PID:6896
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\extension3.vbs"69⤵PID:6944
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\extension3.vbs"70⤵PID:6992
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\extension3.vbs"71⤵PID:7040
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\extension3.vbs"72⤵PID:7092
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\extension3.vbs"73⤵PID:7148
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\extension3.vbs"74⤵PID:1000
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\extension3.vbs"75⤵PID:7312
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\extension3.vbs"76⤵PID:7436
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\extension3.vbs"77⤵PID:8056
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\extension3.vbs"78⤵PID:8232
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\extension3.vbs"79⤵PID:8704
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\extension3.vbs"80⤵PID:9200
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\extension3.vbs"81⤵PID:9564
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\extension3.vbs"82⤵PID:9736
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\extension3.vbs"83⤵PID:10156
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\extension3.vbs"84⤵PID:9432
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\extension3.vbs"85⤵PID:10256
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\extension3.vbs"86⤵PID:10588
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\extension3.vbs"87⤵PID:10832
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\extension3.vbs"88⤵PID:11124
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\extension3.vbs"89⤵PID:10484
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\extension3.vbs"90⤵PID:7580
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\extension3.vbs"91⤵PID:11052
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\extension3.vbs"92⤵PID:11504
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\extension3.vbs"93⤵PID:11716
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\extension3.vbs"94⤵PID:11968
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\extension3.vbs"95⤵PID:12152
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\extension3.vbs"96⤵PID:11324
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\extension3.vbs"97⤵PID:12128
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\extension3.vbs"98⤵PID:12548
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\extension3.vbs"99⤵PID:12540
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\extension3.vbs"100⤵PID:14736
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\extension3.vbs"101⤵PID:15444
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\extension3.vbs"102⤵PID:15660
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\extension3.vbs"103⤵PID:15888
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\extension3.vbs"104⤵PID:16028
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\extension3.vbs"105⤵PID:16224
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\extension3.vbs"106⤵PID:16356
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\extension3.vbs"107⤵PID:15596
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\extension3.vbs"108⤵PID:15592
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\extension3.vbs"109⤵PID:4152
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\extension3.vbs"110⤵PID:16352
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\extension3.vbs"111⤵PID:16020
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\extension3.vbs"112⤵PID:1884
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\extension3.vbs"113⤵PID:16428
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\extension3.vbs"114⤵PID:16568
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\extension3.vbs"115⤵PID:16804
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\extension3.vbs"116⤵PID:16976
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\extension3.vbs"117⤵PID:17112
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\extension3.vbs"118⤵PID:17260
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\extension3.vbs"119⤵PID:5800
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\extension3.vbs"120⤵PID:16716
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\extension3.vbs"121⤵PID:5104
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\extension3.vbs"122⤵PID:17356
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-