Overview
overview
8Static
static
7Win11DeathEdition.exe
windows11-21h2-x64
8Windows 11...er.exe
windows11-21h2-x64
7Windows 11...lp.chm
windows11-21h2-x64
1Windows 11...on.cmd
windows11-21h2-x64
1Windows 11...gm.exe
windows11-21h2-x64
3Windows 11...pe.vbs
windows11-21h2-x64
3Windows 11...br.exe
windows11-21h2-x64
6Analysis
-
max time kernel
17s -
max time network
93s -
platform
windows11-21h2_x64 -
resource
win11-20240802-en -
resource tags
arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system -
submitted
05/09/2024, 01:16
Behavioral task
behavioral1
Sample
Win11DeathEdition.exe
Resource
win11-20240802-en
Behavioral task
behavioral2
Sample
Windows 11 Death Edition Source Code/Bat To Exe Converter/Bat_To_Exe_Converter.exe
Resource
win11-20240802-en
Behavioral task
behavioral3
Sample
Windows 11 Death Edition Source Code/Bat To Exe Converter/help.chm
Resource
win11-20240802-en
Behavioral task
behavioral4
Sample
Windows 11 Death Edition Source Code/Win11DeathEdition.cmd
Resource
win11-20240802-en
Behavioral task
behavioral5
Sample
Windows 11 Death Edition Source Code/bgm.exe
Resource
win11-20240802-en
Behavioral task
behavioral6
Sample
Windows 11 Death Edition Source Code/escape.vbs
Resource
win11-20240802-en
Behavioral task
behavioral7
Sample
Windows 11 Death Edition Source Code/mbr.exe
Resource
win11-20240802-en
General
-
Target
Windows 11 Death Edition Source Code/escape.vbs
-
Size
112B
-
MD5
c5466729495e1701b6e548e798e39e39
-
SHA1
b8c08a7fc8c2d599bd416de20f1a7dfe608ff075
-
SHA256
5464ffdd8c2be512dfe8f6fb001b5ef92289d047b3c8715fe6032903d69c8341
-
SHA512
a87e8d77545850b80fe7f088b0948c12e1e4d18e97950a3a084c3114683e4dd2e003498ce2a9e3339cbd1c27f17f1a79829832d6456420b931dff1571323d4de
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Local Settings WScript.exe Key created \REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Local Settings WScript.exe Key created \REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Local Settings WScript.exe Key created \REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Local Settings WScript.exe Key created \REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Local Settings WScript.exe Key created \REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Local Settings WScript.exe Key created \REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Local Settings WScript.exe Key created \REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Local Settings WScript.exe Key created \REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Local Settings WScript.exe Key created \REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Local Settings WScript.exe Key created \REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Local Settings WScript.exe Key created \REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Local Settings WScript.exe Key created \REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Local Settings WScript.exe Key created \REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Local Settings WScript.exe Key created \REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Local Settings WScript.exe Key created \REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Local Settings WScript.exe Key created \REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Local Settings WScript.exe Key created \REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Local Settings WScript.exe Key created \REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Local Settings WScript.exe Key created \REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Local Settings WScript.exe Key created \REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Local Settings WScript.exe Key created \REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Local Settings WScript.exe Key created \REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Local Settings WScript.exe Key created \REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Local Settings WScript.exe Key created \REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Local Settings WScript.exe Key created \REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Local Settings WScript.exe Key created \REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Local Settings WScript.exe Key created \REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Local Settings WScript.exe Key created \REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Local Settings WScript.exe Key created \REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Local Settings WScript.exe Key created \REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Local Settings WScript.exe Key created \REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Local Settings WScript.exe Key created \REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Local Settings WScript.exe Key created \REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Local Settings WScript.exe Key created \REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Local Settings WScript.exe Key created \REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Local Settings WScript.exe Key created \REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Local Settings WScript.exe Key created \REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Local Settings WScript.exe Key created \REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Local Settings WScript.exe Key created \REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Local Settings WScript.exe Key created \REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Local Settings WScript.exe Key created \REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Local Settings WScript.exe Key created \REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Local Settings WScript.exe Key created \REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Local Settings WScript.exe Key created \REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Local Settings WScript.exe Key created \REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Local Settings WScript.exe Key created \REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Local Settings WScript.exe Key created \REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Local Settings WScript.exe Key created \REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Local Settings WScript.exe Key created \REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Local Settings WScript.exe Key created \REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Local Settings WScript.exe Key created \REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Local Settings WScript.exe Key created \REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Local Settings WScript.exe Key created \REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Local Settings WScript.exe Key created \REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Local Settings WScript.exe Key created \REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Local Settings WScript.exe Key created \REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Local Settings WScript.exe Key created \REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Local Settings WScript.exe Key created \REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Local Settings WScript.exe Key created \REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Local Settings WScript.exe Key created \REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Local Settings WScript.exe Key created \REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Local Settings WScript.exe Key created \REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Local Settings WScript.exe Key created \REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Local Settings WScript.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2452 wrote to memory of 2148 2452 WScript.exe 78 PID 2452 wrote to memory of 2148 2452 WScript.exe 78 PID 2148 wrote to memory of 3512 2148 WScript.exe 79 PID 2148 wrote to memory of 3512 2148 WScript.exe 79 PID 3512 wrote to memory of 1676 3512 WScript.exe 80 PID 3512 wrote to memory of 1676 3512 WScript.exe 80 PID 1676 wrote to memory of 4476 1676 WScript.exe 81 PID 1676 wrote to memory of 4476 1676 WScript.exe 81 PID 4476 wrote to memory of 1660 4476 WScript.exe 82 PID 4476 wrote to memory of 1660 4476 WScript.exe 82 PID 1660 wrote to memory of 1404 1660 WScript.exe 83 PID 1660 wrote to memory of 1404 1660 WScript.exe 83 PID 1404 wrote to memory of 1724 1404 WScript.exe 84 PID 1404 wrote to memory of 1724 1404 WScript.exe 84 PID 1724 wrote to memory of 4396 1724 WScript.exe 85 PID 1724 wrote to memory of 4396 1724 WScript.exe 85 PID 4396 wrote to memory of 2408 4396 WScript.exe 86 PID 4396 wrote to memory of 2408 4396 WScript.exe 86 PID 2408 wrote to memory of 2332 2408 WScript.exe 87 PID 2408 wrote to memory of 2332 2408 WScript.exe 87 PID 2332 wrote to memory of 1000 2332 WScript.exe 88 PID 2332 wrote to memory of 1000 2332 WScript.exe 88 PID 1000 wrote to memory of 2980 1000 WScript.exe 89 PID 1000 wrote to memory of 2980 1000 WScript.exe 89 PID 2980 wrote to memory of 892 2980 WScript.exe 90 PID 2980 wrote to memory of 892 2980 WScript.exe 90 PID 892 wrote to memory of 1496 892 WScript.exe 91 PID 892 wrote to memory of 1496 892 WScript.exe 91 PID 1496 wrote to memory of 4800 1496 WScript.exe 92 PID 1496 wrote to memory of 4800 1496 WScript.exe 92 PID 4800 wrote to memory of 4556 4800 WScript.exe 93 PID 4800 wrote to memory of 4556 4800 WScript.exe 93 PID 4556 wrote to memory of 2008 4556 WScript.exe 94 PID 4556 wrote to memory of 2008 4556 WScript.exe 94 PID 2008 wrote to memory of 3144 2008 WScript.exe 95 PID 2008 wrote to memory of 3144 2008 WScript.exe 95 PID 3144 wrote to memory of 2288 3144 WScript.exe 96 PID 3144 wrote to memory of 2288 3144 WScript.exe 96 PID 2288 wrote to memory of 4940 2288 WScript.exe 97 PID 2288 wrote to memory of 4940 2288 WScript.exe 97 PID 4940 wrote to memory of 788 4940 WScript.exe 98 PID 4940 wrote to memory of 788 4940 WScript.exe 98 PID 788 wrote to memory of 5016 788 WScript.exe 99 PID 788 wrote to memory of 5016 788 WScript.exe 99 PID 5016 wrote to memory of 1148 5016 WScript.exe 100 PID 5016 wrote to memory of 1148 5016 WScript.exe 100 PID 1148 wrote to memory of 2684 1148 WScript.exe 101 PID 1148 wrote to memory of 2684 1148 WScript.exe 101 PID 2684 wrote to memory of 5012 2684 WScript.exe 102 PID 2684 wrote to memory of 5012 2684 WScript.exe 102 PID 5012 wrote to memory of 4868 5012 WScript.exe 103 PID 5012 wrote to memory of 4868 5012 WScript.exe 103 PID 4868 wrote to memory of 4564 4868 WScript.exe 104 PID 4868 wrote to memory of 4564 4868 WScript.exe 104 PID 4564 wrote to memory of 5116 4564 WScript.exe 105 PID 4564 wrote to memory of 5116 4564 WScript.exe 105 PID 5116 wrote to memory of 1280 5116 WScript.exe 106 PID 5116 wrote to memory of 1280 5116 WScript.exe 106 PID 1280 wrote to memory of 2816 1280 WScript.exe 107 PID 1280 wrote to memory of 2816 1280 WScript.exe 107 PID 2816 wrote to memory of 3572 2816 WScript.exe 108 PID 2816 wrote to memory of 3572 2816 WScript.exe 108 PID 3572 wrote to memory of 4376 3572 WScript.exe 109 PID 3572 wrote to memory of 4376 3572 WScript.exe 109
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Windows 11 Death Edition Source Code\escape.vbs"1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2452 -
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Windows 11 Death Edition Source Code\escape.vbs"2⤵
- Suspicious use of WriteProcessMemory
PID:2148 -
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Windows 11 Death Edition Source Code\escape.vbs"3⤵
- Suspicious use of WriteProcessMemory
PID:3512 -
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Windows 11 Death Edition Source Code\escape.vbs"4⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1676 -
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Windows 11 Death Edition Source Code\escape.vbs"5⤵
- Suspicious use of WriteProcessMemory
PID:4476 -
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Windows 11 Death Edition Source Code\escape.vbs"6⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1660 -
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Windows 11 Death Edition Source Code\escape.vbs"7⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1404 -
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Windows 11 Death Edition Source Code\escape.vbs"8⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1724 -
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Windows 11 Death Edition Source Code\escape.vbs"9⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4396 -
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Windows 11 Death Edition Source Code\escape.vbs"10⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2408 -
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Windows 11 Death Edition Source Code\escape.vbs"11⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2332 -
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Windows 11 Death Edition Source Code\escape.vbs"12⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1000 -
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Windows 11 Death Edition Source Code\escape.vbs"13⤵
- Suspicious use of WriteProcessMemory
PID:2980 -
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Windows 11 Death Edition Source Code\escape.vbs"14⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:892 -
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Windows 11 Death Edition Source Code\escape.vbs"15⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1496 -
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Windows 11 Death Edition Source Code\escape.vbs"16⤵
- Suspicious use of WriteProcessMemory
PID:4800 -
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Windows 11 Death Edition Source Code\escape.vbs"17⤵
- Suspicious use of WriteProcessMemory
PID:4556 -
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Windows 11 Death Edition Source Code\escape.vbs"18⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2008 -
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Windows 11 Death Edition Source Code\escape.vbs"19⤵
- Suspicious use of WriteProcessMemory
PID:3144 -
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Windows 11 Death Edition Source Code\escape.vbs"20⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2288 -
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Windows 11 Death Edition Source Code\escape.vbs"21⤵
- Suspicious use of WriteProcessMemory
PID:4940 -
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Windows 11 Death Edition Source Code\escape.vbs"22⤵
- Suspicious use of WriteProcessMemory
PID:788 -
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Windows 11 Death Edition Source Code\escape.vbs"23⤵
- Suspicious use of WriteProcessMemory
PID:5016 -
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Windows 11 Death Edition Source Code\escape.vbs"24⤵
- Suspicious use of WriteProcessMemory
PID:1148 -
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Windows 11 Death Edition Source Code\escape.vbs"25⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2684 -
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Windows 11 Death Edition Source Code\escape.vbs"26⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:5012 -
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Windows 11 Death Edition Source Code\escape.vbs"27⤵
- Suspicious use of WriteProcessMemory
PID:4868 -
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Windows 11 Death Edition Source Code\escape.vbs"28⤵
- Suspicious use of WriteProcessMemory
PID:4564 -
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Windows 11 Death Edition Source Code\escape.vbs"29⤵
- Suspicious use of WriteProcessMemory
PID:5116 -
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Windows 11 Death Edition Source Code\escape.vbs"30⤵
- Suspicious use of WriteProcessMemory
PID:1280 -
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Windows 11 Death Edition Source Code\escape.vbs"31⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2816 -
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Windows 11 Death Edition Source Code\escape.vbs"32⤵
- Suspicious use of WriteProcessMemory
PID:3572 -
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Windows 11 Death Edition Source Code\escape.vbs"33⤵PID:4376
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Windows 11 Death Edition Source Code\escape.vbs"34⤵
- Modifies registry class
PID:4956 -
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Windows 11 Death Edition Source Code\escape.vbs"35⤵PID:2136
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Windows 11 Death Edition Source Code\escape.vbs"36⤵PID:3328
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Windows 11 Death Edition Source Code\escape.vbs"37⤵PID:2356
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Windows 11 Death Edition Source Code\escape.vbs"38⤵
- Modifies registry class
PID:1796 -
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Windows 11 Death Edition Source Code\escape.vbs"39⤵PID:948
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Windows 11 Death Edition Source Code\escape.vbs"40⤵
- Modifies registry class
PID:712 -
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Windows 11 Death Edition Source Code\escape.vbs"41⤵PID:856
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Windows 11 Death Edition Source Code\escape.vbs"42⤵PID:2596
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Windows 11 Death Edition Source Code\escape.vbs"43⤵
- Modifies registry class
PID:3748 -
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Windows 11 Death Edition Source Code\escape.vbs"44⤵
- Modifies registry class
PID:4992 -
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Windows 11 Death Edition Source Code\escape.vbs"45⤵
- Modifies registry class
PID:4032 -
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Windows 11 Death Edition Source Code\escape.vbs"46⤵
- Modifies registry class
PID:3580 -
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Windows 11 Death Edition Source Code\escape.vbs"47⤵
- Modifies registry class
PID:5132 -
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Windows 11 Death Edition Source Code\escape.vbs"48⤵PID:5180
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Windows 11 Death Edition Source Code\escape.vbs"49⤵PID:5228
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Windows 11 Death Edition Source Code\escape.vbs"50⤵PID:5276
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Windows 11 Death Edition Source Code\escape.vbs"51⤵PID:5324
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Windows 11 Death Edition Source Code\escape.vbs"52⤵
- Modifies registry class
PID:5372 -
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Windows 11 Death Edition Source Code\escape.vbs"53⤵
- Modifies registry class
PID:5420 -
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Windows 11 Death Edition Source Code\escape.vbs"54⤵PID:5468
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Windows 11 Death Edition Source Code\escape.vbs"55⤵
- Modifies registry class
PID:5520 -
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Windows 11 Death Edition Source Code\escape.vbs"56⤵PID:5568
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Windows 11 Death Edition Source Code\escape.vbs"57⤵PID:5616
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Windows 11 Death Edition Source Code\escape.vbs"58⤵
- Modifies registry class
PID:5664 -
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Windows 11 Death Edition Source Code\escape.vbs"59⤵
- Modifies registry class
PID:5712 -
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Windows 11 Death Edition Source Code\escape.vbs"60⤵
- Modifies registry class
PID:5760 -
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Windows 11 Death Edition Source Code\escape.vbs"61⤵
- Modifies registry class
PID:5808 -
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Windows 11 Death Edition Source Code\escape.vbs"62⤵PID:5856
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Windows 11 Death Edition Source Code\escape.vbs"63⤵PID:5904
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Windows 11 Death Edition Source Code\escape.vbs"64⤵PID:5956
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Windows 11 Death Edition Source Code\escape.vbs"65⤵
- Modifies registry class
PID:6004 -
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Windows 11 Death Edition Source Code\escape.vbs"66⤵PID:6052
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Windows 11 Death Edition Source Code\escape.vbs"67⤵
- Modifies registry class
PID:6100 -
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Windows 11 Death Edition Source Code\escape.vbs"68⤵PID:5160
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Windows 11 Death Edition Source Code\escape.vbs"69⤵PID:5788
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Windows 11 Death Edition Source Code\escape.vbs"70⤵PID:6156
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Windows 11 Death Edition Source Code\escape.vbs"71⤵
- Modifies registry class
PID:6204 -
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Windows 11 Death Edition Source Code\escape.vbs"72⤵
- Modifies registry class
PID:6252 -
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Windows 11 Death Edition Source Code\escape.vbs"73⤵PID:6304
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Windows 11 Death Edition Source Code\escape.vbs"74⤵
- Modifies registry class
PID:6352 -
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Windows 11 Death Edition Source Code\escape.vbs"75⤵PID:6404
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Windows 11 Death Edition Source Code\escape.vbs"76⤵PID:6452
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Windows 11 Death Edition Source Code\escape.vbs"77⤵
- Modifies registry class
PID:6500 -
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Windows 11 Death Edition Source Code\escape.vbs"78⤵PID:6548
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Windows 11 Death Edition Source Code\escape.vbs"79⤵
- Modifies registry class
PID:6596 -
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Windows 11 Death Edition Source Code\escape.vbs"80⤵
- Modifies registry class
PID:6644 -
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Windows 11 Death Edition Source Code\escape.vbs"81⤵
- Modifies registry class
PID:6692 -
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Windows 11 Death Edition Source Code\escape.vbs"82⤵
- Modifies registry class
PID:6748 -
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Windows 11 Death Edition Source Code\escape.vbs"83⤵
- Modifies registry class
PID:6800 -
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Windows 11 Death Edition Source Code\escape.vbs"84⤵
- Modifies registry class
PID:6848 -
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Windows 11 Death Edition Source Code\escape.vbs"85⤵
- Modifies registry class
PID:6900 -
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Windows 11 Death Edition Source Code\escape.vbs"86⤵
- Modifies registry class
PID:6952 -
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Windows 11 Death Edition Source Code\escape.vbs"87⤵
- Modifies registry class
PID:7000 -
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Windows 11 Death Edition Source Code\escape.vbs"88⤵
- Modifies registry class
PID:7048 -
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Windows 11 Death Edition Source Code\escape.vbs"89⤵PID:7096
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Windows 11 Death Edition Source Code\escape.vbs"90⤵
- Modifies registry class
PID:7144 -
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Windows 11 Death Edition Source Code\escape.vbs"91⤵
- Modifies registry class
PID:6432 -
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Windows 11 Death Edition Source Code\escape.vbs"92⤵
- Modifies registry class
PID:6980 -
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Windows 11 Death Edition Source Code\escape.vbs"93⤵PID:7196
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Windows 11 Death Edition Source Code\escape.vbs"94⤵PID:7244
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Windows 11 Death Edition Source Code\escape.vbs"95⤵PID:7292
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Windows 11 Death Edition Source Code\escape.vbs"96⤵
- Modifies registry class
PID:7340 -
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Windows 11 Death Edition Source Code\escape.vbs"97⤵
- Modifies registry class
PID:7392 -
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Windows 11 Death Edition Source Code\escape.vbs"98⤵PID:7440
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Windows 11 Death Edition Source Code\escape.vbs"99⤵PID:7488
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Windows 11 Death Edition Source Code\escape.vbs"100⤵PID:7536
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Windows 11 Death Edition Source Code\escape.vbs"101⤵PID:7588
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Windows 11 Death Edition Source Code\escape.vbs"102⤵PID:7640
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Windows 11 Death Edition Source Code\escape.vbs"103⤵PID:7688
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Windows 11 Death Edition Source Code\escape.vbs"104⤵PID:7736
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Windows 11 Death Edition Source Code\escape.vbs"105⤵
- Modifies registry class
PID:7784 -
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Windows 11 Death Edition Source Code\escape.vbs"106⤵
- Modifies registry class
PID:7836 -
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Windows 11 Death Edition Source Code\escape.vbs"107⤵
- Modifies registry class
PID:7884 -
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Windows 11 Death Edition Source Code\escape.vbs"108⤵
- Modifies registry class
PID:7936 -
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Windows 11 Death Edition Source Code\escape.vbs"109⤵
- Modifies registry class
PID:7984 -
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Windows 11 Death Edition Source Code\escape.vbs"110⤵PID:8036
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Windows 11 Death Edition Source Code\escape.vbs"111⤵PID:8084
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Windows 11 Death Edition Source Code\escape.vbs"112⤵PID:8132
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Windows 11 Death Edition Source Code\escape.vbs"113⤵PID:8180
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Windows 11 Death Edition Source Code\escape.vbs"114⤵
- Modifies registry class
PID:7564 -
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Windows 11 Death Edition Source Code\escape.vbs"115⤵
- Modifies registry class
PID:8112 -
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Windows 11 Death Edition Source Code\escape.vbs"116⤵PID:8232
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Windows 11 Death Edition Source Code\escape.vbs"117⤵PID:8280
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Windows 11 Death Edition Source Code\escape.vbs"118⤵
- Modifies registry class
PID:8332 -
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Windows 11 Death Edition Source Code\escape.vbs"119⤵
- Modifies registry class
PID:8380 -
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Windows 11 Death Edition Source Code\escape.vbs"120⤵PID:8432
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Windows 11 Death Edition Source Code\escape.vbs"121⤵
- Modifies registry class
PID:8480 -
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Windows 11 Death Edition Source Code\escape.vbs"122⤵PID:8528
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-