phorphiex | 12897e2e24f1a59cf08655fcb274c08747ef550b16741e6306a0a8f94aefcb9c

Analysis

max time kernel
40s
max time network
155s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
23/03/2025, 02:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

12897e2e24f1a59cf08655fcb274c08747ef550b16741e6306a0a8f94aefcb9c.vbs
Size

25KB
MD5

5c4dad0f397077e5e9cc55febfc096bd
SHA1

eed1a50a4818890cb4c474792f8ad0258ab115a8
SHA256

12897e2e24f1a59cf08655fcb274c08747ef550b16741e6306a0a8f94aefcb9c
SHA512

90290ac0ca91e5cca3b2e19c4b5baec11523d7fe4ce674bd5f3db7e47f83deda55d923a635e2ad9e584af61c36e83209f548cfca867f9720a58a8a2181ac47c4
SSDEEP

384:y8enbIbpBStxYUQHSH7l+ix/J/b6GvPpSy+tNywUTZEC:inucJb6UAUqC

Score

10^/10

phorphiex defense_evasion discovery execution impact loader persistence ransomware trojan worm

Malware Config

Extracted

Family

phorphiex

http://185.215.113.66/

http://45.93.20.18/

Wallets

TRuGGXNDM1cavQ1AqMQHG8yfxP4QWVSMN6

qph44jx8r9k5xeq5cuf958krv3ewrnp5vc6hhdjd3r

rsXCXBf9SagxV8JfC12d8Bybk84oPdMNN9

AULzfBuUAPfCGAXoG5Vq14aP9s6fx3AH4Z

LdgchXq1sKbAaAJ1EXAPSRBzLb8jnTZstT

MP8GEm8QpYgQYaMo8oM5NQhRBgDGiLZW5Q

4AtjkCVKbtEC3UEN77SQHuH9i1XkzNiRi5VCbA2XGsJh46nJSXfGQn4GjLuupCqmC57Lo7LvKmFUyRfhtJSvKvuw3h9ReKK

XryzFMFVpDUvU7famUGf214EXD3xNUSmQf

0xCa90599132C4D88907Bd8E046540284aa468a035

15TssKwtjMtwy4vDLcLsQUZUD2B9f7eDjw85sBNVC5LRPPnC

1BzmrjmKPKSR2hH5BeJySfiVA676E8DYaK

ltc1qt0n3f0t7vz9k0mvcswk477shrxwjhf9sj5ykrp

3PMiLynrGVZ8oEqvoqC4hXD67B1WoALR4pc

3ESHude8zUHksQg1h6hHmzY79BS36L91Yn

CSLKveRL2zqkbV2TqiFVuW6twtpqgFajoUZLAJQTTQk2

DLUzwvyxN1RrwjByUPPzVMdfxNRPGVRMMA

t1J6GCPCiHW1eRdjJgDDu6b1vSVmL5U7Twh

stars125f3mw4xd9htpsq4zj5w5ezm5gags37yxxh6mj

bnb1msyt0djx4ecspfxg5en0ye465kg3kmv9utzml2

bc1ppypcmu3684n648gyj62gjp2rw0xy7w3vwfamatlg29ajp4z52desafa0sr

Attributes

mutex
k9ubbn6sdfs
user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Extracted

Family

phorphiex

http://185.215.113.66

http://45.93.20.18

185.215.113.66

Signatures

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "C:\\Users\\Admin\\AppData\\Local\\Temp\\12897e2e24f1a59cf08655fcb274c08747ef550b16741e6306a0a8f94aefcb9c.vbs"	wscript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "C:\\Users\\Admin\\AppData\\Local\\Temp\\12897e2e24f1a59cf08655fcb274c08747ef550b16741e6306a0a8f94aefcb9c.vbs"	wscript.exe

Phorphiex family
phorphiex

Phorphiex payload 1 IoCs

resource	yara_rule
behavioral1/files/0x001b00000001cb7d-1501.dat	family_phorphiex

Phorphiex, Phorpiex
Phorphiex or Phorpiex Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.
worm trojan loader phorphiex

UAC bypass 3 TTPs 2 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	wscript.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	wscript.exe

Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047

Blocklisted process makes network request 5 IoCs

flow	pid	Process
3	1692	wscript.exe
6	1692	wscript.exe
9	1692	wscript.exe
10	1692	wscript.exe
39	1692	wscript.exe

Blocks application from running via registry modification 14 IoCs

Adds application to list of disallowed applications.

defense_evasion

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\4 = "SystemSettings.exe"	wscript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\5 = "procexp.exe"	wscript.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun = "1"	wscript.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun	wscript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\1 = "msconfig.exe"	wscript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\2 = "Autoruns.exe"	wscript.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun = "1"	wscript.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun	wscript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\2 = "Autoruns.exe"	wscript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\3 = "gpedit.msc"	wscript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\3 = "gpedit.msc"	wscript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\4 = "SystemSettings.exe"	wscript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\5 = "procexp.exe"	wscript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\1 = "msconfig.exe"	wscript.exe

Deletes backup catalog 3 TTPs 1 IoCs

Uses wbadmin.exe to inhibit system recovery.

ransomware

Command and Scripting Interpreter

T1059

File Deletion

T1070.004

Inhibit System Recovery

T1490

pid	Process
572	wbadmin.exe

Disables RegEdit via registry modification 2 IoCs

defense_evasion

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	wscript.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	wscript.exe

Disables Task Manager via registry modification
defense_evasion
Downloads MZ/PE file

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	wscript.exe

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 6 IoCs

persistence

Image File Execution Options Injection

T1546.012

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options	wscript.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cmd.exe	wscript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cmd.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\12897e2e24f1a59cf08655fcb274c08747ef550b16741e6306a0a8f94aefcb9c.vbs"	wscript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cmd.exe	wscript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cmd.exe\Debugger	wscript.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cmd.exe	wscript.exe

Adds Run key to start application 2 TTPs 7 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\Anti-VirusScript = "C:\\Windows\\System32\\systemconfig.exe.vbs"	wscript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\advapi32_ext = "C:\\Windows\\advapi32_ext.vbs"	wscript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\advapi32_ext = "C:\\Windows\\advapi32_ext.vbs"	wscript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MyStartupScript = "C:\\Users\\Admin\\AppData\\Local\\Temp\\12897e2e24f1a59cf08655fcb274c08747ef550b16741e6306a0a8f94aefcb9c.vbs"	wscript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\msvcr80dll = "C:\\Windows\\SysWOW64\\msvcr80.dll.bat"	wscript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\msvcr80dll = "C:\\Windows\\SysWOW64\\msvcr80.dll.bat"	wscript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Win32Updater = "C:\\Windows\\System32\\systemconfig.exe.vbs"	wscript.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	wscript.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2976	powershell.exe

Indicator Removal: Clear Persistence 1 TTPs 1 IoCs

remove IFEO.

defense_evasion

Clear Persistence

T1070.009

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cmd.exe\Debugger	wscript.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\msvcr80.dll.bat	wscript.exe
File opened for modification	C:\Windows\SysWOW64\msvcr80.dll.bat	wscript.exe
File created	C:\Windows\System32\systemconfig.exe.vbs	wscript.exe
File opened for modification	C:\Windows\System32\systemconfig.exe.vbs	wscript.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\advapi32_ext.vbs	wscript.exe
File opened for modification	C:\Windows\advapi32_ext.vbs	wscript.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 16 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Interacts with shadow copies 3 TTPs 1 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Direct Volume Access

T1006

pid	Process
2780	vssadmin.exe

Kills process with taskkill 19 IoCs

defense_evasion

pid	Process
2700	taskkill.exe
2400	taskkill.exe
1676	taskkill.exe
1608	taskkill.exe
216	taskkill.exe
6568	taskkill.exe
1972	taskkill.exe
2572	taskkill.exe
2260	taskkill.exe
3548	taskkill.exe
5816	taskkill.exe
8452	taskkill.exe
15080	taskkill.exe
6656	taskkill.exe
4528	taskkill.exe
2184	taskkill.exe
16820	taskkill.exe
3540	taskkill.exe
13344	taskkill.exe

Modifies Control Panel 3 IoCs

defense_evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Control Panel\Mouse\SwapMouseButtons = "1"	wscript.exe
Key created	\REGISTRY\MACHINE\Control Panel\Mouse	wscript.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Control Panel\Mouse	wscript.exe

Modifies Internet Explorer settings 1 TTPs 64 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C33CAC41-0779-11F0-9D46-D6B302822781} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C33C5E21-0779-11F0-9D46-D6B302822781} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C33BC1E1-0779-11F0-9D46-D6B302822781} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
1352	notepad.exe

Script User-Agent 1 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	3	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2976	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2976	powershell.exe
Token: SeBackupPrivilege	2844	vssvc.exe
Token: SeRestorePrivilege	2844	vssvc.exe
Token: SeAuditPrivilege	2844	vssvc.exe
Token: SeBackupPrivilege	784	wbengine.exe
Token: SeRestorePrivilege	784	wbengine.exe
Token: SeSecurityPrivilege	784	wbengine.exe
Token: SeDebugPrivilege	2700	taskkill.exe
Token: SeDebugPrivilege	2400	taskkill.exe
Token: SeDebugPrivilege	1972	taskkill.exe
Token: SeDebugPrivilege	2572	taskkill.exe
Token: SeSystemtimePrivilege	2028	cmd.exe
Token: SeSystemtimePrivilege	2028	cmd.exe
Token: SeDebugPrivilege	1676	taskkill.exe
Token: SeDebugPrivilege	1608	taskkill.exe
Token: SeDebugPrivilege	2260	taskkill.exe
Token: SeSystemtimePrivilege	456	cmd.exe
Token: SeSystemtimePrivilege	456	cmd.exe
Token: SeSystemtimePrivilege	1552	cmd.exe
Token: SeSystemtimePrivilege	1552	cmd.exe
Token: SeSystemtimePrivilege	2028	cmd.exe
Token: SeSystemtimePrivilege	2028	cmd.exe
Token: SeSystemtimePrivilege	1028	cmd.exe
Token: SeSystemtimePrivilege	1028	cmd.exe
Token: SeSystemtimePrivilege	1680	cmd.exe
Token: SeSystemtimePrivilege	1680	cmd.exe
Token: SeSystemtimePrivilege	980	cmd.exe
Token: SeSystemtimePrivilege	980	cmd.exe
Token: SeDebugPrivilege	216	taskkill.exe
Token: SeSystemtimePrivilege	3152	cmd.exe
Token: SeSystemtimePrivilege	3152	cmd.exe
Token: SeSystemtimePrivilege	3132	cmd.exe
Token: SeSystemtimePrivilege	3132	cmd.exe
Token: SeSystemtimePrivilege	3188	cmd.exe
Token: SeSystemtimePrivilege	3188	cmd.exe
Token: SeSystemtimePrivilege	3204	cmd.exe
Token: SeSystemtimePrivilege	3212	cmd.exe
Token: SeSystemtimePrivilege	3204	cmd.exe
Token: SeSystemtimePrivilege	3212	cmd.exe
Token: SeSystemtimePrivilege	3296	cmd.exe
Token: SeSystemtimePrivilege	3296	cmd.exe
Token: SeSystemtimePrivilege	3340	cmd.exe
Token: SeSystemtimePrivilege	3340	cmd.exe
Token: SeSystemtimePrivilege	3388	cmd.exe
Token: SeSystemtimePrivilege	3388	cmd.exe
Token: SeSystemtimePrivilege	3432	cmd.exe
Token: SeSystemtimePrivilege	3432	cmd.exe
Token: SeDebugPrivilege	3540	taskkill.exe
Token: SeSystemtimePrivilege	3460	cmd.exe
Token: SeSystemtimePrivilege	3460	cmd.exe
Token: SeSystemtimePrivilege	3424	cmd.exe
Token: SeSystemtimePrivilege	3424	cmd.exe
Token: SeSystemtimePrivilege	3612	cmd.exe
Token: SeSystemtimePrivilege	3612	cmd.exe
Token: SeSystemtimePrivilege	3476	cmd.exe
Token: SeSystemtimePrivilege	3476	cmd.exe
Token: SeDebugPrivilege	3548	taskkill.exe
Token: SeSystemtimePrivilege	3316	cmd.exe
Token: SeSystemtimePrivilege	3316	cmd.exe
Token: SeSystemtimePrivilege	3168	cmd.exe
Token: SeSystemtimePrivilege	3168	cmd.exe
Token: SeSystemtimePrivilege	3204	cmd.exe
Token: SeSystemtimePrivilege	3204	cmd.exe
Token: SeSystemtimePrivilege	3420	cmd.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2340	iexplore.exe

Suspicious use of SetWindowsHookEx 62 IoCs

pid	Process
2340	iexplore.exe
2340	iexplore.exe
2528	IEXPLORE.EXE
2528	IEXPLORE.EXE
2340	iexplore.exe
2340	iexplore.exe
2340	iexplore.exe
2340	iexplore.exe
2340	iexplore.exe
2340	iexplore.exe
2340	iexplore.exe
2340	iexplore.exe
2340	iexplore.exe
2340	iexplore.exe
2340	iexplore.exe
2340	iexplore.exe
2340	iexplore.exe
2340	iexplore.exe
2052	iexplore.exe
2052	iexplore.exe
3880	iexplore.exe
3880	iexplore.exe
3832	iexplore.exe
3832	iexplore.exe
3944	iexplore.exe
3944	iexplore.exe
3992	iexplore.exe
3992	iexplore.exe
4004	iexplore.exe
3972	iexplore.exe
4004	iexplore.exe
3972	iexplore.exe
2528	IEXPLORE.EXE
2528	IEXPLORE.EXE
2340	iexplore.exe
2340	iexplore.exe
2340	iexplore.exe
2340	iexplore.exe
2528	IEXPLORE.EXE
2528	IEXPLORE.EXE
2340	iexplore.exe
2340	iexplore.exe
2340	iexplore.exe
2340	iexplore.exe
2568	IEXPLORE.EXE
2568	IEXPLORE.EXE
2340	iexplore.exe
2340	iexplore.exe
4180	IEXPLORE.EXE
4180	IEXPLORE.EXE
4544	iexplore.exe
4544	iexplore.exe
4556	iexplore.exe
4556	iexplore.exe
4728	iexplore.exe
4728	iexplore.exe
4804	iexplore.exe
4804	iexplore.exe
4792	iexplore.exe
4792	iexplore.exe
2568	IEXPLORE.EXE
2568	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2528 wrote to memory of 1692	2528	WScript.exe	30
PID 2528 wrote to memory of 1692	2528	WScript.exe	30
PID 2528 wrote to memory of 1692	2528	WScript.exe	30
PID 1692 wrote to memory of 2976	1692	wscript.exe	31
PID 1692 wrote to memory of 2976	1692	wscript.exe	31
PID 1692 wrote to memory of 2976	1692	wscript.exe	31
PID 1692 wrote to memory of 2124	1692	wscript.exe	33
PID 1692 wrote to memory of 2124	1692	wscript.exe	33
PID 1692 wrote to memory of 2124	1692	wscript.exe	33
PID 1692 wrote to memory of 2796	1692	wscript.exe	35
PID 1692 wrote to memory of 2796	1692	wscript.exe	35
PID 1692 wrote to memory of 2796	1692	wscript.exe	35
PID 1692 wrote to memory of 536	1692	wscript.exe	37
PID 1692 wrote to memory of 536	1692	wscript.exe	37
PID 1692 wrote to memory of 536	1692	wscript.exe	37
PID 536 wrote to memory of 2780	536	cmd.exe	39
PID 536 wrote to memory of 2780	536	cmd.exe	39
PID 536 wrote to memory of 2780	536	cmd.exe	39
PID 1692 wrote to memory of 2628	1692	wscript.exe	42
PID 1692 wrote to memory of 2628	1692	wscript.exe	42
PID 1692 wrote to memory of 2628	1692	wscript.exe	42
PID 2628 wrote to memory of 572	2628	cmd.exe	44
PID 2628 wrote to memory of 572	2628	cmd.exe	44
PID 2628 wrote to memory of 572	2628	cmd.exe	44
PID 1692 wrote to memory of 1352	1692	wscript.exe	48
PID 1692 wrote to memory of 1352	1692	wscript.exe	48
PID 1692 wrote to memory of 1352	1692	wscript.exe	48
PID 1692 wrote to memory of 2988	1692	wscript.exe	50
PID 1692 wrote to memory of 2988	1692	wscript.exe	50
PID 1692 wrote to memory of 2988	1692	wscript.exe	50
PID 1692 wrote to memory of 2808	1692	wscript.exe	52
PID 1692 wrote to memory of 2808	1692	wscript.exe	52
PID 1692 wrote to memory of 2808	1692	wscript.exe	52
PID 1692 wrote to memory of 2816	1692	wscript.exe	53
PID 1692 wrote to memory of 2816	1692	wscript.exe	53
PID 1692 wrote to memory of 2816	1692	wscript.exe	53
PID 2988 wrote to memory of 2936	2988	cmd.exe	54
PID 2988 wrote to memory of 2936	2988	cmd.exe	54
PID 2988 wrote to memory of 2936	2988	cmd.exe	54
PID 2988 wrote to memory of 2760	2988	cmd.exe	55
PID 2988 wrote to memory of 2760	2988	cmd.exe	55
PID 2988 wrote to memory of 2760	2988	cmd.exe	55
PID 2988 wrote to memory of 2552	2988	cmd.exe	56
PID 2988 wrote to memory of 2552	2988	cmd.exe	56
PID 2988 wrote to memory of 2552	2988	cmd.exe	56
PID 2988 wrote to memory of 832	2988	cmd.exe	57
PID 2988 wrote to memory of 832	2988	cmd.exe	57
PID 2988 wrote to memory of 832	2988	cmd.exe	57
PID 2988 wrote to memory of 1388	2988	cmd.exe	58
PID 2988 wrote to memory of 1388	2988	cmd.exe	58
PID 2988 wrote to memory of 1388	2988	cmd.exe	58
PID 2988 wrote to memory of 2748	2988	cmd.exe	59
PID 2988 wrote to memory of 2748	2988	cmd.exe	59
PID 2988 wrote to memory of 2748	2988	cmd.exe	59
PID 2808 wrote to memory of 1044	2808	wscript.exe	63
PID 2808 wrote to memory of 1044	2808	wscript.exe	63
PID 2808 wrote to memory of 1044	2808	wscript.exe	63
PID 2816 wrote to memory of 2700	2816	wscript.exe	65
PID 2816 wrote to memory of 2700	2816	wscript.exe	65
PID 2816 wrote to memory of 2700	2816	wscript.exe	65
PID 1044 wrote to memory of 320	1044	wscript.exe	66
PID 1044 wrote to memory of 320	1044	wscript.exe	66
PID 1044 wrote to memory of 320	1044	wscript.exe	66
PID 320 wrote to memory of 2180	320	wscript.exe	68

System policy modification 1 TTPs 19 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoRun = "1"	wscript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\1 = "msconfig.exe"	wscript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\2 = "Autoruns.exe"	wscript.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr = "1"	wscript.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	wscript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\4 = "SystemSettings.exe"	wscript.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisableCMD = "1"	wscript.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	wscript.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoControlPanel = "1"	wscript.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	wscript.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\InactivityTimeoutSecs = "0"	wscript.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer	wscript.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun	wscript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	wscript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	wscript.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System	wscript.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun = "1"	wscript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\3 = "gpedit.msc"	wscript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\5 = "procexp.exe"	wscript.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\12897e2e24f1a59cf08655fcb274c08747ef550b16741e6306a0a8f94aefcb9c.vbs"
1⤵
- Suspicious use of WriteProcessMemory
PID:2528
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\12897e2e24f1a59cf08655fcb274c08747ef550b16741e6306a0a8f94aefcb9c.vbs" /elevated
  2⤵
  - Modifies WinLogon for persistence
  - UAC bypass
  - Blocklisted process makes network request
  - Blocks application from running via registry modification
  - Disables RegEdit via registry modification
  - Drops file in Drivers directory
  - Event Triggered Execution: Image File Execution Options Injection
  - Adds Run key to start application
  - Checks whether UAC is enabled
  - Indicator Removal: Clear Persistence
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Modifies Control Panel
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:1692
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command Set-MpPreference -DisableRealtimeMonitoring $true
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2976
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c "C:\Program Files\Bitdefender\Bitdefender 2025\bdnserv.exe" -disable
    3⤵
    PID:2124
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c "C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 2025\avp.com" disable
    3⤵
    PID:2796
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c vssadmin delete shadows /all /quiet
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:536
  - - C:\Windows\system32\vssadmin.exe
      vssadmin delete shadows /all /quiet
      4⤵
      Interacts with shadow copies
      PID:2780
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c wbadmin delete catalog -quiet
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2628
  - - C:\Windows\system32\wbadmin.exe
      wbadmin delete catalog -quiet
      4⤵
      Deletes backup catalog
      PID:572
- - C:\Windows\System32\notepad.exe
    "C:\Windows\System32\notepad.exe" C:\Users\Admin\Desktop\READMEPLEASE.txt
    3⤵
    - Opens file in notepad (likely ransom note)
    PID:1352
- - C:\Windows\System32\cmd.exe
    cmd /c ""C:\Windows\SysWOW64\msvcr80.dll.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2988
  - - C:\Windows\system32\calc.exe
      calc
      4⤵
      PID:2936
  - - C:\Windows\system32\cmd.exe
      cmd
      4⤵
      PID:2760
  - - C:\Windows\system32\calc.exe
      calc
      4⤵
      PID:2552
  - - C:\Windows\system32\cmd.exe
      cmd
      4⤵
      PID:832
  - - C:\Windows\system32\calc.exe
      calc
      4⤵
      PID:1388
  - - C:\Windows\system32\cmd.exe
      cmd
      4⤵
      PID:2748
- - C:\Windows\System32\wscript.exe
    "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2808
  - - C:\Windows\System32\wscript.exe
      "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1044
    - - C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:320
      - C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        6⤵
        
        PID:2180
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        7⤵
        
        PID:2440
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        8⤵
        
        PID:864
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        9⤵
        
        PID:1104
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        10⤵
        
        PID:1868
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        11⤵
        
        PID:1284
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        12⤵
        
        PID:2296
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        13⤵
        
        PID:1808
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        14⤵
        
        PID:2776
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        15⤵
        
        PID:2924
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        16⤵
        
        PID:2740
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        17⤵
        
        PID:2772
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        18⤵
        
        PID:2384
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        19⤵
        
        PID:2472
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        20⤵
        
        PID:2016
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        21⤵
        
        PID:1020
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        22⤵
        
        PID:1472
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        23⤵
        
        PID:1496
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        24⤵
        
        PID:2012
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        25⤵
        
        PID:3376
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        26⤵
        
        PID:3636
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        27⤵
        
        PID:3732
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        28⤵
        
        PID:3924
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        29⤵
        
        PID:1956
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        30⤵
        
        PID:3604
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        31⤵
        
        PID:3464
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        32⤵
        
        PID:3808
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        33⤵
        
        PID:436
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        34⤵
        
        PID:3256
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        35⤵
        
        PID:4312
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        36⤵
        
        PID:4780
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        37⤵
        
        PID:5028
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        38⤵
        
        PID:3488
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        39⤵
        
        PID:3648
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        40⤵
        
        PID:4996
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        41⤵
        
        PID:5148
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        42⤵
        
        PID:5380
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        43⤵
        
        PID:5648
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        44⤵
        
        PID:5788
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        45⤵
        
        PID:5912
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        46⤵
        
        PID:5996
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        47⤵
        
        PID:6092
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        48⤵
        
        PID:5388
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        49⤵
        
        PID:4532
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        50⤵
        
        PID:6108
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        51⤵
        
        PID:6204
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        52⤵
        
        PID:6288
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        53⤵
        
        PID:6372
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        54⤵
        
        PID:6456
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        55⤵
        
        PID:6664
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        56⤵
        
        PID:6748
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        57⤵
        
        PID:6852
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        58⤵
        
        PID:6956
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        59⤵
        
        PID:7112
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        60⤵
        
        PID:2700
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        61⤵
        
        PID:6700
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        62⤵
        
        PID:6544
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        63⤵
        
        PID:7216
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        64⤵
        
        PID:7416
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        65⤵
        
        PID:7668
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        66⤵
        
        PID:8052
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        67⤵
        
        PID:7796
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        68⤵
        
        PID:8796
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        69⤵
        
        PID:9320
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        70⤵
        
        PID:10164
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        71⤵
        
        PID:10248
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        72⤵
        
        PID:10556
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        73⤵
        
        PID:10840
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        74⤵
        
        PID:11136
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        75⤵
        
        PID:11236
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        76⤵
        
        PID:10744
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        77⤵
        
        PID:12028
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        78⤵
        
        PID:12144
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        79⤵
        
        PID:11424
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        80⤵
        
        PID:11692
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        81⤵
        
        PID:11956
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        82⤵
        
        PID:12060
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        83⤵
        
        PID:11672
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        84⤵
        
        PID:1820
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        85⤵
        
        PID:11988
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        86⤵
        
        PID:3632
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        87⤵
        
        PID:3940
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        88⤵
        
        PID:9872
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        89⤵
        
        PID:12312
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        90⤵
        
        PID:12388
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        91⤵
        
        PID:12488
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        92⤵
        
        PID:12572
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        93⤵
        
        PID:12664
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        94⤵
        
        PID:12744
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        95⤵
        
        PID:12816
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        96⤵
        
        PID:12908
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        97⤵
        
        PID:12984
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        98⤵
        
        PID:13064
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        99⤵
        
        PID:13148
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        100⤵
        
        PID:13224
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        101⤵
        
        PID:13308
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        102⤵
        
        PID:8888
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        103⤵
        
        PID:7960
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        104⤵
        
        PID:12672
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        105⤵
        
        PID:8756
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        106⤵
        
        PID:4388
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        107⤵
        
        PID:4940
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        108⤵
        
        PID:13408
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        109⤵
        
        PID:13540
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        110⤵
        
        PID:13948
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        111⤵
        
        PID:14036
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        112⤵
        
        PID:14232
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        113⤵
        
        PID:13584
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        114⤵
        
        PID:13484
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        115⤵
        
        PID:5780
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        116⤵
        
        PID:14076
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        117⤵
        
        PID:14204
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        118⤵
        
        PID:14272
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        119⤵
        
        PID:12932
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        120⤵
        
        PID:13860
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        121⤵
        
        PID:6244
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        122⤵
        
        PID:11500
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        123⤵
        
        PID:14416
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        124⤵
        
        PID:14500
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        125⤵
        
        PID:14588
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        126⤵
        
        PID:14720
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        127⤵
        
        PID:14800
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        128⤵
        
        PID:14876
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        129⤵
        
        PID:14968
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        130⤵
        
        PID:15044
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        131⤵
        
        PID:15128
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        132⤵
        
        PID:15224
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        133⤵
        
        PID:15332
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        134⤵
        
        PID:14560
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        135⤵
        
        PID:6084
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        136⤵
        
        PID:13352
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        137⤵
        
        PID:11640
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        138⤵
        
        PID:1636
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        139⤵
        
        PID:16076
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        140⤵
        
        PID:15824
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        141⤵
        
        PID:6936
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        142⤵
        
        PID:15432
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        143⤵
        
        PID:3448
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        144⤵
        
        PID:15636
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        145⤵
        
        PID:15800
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        146⤵
        
        PID:6612
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        147⤵
        
        PID:16008
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        148⤵
        
        PID:1580
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        149⤵
        
        PID:12840
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        150⤵
        
        PID:15608
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        151⤵
        
        PID:15948
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        152⤵
        
        PID:12996
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        153⤵
        
        PID:15268
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        154⤵
        
        PID:15776
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        155⤵
        
        PID:7496
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        156⤵
        
        PID:7120
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        157⤵
        
        PID:16392
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        158⤵
        
        PID:16536
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        159⤵
        
        PID:16604
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        160⤵
        
        PID:16720
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        161⤵
        
        PID:16844
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        162⤵
        
        PID:17048
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        163⤵
        
        PID:13500
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        164⤵
        
        PID:17080
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        165⤵
        
        PID:5920
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        166⤵
        
        PID:17260
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        167⤵
        
        PID:3352
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        168⤵
        
        PID:13940
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        169⤵
        
        PID:10352
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        170⤵
        
        PID:17172
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        171⤵
        
        PID:4124
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        172⤵
        
        PID:9384
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        173⤵
        
        PID:3208
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        174⤵
        
        PID:11060
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        175⤵
        
        PID:3172
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        176⤵
        
        PID:10644
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        177⤵
        
        PID:10424
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        178⤵
        
        PID:2200
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        179⤵
        
        PID:11356
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        180⤵
        
        PID:10564
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        181⤵
        
        PID:6920
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        182⤵
        
        PID:5336
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        183⤵
        
        PID:2852
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c time 00:00
        27⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3420
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe" https://youtu.be/o-YBDTqX_ZU?si=KI64texgPjTiIt1k
        27⤵
        Modifies Internet Explorer settings
        Suspicious use of SetWindowsHookEx
        
        PID:4792
        
        C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4792 CREDAT:275457 /prefetch:2
        28⤵
        System Location Discovery: System Language Discovery
        
        PID:5556
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c time 00:00
        26⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3476
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe" https://youtu.be/o-YBDTqX_ZU?si=KI64texgPjTiIt1k
        26⤵
        Modifies Internet Explorer settings
        Suspicious use of SetWindowsHookEx
        
        PID:4556
        
        C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4556 CREDAT:275457 /prefetch:2
        27⤵
        System Location Discovery: System Language Discovery
        
        PID:5420
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c time 00:00
        25⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3168
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe" https://youtu.be/o-YBDTqX_ZU?si=KI64texgPjTiIt1k
        25⤵
        Modifies Internet Explorer settings
        Suspicious use of SetWindowsHookEx
        
        PID:4728
        
        C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4728 CREDAT:275457 /prefetch:2
        26⤵
        System Location Discovery: System Language Discovery
        
        PID:5468
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c time 00:00
        24⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3316
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe" https://youtu.be/o-YBDTqX_ZU?si=KI64texgPjTiIt1k
        24⤵
        Modifies Internet Explorer settings
        Suspicious use of SetWindowsHookEx
        
        PID:4544
        
        C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4544 CREDAT:275457 /prefetch:2
        25⤵
        System Location Discovery: System Language Discovery
        Modifies Internet Explorer settings
        
        PID:5396
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c time 00:00
        23⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3460
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe" https://youtu.be/o-YBDTqX_ZU?si=KI64texgPjTiIt1k
        23⤵
        Modifies Internet Explorer settings
        Suspicious use of SetWindowsHookEx
        
        PID:3992
        
        C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3992 CREDAT:275457 /prefetch:2
        24⤵
        System Location Discovery: System Language Discovery
        
        PID:4372
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c time 00:00
        22⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3612
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c time 00:00
        21⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3132
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c time 00:00
        20⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3204
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe" https://youtu.be/o-YBDTqX_ZU?si=KI64texgPjTiIt1k
        20⤵
        Modifies Internet Explorer settings
        Suspicious use of SetWindowsHookEx
        
        PID:4804
        
        C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4804 CREDAT:275457 /prefetch:2
        21⤵
        System Location Discovery: System Language Discovery
        
        PID:5532
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c time 00:00
        19⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:456
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c time 00:00
        18⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3152
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c time 00:00
        17⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3188
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c time 00:00
        16⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3204
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c time 00:00
        15⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3212
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c time 00:00
        14⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3296
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe" https://youtu.be/o-YBDTqX_ZU?si=KI64texgPjTiIt1k
        14⤵
        Modifies Internet Explorer settings
        Suspicious use of SetWindowsHookEx
        
        PID:3832
        
        C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3832 CREDAT:275457 /prefetch:2
        15⤵
        System Location Discovery: System Language Discovery
        Modifies Internet Explorer settings
        
        PID:4236
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c time 00:00
        13⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3340
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe" https://youtu.be/o-YBDTqX_ZU?si=KI64texgPjTiIt1k
        13⤵
        Modifies Internet Explorer settings
        Suspicious use of SetWindowsHookEx
        
        PID:3880
        
        C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3880 CREDAT:275457 /prefetch:2
        14⤵
        System Location Discovery: System Language Discovery
        
        PID:4212
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c time 00:00
        12⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3388
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe" https://youtu.be/o-YBDTqX_ZU?si=KI64texgPjTiIt1k
        12⤵
        Modifies Internet Explorer settings
        Suspicious use of SetWindowsHookEx
        
        PID:3944
        
        C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3944 CREDAT:275457 /prefetch:2
        13⤵
        System Location Discovery: System Language Discovery
        
        PID:4356
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c time 00:00
        11⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3432
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe" https://youtu.be/o-YBDTqX_ZU?si=KI64texgPjTiIt1k
        11⤵
        Modifies Internet Explorer settings
        Suspicious use of SetWindowsHookEx
        
        PID:3972
        
        C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3972 CREDAT:275457 /prefetch:2
        12⤵
        System Location Discovery: System Language Discovery
        
        PID:4404
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c time 00:00
        10⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2028
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe" https://youtu.be/o-YBDTqX_ZU?si=KI64texgPjTiIt1k
        10⤵
        Modifies Internet Explorer settings
        Suspicious use of FindShellTrayWindow
        Suspicious use of SetWindowsHookEx
        
        PID:2340
        
        C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2340 CREDAT:275457 /prefetch:2
        11⤵
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2528
        
        C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2340 CREDAT:1324036 /prefetch:2
        11⤵
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2568
        
        C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2340 CREDAT:2307077 /prefetch:2
        11⤵
        System Location Discovery: System Language Discovery
        Modifies Internet Explorer settings
        Suspicious use of SetWindowsHookEx
        
        PID:4180
        
        C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2340 CREDAT:209933 /prefetch:2
        11⤵
        System Location Discovery: System Language Discovery
        
        PID:4304
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        10⤵
        
        PID:3524
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        11⤵
        
        PID:3508
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        12⤵
        
        PID:3660
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        13⤵
        
        PID:2268
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        14⤵
        
        PID:3176
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        15⤵
        
        PID:4280
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        16⤵
        
        PID:4752
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        17⤵
        
        PID:5012
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        18⤵
        
        PID:5096
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        19⤵
        
        PID:3404
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        20⤵
        
        PID:2216
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        21⤵
        
        PID:5156
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        22⤵
        
        PID:5372
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        23⤵
        
        PID:5668
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        24⤵
        
        PID:5808
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        25⤵
        
        PID:5928
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        26⤵
        
        PID:6012
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        27⤵
        
        PID:6100
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        28⤵
        
        PID:4860
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        29⤵
        
        PID:5060
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        30⤵
        
        PID:5960
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        31⤵
        
        PID:6188
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        32⤵
        
        PID:6276
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        33⤵
        
        PID:6356
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        34⤵
        
        PID:6432
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        35⤵
        
        PID:6644
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        36⤵
        
        PID:6736
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        37⤵
        
        PID:6844
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        38⤵
        
        PID:6944
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        39⤵
        
        PID:7132
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        40⤵
        
        PID:6024
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        41⤵
        
        PID:6716
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        42⤵
        
        PID:3564
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        43⤵
        
        PID:7236
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        44⤵
        
        PID:7428
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        45⤵
        
        PID:7712
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        46⤵
        
        PID:8080
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        47⤵
        
        PID:8212
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        48⤵
        
        PID:8984
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        49⤵
        
        PID:9400
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        50⤵
        
        PID:10204
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        51⤵
        
        PID:10268
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        52⤵
        
        PID:10540
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        53⤵
        
        PID:10796
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        54⤵
        
        PID:11108
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        55⤵
        
        PID:11220
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        56⤵
        
        PID:6324
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        57⤵
        
        PID:12004
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        58⤵
        
        PID:12124
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        59⤵
        
        PID:11524
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        60⤵
        
        PID:11708
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        61⤵
        
        PID:11976
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        62⤵
        
        PID:1668
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        63⤵
        
        PID:11680
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        64⤵
        
        PID:232
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        65⤵
        
        PID:9876
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        66⤵
        
        PID:3804
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        67⤵
        
        PID:4088
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        68⤵
        
        PID:7372
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        69⤵
        
        PID:12348
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        70⤵
        
        PID:12436
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        71⤵
        
        PID:12536
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        72⤵
        
        PID:12628
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        73⤵
        
        PID:12716
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        74⤵
        
        PID:12780
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        75⤵
        
        PID:12872
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        76⤵
        
        PID:12948
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        77⤵
        
        PID:13024
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        78⤵
        
        PID:13128
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        79⤵
        
        PID:13204
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        80⤵
        
        PID:13292
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        81⤵
        
        PID:2628
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        82⤵
        
        PID:1296
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        83⤵
        
        PID:396
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        84⤵
        
        PID:12796
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        85⤵
        
        PID:13040
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        86⤵
        
        PID:12328
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        87⤵
        
        PID:13328
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        88⤵
        
        PID:13428
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        89⤵
        
        PID:13524
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        90⤵
        
        PID:13996
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        91⤵
        
        PID:13932
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        92⤵
        
        PID:13472
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        93⤵
        
        PID:13576
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        94⤵
        
        PID:13624
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        95⤵
        
        PID:13652
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        96⤵
        
        PID:14096
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        97⤵
        
        PID:14180
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        98⤵
        
        PID:14284
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        99⤵
        
        PID:14292
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        100⤵
        
        PID:11184
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        101⤵
        
        PID:11360
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        102⤵
        
        PID:14364
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        103⤵
        
        PID:14444
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        104⤵
        
        PID:14536
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        105⤵
        
        PID:14604
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        106⤵
        
        PID:14728
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        107⤵
        
        PID:14808
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        108⤵
        
        PID:14888
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        109⤵
        
        PID:14980
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        110⤵
        
        PID:15096
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        111⤵
        
        PID:15196
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        112⤵
        
        PID:15324
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        113⤵
        
        PID:12252
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        114⤵
        
        PID:5984
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        115⤵
        
        PID:13368
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        116⤵
        
        PID:10500
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        117⤵
        
        PID:6932
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        118⤵
        
        PID:15448
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        119⤵
        
        PID:16108
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        120⤵
        
        PID:6940
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        121⤵
        
        PID:15420
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        122⤵
        
        PID:15544
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        123⤵
        
        PID:15664
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        124⤵
        
        PID:15764
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        125⤵
        
        PID:12464
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        126⤵
        
        PID:3664
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        127⤵
        
        PID:7192
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        128⤵
        
        PID:7252
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        129⤵
        
        PID:12504
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        130⤵
        
        PID:7100
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        131⤵
        
        PID:7044
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        132⤵
        
        PID:16212
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        133⤵
        
        PID:3624
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        134⤵
        
        PID:6696
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        135⤵
        
        PID:1112
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        136⤵
        
        PID:16428
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        137⤵
        
        PID:16528
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        138⤵
        
        PID:16620
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        139⤵
        
        PID:16692
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        140⤵
        
        PID:16856
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        141⤵
        
        PID:17024
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        142⤵
        
        PID:8232
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        143⤵
        
        PID:17088
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        144⤵
        
        PID:16764
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        145⤵
        
        PID:4624
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        146⤵
        
        PID:14216
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        147⤵
        
        PID:4724
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        148⤵
        
        PID:16932
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        149⤵
        
        PID:10220
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        150⤵
        
        PID:5052
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        151⤵
        
        PID:17376
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        152⤵
        
        PID:9948
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        153⤵
        
        PID:11120
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        154⤵
        
        PID:4068
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        155⤵
        
        PID:17184
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        156⤵
        
        PID:12080
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        157⤵
        
        PID:6832
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        158⤵
        
        PID:11384
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        159⤵
        
        PID:11772
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        160⤵
        
        PID:12272
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" C:\Windows\System32\systemconfig.exe.vbs
        161⤵
        
        PID:11840
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c time 00:00
        9⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3424
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe" https://youtu.be/o-YBDTqX_ZU?si=KI64texgPjTiIt1k
        9⤵
        Modifies Internet Explorer settings
        Suspicious use of SetWindowsHookEx
        
        PID:4004
        
        C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4004 CREDAT:275457 /prefetch:2
        10⤵
        System Location Discovery: System Language Discovery
        
        PID:4412
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c time 00:00
        8⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2028
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c time 00:00
        7⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1552
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c time 00:00
        6⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1680
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c time 00:00
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1028
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c time 00:00
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:980
  - - C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" https://youtu.be/o-YBDTqX_ZU?si=KI64texgPjTiIt1k
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:2052
    - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2052 CREDAT:275457 /prefetch:2
        5⤵
        System Location Discovery: System Language Discovery
        Modifies Internet Explorer settings
        
        PID:3704
- - C:\Windows\System32\wscript.exe
    "C:\Windows\System32\wscript.exe" C:\Windows\advapi32_ext.vbs
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2816
  - - C:\Windows\System32\taskkill.exe
      "C:\Windows\System32\taskkill.exe" /IM powershell.exe /F
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2700
  - - C:\Windows\System32\taskkill.exe
      "C:\Windows\System32\taskkill.exe" /IM taskmgr.exe /F
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2400
  - - C:\Windows\System32\taskkill.exe
      "C:\Windows\System32\taskkill.exe" /IM cmd.exe /F
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1972
  - - C:\Windows\System32\taskkill.exe
      "C:\Windows\System32\taskkill.exe" /IM regedit.exe /F
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2572
  - - C:\Windows\System32\taskkill.exe
      "C:\Windows\System32\taskkill.exe" /IM control.exe /F
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1676
  - - C:\Windows\System32\taskkill.exe
      "C:\Windows\System32\taskkill.exe" /IM gp.exe /F
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1608
  - - C:\Windows\System32\taskkill.exe
      "C:\Windows\System32\taskkill.exe" /IM msconfig.exe /F
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2260
  - - C:\Windows\System32\taskkill.exe
      "C:\Windows\System32\taskkill.exe" /IM MsMpEng.exe /F
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:216
  - - C:\Windows\System32\taskkill.exe
      "C:\Windows\System32\taskkill.exe" /IM avp.exe /F
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:3540
  - - C:\Windows\System32\taskkill.exe
      "C:\Windows\System32\taskkill.exe" /IM AvastSvc.exe /F
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:3548
  - - C:\Windows\System32\taskkill.exe
      "C:\Windows\System32\taskkill.exe" /IM avgsvc.exe /F
      4⤵
      Kills process with taskkill
      PID:4528
  - - C:\Windows\System32\taskkill.exe
      "C:\Windows\System32\taskkill.exe" /IM avc.exe /F
      4⤵
      Kills process with taskkill
      PID:5816
  - - C:\Windows\System32\taskkill.exe
      "C:\Windows\System32\taskkill.exe" /IM NortonSecurity.exe /F
      4⤵
      Kills process with taskkill
      PID:6568
  - - C:\Windows\System32\taskkill.exe
      "C:\Windows\System32\taskkill.exe" /IM Protegent.exe /F
      4⤵
      Kills process with taskkill
      PID:8452
  - - C:\Windows\System32\taskkill.exe
      "C:\Windows\System32\taskkill.exe" /IM pavsrvx.exe /F
      4⤵
      Kills process with taskkill
      PID:2184
  - - C:\Windows\System32\taskkill.exe
      "C:\Windows\System32\taskkill.exe" /IM mbam.exe /F
      4⤵
      Kills process with taskkill
      PID:13344
  - - C:\Windows\System32\taskkill.exe
      "C:\Windows\System32\taskkill.exe" /IM avguard.exe /F
      4⤵
      Kills process with taskkill
      PID:15080
  - - C:\Windows\System32\taskkill.exe
      "C:\Windows\System32\taskkill.exe" /IM mcshield.exe /F
      4⤵
      Kills process with taskkill
      PID:16820
- - C:\Windows\pei.exe
    "C:\Windows\pei.exe"
    3⤵
    PID:13916
  - - C:\Users\Admin\AppData\Local\Temp\3368415325.exe
      C:\Users\Admin\AppData\Local\Temp\3368415325.exe
      4⤵
      PID:10520
    - - C:\Windows\sysldrvcs.exe
        
        C:\Windows\sysldrvcs.exe
        5⤵
        
        PID:14628
      - C:\Users\Admin\AppData\Local\Temp\1472819124.exe
        
        C:\Users\Admin\AppData\Local\Temp\1472819124.exe
        6⤵
        
        PID:16728
        
        C:\Users\Admin\AppData\Local\Temp\166345560.exe
        
        C:\Users\Admin\AppData\Local\Temp\166345560.exe
        7⤵
        
        PID:16940
        
        C:\Users\Admin\AppData\Local\Temp\1716131136.exe
        
        C:\Users\Admin\AppData\Local\Temp\1716131136.exe
        7⤵
        
        PID:2632
      - C:\Users\Admin\AppData\Local\Temp\712011879.exe
        
        C:\Users\Admin\AppData\Local\Temp\712011879.exe
        6⤵
        
        PID:10304
- - C:\Windows\System32\taskkill.exe
    "C:\Windows\System32\taskkill.exe" /F /IM explorer.exe
    3⤵
    - Kills process with taskkill
    PID:6656

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2844

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:784

C:\Windows\System32\vdsldr.exe
C:\Windows\System32\vdsldr.exe -Embedding
1⤵
PID:1656

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
PID:2832

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Management Instrumentation

T1047

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Direct Volume Access

T1006

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

Clear Persistence

T1070.009

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\05DDC6AA91765AACACDB0A5F96DF8199

Filesize
854B

MD5
e935bc5762068caf3e24a2683b1b8a88

SHA1
82b70eb774c0756837fe8d7acbfeec05ecbf5463

SHA256
a8accfcfeb51bd73df23b91f4d89ff1a9eb7438ef5b12e8afda1a6ff1769e89d

SHA512
bed4f6f5357b37662623f1f8afed1a3ebf3810630b2206a0292052a2e754af9dcfe34ee15c289e3d797a8f33330e47c14cbefbc702f74028557ace29bf855f9e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
1KB

MD5
d9a899ee2ce1ec928baf4fcfda8aa615

SHA1
a8dd8edbe3f1a41162318003bb29c0350054317f

SHA256
3abea751a45405fd1230bb7fe3f9a885a3701a6f0f0ee3048ae60e9b5b749b57

SHA512
44870902380e9c7d9ccb913754e1fb0f7460079ac79f66b496269500ac2b9afa4504c9e7b463cb590dfd073f2c9aae529ba6ce87ca161b687688ce4b57dc78d4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\4FA45AE1010E09657982D8D28B3BD38E_83F29ED1D5F129EB605BF640EBE52C8C

Filesize
472B

MD5
928761a666acdb11b9ef7dc691541229

SHA1
cf254f6b5c18eca66a8ddae3fcc96841e1f4bf90

SHA256
672e9079840e556d2c0452afbc26bf4e87753f8314010eead06ce5aa752a38af

SHA512
65ac95aef456c954b8013925635a1bf88855bc4d5ea0cdcc058c904603e49303bf5a2e2f93d200d8403ce7870fdcc335059503e8248439fce08aea63233d1ac0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6DA548C7E5915679F87E910D6581DEF1_1C4A465B675CB72A1C146B67D7E0A1A7

Filesize
472B

MD5
019382533c7e63e65007046e9fb7c162

SHA1
373168c2c9ba6e08a581d625958530900a1192d8

SHA256
e6d1da9f21858ea854308fe21987059631f09fab079fe92a35b1dcf5ec332204

SHA512
7e45081037f939ef21378469461de4036d1f61d591d7696c917c43a2382ce05a1f5d48e577881359bff060b08bf27dbefc49230dab78ab59ce110599cef6663f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
71KB

MD5
83142242e97b8953c386f988aa694e4a

SHA1
833ed12fc15b356136dcdd27c61a50f59c5c7d50

SHA256
d72761e1a334a754ce8250e3af7ea4bf25301040929fd88cf9e50b4a9197d755

SHA512
bb6da177bd16d163f377d9b4c63f6d535804137887684c113cc2f643ceab4f34338c06b5a29213c23d375e95d22ef417eac928822dfb3688ce9e2de9d5242d10

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\DDE8B1B7E253A9758EC380BD648952AF_F0A3BE93E1741F83EA2C0F5E175466D8

Filesize
471B

MD5
8c9f848f9ce62eb3881427c02a60f1d8

SHA1
21b478af4b3813180cdbd755b8525e79c3ccb1d1

SHA256
8dd6b115342f2ba52e6d7d66629d06fba0165f74b09acba5e89944ec9341de94

SHA512
5f2ecd6faaa512ee40200a9181961569a96c6b8092d6e0076065e21bc6b7a0e3741bb85176828b1c31abb8abddde7e6c5c315213e2e2eceec81359a24739752c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\05DDC6AA91765AACACDB0A5F96DF8199

Filesize
170B

MD5
3d7eacb590ea0fb1cff1f6b34334d822

SHA1
8fbc7b83bec4583d76b2a2799dd3608190695dca

SHA256
e089f4523ee064018b0f4f91880db2d7ad7123fd995545e716a76d62aa10a43f

SHA512
15977e14380375730e69e77566c756d063df1f6662a6048bf0fc6de337d12c5148ffbab13dc6bb9dde456cfbc6dbda4b2f516e20db11013bbde081a1afac24a8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
410B

MD5
4c4fbd8656ec2997755a703d0e04fa7a

SHA1
a777084daf60e612e9e904b48cc106fb28628832

SHA256
25f76164bd1cb3369c953129af82055e29b63dd6b581955914ffdaf67b6df474

SHA512
ce6bb52a77406d68b214252ee952a6e8895a261eaf5b3b6afca7b6632cf45e1f8f4352f143fc0b7cd429aa624bd9237224e0039e13adae78f59245dd830bbb80

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
8bb879fbc9c807b16b68d22ac60f4048

SHA1
953453d0a707ab75e647e3923788fcdcdd3a3c33

SHA256
fdd02205feb79bc868c9e29169c2baafb2e6befd90c932ccef5e039dfb1fd8ab

SHA512
2652cf1ba4ad25231ef97c24d96c9b4d7c32a925f6cbc4b13923521aa0a46cb2f49da920b1ca53f9a36a87c5dd1854fb95c2dca71d00aac7536b25098954386f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\4FA45AE1010E09657982D8D28B3BD38E_83F29ED1D5F129EB605BF640EBE52C8C

Filesize
402B

MD5
d9dcf6ae3af71e92f63ede6a895ec79e

SHA1
595e9336627f369602e9025e63bbfc23d5d79a5b

SHA256
2fb0c69663aeeb204767968371aee5b2e2138a1206a5e0fbe2950b721055b0a7

SHA512
462107276718a3967bb4f532f363f07a39425822fcb9214520785f07c5cd1ea5c8222ea3c62aef340dde932cceba610a4492ac99adfe38e46697fd29f21f3c87

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6DA548C7E5915679F87E910D6581DEF1_1C4A465B675CB72A1C146B67D7E0A1A7

Filesize
402B

MD5
9e7cf0738ccb8edd623f1e4c3bc375e0

SHA1
10a9e8ef519d5a04bb4be099c9e38694a9f8d9e5

SHA256
d08575b85f017286e75bc68e4ef28e5e94ca74fc0fb546b7d9c206ff28077299

SHA512
6a197acfd3ca9bec9dcf5fafaf2bc44d7a54c51d6556b0404a3b54e9dd91b96473fed3122a8a039769c6fd5cf9b0fb3ff64394a1de02d29147a478f022f1f0a0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
82c083e499db25c260fa0b0f6feed0ff

SHA1
c6431e28754ffa160b3804880ed0e36b9f2dbb9e

SHA256
5545bcee76f8d815f304028537ccc3e9b0e962d492787e4791f568fbbee25bea

SHA512
111809a9010b3d3f56ea109840c7fd378c4a747b765df32879dc92e7395d9d3a9ec3dfb081fc3ca62a0860391d9ad6bbd89927d200f8a6b939c743fcc3a57718

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4ad7f8218bf8ee2110131ee90ae24c06

SHA1
5d7bb7f6543909713bb820d45fd68d3f547fde68

SHA256
d6174aa485282d887d2065b3d633bfb38a7b49ef28427cefff8882306fe78e40

SHA512
6d985e4a4d063ac50275ae9fda37cb6c7e19b8d92896d8c2257cdc9f2c5ea6fc9e01b7f8e6a9cda4ea7c2d287a92487560fc4d7c297f677af9f781645689a5a0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4b007a7d015e50c2b5a0c5b9a4920e88

SHA1
791add68d9f2cbab7aeadeb3a797012bd143ef48

SHA256
80ab9b0efc454972ee0ef85457a7880b3f235a4cd142952a9d8dfdac19ef1d60

SHA512
3ce53fcdad881d910ab5208ccdc26c38431a4434e5048bcf1112252e08c3c502cfee6c0f59704621cf98b234610714bc32d16ba69fb6e99772ba0e05c2c6a2f1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ea287f54536388a56c592d3e52e2c926

SHA1
a5d28995ded825376cfc448edb7b9b2397b36ce0

SHA256
677121cedd69bb8a090762e3598e08a4e5892e5a7c090fd0e4b8b8f65ceb4116

SHA512
38a05b7ffb65291a7fc2fb5054977744f8c50550126791ac6a65ec26d14ef121ff73935757e423e91931f46288a2d2a3444d61cf68765e5018c2518352654834

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a9e828d9e14fb35c21aa630cb3e34f50

SHA1
2c53cdb9954c2052189306f84cbcbf47118a913a

SHA256
6643b554d26cc20c8faaa75cc00d4d6a7dba0b4df80bd0d0b6284b5ec0a2cb71

SHA512
1a2e3964e340ff93b82477f3f74dfc50102e1ea6eda4a8154de805136f68b3b975dc05b7b613a3ea1778ac58dabf4e6cbb4e25fc26c74e15318d00cc74bd8be7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d931b21fe9d545640dadccc8d847d653

SHA1
05ffd5db1a1f95dd47e69acf03649beb6de79377

SHA256
5cf834412021ac438822f49f12027d0a42a829c6e13027ffe4535be134814ae6

SHA512
5fdc1cb3151caf8c054702ade4a9d969e03f35c618aa149f7a72ef7f52c3aeb25ce9622edd8f06ea3943ba28e04490d5a4ea23f6bc11471b308faf24d2d392ed

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
17a0e3be528b9a62f7f8d19d4a62c39e

SHA1
0705acb4cba3a3effb5b5e7d8c58916ca0e79864

SHA256
bb04a912908873791d957d14a204f4bf914f3ffd05d1e0e02536c9e860d9d30f

SHA512
b49fefe6d5d32e3edd58500ba0fd1ae2102ae1bd29a6710394467b93e957fb686418aa52c8afcc31e81aaa158623702c951dffb1a83f04582d501a81ac7a1f78

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bae657bfe9e4f9d0c76bfdfbbae32bc4

SHA1
f3f165d797f863c39db117bae82f562115b85318

SHA256
83b8b8878d639dabf093ec0345fd068931ac3c8614baee4f8b86dfe2e6908a23

SHA512
51896f9f6e3345f272843c79d436b15d086d3aaba3bade15888e2ae207c7e64fc2d288e6f7a2023ec568e8d71a55492cdc06db87944ec9d6a2852fd8e4269e71

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
934bc8d240d817e5611d0cc17f4e8fca

SHA1
4d9a6e104a53ffcef4ea16f68e24a7fcb5c73754

SHA256
2a8e9665bf88a9e9987d076c548f65665c0e6d83ddda53dfab07466d6ff4c21b

SHA512
70ed357ab3e48e9bb05e083579f283bc97b305e135b12fa8ba3dc6dd5d984e9f75780d5bafad9eb804f16f05325b9bc0d78653a3ef82bcd542c2a731e3315b23

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d6622fdd7d88d134de12d46d35595f99

SHA1
31ed1167bb77127b706820867eda591e35af51a9

SHA256
eab3da613c8e126af6a6d0b4483ac6e2f9dc0d0a63d23ebeba541fdbdbb20e33

SHA512
ed6e5dc648b142157e0c3cdeef72b77798847a1010188ac4ce353c3e8380a5285a33f26e3fd2489e4c572f5271c7fc5ee7d88f3991351b2fc61bc96c8a56a78f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6db07b45c1d3aa3c7c367312e2e211c0

SHA1
73078211b88c82d8511cc5cd278221016fef9e09

SHA256
3fd935ed83c3e74bc5cb20f6d41e30ef36e986e0d1b71ae33fa332414fa7fe1d

SHA512
272a1e491cdcc3269e34bccfd3cfd5645b4375be6cadcc975903ed76b754b6aa88904129336c2c87f17edec4056c32478774c095e6428a54525558f84ad4caf1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
828185c1d11ed58e7068b33fb615313b

SHA1
95f7e2aca0760c9df67e48e267f24f2bf8309fcd

SHA256
c505620348e86357d4fcf200b4c11b077fd38a360ce3ab0d3a8696c29f409b14

SHA512
2f8f8bf3e4b6132623aae4b165b39483547acabe4140b69012f699cbf9eeac9ac09aee129790c52e75fbaa143e2e187c3dae3feed2d8f0a556cbb86c459b87be

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4226ee887462fd5ee96bd2c256b8b191

SHA1
672286068a59f762d9fb7fdd14d58f40b769280f

SHA256
f2e57db79a91d7a221410c1d993a40467f5372afa318e8bd6be426f422d3efb8

SHA512
813c1eff871f6613656a8909159f6a33d3ff8691a50949b44bbdc426f50e4982783c525297bd557cb805cf5a1b023cfc40b5cd9ffd43a26aca8e75cc083a0f08

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c19ae9ffe56721e5e8eb931ceaf17be7

SHA1
12314874fac47cbae24b58107462e450aa2889f5

SHA256
921aa64dc37daa43cfa05dc17975a7e34717bb5f988bd870c4959c55db736d97

SHA512
ac9e8233d7e83faa72180c04d24e900511116ad476600ed6bc305b105a24ec263a75fbae79c43e060608a0fa5094d104b054a7e5cf3a229455fb4530b241cdae

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
08712a955785f00cb674327ebc3970f1

SHA1
388f1649ced50fa9a2343bc891c239ca27c25d3f

SHA256
3e31f47da84ac40ccc28e92d6e56776d27829bdad42b5d3030bb1a6aae19465e

SHA512
159bb14b23af5b7f85e7018950081ab80ceb389624e517a8c071d04675ded773886055081e7258443ef54745449b08fa12a42d169675833a2e9f790eff3fb0ca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0dcab8391756c0ed250f8db7260d7c35

SHA1
4044f76dc4afb483eb81b804772f1ccbe62642e1

SHA256
4eef90d032034fdb167cf44d825200a0387886ef3f17558f88c2d733978894cc

SHA512
1df1bc1eb273c6d3598c20da4d0a1657ec088b42a4748be3410b5c55b0bc9f6dbd623504306cc6bba535ab130d67bc206be5e754f7567e0308d5c9c0910de749

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8cac79e37fbd73497a06299aecff63e0

SHA1
765077baf80466ecccf1b6fa1f87e979157b0324

SHA256
d710863ed39bc0d1d8e10a849acd6418167a220c644f28196632a0e76f41e05a

SHA512
c91564305ff4af11fea7d92dcef834e8ac092035cdf3a8552a100e655f63f2a37c725f70d387834041fb2c988617c553b812e0ab852f47c98961e8c4cf85e8f8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d188ec0009b5aa49d241e8ce4ec99420

SHA1
ef4abaa0fe9730fe1a4e7810c10adda4bd19b174

SHA256
19bbbbbd20f4ee2564e88f82c30b9723de53a835cc6760b35701cb81e1885f77

SHA512
d805edecda4012fc59ed2c945f088eece2ed02bf79e7f76743fafacca45384f0a0853ee4bef0b86d2787669a33507c6db68968c4e8b8ec3dfbe1a776375b5f5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8bfa4aefb99039badc0d39daf5fa4b8b

SHA1
6b00a0351a291c880365637a8d3e7718bbb49242

SHA256
3fcb00ba39649abe056638a1b51f19927c8c6799932a82afe20651a54951435c

SHA512
513761c227098a221a808a0e635f98de114b6e42e02b741054b2444e0df8f79f303db77e6a93b2f7835b1b1915a17775c7b076becd05deec3732edb04a09a811

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e9ec899851cb816d81eeb9e937d60764

SHA1
540ea4461d91215075eb57b30f682333a0ddc71b

SHA256
d5c8d83359b6dfe50907c74ad2265b469dabef8721970fe1986b3aa02773b7bc

SHA512
d1cb440123d60e99869a90df99663b25895a00df9c5bde5e0ce3a7d2b572a805af29f762fdc8f804931775bb72f6b770b62bb2df02bf4d82c7d60e9540cf6e23

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8f367667e72659241a001fb453b6d023

SHA1
f9c084bf89d38bc8b22b9e5ff246c64f5098366a

SHA256
e23f7a9220c75fd88c33ee62bd8c55ea20b737baa9de50d5108dd86ea47b40ce

SHA512
a1834f6c2d83a16a030f3b06ef873865425015ecbc3579ff5c113149904633946b390d0ef4615a69baf9b19b016d4fc1a04a9c8d407fc9f623489719e1a17422

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e54432481f53a80e2284e3a1842711b5

SHA1
1f14c034132390ba342bfea67d0d788228d53dd7

SHA256
1316b675f15c753c778b8971407aa80186d6158e7cd201b6dd8c1d175ff4d495

SHA512
508bbcf9ea1317ff8acd438f0f7492f00fd046e04f7c021a7b3029c1185cb6e42e48206ca595b7b411d4422aed23d1d2e60cce36d7d39aa990dbde58a11fe0da

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8d56f6b91106b80491cda866f5850a09

SHA1
45f7c78c0a75d5fe838a10597d545b4d93f89612

SHA256
cec6ca3335c2945e0e04f24cbda82b0eef76b9ba13d8eae67344475056092607

SHA512
26b2bf7b13a9a345d16cc045256cdf5e05296fc6f44bada353eb7a6ef334c32647c06fbd544fc2d36e2c859f3a335a47649534c782fa72a25cb90d7fcbc18d07

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e2f62f81e472e5a609451c834082d9f7

SHA1
7e57f3577fb29d0631d03a8fe09c394dbceacf95

SHA256
b89be8a4b764482cd59aa6d580e7dc477f8e588951d47ec752d7ac45dfcbea78

SHA512
5ebc2b0bffa42bc7039a9192fb63f825d851eedb9dcf31e497234c49808b0c25d2b9bc72153553f82c4781e077748559dbf94ceef182a58c3fd9d39786b7201b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
37e32e41c50b78b8d054b09d85dfcf44

SHA1
a9c79c754b2157f1bd704ad3b66b82b9900fa870

SHA256
790b30fe23173e7853955d7744cc37af859f284fd0b3b24c83ce2b2241ae589b

SHA512
af285bb066f0701878d737e67d74823e8c3b29f3ec546f573c305ac4aa399a2c8b1ef6a7462945dde2c7a94a1fb04cd6a731428562326c7b688920b6913aab81

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
99311577f97995544450333cc42420de

SHA1
2613c54f3ac95dffdd8cf9cf8364d5ea5d5009f6

SHA256
2e8554b493fd79f2424ab745f86481b22d914cdc6f222862971fdc2d625c6eb4

SHA512
e38459c131d84441cf1006af55a445068b2dca3a1120a731208923e74e227f429a06906a6b36eba40018d585e0c51575f980f69fdeb718f9ca97e1325e81a86f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e71f0fb3c585dc04b01b541513aec4c4

SHA1
3f5455e0536f5c4c27792b4dcbad79bee36636c1

SHA256
7653b55b2e4cf7958b265d33b040402434e57c0ff32c3caaa44fffef1dcf5306

SHA512
26df7ac7fda071b0a6f9ba6cdb30b0dee8f119b46535d47d81e3ead796e97f0a1bca9d46da5273f042bfe592920e1c4068e71f4281d89e98550609cbb89467bd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cc8fe4b196b82a51be1094efbb673c8b

SHA1
9b72a65e6c279236ac750f24d8ecf5f49ddcd216

SHA256
237af9ac7a7b3ea5854a0f7da3c77912e04f346257ce4e088781c7e6543c4083

SHA512
6593a63de45d9d879a941ab76f70e0a276825b10233917adedb6ee2b471b49a141c53367f75daf291c8a025715fa64e3692e30819341f13424504b7e37e1a1e9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
63eeafba51bc0b75506c8f4e5fb05bd4

SHA1
345ac8b5380fe057c36e754117d38188fd9d147d

SHA256
adf1b921b41f4bad23e6416dafbb871b2977694585589583d095985b29baf020

SHA512
6e3ec3279fa085ce13c3a68cbff77d8692cd7c98f08179fd6727d0b491133446f44a4edf7757654eb0d813741b2649a4db76ad620fcf25ced9d2a39428c67db4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
95042a44aa12c2abaf2306acec2cd405

SHA1
7300e06d4783d4c09b3b522d1d7658c1681a9413

SHA256
d4004272205cd8615214084c09e0593bf0954bf37dfb9a7bb218d792198372f9

SHA512
45f139fd5876050cb2f0ba9ca1aa748b959749d8901fd616c7f3a2ff6390fba50c2b65fc097399b90a46441c11973f43064f0a810fe1c4c1be3065ebc95601c1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
46935fe1d5e3ec1d942f43c6171d70e7

SHA1
335704dd43f5bc480cd1688cb1be481b544a5596

SHA256
59f309d16123d4d8fd58c6df87fd44d7f422bfc972d8dbd7d48823a91e7b18a5

SHA512
96b4dd20423b3ad79c300050ebaa869dba5f2cc9299d1ad90f18aea00145394cb36a0a25ffbe4131fc3253c14bf0feb5df8946e33613925a4db1953fbaf0e068

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a546ee10fb7e596381db2ec4a4f48bdc

SHA1
a75821cebfdc90528f2dab01fc102085b6ea4b1b

SHA256
def746532b87d00e98f1389f28651825678de9e94a506fb8ffb0e18cacb53096

SHA512
f5c21a48e7c80ef78149409fed3d894ad794d7286b9b592e701f41518580eae39f3704c777083afbe3194c84e36f8684551a33d5866cc7ae7fea89d8da92671b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
10f63605d2a53bf96154171a0f303a70

SHA1
aa6375f14283326d1bd8b9d4b18097e52e3c5eeb

SHA256
2c45f87983c6bbab9a2df37c0620fd18dbe27c8c10c1010d7f2877f0643df62b

SHA512
d7900a09f3ca36c0132d9310c950c34007f9ac9bb10ae8996091488cfc6e590c38d202285b2eaa15bc0369055793736995bf322e3bc19d9ad7970ca7df428084

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
af5eb13a577a2d4536e812c57945e891

SHA1
f38182ab9f4c30af1c29b428cd659b2475dcbe21

SHA256
8fb3b9e31dc06984fb356f69e13966c15e4d292c2030dd60ead6f82807b5770b

SHA512
f215692f6c701e3005ca001fa68682fa09473397c579fcbf84f69b4485a7478fdaa7f3be7968eb99ea3d2238596002464e3650f537a983266c55369d25c9d413

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0757209eb71b5d90423d305431a88a0e

SHA1
a23186670ed5b87fe87f39a0dcdbc8f73d12167e

SHA256
962e2dc325099233ca62153e2130137ef84571e84838f6cdb4f8e28f698fcbed

SHA512
405a23b419705e34ef6f2dabd1607f5d2d418a195d8e67fd119710d51ec9742cd787675d967d9e156409b5108fb66ea4ea35d295ac29c2f00f8c3e79292622ba

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6cf603978f8e3ed5bd5e08f0a525b01f

SHA1
0bfdf579fdf78e69515928e07762b9bce28f82c2

SHA256
591fdd952f314dbd1b56a6b19a0c41fee8a69b2667bd0bd7f0f15da0971d3b0e

SHA512
1f04088f169efe1fcedf277a8f6a181d41677fce818a086e0bd33e078aaa6046c3749c8c8261c27c7f04f543ae59990d817bc6a96902517ce6c4d08db0acb9c0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c678f5787853396ea1e5ec7b6bb7a230

SHA1
a1eebbdcfc602202b2f5da1cdafd744598ed3714

SHA256
27fad59c3a85d211f40ba234b69a3842b2a647df5b9547b26483c5363561a8b3

SHA512
9857a32a3aba6e3d7a27e1349d8eeb73448d35add2b208078a179d85b61ac8b7d742d536481204758d2c8a2cdf1a7663adac613f1f399900119bf776cd1f55b8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
84dae59c98dad0c259f4b2d2547321f8

SHA1
6ce1facdd39d73a7846884c5567a71e709d142f9

SHA256
6cfa09e73985dab58b34f76779489b9c367084ad08d23d270e795e2baf78eeae

SHA512
951f275202d2738e7dae9c4a7b8b83c94fe2e1acfc1addb5204cece13a948053abd6ac51cdf48174d6f0ed9815166a59ddb178cf846934201ff48b0de7572d80

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6aa7c860287befd1b729173fce8e0885

SHA1
b61625781e8004ab1d4e0ba0f47c5556b2e94898

SHA256
80a3c2bf5ad810c44bf3bb5cd6a008482c0530c0203272cd864be13a690e6599

SHA512
a4794b2031b8bfda330116e9f1ce7f320528270ea6aa4cfc1c9e72eb7418efdd78188ad67323522f6df51313822d2242889960a5ebd714e29011151df77bbed2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
777b9500edd66f0ed07a8adda4b44a87

SHA1
de8210643aac1343bbd05f3c52c39451ed34d160

SHA256
963eae00e39dc0ec7616733064aca3c4f1fc305d8eccfd5ac907a720f23ed701

SHA512
e30bf4aad5b8ef6e5ea20926ebfaca4ceb908fd587de1f4c6316f5de78e0908ac201064c9dc09b34b6506c8c191bbe658d20839fb5d4ba84f893e1ef251f7c93

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5865156f4b94a1e3a5890db04af2f352

SHA1
1bb1297e894f891b9d6cb2e1790d84ebf5efe39a

SHA256
81934995b8827ce3dfcee88b861fbf69b7af9d02c85a406dd28f207652909c1f

SHA512
8fa122571f98a13d1a0a759a362398933571876b11c3af8c2f3b08a04cda2c3531b24450a18ab58f9955c89aeeba098ccf5fa65d7146378a27bf60961fddce6b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
61039ccd57e424ffd23fae3935f3fe51

SHA1
83158b30005c4eff41d98fecda86597731209e8c

SHA256
76c5db917bcdbf2da6e62e055555ff710279c1ca377895efa8a8a69ca70b7c53

SHA512
f29f1cb503437c2507913f203f43d761d334c63b372f23f3313b6a4db9fa198c4ecd5a271b06f777e22e74f8b603f28ca6036fff8bf6bef9594fe7bc1bb1e215

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c09f74f845cb9ec91d5c7c13c01e8860

SHA1
4957ae51864a941965809f43567559432f587764

SHA256
16b4248492ae389bce932e38fd0e13d76b1f67c77247142dbf1b83fbe5226d13

SHA512
ec73fb7e8a5f235345e6ad2b768eee65409e0fccaab2768849d8f56ef4253057ad030ba110048260cad629269f49c3f4016a981b8e93a6821925f19cfcecc08e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e5ba5c3d03daa08474f5d5fa2f166dd3

SHA1
d988c29bfc8170fad186bb7efbeccaf87be5864b

SHA256
78baf3553a75ebbc177eaa0c0e3626e62a6c3cd397f6c6c7b003d89c46521a34

SHA512
2e81b2236e82f9842acf1880f29a6ba05b244d0705eddf95b4bb97dca20d2382414bd93d0403d8d3950539cc3bca88842dd78ef20611ff2b7cdc4fd1890cfa55

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a80356c2478b098c2a23aaae5ea929c1

SHA1
1fcfd84578dc97f39761849cafa23f8e73bdd6d6

SHA256
a9220d528d4aa6d75a2ed7d4b1321a62a9a259f6d1089a433ad7ebb9956f5848

SHA512
4b0dc7a94197eb262a35202510e2b89423263aeafa216ff86eaed0296868264b5cd6d8ee9aa328a3eb6227e83e42b51c46c1053c3569c92e47ef8e2d6a40aabc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
96c881b1608a6b9d34cb8e0415e5ccb0

SHA1
2b6c2c0f6e71a93b3b5ef87a50a5972fdedd6d49

SHA256
8b59514767e7bbc5b517e71d38d12376780132d459058b6a3973ae2769c3880a

SHA512
b0558f44a54c244074bf938006b94ed52cda81d29baf2ac5b4340e210afc62f3741f7eca16ae142bf7cf040897a5ee1839ba0ecd3cda52485c99221e483e1c5a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c769dab23bc234533174468ec85d8812

SHA1
ca19ef63ea644e90b7c795c4ab30acf68e306ac1

SHA256
aba8d89326e247b906b57d1134e14acc6d6227cfa6e8cb06837d373a394b5727

SHA512
6f32452a82382948b1e1627cda31133dda1e76783047e815e62aa08341baf85fd5d831d1d37c06954c3f217e02f4f5e23ee3dd07c621f33d3f2ac355982cb953

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
95b7fbc7574019d722ffb413e14c6cdf

SHA1
fa43837bbd0fed391ef080a9a996dc1db480cc60

SHA256
05f8d25f2aeee2212f5f1cc1abb936fafc8c7e0461b39296af8f034d09c69c99

SHA512
739582f87b347f28b74ea6cfdffb770ff0a88db5a53b5304a6c13beec233e1b7e9a0e438fd5652c404750376efb3286785fdcb9b5b29e54bc5cb74dbb060b595

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ac6f200b8eb164ce30c31ed66b20a7f0

SHA1
95f40dd7b2fdc41f4b41f3e09e3ab12decd07d68

SHA256
a10cf5c8776729cca13506b0b8afa6c24e7ae617c171d268029ada245d8a40dc

SHA512
7abc76110d648cc3dc5b2e092013adc3bf8fa6286842e16c86cda5a6b67d7bf855febba42012867d0e4d807725c070b12f6ca3fd1870b4618e846857254a5a63

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8aca8cbb1f8ceefbe5afcd5d3eac7397

SHA1
5a7e65e69646d319c3a3804f4e2ef9b02625e937

SHA256
a12f7d671eb56916b23235484812a45611a92c79f2d1917455f801636dca025e

SHA512
dae4e12d7943d9407222a30abf680f6bee77b29a22dba630014639336a57eff048632cef474e3e88a8508a73fcd7258292d34d6b81bee00725fbb52fa99d07ff

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bad0c1aa01ef5e41019d3f5b95e8c8b0

SHA1
dbd531c5f689a05f612eb75be3d18349e2f57c2a

SHA256
50092653705af5133d8bb2dca6341a3917c01af88bbf91665213d7725fb3ff39

SHA512
3bd9d54c01d0b050ccc1d804ed722c120f2b321a338286ca1b20384024138abb200f1e9cd2572cc82089213a3b75202c33db2341d4543e00f734b4f9e0da6fcf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a98c8e81cfe04a73def32cd224a810fb

SHA1
7f0c612341534a7aa4d45a008f9f46000c37fe87

SHA256
452f8698983bdd4364ea58f9aaa0c1af367e40cf9d96128435336a09e497b2c4

SHA512
43999e6bee3597d63006a75717f755f76c6db9760d2a1537fe96b5d08fb24b3422977766ea3487bd1c20e27fb70037459b6cf70977edf7891aa85cc4303177d0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2affa7596bd7b129eb0ad573850ce3db

SHA1
5c37d9445e1a1ca4fdc438591ce4082d5d25587a

SHA256
7a52500b30def534072fea80eb653e717b425fc7c7016173723e8e31f3981096

SHA512
3d1a868a56ed85b682c90d44beef552479618a2c0a70592eff9ac067dfe5a8b35ebfef5bca2220730dab6c95232e8e1e7beb7359f48fb357df3e5fe96a63eb5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
83b1090891d65ae641631ff2a8095277

SHA1
64182e0152e2fbd233c5ebb5faeb9a82e4526c69

SHA256
60e36bde931c500cf5658487d24ba75ecbf6ecf478b428ce0f90214ec3a50d8c

SHA512
ef50d1ed31968aeb4ef617e1ffe550fd9ee558f34a939ac157dfbe4467e192356889c33c061f39e79fd7d678a977cfba71cb78db040c35a320a310f7d66675c2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
700a825bfe93d539a3a0a90431f3062c

SHA1
eb4bfc7c061d3839fb014332912d01a35cad516d

SHA256
316d366c8c9bcaf2bfd7179491bf22b605430ccf137ade76f648e7299d9b3f5a

SHA512
2c08c1dd80c7700bf72dbbb9a6a04be8543d05ae4466a196649dbe1ff1c2cd85a0319acee3d9d3797e983a7adf99708ca2f7e832ae5c3368e5cb911519343109

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\DDE8B1B7E253A9758EC380BD648952AF_F0A3BE93E1741F83EA2C0F5E175466D8

Filesize
406B

MD5
18da2b8df28dad8d7532f22653a1f69b

SHA1
d29822912638c2a63f562fd0868261612852307a

SHA256
49c677e16ca355b666bb2b03e25850b35ed32b2d91b93f8b403efd5d4921de32

SHA512
ca36c50c562223ba98e376d719165c5635b7fd97465e261a444f060984a359255f61a4f7dd2260ecdaf92e993f753c35ad69f33b8eb147c00755234a3f76bda9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
9692c0a17c4e3c493b09b00e1b611a5e

SHA1
e7cb8855bd6143018310ecd01932863809c62e92

SHA256
0de5ee6eca3b61431c67b955152ea496f3c2a653087a984c7278a7552a606427

SHA512
d11ac559bb3c9a3d0a384b489b96101eb258ac77fcf4d32bf711032c881fc609b747ae890377d0edc7cb350fde4ca9fcbb4c42b756fd13a465dfc479cfe915de

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{C2E3AF01-0779-11F0-9D46-D6B302822781}.dat

Filesize
10KB

MD5
899f95b5247585bc1ed68708645ebf6b

SHA1
9465c332f0aa09aed9c0374cc70dd01e28b9c5b5

SHA256
28f912ff4993e6b17eba65e6247c07cac939fcff48977f164b994f6592ce4453

SHA512
05863f8e9902ba38bc110862a29197c654b723601a9823a5095ee396abe63f74b05ef246aea2523512f148f038c3063bab85b2cf2ae8cf1bb90fc631ddb2ad8c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{C33BE8F1-0779-11F0-9D46-D6B302822781}.dat

Filesize
5KB

MD5
669086a80b4cec368feed3ae06c88e9a

SHA1
8129a9060529b6c0eaa944ecf3fa1a5d105894e0

SHA256
077c24e2468f5a878f5cb2ddc51a05732060011295076a10e1a817d2567ead77

SHA512
b9bb2d8518369aea10ce090aa542ce252fed75faf3eb2a40c94edd3ee9724018409962c062f3f5501e762a277900d9a8896245ec340b829e4f402a66220385cc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{C33C1001-0779-11F0-9D46-D6B302822781}.dat

Filesize
5KB

MD5
90c65cc705620a3f9215852f1de893b8

SHA1
d82bedd06fc8916a88854d7e059ae7aa4cbf7a3f

SHA256
010b9bb9a2e6cc347f33e66b4b2d66555c4f2ff5a8a58f906853a3586b2f34c1

SHA512
ede00f5930baa36400d9aa28834c05ed15ade4c40f8eaa4d1ace2bb5e6eeef52941f27fbac2f724ccaf53f7768e4514f23f7062fb2fdbcd0c50e7709ef854e55

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{C33C3711-0779-11F0-9D46-D6B302822781}.dat

Filesize
5KB

MD5
86ad73a25fff34b051ebb6f57a757cb3

SHA1
13ae458a1cfd1cc06a5e3746b51d67a832bc3885

SHA256
5437bf75a145279cec22704292c335e223d3de3a4f5aaa75ebb056cb4d1e4c70

SHA512
a442b6c94475669e594800562a96c35f1bec81ed348e153da7bd69ffc4dba655b7c17422e87ce4eb161459f910a676b8d1e127ff412269ae757c95f265ba0c6d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{C33C5E21-0779-11F0-9D46-D6B302822781}.dat

Filesize
3KB

MD5
2a57c3b805d945f5eebedbd204c0d6cc

SHA1
6ac953af6f88cbd9f306bdbefb757c132681eb6e

SHA256
95947e4e477de637544ad457b8cffa0b4e02d81398aa734df407b7c0db17ec0e

SHA512
ba503493b9b5b0306469d56a3a13f70c59bdb18fa67072d18d00b747f585c632f406d1d74db7775dc83c100777bd554a9c9cb31d62de33b1fc1cec9229596759

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{C33CAC41-0779-11F0-9D46-D6B302822781}.dat

Filesize
5KB

MD5
58915cf0bbc269717a866fd4a9c1d4cf

SHA1
75709e35272d4bbc2ccd4085f161c8733bd3b846

SHA256
128e63a803f5aa86273239f2923b87bca3ba09a7a658fecb022fac77bf4ce853

SHA512
1c7d702e23d946b8357da70078b2710eacb87d81c5b2eed55c595299d7e0979a13bd5f0e5c4e7b1505e603824eb5a327f9fa214a97d0592a6a1c0f72212dc102

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{C462EC61-0779-11F0-9D46-D6B302822781}.dat

Filesize
5KB

MD5
57ca9f00afcc573c0d17f18b49f8b9a3

SHA1
b95afe5578d9ae7ad493a35316425ad7f393c8bd

SHA256
873bb1ff462e50175ac6500bcf81fcdb471a3b9830e6e9592478dce3e769f5f6

SHA512
938c866a1b92ceaabba98233a9194efc052011e4c70489f8cc7393c72d537e016b7134a4fd2d6377551fb1a256b840237a8790d9fbd88deaadf6d56056839454

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{C467AF21-0779-11F0-9D46-D6B302822781}.dat

Filesize
5KB

MD5
7037d32f3565ac4153455b87d6cd81a5

SHA1
ce0a784a89a71f9ef05f6e650da67b4692df6c42

SHA256
cfbb176c40cb7d99020e46b8b5b8b0cc5c03dccc74d79dc698b30a12e7a58a78

SHA512
8be671cb0a46878bfa26d73a85f4c9b826b65a495d77b9de61f0d039070165ecb0c6a2389384357ccab004a08532c42c8a08192824e94651d79b66fe010a89fc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{C4ACB701-0779-11F0-9D46-D6B302822781}.dat

Filesize
5KB

MD5
c61d96496155be72b667b3cad054a73e

SHA1
0ae02eba1acbc831a4d9c78312951669c98d8329

SHA256
5237e2b7216fa326b810115387fa9bb1df4f239d3cf58bc0c9037409405c91dc

SHA512
a4fcf783eb2823e997a577cdbb3ffb23c3fc6b239de329b211a0a613ae6756d1415fdf091966584107481ba93cb6daec06ba65418f97b6fb6435c0fe9df569b3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{C4C22361-0779-11F0-9D46-D6B302822781}.dat

Filesize
5KB

MD5
8c9eb1d520927935fcb415bdca98e4a8

SHA1
3d2a679121846c01307156313a0c2e599f2e8695

SHA256
ae21aece4a090e0e7afb529055eed0e66c99e24a20656c346615b04fbe12c122

SHA512
88c45b8b042315754a773c3fa27a4b85f1f150cadd8c01b333b816ea736d93c9b4042d3e8e805e737c0e668f1c1a4cfa6f4b26c2e0093a7b5e4fd10d9180ce9b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{C4C484C1-0779-11F0-9D46-D6B302822781}.dat

Filesize
3KB

MD5
7c34867301de0ddede28c9d2b33c3b96

SHA1
d7887bd525473c97556fdcd319a55bdaeef8551a

SHA256
26b19b6e969912711eb62293261ba9c89c6a805df25d8432f535fa61fed20b09

SHA512
f492be29d86ebf117d7b1ea2bc8151a3fc3f5a2ed58f09f0181ba5ffbc8700462883d64c59e1baa25054d8149d209b5e8c8473191cb7b01244f8f51632050ff5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\melo7gx\imagestore.dat

Filesize
1KB

MD5
98c6f827fec95888ef73f579eb84cf86

SHA1
aa43c913e31ba26a8f697138ed4337c52b88e8d7

SHA256
9ce56276cf75399e07d73efdef5f458068973fb6f4098b8245c58db2fb865bf8

SHA512
e2e276c1712dc989a79a4234e0627f269c3bba5ee12b815157a7b2dd004ade00f57086c50c6ff802a03e1719f250f384f1f8b5a3cdf370161ba6bfe8cfcbb1a7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\7BCOPU31\edgium[1].png

Filesize
6KB

MD5
01010c21bdf1fc1d7f859071c4227529

SHA1
cd297bf459f24e417a7bf07800d6cf0e41dd36bc

SHA256
6fb31acdaf443a97183562571d52ce47dd44c1a8dcb4087338d77ea2617b286e

SHA512
8418d5ac3987ee8b6a7491167b0f90d0742e09f12fceb1e305923e60c78628d494fcd0fee64f8a6b5f6884796360e1e3ec1459dc754bbfb874504f9db5b56135

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\7BCOPU31\firefox[1].png

Filesize
9KB

MD5
7f980569ce347d0d4b8c669944946846

SHA1
80a8187549645547b407f81e468d4db0b6635266

SHA256
39f9942adc112194b8ae13ba1088794b6cb6e83bd05a4ed8ce87b53155d0e2f7

SHA512
17993496f11678c9680978c969accfa33b6ae650ba2b2c3327c45435d187b74e736e1489f625adf7255441baa61b65af2b5640417b38eefd541abff598b793c9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8P9TO0C6\favicon[2].ico

Filesize
1KB

MD5
f2a495d85735b9a0ac65deb19c129985

SHA1
f2e22853e5da3e1017d5e1e319eeefe4f622e8c8

SHA256
8bb1d0fa43a17436d59dd546f6f74c76dc44735def7522c22d8031166db8911d

SHA512
6ca6a89de3fa98ca1efcf0b19b8a80420e023f38ed00f4496dc0f821cea23d24fb0992cee58c6d089f093fdefca42b60bb3a0a0b16c97b9862d75b269ae8463b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8P9TO0C6\opera[1].png

Filesize
2KB

MD5
5cb98952519cb0dd822d622dbecaef70

SHA1
2849670ba8c4e2130d906a94875b3f99c57d78e1

SHA256
02f95fbdb68f232bffd4f2c0fdd033d6c83b829c610cddccc0b1d43e2274e6a7

SHA512
5f29b7459fbd01e16dbd196e4bcddf109af017cccf31337abe1cec6cc5a84711fc2cd34ad7a35d9432a9d7e42ca23d7f6c9d4315396429d7b8e48b9491696afc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\DUME8XYE\dinosaur[1].png

Filesize
57KB

MD5
bdda3ffd41c3527ad053e4afb8cd9e1e

SHA1
0ad1bb7ce8d8a4dc8ac2a28e1c5155980edfab9b

SHA256
1a9251dc3b3c064cfc5e2b90b6c7dc3c225f7017066db2b77e49dae90a94a399

SHA512
4dc21ef447b54d0e17ccd88db5597171047112ce1f3f228527e6df079ce2a43a463a3a1e4255828b12f802d70a68dbe40b791852134be71c74de97718b2f1d5f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\DUME8XYE\yt_logo_rgb_light[1].png

Filesize
8KB

MD5
d654f892f287a28026cd4d4df56c29c8

SHA1
98779a55fe32a66ebec8338c838395d265e45013

SHA256
fc6f5d8f32f13d5855840234dc1bff5c91c35318ee2192d99b13eb3572f0bca8

SHA512
3668902aeaf792ad73ba51e0a4caaa520ebc38177791dfac9a9b28026c3bde99e721bf54d626f266a19cfd045a6d2dc8c8e70e53a2c5ee524c6f2736bb0ce409

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\NT668XG4\KFOlCnqEu92Fr1MmEU9fBBc-[1].woff

Filesize
23KB

MD5
30ef7351c99d2cd25159e6fc71e6c6fc

SHA1
5e44b3f6ead8d9aba512a9efac3ec0015a01e6e6

SHA256
6ba203ebcc641340ab5eedea7652697bc6e7e11def4c8e2e85d7493e0d4b1e76

SHA512
375750efaff14bdb39507c00db04c279d93d1e01027afa58fde65146bf627081b9aadd0b7f8d59f569abca39ab6d9b89bf3d84f61da90786794c94ee91bb6439

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\NT668XG4\KFOmCnqEu92Fr1Mu4mxM[1].woff

Filesize
23KB

MD5
1ac185dda7da331babe18e8d84ec6984

SHA1
1ffcb05cec93b6cb5a43a280ebfb99fe1f729ce4

SHA256
f00fa16d99be425022af380773c6b55cb44898a4568052c1a728ff9a383c9095

SHA512
f24abd0a39a6fb4635b507ab0b86b69a4efe214f69f7b5e22ae5deffaf56e0c4e5b980493e1df3fcb8a385ec603a02c1aae00832fd09d444722cd15afe421ea2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\NT668XG4\Qw3hZQNGEDjaO2m6tqIqX5E-AVS5_rSejo46_PCTRspJ0OosolrBEJL3HMXfxQASluL2m_dANVawBpSF[1].woff

Filesize
18KB

MD5
d77dde5a38a8920bc8e0d7ffcf5e031c

SHA1
c4e4a8aba5c128b7d5be9eee8525da2cdbd4d760

SHA256
58cf604e2059ebd4fe016f9b7422cc4cd653a589239ac7b4ce27f964e5cb8967

SHA512
574f162bdf8ce1163fe7cb33984ce961aa4b46b3a3a342c487ae199dd71f31e70e3d5f900fff9c2b88e15b6505d3d204702cbd8882830b01a54f6f3bb791c4b9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\NT668XG4\chrome[1].png

Filesize
6KB

MD5
ac10b50494982bc75d03bd2d94e382f6

SHA1
6c10df97f511816243ba82265c1e345fe40b95e6

SHA256
846a9b551e74f824fd7ace3439a319b0c0803449e8caec9f16e2666e38a80efd

SHA512
b6666b540aef6c9c221fe6da29f3e0d897929f7b6612c27630be4a33ae2f5d593bc7c1ee44166ce9f08c72e8608f57d66dd5763b17fec7c1fb92fc4d5c6dd278

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarBEA5.tmp

Filesize
183KB

MD5
109cab5505f5e065b63d01361467a83b

SHA1
4ed78955b9272a9ed689b51bf2bf4a86a25e53fc

SHA256
ea6b7f51e85835c09259d9475a7d246c3e764ad67c449673f9dc97172c351673

SHA512
753a6da5d6889dd52f40208e37f2b8c185805ef81148682b269fff5aa84a46d710fe0ebfe05bce625da2e801e1c26745998a41266fa36bf47bc088a224d730cc

Download Submit
C:\Users\Admin\AppData\Local\Temp\~DF01FD816EA5411034.TMP

Filesize
16KB

MD5
cb31df951dbff466ba8b121394ceedd2

SHA1
ed9d840a75362649e82b619a7527b3de288fa01c

SHA256
a9257ef85813e73dada7c354775d5b23c94e9bc78f89241022defda797f3cc39

SHA512
fb9099f8ccea2caaac17fa4422620aff63c1291e24c734266c8fe60786c762d8d07610ed5c0cb4866ec4f89f963eafe57cb1877c6219a00c640a4b3d1983bafb

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\9ER2X22N.txt

Filesize
225B

MD5
ca27b0321fde99d5ec1f648d960911b6

SHA1
a14bd326efb520bc5bc476b6c5ef930fc6e82f98

SHA256
56a9cae3242f5fb5d3a2883f76ca15d7b014b3795a89abe4f4552c4027a8cfab

SHA512
2658aee82fca08bd85e87721f255c70191b0b5a8f839938935289a1d1d11a6f1f955da0a1c153dbb9e43df7a492846491477b057717b15abb6332a05c16ce512

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\VPIZSVAA.txt

Filesize
226B

MD5
a588f3d5476499e7300de425df8b49d7

SHA1
e3444ae303b362d23041360e0049ad17d2470421

SHA256
3d479412578b7647ee073c02b0cdf801304e195e54f044d869c1d59f1cf83e22

SHA512
aa45bfe555704714280e2586c981cb8874a5cfd944728c39c15701365f6ee158d3c2a98c381944045344e4032b7fa6db76c77740a2c47670abff68b1381a72b0

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\Y1F2TLU3.txt

Filesize
227B

MD5
7a13541db6f0f7bb3414bdbc666b399c

SHA1
aa43ff9c4399adea0011fc45516a81dda15b2285

SHA256
3e4152f06dd13119dd07cb6825233776f199263259357ca69bd8fa9f2c85bb3e

SHA512
b7ef5b03291c78d2df627e07847c9f7248289a235bc72beebb71c0cfe2862d40e37dd460170ad4fffb898949eb4801e5b4bbfb8cc491914cd24d7d535e37ac4d

Download Submit
C:\Users\Admin\Desktop\READMEPLEASE.txt

Filesize
265B

MD5
e88249b855fa0eed74d36842922b66ca

SHA1
90c4bee3131270f88d3a9a40465a76d4108283dc

SHA256
c10d2b501bcf4f50ddcc134b3bca17076610cf15da53cf73959c43824f0e09dc

SHA512
97c84807ef34b9eb96304d29b072f636faf8538f236414bf8ca0ac979635f6236dc36998fdbc5237898dd3c2864a08c6bf687805c1dbf4398499f2ce9647a1d3

Download Submit
C:\Windows\SysWOW64\msvcr80.dll.bat

Filesize
137B

MD5
d3c8cdc769514ce85192750f1902c2ac

SHA1
bebba274b8268a749dc3010700bfd762b57386f0

SHA256
e69ca202d729a3a721f87fcbc4510479c59cd2423294a269204466474943725a

SHA512
66b63f8af41575ac1b486735efac9155e1dfe37d83e74944ee77b8a5ec3632c3bc0a0aefa1c2fe04ccff439ee09b32ea2176bf815f84c4cc2dc90a4e953e31f0

Download Submit
C:\Windows\System32\systemconfig.exe.vbs

Filesize
1KB

MD5
f7f9da3c5b7b83cceaf4caaefaacf294

SHA1
a1e8fdec05acbbee9db2f800c71c5d71fd9593d8

SHA256
fa5361028ad789b0423c8528a333748e628efc214f74a89840ed678abd068f79

SHA512
53ec381354624b46ae12024216e95d6303e697023d9b8e4f69c03a4dc096f6dcdad5253a5b2bdbb813b66150f132ebe9845f722f53e1f82d6bbd7e51a11dae7a

Download Submit
C:\Windows\advapi32_ext.vbs

Filesize
1KB

MD5
12fab7544912da13a25635c1c2c40044

SHA1
35ffec9f570c66a5ad2e4c733ffec8c00c546bb4

SHA256
82cdaf326f78c9ef5f6b5fd7c1307ca53efb80ea76775097cba45bfad276fa8d

SHA512
8820a71932941ea55114e974702eb4459f1019f43471e8abd9b84728c57454b539147f355e825cf99977c3a0369f7531cc2362caf1ca78609fd5f057f2b6e018

Download Submit
C:\Windows\pei.exe

Filesize
10KB

MD5
4c52cf849be8954638925c242e0cc976

SHA1
949ba0061ea9dbe3b9059bb2a7b20caa74861280

SHA256
fa6fcf2e154c0b18b12ab86267ccd38d79cc9c27e7e261a7e9201a0a9dd9d0bb

SHA512
c11572dcd274bdcb5e94cf38ec36aa65e4d5605df250ee8887cd5098b044e3e2e71be3b3292118b967e27bc752b5cf5d9c8da5ac2834b7c156302c307abe123b

Download Submit
\Users\Admin\AppData\Local\Temp\1472819124.exe

Filesize
13KB

MD5
181921fd5d4f7e043b446392233698ee

SHA1
0f710714ea4c01446dcb2ea4f29256fd53633f5c

SHA256
aed4ab578ba8613117a2132bee215cdc3b360a1d9f993ad937ed3eecd7e9f3e6

SHA512
a04699fa408ceb79f89cf61f2bea6ab85b6d93b52989f7d5ba6bdb22964fe8bc2a19aa3e1a02b063b11f8a63f3d3582ba0a621b97d911c27e2010fe9df5c6172

Download Submit
\Users\Admin\AppData\Local\Temp\166345560.exe

Filesize
53KB

MD5
60686a27b79838583920c9a0954104c9

SHA1
0c253b3c72cd5b01a9403230ff3ec9d3cdd8b71c

SHA256
270149da5feb9487799083b5e76d41d3aa69afaf8f731e72e7d64c3a7c070c7e

SHA512
c0a9308b5a3baca0906c9663ca3e3eaf64fc131aaa5358557874b30e4b743ffe898da6fbace032c3481693bf9081f938127fd07c8d550d9eb74958b20e24ab04

Download Submit
\Users\Admin\AppData\Local\Temp\1716131136.exe

Filesize
20KB

MD5
2e5f10745392643c8cf21aae4241e4cc

SHA1
ad390d62e2215a37a3faf5e0cb3f0f3244452c07

SHA256
44db578a4075ab126df387da3fa757f76bd3074606f3a9be21ee55ec6ac1ed29

SHA512
85e63e752fc43d4b2be83628f5f8dcb288276c5369a3e940f795e87409f70473221d2d28a87f04e68c126bc0836171310d00247f240e05f4618e1f9393b132af

Download Submit
\Users\Admin\AppData\Local\Temp\3368415325.exe

Filesize
101KB

MD5
8a30adfbb8c9ed8170177ce8c5738fbf

SHA1
2d029ddd39fe81a08982dd4309a74045aa91004f

SHA256
72b19310a8c3cdfc23be1041eb773e6e41a08ec608e53b027b32e05a275b1da9

SHA512
8885308b53b8d1baab14a98ec257acac9c700f2cebe48cbb79a25e3d7133f0016ba082ec9f8397c9b1677375dd5a1d3894d813aba5947f267b44b012fa6a027f

Download Submit
\Users\Admin\AppData\Local\Temp\712011879.exe

Filesize
19KB

MD5
9adb4c4939743d5f3e670b4d783d38e5

SHA1
7c989249b99b82def352f66bc97d9403fd6e653b

SHA256
be502d8d90235a3c317e97cacb55b0eb5ec2aa8c50a582ec6f0527d08e99a759

SHA512
7573981af4fc4845e4af61067e4620b92aace90b4ac218a14920dc6f93bddafac92a8f7b02c61f3d41b42ba9f1aabbea3c215dc439da3e9c9dc68060c9a53ac1

Download Submit
memory/2976-4-0x000000001B350000-0x000000001B632000-memory.dmp

Filesize
2.9MB

Download
memory/2976-5-0x0000000001EB0000-0x0000000001EB8000-memory.dmp

Filesize
32KB

Download