Analysis
- max time kernel
17s - max time network
140s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
- submitted
25/10/2024, 02:02
General
- Target LCrypt0rX.vbs
- Size 20KB
- Sample241025-cgcp4asdpp
- SHA256 986ed8f4b099e1897c13a9bf6e9bda6f5e1d54049e16905d9e9df91f44fa5fb4
Score
10/10
Malware Config
Signatures
- UAC bypass 3 TTPs 2 IoCs
- Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
- Blocklisted process makes network request 3 IoCs
- Blocks application from running via registry modification 3 IoCs
Adds application to list of disallowed applications.
- Disables RegEdit via registry modification 1 IoCs
- Checks computer location settings 2 TTPs 57 IoCs
Looks up country code configured in the registry, likely geofence.
- Adds Run key to start application 2 TTPs 4 IoCs
- Checks whether UAC is enabled 1 TTPs 1 IoCs
- Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
- Drops file in System32 directory 6 IoCs
- Sets desktop wallpaper using registry 2 TTPs 1 IoCs
- Drops file in Windows directory 1 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Enumerates system info in registry 2 TTPs 3 IoCs
- Interacts with shadow copies 3 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
- Kills process with taskkill 64 IoCs
- Modifies Control Panel 2 IoCs
- Opens file in notepad (likely ransom note) 14 IoCs
- Script User-Agent 3 IoCs
Uses user-agent string associated with script host/environment.
- Suspicious behavior: EnumeratesProcesses 6 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
- Suspicious use of AdjustPrivilegeToken 12 IoCs
- Suspicious use of FindShellTrayWindow 25 IoCs
- Suspicious use of SetWindowsHookEx 4 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- System policy modification 1 TTPs 15 IoCs
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\LCrypt0rX.vbs"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\LCrypt0rX.vbs" /elevated2⤵
- UAC bypass
- Blocklisted process makes network request
- Blocks application from running via registry modification
- Disables RegEdit via registry modification
- Checks computer location settings
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Modifies Control Panel
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin delete shadows /all /quiet3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet4⤵
- Interacts with shadow copies
-
-
-
C:\Windows\System32\notepad.exe"C:\Windows\System32\notepad.exe" C:\Users\Admin\Desktop\READMEPLEASE.txt3⤵
- Opens file in notepad (likely ransom note)
-
-
C:\Windows\System32\RUNDLL32.EXE"C:\Windows\System32\RUNDLL32.EXE" user32.dll,UpdatePerUserSystemParameters3⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Windows\System32\iamthedoom.bat" "3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\mspaint.exemspaint4⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://languishcharmingwidely.com/22/f4/31/22f431404146fb2f892b30f7d213aea4.js4⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x134,0x138,0x13c,0x110,0x140,0x7ffd955846f8,0x7ffd95584708,0x7ffd955847185⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2156,12003555556558394509,2944500595177109389,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2164 /prefetch:25⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2156,12003555556558394509,2944500595177109389,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2216 /prefetch:35⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2156,12003555556558394509,2944500595177109389,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2688 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,12003555556558394509,2944500595177109389,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,12003555556558394509,2944500595177109389,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3340 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,12003555556558394509,2944500595177109389,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4272 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,12003555556558394509,2944500595177109389,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5064 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,12003555556558394509,2944500595177109389,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5092 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,12003555556558394509,2944500595177109389,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4188 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2156,12003555556558394509,2944500595177109389,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5536 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2156,12003555556558394509,2944500595177109389,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5536 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2156,12003555556558394509,2944500595177109389,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1408 /prefetch:25⤵
-
-
-
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\haha.vbs3⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\haha.vbs4⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\haha.vbs5⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\haha.vbs6⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\haha.vbs7⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\haha.vbs8⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\haha.vbs9⤵
- Checks computer location settings
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\haha.vbs10⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\haha.vbs11⤵
- Checks computer location settings
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\haha.vbs12⤵
- Checks computer location settings
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\haha.vbs13⤵
- Checks computer location settings
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\haha.vbs14⤵
- Checks computer location settings
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\haha.vbs15⤵
- Checks computer location settings
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\haha.vbs16⤵
- Checks computer location settings
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\haha.vbs17⤵
- Checks computer location settings
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\haha.vbs18⤵
- Checks computer location settings
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\haha.vbs19⤵
- Checks computer location settings
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\haha.vbs20⤵
- Checks computer location settings
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\haha.vbs21⤵
- Checks computer location settings
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\haha.vbs22⤵
- Checks computer location settings
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\haha.vbs23⤵
- Checks computer location settings
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\haha.vbs24⤵
- Checks computer location settings
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\haha.vbs25⤵
- Checks computer location settings
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\haha.vbs26⤵
- Checks computer location settings
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\haha.vbs27⤵
- Checks computer location settings
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\haha.vbs28⤵
- Checks computer location settings
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\haha.vbs29⤵
- Checks computer location settings
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\haha.vbs30⤵
- Checks computer location settings
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\haha.vbs31⤵
- Checks computer location settings
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\haha.vbs32⤵
- Checks computer location settings
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\haha.vbs33⤵
- Checks computer location settings
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\haha.vbs34⤵
- Checks computer location settings
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\haha.vbs35⤵
- Checks computer location settings
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\haha.vbs36⤵
- Checks computer location settings
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\haha.vbs37⤵
- Checks computer location settings
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\haha.vbs38⤵
- Checks computer location settings
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\haha.vbs39⤵
- Checks computer location settings
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\haha.vbs40⤵
- Checks computer location settings
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\haha.vbs41⤵
- Checks computer location settings
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\haha.vbs42⤵
- Checks computer location settings
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\haha.vbs43⤵
- Checks computer location settings
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\haha.vbs44⤵
- Checks computer location settings
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\haha.vbs45⤵
- Checks computer location settings
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\haha.vbs46⤵
- Checks computer location settings
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\haha.vbs47⤵
- Checks computer location settings
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\haha.vbs48⤵
- Checks computer location settings
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\haha.vbs49⤵
- Checks computer location settings
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\haha.vbs50⤵
- Checks computer location settings
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\haha.vbs51⤵
- Checks computer location settings
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\haha.vbs52⤵
- Checks computer location settings
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\haha.vbs53⤵
- Checks computer location settings
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\haha.vbs54⤵
- Checks computer location settings
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\haha.vbs55⤵
- Checks computer location settings
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\haha.vbs56⤵
- Checks computer location settings
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\haha.vbs57⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\haha.vbs58⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\haha.vbs59⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\haha.vbs60⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\haha.vbs61⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\haha.vbs62⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\haha.vbs63⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\haha.vbs64⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\haha.vbs65⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\haha.vbs66⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\haha.vbs67⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\haha.vbs68⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\haha.vbs69⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\haha.vbs70⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\haha.vbs71⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\haha.vbs72⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\haha.vbs73⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\haha.vbs74⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\haha.vbs75⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\haha.vbs76⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\haha.vbs77⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\haha.vbs78⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\haha.vbs79⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\haha.vbs80⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\haha.vbs81⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\haha.vbs82⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\haha.vbs83⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\haha.vbs84⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\haha.vbs85⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\haha.vbs86⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\haha.vbs87⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\haha.vbs88⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\haha.vbs89⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\haha.vbs90⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\haha.vbs91⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\haha.vbs92⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\haha.vbs93⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\haha.vbs94⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\haha.vbs95⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\haha.vbs96⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\haha.vbs97⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\haha.vbs98⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\haha.vbs99⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\haha.vbs100⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\haha.vbs101⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\haha.vbs102⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\haha.vbs103⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\haha.vbs104⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\haha.vbs105⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\haha.vbs106⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\haha.vbs107⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\haha.vbs108⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\haha.vbs109⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\haha.vbs110⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\haha.vbs111⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\haha.vbs112⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\haha.vbs113⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\haha.vbs114⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\haha.vbs115⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\haha.vbs116⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\haha.vbs117⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\haha.vbs118⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\haha.vbs119⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\haha.vbs120⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Windows\System32\haha.vbs121⤵
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-