6738c3990bb3ef92da2d43f671c043232229cf7469fcf9fc8319404e33365885

Analysis

user interaction
yes
max time kernel
564s
max time network
621s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260617-de
resource tags

arch:x64arch:x86image:win11ltsc2024-20260617-delocale:de-deos:windows11-ltsc_2024-x64systemwindows
submitted
20/06/2026, 13:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
welcome.vbs
Size 2KB
Sample260620-qcg1xae17r
SHA256 6738c3990bb3ef92da2d43f671c043232229cf7469fcf9fc8319404e33365885
MD5 34434aaa8887148bfe655c6ae43933bc
SHA1 f66b09aba978ec2b6fca39753edda499059a2582
SHA512 034d5a957bf21176db6cf773deb1918a9bfa09b1c866df583fc5380b6b429eeefef261041e4fb111a5851cb6ad623078972be9afd605e17e7c203618504372b7
TLSH
T139411843370E98158B7227509292C54EBBA20AE7125DBF522C4FD03FC811BF885EA0A6
MD5 SHA1 SHA512 TLSH

Score

5^/10

adware discovery persistence ransomware spyware

Malware Config

Signatures

Drops file in System32 directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\taskschd.msc	mmc.exe
File opened for modification	C:\Windows\system32\comexp.msc	mmc.exe

Drops file in Windows directory 17 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	UserOOBEBroker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	UserOOBEBroker.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3624_416423695\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3624_416423695\smart_switch_list.json	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3624_416423695\llm_user_input_extractor_config.json	msedge.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setupact.log	UserOOBEBroker.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3624_1881933666\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3624_219988548\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3624_1148557664\nav_config.json	msedge.exe
File opened for modification	C:\Windows\Registration\{02D4B3F1-FD88-11D1-960D-00805FC79235}.{3760AA11-C2B3-489A-ABAC-3E1A88D00DA5}.crmlog	dllhost.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3624_416423695\manifest.json	msedge.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setuperr.log	UserOOBEBroker.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3624_219988548\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3624_1148557664\manifest.json	msedge.exe
File created	C:\Windows\Registration\{02D4B3F1-FD88-11D1-960D-00805FC79235}.{3760AA11-C2B3-489A-ABAC-3E1A88D00DA5}.crmlog	dllhost.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FileCoAuth.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DllHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DllHost.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 9 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2504	cmd.exe
5516	cmd.exe
4764	cmd.exe
4656	cmd.exe
3688	cmd.exe
5852	cmd.exe
772	cmd.exe
1888	cmd.exe
6056	cmd.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2156	msedge.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3655380807-1096177077-1670381078-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3655380807-1096177077-1670381078-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe

Modifies data under HKEY_USERS 4 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134264348455877134"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Classes\Local Settings\MuiCache\27\52C64B7E	msdtc.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Classes\Local Settings\MuiCache	msdtc.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\notification_click_helper.exe	mmc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{8086ebd4-43e3-4b19-beb3-f0ea4ecf319c}\ = "CScriptedDiagNativeHost"	mmc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{be19f061-c08b-426e-811f-2a1ceb1e80ad}\ = "Microsoft.OsfMui.InstallerMainShell"	mmc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{00020833-0000-0000-C000-000000000046}\AppID = "{00020812-0000-0000-C000-000000000046}"	mmc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{00024505-0016-0000-C000-000000000046}\AppID = "{00020812-0000-0000-C000-000000000046}"	mmc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E4C18D40-1CD5-101C-B325-00AA001F3168}\AppID = "{E4C18D40-1CD5-101C-B325-00AA001F3168}"	mmc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{45EAE363-122A-445A-97B6-3DE890E786F8}	mmc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\CertEnrollCtrl.exe\AppId = "{884e2049-217d-11da-b2a4-000e7bbb2b09}"	mmc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\DeviceEnroller.exe	mmc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\SDXHelper.exe	mmc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\WINWORD.EXE\AppId = "{00020906-0000-0000-C000-000000000046}"	mmc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{531fdebf-9b4c-4a43-a2aa-960e8fcdc732}	mmc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\fixmapi.exe\AppId = "{DC7A02CD-2E47-406C-BA5A-B08EC00C4238}"	mmc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0006F065-0000-0000-C000-000000000046}\AppID = "{00020D09-0000-0000-C000-000000000046}"	mmc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\fsquirt.exe	mmc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\CameraSettingsUIHost.exe	mmc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{ADBE6DEC-9B04-4A3D-A09C-4BB38EF1351C}	mmc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3655380807-1096177077-1670381078-1000_Classes\CLSID\{9489FEB2-1925-4D01-B788-6D912C70F7F2}\AppID = "{021E4F06-9DCC-49AD-88CF-ECC2DA314C8A}"	mmc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E81752ED-2885-4624-AE89-5A28DB58874B}\AppID = "{0039FFEC-A022-4232-8274-6B34787BFC27}"	mmc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\PDFREFLOW.EXE	mmc.exe
Key created	\REGISTRY\USER\S-1-5-21-3655380807-1096177077-1670381078-1000_Classes\Local Settings	control.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0006F01E-0000-0000-C000-000000000046}\AppID = "{00020D09-0000-0000-C000-000000000046}"	mmc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1B261B22-AC6A-4E68-A870-AB5080E8687B}\AppID = "{00020906-0000-0000-C000-000000000046}"	mmc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{4A749F25-A9E2-4CBE-9859-CF7B15255E14}	mmc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{A5C79653-FC73-46ee-AD3E-B64C01268DAA}	mmc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0006F01F-0000-0000-C000-000000000046}\AppID = "{00020D09-0000-0000-C000-000000000046}"	mmc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0006F0C6-0000-0000-C000-000000000046}\AppID = "{00020D09-0000-0000-C000-000000000046}"	mmc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\FileCoAuth.exe	mmc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\easinvoker.exe	mmc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\imesearch.exe	mmc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8A624388-AA27-43e0-89F8-2A12BFF7BCCD}\AppID = "{00020906-0000-0000-C000-000000000046}"	mmc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\ONENOTE.EXE	mmc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0006F04A-0000-0000-C000-000000000046}\AppID = "{0006F04A-0000-0000-C000-000000000046}"	mmc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0006F053-0000-0000-C000-000000000046}\AppID = "{0006F04A-0000-0000-C000-000000000046}"	mmc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0006F058-0000-0000-C000-000000000046}\AppID = "{0006F04A-0000-0000-C000-000000000046}"	mmc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{021E4F06-9DCC-49AD-88CF-ECC2DA314C8A}	mmc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{6316D324-2238-101B-9E66-00AA003BA905}\ = "{6316D324-2238-101B-9E66-00AA003BA905}"	mmc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{64AE6F2A-2EE6-44FC-BB83-112D6002D3E7}\ = "Microsoft.MsoASB.RemoterTrusted"	mmc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{BC7ADC2B-CC8C-48d2-A820-1BC605B0D3C7}\ = "CWordConv Class"	mmc.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3655380807-1096177077-1670381078-1000\{7D75B893-D8BE-4421-8F8E-2CD1F0CBA7FD}	msedge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{000209F5-0000-0000-C000-000000000046}\AppID = "{00020906-0000-0000-C000-000000000046}"	mmc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\POWERPNT.EXE	mmc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\UNPUXHost.exe	mmc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\DeviceEnroller.exe\AppId = "{98BB952B-B23E-4737-8ABD-B553E7484B38}"	mmc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{000209F0-0000-0000-C000-000000000046}\AppID = "{00020906-0000-0000-C000-000000000046}"	mmc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{AAEC1DAE-CC06-4DA4-B762-56A76FD4B2FF}\AppID = "{64AE6F2A-2EE6-44FC-BB83-112D6002D3E7}"	mmc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{912ABC52-36E2-4714-8E62-A8B73CA5E390}\AppID = "{00020906-0000-0000-C000-000000000046}"	mmc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BB2B65B0-241E-101B-9E67-00AA003BA905}\AppID = "{6316D324-2238-101B-9E66-00AA003BA905}"	mmc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BC7ADC2B-CC8C-48d2-A820-1BC605B0D3C7}\AppID = "{BC7ADC2B-CC8C-48d2-A820-1BC605B0D3C7}"	mmc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\OUTLOOK.EXE\AppId = "{00020D09-0000-0000-C000-000000000046}"	mmc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{048EB43E-2059-422F-95E0-557DA96038AF}\ = "Microsoft PowerPoint Slide"	mmc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\notification_click_helper.exe\AppId = "{4A749F25-A9E2-4CBE-9859-CF7B15255E14}"	mmc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{98BB952B-B23E-4737-8ABD-B553E7484B38}	mmc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{00024502-0000-0000-C000-000000000046}\AppID = "{00020800-0000-0000-C000-000000000046}"	mmc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\ONENOTE.EXE\AppId = "{0039FFEC-A022-4232-8274-6B34787BFC27}"	mmc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{531fdebf-9b4c-4a43-a2aa-960e8fcdc732}\ = "CImeServerCht"	mmc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{6316D324-2238-101B-9E66-00AA003BA905}	mmc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{e4544aba-62bf-4c54-aab2-ec246342626c}\ = "CloudExperienceHost Create System Object Task"	mmc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{F827EC16-664E-4B05-878C-02D242229094}	mmc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{18FBD4BC-16EA-47f2-8AD0-868C1269C79A}\ = "{18FBD4BC-16EA-47f2-8AD0-868C1269C79A}"	mmc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{2986F5D1-3192-43F4-A734-5F3000C8587B}	mmc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID	mmc.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
3704	explorer.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
5076	msedge.exe
5076	msedge.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
3704	explorer.exe
1044	mmc.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe

Suspicious behavior: SetClipboardViewer 1 IoCs

pid	Process
1044	mmc.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3792	control.exe
Token: SeCreatePagefilePrivilege	3792	control.exe
Token: 33	764	mmc.exe
Token: SeIncBasePriorityPrivilege	764	mmc.exe
Token: 33	764	mmc.exe
Token: SeIncBasePriorityPrivilege	764	mmc.exe
Token: 33	764	mmc.exe
Token: SeIncBasePriorityPrivilege	764	mmc.exe
Token: 33	764	mmc.exe
Token: SeIncBasePriorityPrivilege	764	mmc.exe
Token: 33	764	mmc.exe
Token: SeIncBasePriorityPrivilege	764	mmc.exe
Token: 33	764	mmc.exe
Token: SeIncBasePriorityPrivilege	764	mmc.exe
Token: 33	764	mmc.exe
Token: SeIncBasePriorityPrivilege	764	mmc.exe
Token: 33	764	mmc.exe
Token: SeIncBasePriorityPrivilege	764	mmc.exe
Token: 33	764	mmc.exe
Token: SeIncBasePriorityPrivilege	764	mmc.exe
Token: 33	764	mmc.exe
Token: SeIncBasePriorityPrivilege	764	mmc.exe
Token: 33	764	mmc.exe
Token: SeIncBasePriorityPrivilege	764	mmc.exe
Token: 33	764	mmc.exe
Token: SeIncBasePriorityPrivilege	764	mmc.exe
Token: 33	764	mmc.exe
Token: SeIncBasePriorityPrivilege	764	mmc.exe
Token: 33	764	mmc.exe
Token: SeIncBasePriorityPrivilege	764	mmc.exe
Token: 33	764	mmc.exe
Token: SeIncBasePriorityPrivilege	764	mmc.exe
Token: 33	764	mmc.exe
Token: SeIncBasePriorityPrivilege	764	mmc.exe
Token: 33	764	mmc.exe
Token: SeIncBasePriorityPrivilege	764	mmc.exe
Token: 33	764	mmc.exe
Token: SeIncBasePriorityPrivilege	764	mmc.exe
Token: 33	764	mmc.exe
Token: SeIncBasePriorityPrivilege	764	mmc.exe
Token: 33	764	mmc.exe
Token: SeIncBasePriorityPrivilege	764	mmc.exe
Token: 33	764	mmc.exe
Token: SeIncBasePriorityPrivilege	764	mmc.exe
Token: 33	764	mmc.exe
Token: SeIncBasePriorityPrivilege	764	mmc.exe
Token: 33	764	mmc.exe
Token: SeIncBasePriorityPrivilege	764	mmc.exe
Token: 33	764	mmc.exe
Token: SeIncBasePriorityPrivilege	764	mmc.exe
Token: 33	764	mmc.exe
Token: SeIncBasePriorityPrivilege	764	mmc.exe
Token: 33	764	mmc.exe
Token: SeIncBasePriorityPrivilege	764	mmc.exe
Token: 33	764	mmc.exe
Token: SeIncBasePriorityPrivilege	764	mmc.exe
Token: 33	764	mmc.exe
Token: SeIncBasePriorityPrivilege	764	mmc.exe
Token: 33	764	mmc.exe
Token: SeIncBasePriorityPrivilege	764	mmc.exe
Token: 33	764	mmc.exe
Token: SeIncBasePriorityPrivilege	764	mmc.exe
Token: 33	764	mmc.exe
Token: SeIncBasePriorityPrivilege	764	mmc.exe

Suspicious use of FindShellTrayWindow 58 IoCs

pid	Process
3624	msedge.exe
3704	explorer.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe

Suspicious use of SendNotifyMessage 56 IoCs

pid	Process
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe

Suspicious use of SetWindowsHookEx 20 IoCs

pid	Process
1820	SystemSettingsAdminFlows.exe
1648	SystemSettingsAdminFlows.exe
4028	SystemSettingsAdminFlows.exe
3704	explorer.exe
3704	explorer.exe
3704	explorer.exe
764	mmc.exe
764	mmc.exe
772	taskmgr.exe
1044	mmc.exe
1044	mmc.exe
2480	msconfig.exe
2480	msconfig.exe
1044	mmc.exe
1044	mmc.exe
1044	mmc.exe
1044	mmc.exe
1044	mmc.exe
1044	mmc.exe
1044	mmc.exe

Suspicious use of WriteProcessMemory 56 IoCs

description	pid	Process	procid_target
PID 1680 wrote to memory of 6056	1680	WScript.exe	89
PID 5632 wrote to memory of 2504	5632	WScript.exe	105
PID 1212 wrote to memory of 5852	1212	WScript.exe	108
PID 1500 wrote to memory of 5516	1500	WScript.exe	112
PID 3076 wrote to memory of 4764	3076	WScript.exe	115
PID 4860 wrote to memory of 4656	4860	WScript.exe	124
PID 3308 wrote to memory of 772	3308	WScript.exe	127
PID 2372 wrote to memory of 1888	2372	WScript.exe	130
PID 5360 wrote to memory of 3688	5360	WScript.exe	133
PID 3624 wrote to memory of 1464	3624	msedge.exe	157
PID 3624 wrote to memory of 2156	3624	msedge.exe	158
PID 3624 wrote to memory of 4576	3624	msedge.exe	159
PID 3624 wrote to memory of 4576	3624	msedge.exe	159
PID 3624 wrote to memory of 4576	3624	msedge.exe	159
PID 3624 wrote to memory of 5552	3624	msedge.exe	160
PID 3624 wrote to memory of 5552	3624	msedge.exe	160
PID 3624 wrote to memory of 3808	3624	msedge.exe	162
PID 3624 wrote to memory of 1312	3624	msedge.exe	163
PID 3624 wrote to memory of 3808	3624	msedge.exe	162
PID 3624 wrote to memory of 3808	3624	msedge.exe	162
PID 3624 wrote to memory of 1312	3624	msedge.exe	163
PID 3624 wrote to memory of 1312	3624	msedge.exe	163
PID 3624 wrote to memory of 4248	3624	msedge.exe	164
PID 3624 wrote to memory of 2816	3624	msedge.exe	165
PID 3624 wrote to memory of 4248	3624	msedge.exe	164
PID 3624 wrote to memory of 4248	3624	msedge.exe	164
PID 3624 wrote to memory of 2816	3624	msedge.exe	165
PID 3624 wrote to memory of 2816	3624	msedge.exe	165
PID 3624 wrote to memory of 1076	3624	msedge.exe	166
PID 3624 wrote to memory of 1076	3624	msedge.exe	166
PID 3624 wrote to memory of 6076	3624	msedge.exe	168
PID 3624 wrote to memory of 1708	3624	msedge.exe	169
PID 3624 wrote to memory of 6076	3624	msedge.exe	168
PID 3624 wrote to memory of 1708	3624	msedge.exe	169
PID 3624 wrote to memory of 3528	3624	msedge.exe	171
PID 3624 wrote to memory of 2080	3624	msedge.exe	174
PID 3624 wrote to memory of 2080	3624	msedge.exe	174
PID 3624 wrote to memory of 5600	3624	msedge.exe	175
PID 3624 wrote to memory of 5600	3624	msedge.exe	175
PID 3624 wrote to memory of 2400	3624	msedge.exe	176
PID 3624 wrote to memory of 2060	3624	msedge.exe	177
PID 3624 wrote to memory of 6044	3624	msedge.exe	178
PID 3624 wrote to memory of 1100	3624	msedge.exe	185
PID 3624 wrote to memory of 1100	3624	msedge.exe	185
PID 3624 wrote to memory of 4260	3624	msedge.exe	189
PID 3624 wrote to memory of 4260	3624	msedge.exe	189
PID 3624 wrote to memory of 1932	3624	msedge.exe	192
PID 3624 wrote to memory of 1932	3624	msedge.exe	192
PID 3704 wrote to memory of 4652	3704	explorer.exe	194
PID 3624 wrote to memory of 916	3624	msedge.exe	195
PID 3624 wrote to memory of 916	3624	msedge.exe	195
PID 3624 wrote to memory of 5076	3624	msedge.exe	196
PID 3704 wrote to memory of 1044	3704	explorer.exe	197
PID 3704 wrote to memory of 2480	3704	explorer.exe	200
PID 3624 wrote to memory of 6116	3624	msedge.exe	201
PID 3624 wrote to memory of 6116	3624	msedge.exe	201

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\welcome.vbs"
1⤵
- Suspicious use of WriteProcessMemory
PID:1680
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /k mode con: cols=120 lines=40 && color 1F && title Windows Error && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 0%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 1%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 2%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 3%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 4%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 5%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 6%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 7%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 8%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 9%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 10%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 11%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 12%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 13%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 14%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 15%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 16%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 17%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 18%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 19%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 20%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 21%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 22%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 23%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 24%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 25%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 26%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 27%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 28%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 29%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 30%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 31%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 32%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 33%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 34%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 35%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 36%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 37%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 38%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 39%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 40%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 41%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 42%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 43%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 44%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 45%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 46%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 47%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 48%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 49%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 50%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 51%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 52%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 53%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 54%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 55%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 56%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 57%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 58%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 59%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 60%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 61%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 62%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 63%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 64%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 65%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 66%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 67%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 68%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 69%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 70%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 71%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 72%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 73%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 74%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 75%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 76%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 77%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 78%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 79%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 80%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 81%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 82%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 83%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 84%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 85%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 86%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 87%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 88%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 89%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 90%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 91%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 92%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 93%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 94%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 95%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 96%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 97%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 98%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 99%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 100%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 100%% complete && echo Stop code: CRITICAL_PROCESS_DIED && echo What failed: ntoskrnl.exe && ping localhost -n 4 >nul && cls && color 07 && echo Restarting... && ping localhost -n 3 >nul && cls && color 17 && echo PhoenixBIOS v4.0 && echo Initializing hardware... && ping localhost -n 2 >nul && echo Checking disk... && ping localhost -n 2 >nul && echo Disk error detected! && echo Attempting automatic repair... && ping localhost -n 2 >nul && cls && color 0C && echo CRITICAL FAILURE! && echo File table corrupted! && echo Deleting all sectors... && echo Wiping disk... 1%% && ping localhost -n 2 >nul && echo Wiping disk... 2%% && ping localhost -n 2 >nul && echo Wiping disk... 3%% && ping localhost -n 2 >nul && echo Wiping disk... 4%% && ping localhost -n 2 >nul && echo Wiping disk... 5%% && ping localhost -n 2 >nul && echo Wiping disk... 6%% && ping localhost -n 2 >nul && echo Wiping disk... 7%% && ping localhost -n 2 >nul && echo Wiping disk... 8%% && ping localhost -n 2 >nul && echo Wiping disk... 9%% && ping localhost -n 2 >nul && echo Wiping disk... 10%% && ping localhost -n 2 >nul && echo Wiping disk... 11%% && ping localhost -n 2 >nul && echo Wiping disk... 12%% && ping localhost -n 2 >nul && echo Wiping disk... 13%% && ping localhost -n 2 >nul && echo Wiping disk... 14%% && ping localhost -n 2 >nul && echo Wiping disk... 15%% && ping localhost -n 2 >nul && echo Wiping disk... 16%% && ping localhost -n 2 >nul && echo Wiping disk... 17%% && ping localhost -n 2 >nul && echo Wiping disk... 18%% && ping localhost -n 2 >nul && echo Wiping disk... 19%% && ping localhost -n 2 >nul && echo Wiping disk... 20%% && ping localhost -n 2 >nul && echo Wiping disk... 21%% && ping localhost -n 2 >nul && echo Wiping disk... 22%% && ping localhost -n 2 >nul && echo Wiping disk... 23%% && ping localhost -n 2 >nul && echo Wiping disk... 24%% && ping localhost -n 2 >nul && echo Wiping disk... 25%% && ping localhost -n 2 >nul && echo Wiping disk... 26%% && ping localhost -n 2 >nul && echo Wiping disk... 27%% && ping localhost -n 2 >nul && echo Wiping disk... 28%% && ping localhost -n 2 >nul && echo Wiping disk... 29%% && ping localhost -n 2 >nul && echo Wiping disk... 30%% && ping localhost -n 2 >nul && echo Wiping disk... 31%% && ping localhost -n 2 >nul && echo Wiping disk... 32%% && ping localhost -n 2 >nul && echo Wiping disk... 33%% && ping localhost -n 2 >nul && echo Wiping disk... 34%% && ping localhost -n 2 >nul && echo Wiping disk... 35%% && ping localhost -n 2 >nul && echo Wiping disk... 36%% && ping localhost -n 2 >nul && echo Wiping disk... 37%% && ping localhost -n 2 >nul && echo Wiping disk... 38%% && ping localhost -n 2 >nul && echo Wiping disk... 39%% && ping localhost -n 2 >nul && echo Wiping disk... 40%% && ping localhost -n 2 >nul && echo Wiping disk... 41%% && ping localhost -n 2 >nul && echo Wiping disk... 42%% && ping localhost -n 2 >nul && echo Wiping disk... 43%% && ping localhost -n 2 >nul && echo Wiping disk... 44%% && ping localhost -n 2 >nul && echo Wiping disk... 45%% && ping localhost -n 2 >nul && echo Wiping disk... 46%% && ping localhost -n 2 >nul && echo Wiping disk... 47%% && ping localhost -n 2 >nul && echo Wiping disk... 48%% && ping localhost -n 2 >nul && echo Wiping disk... 49%% && ping localhost -n 2 >nul && echo Wiping disk... 50%% && ping localhost -n 2 >nul && echo Wiping disk... 51%% && ping localhost -n 2 >nul && echo Wiping disk... 52%% && ping localhost -n 2 >nul && echo Wiping disk... 53%% && ping localhost -n 2 >nul && echo Wiping disk... 54%% && ping localhost -n 2 >nul && echo Wiping disk... 55%% && ping localhost -n 2 >nul && echo Wiping disk... 56%% && ping localhost -n 2 >nul && echo Wiping disk... 57%% && ping localhost -n 2 >nul && echo Wiping disk... 58%% && ping localhost -n 2 >nul && echo Wiping disk... 59%% && ping localhost -n 2 >nul && echo Wiping disk... 60%% && ping localhost -n 2 >nul && echo Wiping disk... 61%% && ping localhost -n 2 >nul && echo Wiping disk... 62%% && ping localhost -n 2 >nul && echo Wiping disk... 63%% && ping localhost -n 2 >nul && echo Wiping disk... 64%% && ping localhost -n 2 >nul && echo Wiping disk... 65%% && ping localhost -n 2 >nul && echo Wiping disk... 66%% && ping localhost -n 2 >nul && echo Wiping disk... 67%% && ping localhost -n 2 >nul && echo Wiping disk... 68%% && ping localhost -n 2 >nul && echo Wiping disk... 69%% && ping localhost -n 2 >nul && echo Wiping disk... 70%% && ping localhost -n 2 >nul && echo Wiping disk... 71%% && ping localhost -n 2 >nul && echo Wiping disk... 72%% && ping localhost -n 2 >nul && echo Wiping disk... 73%% && ping localhost -n 2 >nul && echo Wiping disk... 74%% && ping localhost -n 2 >nul && echo Wiping disk... 75%% && ping localhost -n 2 >nul && echo Wiping disk... 76%% && ping localhost -n 2 >nul && echo Wiping disk... 77%% && ping localhost -n 2 >nul && echo Wiping disk... 78%% && ping localhost -n 2 >nul && echo Wiping disk... 79%% && ping localhost -n 2 >nul && echo Wiping disk... 80%% && ping localhost -n 2 >nul && echo Wiping disk... 81%% && ping localhost -n 2 >nul && echo Wiping disk... 82%% && ping localhost -n 2 >nul && echo Wiping disk... 83%% && ping localhost -n 2 >nul && echo Wiping disk... 84%% && ping localhost -n 2 >nul && echo Wiping disk... 85%% && ping localhost -n 2 >nul && echo Wiping disk... 86%% && ping localhost -n 2 >nul && echo Wiping disk... 87%% && ping localhost -n 2 >nul && echo Wiping disk... 88%% && ping localhost -n 2 >nul && echo Wiping disk... 89%% && ping localhost -n 2 >nul && echo Wiping disk... 90%% && ping localhost -n 2 >nul && echo Wiping disk... 91%% && ping localhost -n 2 >nul && echo Wiping disk... 92%% && ping localhost -n 2 >nul && echo Wiping disk... 93%% && ping localhost -n 2 >nul && echo Wiping disk... 94%% && ping localhost -n 2 >nul && echo Wiping disk... 95%% && ping localhost -n 2 >nul && echo Wiping disk... 96%% && ping localhost -n 2 >nul && echo Wiping disk... 97%% && ping localhost -n 2 >nul && echo Wiping disk... 98%% && ping localhost -n 2 >nul && echo Wiping disk... 99%% && ping localhost -n 2 >nul && echo Wiping disk... 100%% && ping localhost -n 2 >nul && echo. && echo ALL DATA HAS BEEN REMOVED! && ping localhost -n 4 >nul && cls && color 0A && echo Just kidding :D && echo Nothing was deleted. && echo Your PC is totally fine!
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:6056

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:3916

C:\Windows\system32\SystemSettingsAdminFlows.exe
"C:\Windows\system32\SystemSettingsAdminFlows.exe" StorageAdminHelper
1⤵
PID:5776

C:\Windows\system32\SystemSettingsAdminFlows.exe
"C:\Windows\system32\SystemSettingsAdminFlows.exe" TurnOnDeveloperFeatures DeveloperUnlock
1⤵
- Suspicious use of SetWindowsHookEx
PID:1820

C:\Windows\System32\FodHelper.exe
C:\Windows\System32\FodHelper.exe -Embedding
1⤵
PID:4028

C:\Windows\system32\SystemSettingsAdminFlows.exe
"C:\Windows\system32\SystemSettingsAdminFlows.exe" TurnOffDeveloperFeatures
1⤵
PID:704

C:\Windows\system32\SystemSettingsAdminFlows.exe
"C:\Windows\system32\SystemSettingsAdminFlows.exe" TurnOffDeviceDiscovery
1⤵
PID:4496

C:\Windows\system32\SystemSettingsAdminFlows.exe
"C:\Windows\system32\SystemSettingsAdminFlows.exe" TurnOnDeveloperFeatures DeveloperUnlock
1⤵
- Suspicious use of SetWindowsHookEx
PID:1648

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5992

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\welcome.vbs"
1⤵
- Suspicious use of WriteProcessMemory
PID:5632
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /k mode con: cols=120 lines=40 && color 1F && title Windows Error && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 0%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 1%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 2%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 3%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 4%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 5%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 6%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 7%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 8%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 9%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 10%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 11%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 12%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 13%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 14%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 15%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 16%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 17%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 18%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 19%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 20%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 21%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 22%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 23%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 24%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 25%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 26%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 27%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 28%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 29%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 30%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 31%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 32%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 33%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 34%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 35%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 36%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 37%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 38%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 39%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 40%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 41%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 42%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 43%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 44%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 45%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 46%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 47%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 48%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 49%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 50%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 51%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 52%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 53%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 54%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 55%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 56%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 57%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 58%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 59%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 60%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 61%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 62%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 63%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 64%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 65%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 66%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 67%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 68%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 69%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 70%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 71%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 72%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 73%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 74%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 75%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 76%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 77%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 78%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 79%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 80%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 81%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 82%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 83%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 84%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 85%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 86%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 87%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 88%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 89%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 90%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 91%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 92%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 93%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 94%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 95%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 96%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 97%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 98%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 99%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 100%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 100%% complete && echo Stop code: CRITICAL_PROCESS_DIED && echo What failed: ntoskrnl.exe && ping localhost -n 4 >nul && cls && color 07 && echo Restarting... && ping localhost -n 3 >nul && cls && color 17 && echo PhoenixBIOS v4.0 && echo Initializing hardware... && ping localhost -n 2 >nul && echo Checking disk... && ping localhost -n 2 >nul && echo Disk error detected! && echo Attempting automatic repair... && ping localhost -n 2 >nul && cls && color 0C && echo CRITICAL FAILURE! && echo File table corrupted! && echo Deleting all sectors... && echo Wiping disk... 1%% && ping localhost -n 2 >nul && echo Wiping disk... 2%% && ping localhost -n 2 >nul && echo Wiping disk... 3%% && ping localhost -n 2 >nul && echo Wiping disk... 4%% && ping localhost -n 2 >nul && echo Wiping disk... 5%% && ping localhost -n 2 >nul && echo Wiping disk... 6%% && ping localhost -n 2 >nul && echo Wiping disk... 7%% && ping localhost -n 2 >nul && echo Wiping disk... 8%% && ping localhost -n 2 >nul && echo Wiping disk... 9%% && ping localhost -n 2 >nul && echo Wiping disk... 10%% && ping localhost -n 2 >nul && echo Wiping disk... 11%% && ping localhost -n 2 >nul && echo Wiping disk... 12%% && ping localhost -n 2 >nul && echo Wiping disk... 13%% && ping localhost -n 2 >nul && echo Wiping disk... 14%% && ping localhost -n 2 >nul && echo Wiping disk... 15%% && ping localhost -n 2 >nul && echo Wiping disk... 16%% && ping localhost -n 2 >nul && echo Wiping disk... 17%% && ping localhost -n 2 >nul && echo Wiping disk... 18%% && ping localhost -n 2 >nul && echo Wiping disk... 19%% && ping localhost -n 2 >nul && echo Wiping disk... 20%% && ping localhost -n 2 >nul && echo Wiping disk... 21%% && ping localhost -n 2 >nul && echo Wiping disk... 22%% && ping localhost -n 2 >nul && echo Wiping disk... 23%% && ping localhost -n 2 >nul && echo Wiping disk... 24%% && ping localhost -n 2 >nul && echo Wiping disk... 25%% && ping localhost -n 2 >nul && echo Wiping disk... 26%% && ping localhost -n 2 >nul && echo Wiping disk... 27%% && ping localhost -n 2 >nul && echo Wiping disk... 28%% && ping localhost -n 2 >nul && echo Wiping disk... 29%% && ping localhost -n 2 >nul && echo Wiping disk... 30%% && ping localhost -n 2 >nul && echo Wiping disk... 31%% && ping localhost -n 2 >nul && echo Wiping disk... 32%% && ping localhost -n 2 >nul && echo Wiping disk... 33%% && ping localhost -n 2 >nul && echo Wiping disk... 34%% && ping localhost -n 2 >nul && echo Wiping disk... 35%% && ping localhost -n 2 >nul && echo Wiping disk... 36%% && ping localhost -n 2 >nul && echo Wiping disk... 37%% && ping localhost -n 2 >nul && echo Wiping disk... 38%% && ping localhost -n 2 >nul && echo Wiping disk... 39%% && ping localhost -n 2 >nul && echo Wiping disk... 40%% && ping localhost -n 2 >nul && echo Wiping disk... 41%% && ping localhost -n 2 >nul && echo Wiping disk... 42%% && ping localhost -n 2 >nul && echo Wiping disk... 43%% && ping localhost -n 2 >nul && echo Wiping disk... 44%% && ping localhost -n 2 >nul && echo Wiping disk... 45%% && ping localhost -n 2 >nul && echo Wiping disk... 46%% && ping localhost -n 2 >nul && echo Wiping disk... 47%% && ping localhost -n 2 >nul && echo Wiping disk... 48%% && ping localhost -n 2 >nul && echo Wiping disk... 49%% && ping localhost -n 2 >nul && echo Wiping disk... 50%% && ping localhost -n 2 >nul && echo Wiping disk... 51%% && ping localhost -n 2 >nul && echo Wiping disk... 52%% && ping localhost -n 2 >nul && echo Wiping disk... 53%% && ping localhost -n 2 >nul && echo Wiping disk... 54%% && ping localhost -n 2 >nul && echo Wiping disk... 55%% && ping localhost -n 2 >nul && echo Wiping disk... 56%% && ping localhost -n 2 >nul && echo Wiping disk... 57%% && ping localhost -n 2 >nul && echo Wiping disk... 58%% && ping localhost -n 2 >nul && echo Wiping disk... 59%% && ping localhost -n 2 >nul && echo Wiping disk... 60%% && ping localhost -n 2 >nul && echo Wiping disk... 61%% && ping localhost -n 2 >nul && echo Wiping disk... 62%% && ping localhost -n 2 >nul && echo Wiping disk... 63%% && ping localhost -n 2 >nul && echo Wiping disk... 64%% && ping localhost -n 2 >nul && echo Wiping disk... 65%% && ping localhost -n 2 >nul && echo Wiping disk... 66%% && ping localhost -n 2 >nul && echo Wiping disk... 67%% && ping localhost -n 2 >nul && echo Wiping disk... 68%% && ping localhost -n 2 >nul && echo Wiping disk... 69%% && ping localhost -n 2 >nul && echo Wiping disk... 70%% && ping localhost -n 2 >nul && echo Wiping disk... 71%% && ping localhost -n 2 >nul && echo Wiping disk... 72%% && ping localhost -n 2 >nul && echo Wiping disk... 73%% && ping localhost -n 2 >nul && echo Wiping disk... 74%% && ping localhost -n 2 >nul && echo Wiping disk... 75%% && ping localhost -n 2 >nul && echo Wiping disk... 76%% && ping localhost -n 2 >nul && echo Wiping disk... 77%% && ping localhost -n 2 >nul && echo Wiping disk... 78%% && ping localhost -n 2 >nul && echo Wiping disk... 79%% && ping localhost -n 2 >nul && echo Wiping disk... 80%% && ping localhost -n 2 >nul && echo Wiping disk... 81%% && ping localhost -n 2 >nul && echo Wiping disk... 82%% && ping localhost -n 2 >nul && echo Wiping disk... 83%% && ping localhost -n 2 >nul && echo Wiping disk... 84%% && ping localhost -n 2 >nul && echo Wiping disk... 85%% && ping localhost -n 2 >nul && echo Wiping disk... 86%% && ping localhost -n 2 >nul && echo Wiping disk... 87%% && ping localhost -n 2 >nul && echo Wiping disk... 88%% && ping localhost -n 2 >nul && echo Wiping disk... 89%% && ping localhost -n 2 >nul && echo Wiping disk... 90%% && ping localhost -n 2 >nul && echo Wiping disk... 91%% && ping localhost -n 2 >nul && echo Wiping disk... 92%% && ping localhost -n 2 >nul && echo Wiping disk... 93%% && ping localhost -n 2 >nul && echo Wiping disk... 94%% && ping localhost -n 2 >nul && echo Wiping disk... 95%% && ping localhost -n 2 >nul && echo Wiping disk... 96%% && ping localhost -n 2 >nul && echo Wiping disk... 97%% && ping localhost -n 2 >nul && echo Wiping disk... 98%% && ping localhost -n 2 >nul && echo Wiping disk... 99%% && ping localhost -n 2 >nul && echo Wiping disk... 100%% && ping localhost -n 2 >nul && echo. && echo ALL DATA HAS BEEN REMOVED! && ping localhost -n 4 >nul && cls && color 0A && echo Just kidding :D && echo Nothing was deleted. && echo Your PC is totally fine!
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:2504

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\welcome.vbs"
1⤵
- Suspicious use of WriteProcessMemory
PID:1212
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /k mode con: cols=120 lines=40 && color 1F && title Windows Error && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 0%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 1%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 2%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 3%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 4%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 5%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 6%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 7%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 8%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 9%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 10%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 11%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 12%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 13%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 14%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 15%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 16%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 17%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 18%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 19%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 20%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 21%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 22%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 23%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 24%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 25%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 26%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 27%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 28%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 29%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 30%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 31%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 32%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 33%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 34%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 35%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 36%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 37%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 38%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 39%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 40%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 41%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 42%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 43%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 44%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 45%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 46%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 47%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 48%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 49%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 50%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 51%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 52%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 53%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 54%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 55%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 56%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 57%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 58%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 59%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 60%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 61%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 62%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 63%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 64%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 65%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 66%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 67%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 68%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 69%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 70%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 71%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 72%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 73%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 74%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 75%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 76%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 77%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 78%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 79%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 80%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 81%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 82%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 83%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 84%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 85%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 86%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 87%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 88%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 89%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 90%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 91%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 92%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 93%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 94%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 95%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 96%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 97%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 98%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 99%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 100%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 100%% complete && echo Stop code: CRITICAL_PROCESS_DIED && echo What failed: ntoskrnl.exe && ping localhost -n 4 >nul && cls && color 07 && echo Restarting... && ping localhost -n 3 >nul && cls && color 17 && echo PhoenixBIOS v4.0 && echo Initializing hardware... && ping localhost -n 2 >nul && echo Checking disk... && ping localhost -n 2 >nul && echo Disk error detected! && echo Attempting automatic repair... && ping localhost -n 2 >nul && cls && color 0C && echo CRITICAL FAILURE! && echo File table corrupted! && echo Deleting all sectors... && echo Wiping disk... 1%% && ping localhost -n 2 >nul && echo Wiping disk... 2%% && ping localhost -n 2 >nul && echo Wiping disk... 3%% && ping localhost -n 2 >nul && echo Wiping disk... 4%% && ping localhost -n 2 >nul && echo Wiping disk... 5%% && ping localhost -n 2 >nul && echo Wiping disk... 6%% && ping localhost -n 2 >nul && echo Wiping disk... 7%% && ping localhost -n 2 >nul && echo Wiping disk... 8%% && ping localhost -n 2 >nul && echo Wiping disk... 9%% && ping localhost -n 2 >nul && echo Wiping disk... 10%% && ping localhost -n 2 >nul && echo Wiping disk... 11%% && ping localhost -n 2 >nul && echo Wiping disk... 12%% && ping localhost -n 2 >nul && echo Wiping disk... 13%% && ping localhost -n 2 >nul && echo Wiping disk... 14%% && ping localhost -n 2 >nul && echo Wiping disk... 15%% && ping localhost -n 2 >nul && echo Wiping disk... 16%% && ping localhost -n 2 >nul && echo Wiping disk... 17%% && ping localhost -n 2 >nul && echo Wiping disk... 18%% && ping localhost -n 2 >nul && echo Wiping disk... 19%% && ping localhost -n 2 >nul && echo Wiping disk... 20%% && ping localhost -n 2 >nul && echo Wiping disk... 21%% && ping localhost -n 2 >nul && echo Wiping disk... 22%% && ping localhost -n 2 >nul && echo Wiping disk... 23%% && ping localhost -n 2 >nul && echo Wiping disk... 24%% && ping localhost -n 2 >nul && echo Wiping disk... 25%% && ping localhost -n 2 >nul && echo Wiping disk... 26%% && ping localhost -n 2 >nul && echo Wiping disk... 27%% && ping localhost -n 2 >nul && echo Wiping disk... 28%% && ping localhost -n 2 >nul && echo Wiping disk... 29%% && ping localhost -n 2 >nul && echo Wiping disk... 30%% && ping localhost -n 2 >nul && echo Wiping disk... 31%% && ping localhost -n 2 >nul && echo Wiping disk... 32%% && ping localhost -n 2 >nul && echo Wiping disk... 33%% && ping localhost -n 2 >nul && echo Wiping disk... 34%% && ping localhost -n 2 >nul && echo Wiping disk... 35%% && ping localhost -n 2 >nul && echo Wiping disk... 36%% && ping localhost -n 2 >nul && echo Wiping disk... 37%% && ping localhost -n 2 >nul && echo Wiping disk... 38%% && ping localhost -n 2 >nul && echo Wiping disk... 39%% && ping localhost -n 2 >nul && echo Wiping disk... 40%% && ping localhost -n 2 >nul && echo Wiping disk... 41%% && ping localhost -n 2 >nul && echo Wiping disk... 42%% && ping localhost -n 2 >nul && echo Wiping disk... 43%% && ping localhost -n 2 >nul && echo Wiping disk... 44%% && ping localhost -n 2 >nul && echo Wiping disk... 45%% && ping localhost -n 2 >nul && echo Wiping disk... 46%% && ping localhost -n 2 >nul && echo Wiping disk... 47%% && ping localhost -n 2 >nul && echo Wiping disk... 48%% && ping localhost -n 2 >nul && echo Wiping disk... 49%% && ping localhost -n 2 >nul && echo Wiping disk... 50%% && ping localhost -n 2 >nul && echo Wiping disk... 51%% && ping localhost -n 2 >nul && echo Wiping disk... 52%% && ping localhost -n 2 >nul && echo Wiping disk... 53%% && ping localhost -n 2 >nul && echo Wiping disk... 54%% && ping localhost -n 2 >nul && echo Wiping disk... 55%% && ping localhost -n 2 >nul && echo Wiping disk... 56%% && ping localhost -n 2 >nul && echo Wiping disk... 57%% && ping localhost -n 2 >nul && echo Wiping disk... 58%% && ping localhost -n 2 >nul && echo Wiping disk... 59%% && ping localhost -n 2 >nul && echo Wiping disk... 60%% && ping localhost -n 2 >nul && echo Wiping disk... 61%% && ping localhost -n 2 >nul && echo Wiping disk... 62%% && ping localhost -n 2 >nul && echo Wiping disk... 63%% && ping localhost -n 2 >nul && echo Wiping disk... 64%% && ping localhost -n 2 >nul && echo Wiping disk... 65%% && ping localhost -n 2 >nul && echo Wiping disk... 66%% && ping localhost -n 2 >nul && echo Wiping disk... 67%% && ping localhost -n 2 >nul && echo Wiping disk... 68%% && ping localhost -n 2 >nul && echo Wiping disk... 69%% && ping localhost -n 2 >nul && echo Wiping disk... 70%% && ping localhost -n 2 >nul && echo Wiping disk... 71%% && ping localhost -n 2 >nul && echo Wiping disk... 72%% && ping localhost -n 2 >nul && echo Wiping disk... 73%% && ping localhost -n 2 >nul && echo Wiping disk... 74%% && ping localhost -n 2 >nul && echo Wiping disk... 75%% && ping localhost -n 2 >nul && echo Wiping disk... 76%% && ping localhost -n 2 >nul && echo Wiping disk... 77%% && ping localhost -n 2 >nul && echo Wiping disk... 78%% && ping localhost -n 2 >nul && echo Wiping disk... 79%% && ping localhost -n 2 >nul && echo Wiping disk... 80%% && ping localhost -n 2 >nul && echo Wiping disk... 81%% && ping localhost -n 2 >nul && echo Wiping disk... 82%% && ping localhost -n 2 >nul && echo Wiping disk... 83%% && ping localhost -n 2 >nul && echo Wiping disk... 84%% && ping localhost -n 2 >nul && echo Wiping disk... 85%% && ping localhost -n 2 >nul && echo Wiping disk... 86%% && ping localhost -n 2 >nul && echo Wiping disk... 87%% && ping localhost -n 2 >nul && echo Wiping disk... 88%% && ping localhost -n 2 >nul && echo Wiping disk... 89%% && ping localhost -n 2 >nul && echo Wiping disk... 90%% && ping localhost -n 2 >nul && echo Wiping disk... 91%% && ping localhost -n 2 >nul && echo Wiping disk... 92%% && ping localhost -n 2 >nul && echo Wiping disk... 93%% && ping localhost -n 2 >nul && echo Wiping disk... 94%% && ping localhost -n 2 >nul && echo Wiping disk... 95%% && ping localhost -n 2 >nul && echo Wiping disk... 96%% && ping localhost -n 2 >nul && echo Wiping disk... 97%% && ping localhost -n 2 >nul && echo Wiping disk... 98%% && ping localhost -n 2 >nul && echo Wiping disk... 99%% && ping localhost -n 2 >nul && echo Wiping disk... 100%% && ping localhost -n 2 >nul && echo. && echo ALL DATA HAS BEEN REMOVED! && ping localhost -n 4 >nul && cls && color 0A && echo Just kidding :D && echo Nothing was deleted. && echo Your PC is totally fine!
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:5852

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\welcome.vbs"
1⤵
- Suspicious use of WriteProcessMemory
PID:1500
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /k mode con: cols=120 lines=40 && color 1F && title Windows Error && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 0%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 1%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 2%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 3%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 4%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 5%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 6%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 7%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 8%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 9%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 10%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 11%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 12%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 13%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 14%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 15%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 16%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 17%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 18%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 19%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 20%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 21%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 22%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 23%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 24%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 25%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 26%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 27%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 28%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 29%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 30%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 31%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 32%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 33%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 34%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 35%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 36%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 37%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 38%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 39%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 40%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 41%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 42%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 43%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 44%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 45%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 46%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 47%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 48%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 49%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 50%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 51%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 52%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 53%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 54%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 55%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 56%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 57%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 58%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 59%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 60%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 61%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 62%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 63%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 64%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 65%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 66%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 67%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 68%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 69%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 70%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 71%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 72%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 73%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 74%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 75%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 76%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 77%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 78%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 79%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 80%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 81%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 82%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 83%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 84%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 85%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 86%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 87%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 88%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 89%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 90%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 91%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 92%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 93%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 94%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 95%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 96%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 97%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 98%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 99%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 100%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 100%% complete && echo Stop code: CRITICAL_PROCESS_DIED && echo What failed: ntoskrnl.exe && ping localhost -n 4 >nul && cls && color 07 && echo Restarting... && ping localhost -n 3 >nul && cls && color 17 && echo PhoenixBIOS v4.0 && echo Initializing hardware... && ping localhost -n 2 >nul && echo Checking disk... && ping localhost -n 2 >nul && echo Disk error detected! && echo Attempting automatic repair... && ping localhost -n 2 >nul && cls && color 0C && echo CRITICAL FAILURE! && echo File table corrupted! && echo Deleting all sectors... && echo Wiping disk... 1%% && ping localhost -n 2 >nul && echo Wiping disk... 2%% && ping localhost -n 2 >nul && echo Wiping disk... 3%% && ping localhost -n 2 >nul && echo Wiping disk... 4%% && ping localhost -n 2 >nul && echo Wiping disk... 5%% && ping localhost -n 2 >nul && echo Wiping disk... 6%% && ping localhost -n 2 >nul && echo Wiping disk... 7%% && ping localhost -n 2 >nul && echo Wiping disk... 8%% && ping localhost -n 2 >nul && echo Wiping disk... 9%% && ping localhost -n 2 >nul && echo Wiping disk... 10%% && ping localhost -n 2 >nul && echo Wiping disk... 11%% && ping localhost -n 2 >nul && echo Wiping disk... 12%% && ping localhost -n 2 >nul && echo Wiping disk... 13%% && ping localhost -n 2 >nul && echo Wiping disk... 14%% && ping localhost -n 2 >nul && echo Wiping disk... 15%% && ping localhost -n 2 >nul && echo Wiping disk... 16%% && ping localhost -n 2 >nul && echo Wiping disk... 17%% && ping localhost -n 2 >nul && echo Wiping disk... 18%% && ping localhost -n 2 >nul && echo Wiping disk... 19%% && ping localhost -n 2 >nul && echo Wiping disk... 20%% && ping localhost -n 2 >nul && echo Wiping disk... 21%% && ping localhost -n 2 >nul && echo Wiping disk... 22%% && ping localhost -n 2 >nul && echo Wiping disk... 23%% && ping localhost -n 2 >nul && echo Wiping disk... 24%% && ping localhost -n 2 >nul && echo Wiping disk... 25%% && ping localhost -n 2 >nul && echo Wiping disk... 26%% && ping localhost -n 2 >nul && echo Wiping disk... 27%% && ping localhost -n 2 >nul && echo Wiping disk... 28%% && ping localhost -n 2 >nul && echo Wiping disk... 29%% && ping localhost -n 2 >nul && echo Wiping disk... 30%% && ping localhost -n 2 >nul && echo Wiping disk... 31%% && ping localhost -n 2 >nul && echo Wiping disk... 32%% && ping localhost -n 2 >nul && echo Wiping disk... 33%% && ping localhost -n 2 >nul && echo Wiping disk... 34%% && ping localhost -n 2 >nul && echo Wiping disk... 35%% && ping localhost -n 2 >nul && echo Wiping disk... 36%% && ping localhost -n 2 >nul && echo Wiping disk... 37%% && ping localhost -n 2 >nul && echo Wiping disk... 38%% && ping localhost -n 2 >nul && echo Wiping disk... 39%% && ping localhost -n 2 >nul && echo Wiping disk... 40%% && ping localhost -n 2 >nul && echo Wiping disk... 41%% && ping localhost -n 2 >nul && echo Wiping disk... 42%% && ping localhost -n 2 >nul && echo Wiping disk... 43%% && ping localhost -n 2 >nul && echo Wiping disk... 44%% && ping localhost -n 2 >nul && echo Wiping disk... 45%% && ping localhost -n 2 >nul && echo Wiping disk... 46%% && ping localhost -n 2 >nul && echo Wiping disk... 47%% && ping localhost -n 2 >nul && echo Wiping disk... 48%% && ping localhost -n 2 >nul && echo Wiping disk... 49%% && ping localhost -n 2 >nul && echo Wiping disk... 50%% && ping localhost -n 2 >nul && echo Wiping disk... 51%% && ping localhost -n 2 >nul && echo Wiping disk... 52%% && ping localhost -n 2 >nul && echo Wiping disk... 53%% && ping localhost -n 2 >nul && echo Wiping disk... 54%% && ping localhost -n 2 >nul && echo Wiping disk... 55%% && ping localhost -n 2 >nul && echo Wiping disk... 56%% && ping localhost -n 2 >nul && echo Wiping disk... 57%% && ping localhost -n 2 >nul && echo Wiping disk... 58%% && ping localhost -n 2 >nul && echo Wiping disk... 59%% && ping localhost -n 2 >nul && echo Wiping disk... 60%% && ping localhost -n 2 >nul && echo Wiping disk... 61%% && ping localhost -n 2 >nul && echo Wiping disk... 62%% && ping localhost -n 2 >nul && echo Wiping disk... 63%% && ping localhost -n 2 >nul && echo Wiping disk... 64%% && ping localhost -n 2 >nul && echo Wiping disk... 65%% && ping localhost -n 2 >nul && echo Wiping disk... 66%% && ping localhost -n 2 >nul && echo Wiping disk... 67%% && ping localhost -n 2 >nul && echo Wiping disk... 68%% && ping localhost -n 2 >nul && echo Wiping disk... 69%% && ping localhost -n 2 >nul && echo Wiping disk... 70%% && ping localhost -n 2 >nul && echo Wiping disk... 71%% && ping localhost -n 2 >nul && echo Wiping disk... 72%% && ping localhost -n 2 >nul && echo Wiping disk... 73%% && ping localhost -n 2 >nul && echo Wiping disk... 74%% && ping localhost -n 2 >nul && echo Wiping disk... 75%% && ping localhost -n 2 >nul && echo Wiping disk... 76%% && ping localhost -n 2 >nul && echo Wiping disk... 77%% && ping localhost -n 2 >nul && echo Wiping disk... 78%% && ping localhost -n 2 >nul && echo Wiping disk... 79%% && ping localhost -n 2 >nul && echo Wiping disk... 80%% && ping localhost -n 2 >nul && echo Wiping disk... 81%% && ping localhost -n 2 >nul && echo Wiping disk... 82%% && ping localhost -n 2 >nul && echo Wiping disk... 83%% && ping localhost -n 2 >nul && echo Wiping disk... 84%% && ping localhost -n 2 >nul && echo Wiping disk... 85%% && ping localhost -n 2 >nul && echo Wiping disk... 86%% && ping localhost -n 2 >nul && echo Wiping disk... 87%% && ping localhost -n 2 >nul && echo Wiping disk... 88%% && ping localhost -n 2 >nul && echo Wiping disk... 89%% && ping localhost -n 2 >nul && echo Wiping disk... 90%% && ping localhost -n 2 >nul && echo Wiping disk... 91%% && ping localhost -n 2 >nul && echo Wiping disk... 92%% && ping localhost -n 2 >nul && echo Wiping disk... 93%% && ping localhost -n 2 >nul && echo Wiping disk... 94%% && ping localhost -n 2 >nul && echo Wiping disk... 95%% && ping localhost -n 2 >nul && echo Wiping disk... 96%% && ping localhost -n 2 >nul && echo Wiping disk... 97%% && ping localhost -n 2 >nul && echo Wiping disk... 98%% && ping localhost -n 2 >nul && echo Wiping disk... 99%% && ping localhost -n 2 >nul && echo Wiping disk... 100%% && ping localhost -n 2 >nul && echo. && echo ALL DATA HAS BEEN REMOVED! && ping localhost -n 4 >nul && cls && color 0A && echo Just kidding :D && echo Nothing was deleted. && echo Your PC is totally fine!
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:5516

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\welcome.vbs"
1⤵
- Suspicious use of WriteProcessMemory
PID:3076
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /k mode con: cols=120 lines=40 && color 1F && title Windows Error && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 0%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 1%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 2%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 3%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 4%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 5%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 6%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 7%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 8%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 9%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 10%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 11%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 12%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 13%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 14%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 15%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 16%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 17%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 18%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 19%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 20%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 21%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 22%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 23%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 24%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 25%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 26%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 27%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 28%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 29%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 30%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 31%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 32%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 33%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 34%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 35%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 36%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 37%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 38%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 39%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 40%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 41%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 42%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 43%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 44%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 45%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 46%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 47%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 48%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 49%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 50%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 51%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 52%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 53%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 54%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 55%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 56%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 57%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 58%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 59%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 60%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 61%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 62%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 63%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 64%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 65%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 66%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 67%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 68%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 69%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 70%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 71%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 72%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 73%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 74%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 75%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 76%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 77%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 78%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 79%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 80%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 81%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 82%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 83%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 84%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 85%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 86%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 87%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 88%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 89%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 90%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 91%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 92%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 93%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 94%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 95%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 96%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 97%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 98%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 99%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 100%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 100%% complete && echo Stop code: CRITICAL_PROCESS_DIED && echo What failed: ntoskrnl.exe && ping localhost -n 4 >nul && cls && color 07 && echo Restarting... && ping localhost -n 3 >nul && cls && color 17 && echo PhoenixBIOS v4.0 && echo Initializing hardware... && ping localhost -n 2 >nul && echo Checking disk... && ping localhost -n 2 >nul && echo Disk error detected! && echo Attempting automatic repair... && ping localhost -n 2 >nul && cls && color 0C && echo CRITICAL FAILURE! && echo File table corrupted! && echo Deleting all sectors... && echo Wiping disk... 1%% && ping localhost -n 2 >nul && echo Wiping disk... 2%% && ping localhost -n 2 >nul && echo Wiping disk... 3%% && ping localhost -n 2 >nul && echo Wiping disk... 4%% && ping localhost -n 2 >nul && echo Wiping disk... 5%% && ping localhost -n 2 >nul && echo Wiping disk... 6%% && ping localhost -n 2 >nul && echo Wiping disk... 7%% && ping localhost -n 2 >nul && echo Wiping disk... 8%% && ping localhost -n 2 >nul && echo Wiping disk... 9%% && ping localhost -n 2 >nul && echo Wiping disk... 10%% && ping localhost -n 2 >nul && echo Wiping disk... 11%% && ping localhost -n 2 >nul && echo Wiping disk... 12%% && ping localhost -n 2 >nul && echo Wiping disk... 13%% && ping localhost -n 2 >nul && echo Wiping disk... 14%% && ping localhost -n 2 >nul && echo Wiping disk... 15%% && ping localhost -n 2 >nul && echo Wiping disk... 16%% && ping localhost -n 2 >nul && echo Wiping disk... 17%% && ping localhost -n 2 >nul && echo Wiping disk... 18%% && ping localhost -n 2 >nul && echo Wiping disk... 19%% && ping localhost -n 2 >nul && echo Wiping disk... 20%% && ping localhost -n 2 >nul && echo Wiping disk... 21%% && ping localhost -n 2 >nul && echo Wiping disk... 22%% && ping localhost -n 2 >nul && echo Wiping disk... 23%% && ping localhost -n 2 >nul && echo Wiping disk... 24%% && ping localhost -n 2 >nul && echo Wiping disk... 25%% && ping localhost -n 2 >nul && echo Wiping disk... 26%% && ping localhost -n 2 >nul && echo Wiping disk... 27%% && ping localhost -n 2 >nul && echo Wiping disk... 28%% && ping localhost -n 2 >nul && echo Wiping disk... 29%% && ping localhost -n 2 >nul && echo Wiping disk... 30%% && ping localhost -n 2 >nul && echo Wiping disk... 31%% && ping localhost -n 2 >nul && echo Wiping disk... 32%% && ping localhost -n 2 >nul && echo Wiping disk... 33%% && ping localhost -n 2 >nul && echo Wiping disk... 34%% && ping localhost -n 2 >nul && echo Wiping disk... 35%% && ping localhost -n 2 >nul && echo Wiping disk... 36%% && ping localhost -n 2 >nul && echo Wiping disk... 37%% && ping localhost -n 2 >nul && echo Wiping disk... 38%% && ping localhost -n 2 >nul && echo Wiping disk... 39%% && ping localhost -n 2 >nul && echo Wiping disk... 40%% && ping localhost -n 2 >nul && echo Wiping disk... 41%% && ping localhost -n 2 >nul && echo Wiping disk... 42%% && ping localhost -n 2 >nul && echo Wiping disk... 43%% && ping localhost -n 2 >nul && echo Wiping disk... 44%% && ping localhost -n 2 >nul && echo Wiping disk... 45%% && ping localhost -n 2 >nul && echo Wiping disk... 46%% && ping localhost -n 2 >nul && echo Wiping disk... 47%% && ping localhost -n 2 >nul && echo Wiping disk... 48%% && ping localhost -n 2 >nul && echo Wiping disk... 49%% && ping localhost -n 2 >nul && echo Wiping disk... 50%% && ping localhost -n 2 >nul && echo Wiping disk... 51%% && ping localhost -n 2 >nul && echo Wiping disk... 52%% && ping localhost -n 2 >nul && echo Wiping disk... 53%% && ping localhost -n 2 >nul && echo Wiping disk... 54%% && ping localhost -n 2 >nul && echo Wiping disk... 55%% && ping localhost -n 2 >nul && echo Wiping disk... 56%% && ping localhost -n 2 >nul && echo Wiping disk... 57%% && ping localhost -n 2 >nul && echo Wiping disk... 58%% && ping localhost -n 2 >nul && echo Wiping disk... 59%% && ping localhost -n 2 >nul && echo Wiping disk... 60%% && ping localhost -n 2 >nul && echo Wiping disk... 61%% && ping localhost -n 2 >nul && echo Wiping disk... 62%% && ping localhost -n 2 >nul && echo Wiping disk... 63%% && ping localhost -n 2 >nul && echo Wiping disk... 64%% && ping localhost -n 2 >nul && echo Wiping disk... 65%% && ping localhost -n 2 >nul && echo Wiping disk... 66%% && ping localhost -n 2 >nul && echo Wiping disk... 67%% && ping localhost -n 2 >nul && echo Wiping disk... 68%% && ping localhost -n 2 >nul && echo Wiping disk... 69%% && ping localhost -n 2 >nul && echo Wiping disk... 70%% && ping localhost -n 2 >nul && echo Wiping disk... 71%% && ping localhost -n 2 >nul && echo Wiping disk... 72%% && ping localhost -n 2 >nul && echo Wiping disk... 73%% && ping localhost -n 2 >nul && echo Wiping disk... 74%% && ping localhost -n 2 >nul && echo Wiping disk... 75%% && ping localhost -n 2 >nul && echo Wiping disk... 76%% && ping localhost -n 2 >nul && echo Wiping disk... 77%% && ping localhost -n 2 >nul && echo Wiping disk... 78%% && ping localhost -n 2 >nul && echo Wiping disk... 79%% && ping localhost -n 2 >nul && echo Wiping disk... 80%% && ping localhost -n 2 >nul && echo Wiping disk... 81%% && ping localhost -n 2 >nul && echo Wiping disk... 82%% && ping localhost -n 2 >nul && echo Wiping disk... 83%% && ping localhost -n 2 >nul && echo Wiping disk... 84%% && ping localhost -n 2 >nul && echo Wiping disk... 85%% && ping localhost -n 2 >nul && echo Wiping disk... 86%% && ping localhost -n 2 >nul && echo Wiping disk... 87%% && ping localhost -n 2 >nul && echo Wiping disk... 88%% && ping localhost -n 2 >nul && echo Wiping disk... 89%% && ping localhost -n 2 >nul && echo Wiping disk... 90%% && ping localhost -n 2 >nul && echo Wiping disk... 91%% && ping localhost -n 2 >nul && echo Wiping disk... 92%% && ping localhost -n 2 >nul && echo Wiping disk... 93%% && ping localhost -n 2 >nul && echo Wiping disk... 94%% && ping localhost -n 2 >nul && echo Wiping disk... 95%% && ping localhost -n 2 >nul && echo Wiping disk... 96%% && ping localhost -n 2 >nul && echo Wiping disk... 97%% && ping localhost -n 2 >nul && echo Wiping disk... 98%% && ping localhost -n 2 >nul && echo Wiping disk... 99%% && ping localhost -n 2 >nul && echo Wiping disk... 100%% && ping localhost -n 2 >nul && echo. && echo ALL DATA HAS BEEN REMOVED! && ping localhost -n 4 >nul && cls && color 0A && echo Just kidding :D && echo Nothing was deleted. && echo Your PC is totally fine!
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:4764

C:\Windows\system32\SystemSettingsAdminFlows.exe
"C:\Windows\system32\SystemSettingsAdminFlows.exe" TroubleshootActivation
1⤵
- Suspicious use of SetWindowsHookEx
PID:4028

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\welcome.vbs"
1⤵
- Suspicious use of WriteProcessMemory
PID:4860
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /k mode con: cols=120 lines=40 && color 1F && title Windows Error && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 0%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 1%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 2%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 3%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 4%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 5%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 6%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 7%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 8%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 9%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 10%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 11%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 12%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 13%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 14%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 15%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 16%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 17%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 18%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 19%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 20%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 21%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 22%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 23%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 24%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 25%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 26%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 27%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 28%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 29%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 30%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 31%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 32%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 33%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 34%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 35%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 36%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 37%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 38%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 39%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 40%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 41%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 42%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 43%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 44%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 45%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 46%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 47%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 48%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 49%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 50%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 51%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 52%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 53%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 54%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 55%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 56%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 57%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 58%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 59%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 60%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 61%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 62%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 63%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 64%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 65%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 66%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 67%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 68%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 69%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 70%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 71%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 72%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 73%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 74%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 75%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 76%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 77%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 78%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 79%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 80%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 81%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 82%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 83%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 84%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 85%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 86%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 87%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 88%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 89%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 90%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 91%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 92%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 93%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 94%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 95%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 96%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 97%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 98%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 99%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 100%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 100%% complete && echo Stop code: CRITICAL_PROCESS_DIED && echo What failed: ntoskrnl.exe && ping localhost -n 4 >nul && cls && color 07 && echo Restarting... && ping localhost -n 3 >nul && cls && color 17 && echo PhoenixBIOS v4.0 && echo Initializing hardware... && ping localhost -n 2 >nul && echo Checking disk... && ping localhost -n 2 >nul && echo Disk error detected! && echo Attempting automatic repair... && ping localhost -n 2 >nul && cls && color 0C && echo CRITICAL FAILURE! && echo File table corrupted! && echo Deleting all sectors... && echo Wiping disk... 1%% && ping localhost -n 2 >nul && echo Wiping disk... 2%% && ping localhost -n 2 >nul && echo Wiping disk... 3%% && ping localhost -n 2 >nul && echo Wiping disk... 4%% && ping localhost -n 2 >nul && echo Wiping disk... 5%% && ping localhost -n 2 >nul && echo Wiping disk... 6%% && ping localhost -n 2 >nul && echo Wiping disk... 7%% && ping localhost -n 2 >nul && echo Wiping disk... 8%% && ping localhost -n 2 >nul && echo Wiping disk... 9%% && ping localhost -n 2 >nul && echo Wiping disk... 10%% && ping localhost -n 2 >nul && echo Wiping disk... 11%% && ping localhost -n 2 >nul && echo Wiping disk... 12%% && ping localhost -n 2 >nul && echo Wiping disk... 13%% && ping localhost -n 2 >nul && echo Wiping disk... 14%% && ping localhost -n 2 >nul && echo Wiping disk... 15%% && ping localhost -n 2 >nul && echo Wiping disk... 16%% && ping localhost -n 2 >nul && echo Wiping disk... 17%% && ping localhost -n 2 >nul && echo Wiping disk... 18%% && ping localhost -n 2 >nul && echo Wiping disk... 19%% && ping localhost -n 2 >nul && echo Wiping disk... 20%% && ping localhost -n 2 >nul && echo Wiping disk... 21%% && ping localhost -n 2 >nul && echo Wiping disk... 22%% && ping localhost -n 2 >nul && echo Wiping disk... 23%% && ping localhost -n 2 >nul && echo Wiping disk... 24%% && ping localhost -n 2 >nul && echo Wiping disk... 25%% && ping localhost -n 2 >nul && echo Wiping disk... 26%% && ping localhost -n 2 >nul && echo Wiping disk... 27%% && ping localhost -n 2 >nul && echo Wiping disk... 28%% && ping localhost -n 2 >nul && echo Wiping disk... 29%% && ping localhost -n 2 >nul && echo Wiping disk... 30%% && ping localhost -n 2 >nul && echo Wiping disk... 31%% && ping localhost -n 2 >nul && echo Wiping disk... 32%% && ping localhost -n 2 >nul && echo Wiping disk... 33%% && ping localhost -n 2 >nul && echo Wiping disk... 34%% && ping localhost -n 2 >nul && echo Wiping disk... 35%% && ping localhost -n 2 >nul && echo Wiping disk... 36%% && ping localhost -n 2 >nul && echo Wiping disk... 37%% && ping localhost -n 2 >nul && echo Wiping disk... 38%% && ping localhost -n 2 >nul && echo Wiping disk... 39%% && ping localhost -n 2 >nul && echo Wiping disk... 40%% && ping localhost -n 2 >nul && echo Wiping disk... 41%% && ping localhost -n 2 >nul && echo Wiping disk... 42%% && ping localhost -n 2 >nul && echo Wiping disk... 43%% && ping localhost -n 2 >nul && echo Wiping disk... 44%% && ping localhost -n 2 >nul && echo Wiping disk... 45%% && ping localhost -n 2 >nul && echo Wiping disk... 46%% && ping localhost -n 2 >nul && echo Wiping disk... 47%% && ping localhost -n 2 >nul && echo Wiping disk... 48%% && ping localhost -n 2 >nul && echo Wiping disk... 49%% && ping localhost -n 2 >nul && echo Wiping disk... 50%% && ping localhost -n 2 >nul && echo Wiping disk... 51%% && ping localhost -n 2 >nul && echo Wiping disk... 52%% && ping localhost -n 2 >nul && echo Wiping disk... 53%% && ping localhost -n 2 >nul && echo Wiping disk... 54%% && ping localhost -n 2 >nul && echo Wiping disk... 55%% && ping localhost -n 2 >nul && echo Wiping disk... 56%% && ping localhost -n 2 >nul && echo Wiping disk... 57%% && ping localhost -n 2 >nul && echo Wiping disk... 58%% && ping localhost -n 2 >nul && echo Wiping disk... 59%% && ping localhost -n 2 >nul && echo Wiping disk... 60%% && ping localhost -n 2 >nul && echo Wiping disk... 61%% && ping localhost -n 2 >nul && echo Wiping disk... 62%% && ping localhost -n 2 >nul && echo Wiping disk... 63%% && ping localhost -n 2 >nul && echo Wiping disk... 64%% && ping localhost -n 2 >nul && echo Wiping disk... 65%% && ping localhost -n 2 >nul && echo Wiping disk... 66%% && ping localhost -n 2 >nul && echo Wiping disk... 67%% && ping localhost -n 2 >nul && echo Wiping disk... 68%% && ping localhost -n 2 >nul && echo Wiping disk... 69%% && ping localhost -n 2 >nul && echo Wiping disk... 70%% && ping localhost -n 2 >nul && echo Wiping disk... 71%% && ping localhost -n 2 >nul && echo Wiping disk... 72%% && ping localhost -n 2 >nul && echo Wiping disk... 73%% && ping localhost -n 2 >nul && echo Wiping disk... 74%% && ping localhost -n 2 >nul && echo Wiping disk... 75%% && ping localhost -n 2 >nul && echo Wiping disk... 76%% && ping localhost -n 2 >nul && echo Wiping disk... 77%% && ping localhost -n 2 >nul && echo Wiping disk... 78%% && ping localhost -n 2 >nul && echo Wiping disk... 79%% && ping localhost -n 2 >nul && echo Wiping disk... 80%% && ping localhost -n 2 >nul && echo Wiping disk... 81%% && ping localhost -n 2 >nul && echo Wiping disk... 82%% && ping localhost -n 2 >nul && echo Wiping disk... 83%% && ping localhost -n 2 >nul && echo Wiping disk... 84%% && ping localhost -n 2 >nul && echo Wiping disk... 85%% && ping localhost -n 2 >nul && echo Wiping disk... 86%% && ping localhost -n 2 >nul && echo Wiping disk... 87%% && ping localhost -n 2 >nul && echo Wiping disk... 88%% && ping localhost -n 2 >nul && echo Wiping disk... 89%% && ping localhost -n 2 >nul && echo Wiping disk... 90%% && ping localhost -n 2 >nul && echo Wiping disk... 91%% && ping localhost -n 2 >nul && echo Wiping disk... 92%% && ping localhost -n 2 >nul && echo Wiping disk... 93%% && ping localhost -n 2 >nul && echo Wiping disk... 94%% && ping localhost -n 2 >nul && echo Wiping disk... 95%% && ping localhost -n 2 >nul && echo Wiping disk... 96%% && ping localhost -n 2 >nul && echo Wiping disk... 97%% && ping localhost -n 2 >nul && echo Wiping disk... 98%% && ping localhost -n 2 >nul && echo Wiping disk... 99%% && ping localhost -n 2 >nul && echo Wiping disk... 100%% && ping localhost -n 2 >nul && echo. && echo ALL DATA HAS BEEN REMOVED! && ping localhost -n 4 >nul && cls && color 0A && echo Just kidding :D && echo Nothing was deleted. && echo Your PC is totally fine!
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:4656

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\welcome.vbs"
1⤵
- Suspicious use of WriteProcessMemory
PID:3308
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /k mode con: cols=120 lines=40 && color 1F && title Windows Error && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 0%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 1%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 2%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 3%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 4%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 5%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 6%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 7%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 8%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 9%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 10%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 11%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 12%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 13%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 14%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 15%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 16%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 17%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 18%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 19%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 20%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 21%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 22%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 23%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 24%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 25%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 26%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 27%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 28%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 29%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 30%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 31%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 32%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 33%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 34%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 35%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 36%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 37%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 38%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 39%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 40%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 41%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 42%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 43%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 44%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 45%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 46%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 47%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 48%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 49%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 50%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 51%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 52%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 53%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 54%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 55%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 56%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 57%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 58%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 59%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 60%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 61%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 62%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 63%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 64%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 65%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 66%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 67%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 68%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 69%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 70%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 71%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 72%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 73%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 74%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 75%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 76%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 77%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 78%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 79%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 80%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 81%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 82%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 83%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 84%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 85%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 86%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 87%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 88%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 89%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 90%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 91%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 92%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 93%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 94%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 95%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 96%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 97%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 98%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 99%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 100%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 100%% complete && echo Stop code: CRITICAL_PROCESS_DIED && echo What failed: ntoskrnl.exe && ping localhost -n 4 >nul && cls && color 07 && echo Restarting... && ping localhost -n 3 >nul && cls && color 17 && echo PhoenixBIOS v4.0 && echo Initializing hardware... && ping localhost -n 2 >nul && echo Checking disk... && ping localhost -n 2 >nul && echo Disk error detected! && echo Attempting automatic repair... && ping localhost -n 2 >nul && cls && color 0C && echo CRITICAL FAILURE! && echo File table corrupted! && echo Deleting all sectors... && echo Wiping disk... 1%% && ping localhost -n 2 >nul && echo Wiping disk... 2%% && ping localhost -n 2 >nul && echo Wiping disk... 3%% && ping localhost -n 2 >nul && echo Wiping disk... 4%% && ping localhost -n 2 >nul && echo Wiping disk... 5%% && ping localhost -n 2 >nul && echo Wiping disk... 6%% && ping localhost -n 2 >nul && echo Wiping disk... 7%% && ping localhost -n 2 >nul && echo Wiping disk... 8%% && ping localhost -n 2 >nul && echo Wiping disk... 9%% && ping localhost -n 2 >nul && echo Wiping disk... 10%% && ping localhost -n 2 >nul && echo Wiping disk... 11%% && ping localhost -n 2 >nul && echo Wiping disk... 12%% && ping localhost -n 2 >nul && echo Wiping disk... 13%% && ping localhost -n 2 >nul && echo Wiping disk... 14%% && ping localhost -n 2 >nul && echo Wiping disk... 15%% && ping localhost -n 2 >nul && echo Wiping disk... 16%% && ping localhost -n 2 >nul && echo Wiping disk... 17%% && ping localhost -n 2 >nul && echo Wiping disk... 18%% && ping localhost -n 2 >nul && echo Wiping disk... 19%% && ping localhost -n 2 >nul && echo Wiping disk... 20%% && ping localhost -n 2 >nul && echo Wiping disk... 21%% && ping localhost -n 2 >nul && echo Wiping disk... 22%% && ping localhost -n 2 >nul && echo Wiping disk... 23%% && ping localhost -n 2 >nul && echo Wiping disk... 24%% && ping localhost -n 2 >nul && echo Wiping disk... 25%% && ping localhost -n 2 >nul && echo Wiping disk... 26%% && ping localhost -n 2 >nul && echo Wiping disk... 27%% && ping localhost -n 2 >nul && echo Wiping disk... 28%% && ping localhost -n 2 >nul && echo Wiping disk... 29%% && ping localhost -n 2 >nul && echo Wiping disk... 30%% && ping localhost -n 2 >nul && echo Wiping disk... 31%% && ping localhost -n 2 >nul && echo Wiping disk... 32%% && ping localhost -n 2 >nul && echo Wiping disk... 33%% && ping localhost -n 2 >nul && echo Wiping disk... 34%% && ping localhost -n 2 >nul && echo Wiping disk... 35%% && ping localhost -n 2 >nul && echo Wiping disk... 36%% && ping localhost -n 2 >nul && echo Wiping disk... 37%% && ping localhost -n 2 >nul && echo Wiping disk... 38%% && ping localhost -n 2 >nul && echo Wiping disk... 39%% && ping localhost -n 2 >nul && echo Wiping disk... 40%% && ping localhost -n 2 >nul && echo Wiping disk... 41%% && ping localhost -n 2 >nul && echo Wiping disk... 42%% && ping localhost -n 2 >nul && echo Wiping disk... 43%% && ping localhost -n 2 >nul && echo Wiping disk... 44%% && ping localhost -n 2 >nul && echo Wiping disk... 45%% && ping localhost -n 2 >nul && echo Wiping disk... 46%% && ping localhost -n 2 >nul && echo Wiping disk... 47%% && ping localhost -n 2 >nul && echo Wiping disk... 48%% && ping localhost -n 2 >nul && echo Wiping disk... 49%% && ping localhost -n 2 >nul && echo Wiping disk... 50%% && ping localhost -n 2 >nul && echo Wiping disk... 51%% && ping localhost -n 2 >nul && echo Wiping disk... 52%% && ping localhost -n 2 >nul && echo Wiping disk... 53%% && ping localhost -n 2 >nul && echo Wiping disk... 54%% && ping localhost -n 2 >nul && echo Wiping disk... 55%% && ping localhost -n 2 >nul && echo Wiping disk... 56%% && ping localhost -n 2 >nul && echo Wiping disk... 57%% && ping localhost -n 2 >nul && echo Wiping disk... 58%% && ping localhost -n 2 >nul && echo Wiping disk... 59%% && ping localhost -n 2 >nul && echo Wiping disk... 60%% && ping localhost -n 2 >nul && echo Wiping disk... 61%% && ping localhost -n 2 >nul && echo Wiping disk... 62%% && ping localhost -n 2 >nul && echo Wiping disk... 63%% && ping localhost -n 2 >nul && echo Wiping disk... 64%% && ping localhost -n 2 >nul && echo Wiping disk... 65%% && ping localhost -n 2 >nul && echo Wiping disk... 66%% && ping localhost -n 2 >nul && echo Wiping disk... 67%% && ping localhost -n 2 >nul && echo Wiping disk... 68%% && ping localhost -n 2 >nul && echo Wiping disk... 69%% && ping localhost -n 2 >nul && echo Wiping disk... 70%% && ping localhost -n 2 >nul && echo Wiping disk... 71%% && ping localhost -n 2 >nul && echo Wiping disk... 72%% && ping localhost -n 2 >nul && echo Wiping disk... 73%% && ping localhost -n 2 >nul && echo Wiping disk... 74%% && ping localhost -n 2 >nul && echo Wiping disk... 75%% && ping localhost -n 2 >nul && echo Wiping disk... 76%% && ping localhost -n 2 >nul && echo Wiping disk... 77%% && ping localhost -n 2 >nul && echo Wiping disk... 78%% && ping localhost -n 2 >nul && echo Wiping disk... 79%% && ping localhost -n 2 >nul && echo Wiping disk... 80%% && ping localhost -n 2 >nul && echo Wiping disk... 81%% && ping localhost -n 2 >nul && echo Wiping disk... 82%% && ping localhost -n 2 >nul && echo Wiping disk... 83%% && ping localhost -n 2 >nul && echo Wiping disk... 84%% && ping localhost -n 2 >nul && echo Wiping disk... 85%% && ping localhost -n 2 >nul && echo Wiping disk... 86%% && ping localhost -n 2 >nul && echo Wiping disk... 87%% && ping localhost -n 2 >nul && echo Wiping disk... 88%% && ping localhost -n 2 >nul && echo Wiping disk... 89%% && ping localhost -n 2 >nul && echo Wiping disk... 90%% && ping localhost -n 2 >nul && echo Wiping disk... 91%% && ping localhost -n 2 >nul && echo Wiping disk... 92%% && ping localhost -n 2 >nul && echo Wiping disk... 93%% && ping localhost -n 2 >nul && echo Wiping disk... 94%% && ping localhost -n 2 >nul && echo Wiping disk... 95%% && ping localhost -n 2 >nul && echo Wiping disk... 96%% && ping localhost -n 2 >nul && echo Wiping disk... 97%% && ping localhost -n 2 >nul && echo Wiping disk... 98%% && ping localhost -n 2 >nul && echo Wiping disk... 99%% && ping localhost -n 2 >nul && echo Wiping disk... 100%% && ping localhost -n 2 >nul && echo. && echo ALL DATA HAS BEEN REMOVED! && ping localhost -n 4 >nul && cls && color 0A && echo Just kidding :D && echo Nothing was deleted. && echo Your PC is totally fine!
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:772

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\welcome.vbs"
1⤵
- Suspicious use of WriteProcessMemory
PID:2372
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /k mode con: cols=120 lines=40 && color 1F && title Windows Error && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 0%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 1%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 2%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 3%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 4%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 5%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 6%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 7%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 8%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 9%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 10%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 11%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 12%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 13%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 14%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 15%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 16%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 17%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 18%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 19%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 20%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 21%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 22%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 23%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 24%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 25%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 26%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 27%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 28%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 29%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 30%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 31%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 32%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 33%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 34%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 35%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 36%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 37%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 38%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 39%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 40%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 41%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 42%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 43%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 44%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 45%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 46%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 47%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 48%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 49%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 50%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 51%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 52%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 53%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 54%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 55%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 56%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 57%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 58%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 59%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 60%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 61%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 62%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 63%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 64%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 65%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 66%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 67%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 68%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 69%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 70%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 71%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 72%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 73%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 74%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 75%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 76%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 77%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 78%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 79%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 80%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 81%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 82%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 83%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 84%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 85%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 86%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 87%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 88%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 89%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 90%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 91%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 92%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 93%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 94%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 95%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 96%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 97%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 98%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 99%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 100%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 100%% complete && echo Stop code: CRITICAL_PROCESS_DIED && echo What failed: ntoskrnl.exe && ping localhost -n 4 >nul && cls && color 07 && echo Restarting... && ping localhost -n 3 >nul && cls && color 17 && echo PhoenixBIOS v4.0 && echo Initializing hardware... && ping localhost -n 2 >nul && echo Checking disk... && ping localhost -n 2 >nul && echo Disk error detected! && echo Attempting automatic repair... && ping localhost -n 2 >nul && cls && color 0C && echo CRITICAL FAILURE! && echo File table corrupted! && echo Deleting all sectors... && echo Wiping disk... 1%% && ping localhost -n 2 >nul && echo Wiping disk... 2%% && ping localhost -n 2 >nul && echo Wiping disk... 3%% && ping localhost -n 2 >nul && echo Wiping disk... 4%% && ping localhost -n 2 >nul && echo Wiping disk... 5%% && ping localhost -n 2 >nul && echo Wiping disk... 6%% && ping localhost -n 2 >nul && echo Wiping disk... 7%% && ping localhost -n 2 >nul && echo Wiping disk... 8%% && ping localhost -n 2 >nul && echo Wiping disk... 9%% && ping localhost -n 2 >nul && echo Wiping disk... 10%% && ping localhost -n 2 >nul && echo Wiping disk... 11%% && ping localhost -n 2 >nul && echo Wiping disk... 12%% && ping localhost -n 2 >nul && echo Wiping disk... 13%% && ping localhost -n 2 >nul && echo Wiping disk... 14%% && ping localhost -n 2 >nul && echo Wiping disk... 15%% && ping localhost -n 2 >nul && echo Wiping disk... 16%% && ping localhost -n 2 >nul && echo Wiping disk... 17%% && ping localhost -n 2 >nul && echo Wiping disk... 18%% && ping localhost -n 2 >nul && echo Wiping disk... 19%% && ping localhost -n 2 >nul && echo Wiping disk... 20%% && ping localhost -n 2 >nul && echo Wiping disk... 21%% && ping localhost -n 2 >nul && echo Wiping disk... 22%% && ping localhost -n 2 >nul && echo Wiping disk... 23%% && ping localhost -n 2 >nul && echo Wiping disk... 24%% && ping localhost -n 2 >nul && echo Wiping disk... 25%% && ping localhost -n 2 >nul && echo Wiping disk... 26%% && ping localhost -n 2 >nul && echo Wiping disk... 27%% && ping localhost -n 2 >nul && echo Wiping disk... 28%% && ping localhost -n 2 >nul && echo Wiping disk... 29%% && ping localhost -n 2 >nul && echo Wiping disk... 30%% && ping localhost -n 2 >nul && echo Wiping disk... 31%% && ping localhost -n 2 >nul && echo Wiping disk... 32%% && ping localhost -n 2 >nul && echo Wiping disk... 33%% && ping localhost -n 2 >nul && echo Wiping disk... 34%% && ping localhost -n 2 >nul && echo Wiping disk... 35%% && ping localhost -n 2 >nul && echo Wiping disk... 36%% && ping localhost -n 2 >nul && echo Wiping disk... 37%% && ping localhost -n 2 >nul && echo Wiping disk... 38%% && ping localhost -n 2 >nul && echo Wiping disk... 39%% && ping localhost -n 2 >nul && echo Wiping disk... 40%% && ping localhost -n 2 >nul && echo Wiping disk... 41%% && ping localhost -n 2 >nul && echo Wiping disk... 42%% && ping localhost -n 2 >nul && echo Wiping disk... 43%% && ping localhost -n 2 >nul && echo Wiping disk... 44%% && ping localhost -n 2 >nul && echo Wiping disk... 45%% && ping localhost -n 2 >nul && echo Wiping disk... 46%% && ping localhost -n 2 >nul && echo Wiping disk... 47%% && ping localhost -n 2 >nul && echo Wiping disk... 48%% && ping localhost -n 2 >nul && echo Wiping disk... 49%% && ping localhost -n 2 >nul && echo Wiping disk... 50%% && ping localhost -n 2 >nul && echo Wiping disk... 51%% && ping localhost -n 2 >nul && echo Wiping disk... 52%% && ping localhost -n 2 >nul && echo Wiping disk... 53%% && ping localhost -n 2 >nul && echo Wiping disk... 54%% && ping localhost -n 2 >nul && echo Wiping disk... 55%% && ping localhost -n 2 >nul && echo Wiping disk... 56%% && ping localhost -n 2 >nul && echo Wiping disk... 57%% && ping localhost -n 2 >nul && echo Wiping disk... 58%% && ping localhost -n 2 >nul && echo Wiping disk... 59%% && ping localhost -n 2 >nul && echo Wiping disk... 60%% && ping localhost -n 2 >nul && echo Wiping disk... 61%% && ping localhost -n 2 >nul && echo Wiping disk... 62%% && ping localhost -n 2 >nul && echo Wiping disk... 63%% && ping localhost -n 2 >nul && echo Wiping disk... 64%% && ping localhost -n 2 >nul && echo Wiping disk... 65%% && ping localhost -n 2 >nul && echo Wiping disk... 66%% && ping localhost -n 2 >nul && echo Wiping disk... 67%% && ping localhost -n 2 >nul && echo Wiping disk... 68%% && ping localhost -n 2 >nul && echo Wiping disk... 69%% && ping localhost -n 2 >nul && echo Wiping disk... 70%% && ping localhost -n 2 >nul && echo Wiping disk... 71%% && ping localhost -n 2 >nul && echo Wiping disk... 72%% && ping localhost -n 2 >nul && echo Wiping disk... 73%% && ping localhost -n 2 >nul && echo Wiping disk... 74%% && ping localhost -n 2 >nul && echo Wiping disk... 75%% && ping localhost -n 2 >nul && echo Wiping disk... 76%% && ping localhost -n 2 >nul && echo Wiping disk... 77%% && ping localhost -n 2 >nul && echo Wiping disk... 78%% && ping localhost -n 2 >nul && echo Wiping disk... 79%% && ping localhost -n 2 >nul && echo Wiping disk... 80%% && ping localhost -n 2 >nul && echo Wiping disk... 81%% && ping localhost -n 2 >nul && echo Wiping disk... 82%% && ping localhost -n 2 >nul && echo Wiping disk... 83%% && ping localhost -n 2 >nul && echo Wiping disk... 84%% && ping localhost -n 2 >nul && echo Wiping disk... 85%% && ping localhost -n 2 >nul && echo Wiping disk... 86%% && ping localhost -n 2 >nul && echo Wiping disk... 87%% && ping localhost -n 2 >nul && echo Wiping disk... 88%% && ping localhost -n 2 >nul && echo Wiping disk... 89%% && ping localhost -n 2 >nul && echo Wiping disk... 90%% && ping localhost -n 2 >nul && echo Wiping disk... 91%% && ping localhost -n 2 >nul && echo Wiping disk... 92%% && ping localhost -n 2 >nul && echo Wiping disk... 93%% && ping localhost -n 2 >nul && echo Wiping disk... 94%% && ping localhost -n 2 >nul && echo Wiping disk... 95%% && ping localhost -n 2 >nul && echo Wiping disk... 96%% && ping localhost -n 2 >nul && echo Wiping disk... 97%% && ping localhost -n 2 >nul && echo Wiping disk... 98%% && ping localhost -n 2 >nul && echo Wiping disk... 99%% && ping localhost -n 2 >nul && echo Wiping disk... 100%% && ping localhost -n 2 >nul && echo. && echo ALL DATA HAS BEEN REMOVED! && ping localhost -n 4 >nul && cls && color 0A && echo Just kidding :D && echo Nothing was deleted. && echo Your PC is totally fine!
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:1888

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\welcome.vbs"
1⤵
- Suspicious use of WriteProcessMemory
PID:5360
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /k mode con: cols=120 lines=40 && color 1F && title Windows Error && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 0%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 1%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 2%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 3%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 4%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 5%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 6%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 7%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 8%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 9%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 10%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 11%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 12%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 13%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 14%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 15%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 16%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 17%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 18%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 19%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 20%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 21%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 22%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 23%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 24%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 25%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 26%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 27%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 28%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 29%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 30%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 31%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 32%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 33%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 34%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 35%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 36%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 37%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 38%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 39%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 40%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 41%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 42%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 43%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 44%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 45%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 46%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 47%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 48%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 49%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 50%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 51%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 52%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 53%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 54%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 55%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 56%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 57%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 58%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 59%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 60%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 61%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 62%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 63%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 64%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 65%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 66%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 67%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 68%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 69%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 70%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 71%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 72%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 73%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 74%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 75%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 76%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 77%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 78%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 79%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 80%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 81%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 82%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 83%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 84%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 85%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 86%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 87%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 88%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 89%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 90%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 91%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 92%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 93%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 94%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 95%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 96%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 97%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 98%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 99%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 100%% complete && ping localhost -n 2 >nul && cls && echo. && echo :( && echo. && echo Your PC ran into a problem and needs to restart. && echo We're just collecting some error info... && echo. && echo 100%% complete && echo Stop code: CRITICAL_PROCESS_DIED && echo What failed: ntoskrnl.exe && ping localhost -n 4 >nul && cls && color 07 && echo Restarting... && ping localhost -n 3 >nul && cls && color 17 && echo PhoenixBIOS v4.0 && echo Initializing hardware... && ping localhost -n 2 >nul && echo Checking disk... && ping localhost -n 2 >nul && echo Disk error detected! && echo Attempting automatic repair... && ping localhost -n 2 >nul && cls && color 0C && echo CRITICAL FAILURE! && echo File table corrupted! && echo Deleting all sectors... && echo Wiping disk... 1%% && ping localhost -n 2 >nul && echo Wiping disk... 2%% && ping localhost -n 2 >nul && echo Wiping disk... 3%% && ping localhost -n 2 >nul && echo Wiping disk... 4%% && ping localhost -n 2 >nul && echo Wiping disk... 5%% && ping localhost -n 2 >nul && echo Wiping disk... 6%% && ping localhost -n 2 >nul && echo Wiping disk... 7%% && ping localhost -n 2 >nul && echo Wiping disk... 8%% && ping localhost -n 2 >nul && echo Wiping disk... 9%% && ping localhost -n 2 >nul && echo Wiping disk... 10%% && ping localhost -n 2 >nul && echo Wiping disk... 11%% && ping localhost -n 2 >nul && echo Wiping disk... 12%% && ping localhost -n 2 >nul && echo Wiping disk... 13%% && ping localhost -n 2 >nul && echo Wiping disk... 14%% && ping localhost -n 2 >nul && echo Wiping disk... 15%% && ping localhost -n 2 >nul && echo Wiping disk... 16%% && ping localhost -n 2 >nul && echo Wiping disk... 17%% && ping localhost -n 2 >nul && echo Wiping disk... 18%% && ping localhost -n 2 >nul && echo Wiping disk... 19%% && ping localhost -n 2 >nul && echo Wiping disk... 20%% && ping localhost -n 2 >nul && echo Wiping disk... 21%% && ping localhost -n 2 >nul && echo Wiping disk... 22%% && ping localhost -n 2 >nul && echo Wiping disk... 23%% && ping localhost -n 2 >nul && echo Wiping disk... 24%% && ping localhost -n 2 >nul && echo Wiping disk... 25%% && ping localhost -n 2 >nul && echo Wiping disk... 26%% && ping localhost -n 2 >nul && echo Wiping disk... 27%% && ping localhost -n 2 >nul && echo Wiping disk... 28%% && ping localhost -n 2 >nul && echo Wiping disk... 29%% && ping localhost -n 2 >nul && echo Wiping disk... 30%% && ping localhost -n 2 >nul && echo Wiping disk... 31%% && ping localhost -n 2 >nul && echo Wiping disk... 32%% && ping localhost -n 2 >nul && echo Wiping disk... 33%% && ping localhost -n 2 >nul && echo Wiping disk... 34%% && ping localhost -n 2 >nul && echo Wiping disk... 35%% && ping localhost -n 2 >nul && echo Wiping disk... 36%% && ping localhost -n 2 >nul && echo Wiping disk... 37%% && ping localhost -n 2 >nul && echo Wiping disk... 38%% && ping localhost -n 2 >nul && echo Wiping disk... 39%% && ping localhost -n 2 >nul && echo Wiping disk... 40%% && ping localhost -n 2 >nul && echo Wiping disk... 41%% && ping localhost -n 2 >nul && echo Wiping disk... 42%% && ping localhost -n 2 >nul && echo Wiping disk... 43%% && ping localhost -n 2 >nul && echo Wiping disk... 44%% && ping localhost -n 2 >nul && echo Wiping disk... 45%% && ping localhost -n 2 >nul && echo Wiping disk... 46%% && ping localhost -n 2 >nul && echo Wiping disk... 47%% && ping localhost -n 2 >nul && echo Wiping disk... 48%% && ping localhost -n 2 >nul && echo Wiping disk... 49%% && ping localhost -n 2 >nul && echo Wiping disk... 50%% && ping localhost -n 2 >nul && echo Wiping disk... 51%% && ping localhost -n 2 >nul && echo Wiping disk... 52%% && ping localhost -n 2 >nul && echo Wiping disk... 53%% && ping localhost -n 2 >nul && echo Wiping disk... 54%% && ping localhost -n 2 >nul && echo Wiping disk... 55%% && ping localhost -n 2 >nul && echo Wiping disk... 56%% && ping localhost -n 2 >nul && echo Wiping disk... 57%% && ping localhost -n 2 >nul && echo Wiping disk... 58%% && ping localhost -n 2 >nul && echo Wiping disk... 59%% && ping localhost -n 2 >nul && echo Wiping disk... 60%% && ping localhost -n 2 >nul && echo Wiping disk... 61%% && ping localhost -n 2 >nul && echo Wiping disk... 62%% && ping localhost -n 2 >nul && echo Wiping disk... 63%% && ping localhost -n 2 >nul && echo Wiping disk... 64%% && ping localhost -n 2 >nul && echo Wiping disk... 65%% && ping localhost -n 2 >nul && echo Wiping disk... 66%% && ping localhost -n 2 >nul && echo Wiping disk... 67%% && ping localhost -n 2 >nul && echo Wiping disk... 68%% && ping localhost -n 2 >nul && echo Wiping disk... 69%% && ping localhost -n 2 >nul && echo Wiping disk... 70%% && ping localhost -n 2 >nul && echo Wiping disk... 71%% && ping localhost -n 2 >nul && echo Wiping disk... 72%% && ping localhost -n 2 >nul && echo Wiping disk... 73%% && ping localhost -n 2 >nul && echo Wiping disk... 74%% && ping localhost -n 2 >nul && echo Wiping disk... 75%% && ping localhost -n 2 >nul && echo Wiping disk... 76%% && ping localhost -n 2 >nul && echo Wiping disk... 77%% && ping localhost -n 2 >nul && echo Wiping disk... 78%% && ping localhost -n 2 >nul && echo Wiping disk... 79%% && ping localhost -n 2 >nul && echo Wiping disk... 80%% && ping localhost -n 2 >nul && echo Wiping disk... 81%% && ping localhost -n 2 >nul && echo Wiping disk... 82%% && ping localhost -n 2 >nul && echo Wiping disk... 83%% && ping localhost -n 2 >nul && echo Wiping disk... 84%% && ping localhost -n 2 >nul && echo Wiping disk... 85%% && ping localhost -n 2 >nul && echo Wiping disk... 86%% && ping localhost -n 2 >nul && echo Wiping disk... 87%% && ping localhost -n 2 >nul && echo Wiping disk... 88%% && ping localhost -n 2 >nul && echo Wiping disk... 89%% && ping localhost -n 2 >nul && echo Wiping disk... 90%% && ping localhost -n 2 >nul && echo Wiping disk... 91%% && ping localhost -n 2 >nul && echo Wiping disk... 92%% && ping localhost -n 2 >nul && echo Wiping disk... 93%% && ping localhost -n 2 >nul && echo Wiping disk... 94%% && ping localhost -n 2 >nul && echo Wiping disk... 95%% && ping localhost -n 2 >nul && echo Wiping disk... 96%% && ping localhost -n 2 >nul && echo Wiping disk... 97%% && ping localhost -n 2 >nul && echo Wiping disk... 98%% && ping localhost -n 2 >nul && echo Wiping disk... 99%% && ping localhost -n 2 >nul && echo Wiping disk... 100%% && ping localhost -n 2 >nul && echo. && echo ALL DATA HAS BEEN REMOVED! && ping localhost -n 4 >nul && cls && color 0A && echo Just kidding :D && echo Nothing was deleted. && echo Your PC is totally fine!
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:3688

C:\Windows\System32\oobe\UserOOBEBroker.exe
C:\Windows\System32\oobe\UserOOBEBroker.exe -Embedding
1⤵
- Drops file in Windows directory
PID:4876

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe -Embedding
1⤵
- System Location Discovery: System Language Discovery
PID:3304

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4600

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
1⤵
- System Location Discovery: System Language Discovery
PID:4968

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,Control_RunDLL C:\Windows\System32\srchadmin.dll ,
1⤵
PID:3048

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x25c,0x304,0x7ff958d9c188,0x7ff958d9c194,0x7ff958d9c1a0
  2⤵
  PID:1464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=de --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2040,i,15188708480231612615,5110434013043748432,524288 --field-trial-handle=2424,i,18164175057595890054,15352478856686848097,262144 --variations-seed-version --mojo-platform-channel-handle=2460 /prefetch:11
  2⤵
  - System Time Discovery
  PID:2156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1920,i,5743190952708394704,407934326890156674,262144 --field-trial-handle=2424,i,18164175057595890054,15352478856686848097,262144 --variations-seed-version --mojo-platform-channel-handle=2420 /prefetch:2
  2⤵
  PID:4576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=de --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2620,i,1554551016741918124,8140101088141066990,524288 --field-trial-handle=2424,i,18164175057595890054,15352478856686848097,262144 --variations-seed-version --mojo-platform-channel-handle=2876 /prefetch:13
  2⤵
  PID:5552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=de --js-flags=--ms-user-locale=de_DE --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3600,i,6914213516518293192,16733691995364352973,2097152 --field-trial-handle=2424,i,18164175057595890054,15352478856686848097,262144 --variations-seed-version --mojo-platform-channel-handle=3624 /prefetch:1
  2⤵
  PID:3808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=de --js-flags=--ms-user-locale=de_DE --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3612,i,13485161158249444896,14404809353994284309,2097152 --field-trial-handle=2424,i,18164175057595890054,15352478856686848097,262144 --variations-seed-version --mojo-platform-channel-handle=3628 /prefetch:1
  2⤵
  PID:1312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=de --js-flags=--ms-user-locale=de_DE --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4328,i,13028025004719549087,13984179853472685355,2097152 --field-trial-handle=2424,i,18164175057595890054,15352478856686848097,262144 --variations-seed-version --mojo-platform-channel-handle=4776 /prefetch:1
  2⤵
  PID:4248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=de --js-flags=--ms-user-locale=de_DE --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4348,i,12455505189884565453,6579239310984970839,2097152 --field-trial-handle=2424,i,18164175057595890054,15352478856686848097,262144 --variations-seed-version --mojo-platform-channel-handle=4784 /prefetch:9
  2⤵
  PID:2816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=de --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5348,i,6501450466763179806,2657780966602517902,524288 --field-trial-handle=2424,i,18164175057595890054,15352478856686848097,262144 --variations-seed-version --mojo-platform-channel-handle=5132 /prefetch:14
  2⤵
  PID:1076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=de --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5400,i,13691943836202921392,4327318842785550248,524288 --field-trial-handle=2424,i,18164175057595890054,15352478856686848097,262144 --variations-seed-version --mojo-platform-channel-handle=5456 /prefetch:14
  2⤵
  PID:6076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=de --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5392,i,3227216374475444264,8434244089813535713,524288 --field-trial-handle=2424,i,18164175057595890054,15352478856686848097,262144 --variations-seed-version --mojo-platform-channel-handle=5464 /prefetch:14
  2⤵
  PID:1708
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=de --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6108,i,6292175836187162261,6296215316217010314,524288 --field-trial-handle=2424,i,18164175057595890054,15352478856686848097,262144 --variations-seed-version --mojo-platform-channel-handle=6052 /prefetch:14
  2⤵
  PID:5388
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=de --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6108,i,6292175836187162261,6296215316217010314,524288 --field-trial-handle=2424,i,18164175057595890054,15352478856686848097,262144 --variations-seed-version --mojo-platform-channel-handle=6052 /prefetch:14
  2⤵
  PID:3528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=de --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6696,i,8287120871879343168,9769974196310840290,524288 --field-trial-handle=2424,i,18164175057595890054,15352478856686848097,262144 --variations-seed-version --mojo-platform-channel-handle=6704 /prefetch:14
  2⤵
  PID:2080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=de --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5788,i,5951916790205744328,2353411678765907192,524288 --field-trial-handle=2424,i,18164175057595890054,15352478856686848097,262144 --variations-seed-version --mojo-platform-channel-handle=6608 /prefetch:14
  2⤵
  PID:5600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=de --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1396,i,6301272457951501382,4436625980001801281,524288 --field-trial-handle=2424,i,18164175057595890054,15352478856686848097,262144 --variations-seed-version --mojo-platform-channel-handle=1276 /prefetch:14
  2⤵
  PID:2400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=de --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1404,i,1357247027539421616,1435030363103220857,524288 --field-trial-handle=2424,i,18164175057595890054,15352478856686848097,262144 --variations-seed-version --mojo-platform-channel-handle=1380 /prefetch:14
  2⤵
  PID:2060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=de --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1412,i,10792607345365841798,16187822451740703218,524288 --field-trial-handle=2424,i,18164175057595890054,15352478856686848097,262144 --variations-seed-version --mojo-platform-channel-handle=6252 /prefetch:14
  2⤵
  PID:6044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=de --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5024,i,12629040332035741316,17246892666999841005,524288 --field-trial-handle=2424,i,18164175057595890054,15352478856686848097,262144 --variations-seed-version --mojo-platform-channel-handle=5000 /prefetch:14
  2⤵
  PID:1100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=de --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6524,i,5912648614832706600,3367259747920374776,524288 --field-trial-handle=2424,i,18164175057595890054,15352478856686848097,262144 --variations-seed-version --mojo-platform-channel-handle=4768 /prefetch:14
  2⤵
  PID:4260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=de --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5564,i,14903741136461233593,18210763217172649380,524288 --field-trial-handle=2424,i,18164175057595890054,15352478856686848097,262144 --variations-seed-version --mojo-platform-channel-handle=4340 /prefetch:14
  2⤵
  PID:1932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=de --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6100,i,2395222456980512027,5523527754356292913,524288 --field-trial-handle=2424,i,18164175057595890054,15352478856686848097,262144 --variations-seed-version --mojo-platform-channel-handle=6192 /prefetch:14
  2⤵
  PID:916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6484,i,15242331990893727438,12977679990763873265,262144 --field-trial-handle=2424,i,18164175057595890054,15352478856686848097,262144 --variations-seed-version --mojo-platform-channel-handle=3592 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=de --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3568,i,15254296260292952528,2408520580573895313,524288 --field-trial-handle=2424,i,18164175057595890054,15352478856686848097,262144 --variations-seed-version --mojo-platform-channel-handle=5792 /prefetch:14
  2⤵
  PID:6116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=de --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6728,i,6274628842561084335,3760662753396503655,524288 --field-trial-handle=2424,i,18164175057595890054,15352478856686848097,262144 --variations-seed-version --mojo-platform-channel-handle=3704 /prefetch:14
  2⤵
  PID:2832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=de --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6160,i,3616723896152248289,3052370482289357265,524288 --field-trial-handle=2424,i,18164175057595890054,15352478856686848097,262144 --variations-seed-version --mojo-platform-channel-handle=5616 /prefetch:14
  2⤵
  PID:3244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=de --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5032,i,17219253883640480540,13118350362664726277,524288 --field-trial-handle=2424,i,18164175057595890054,15352478856686848097,262144 --variations-seed-version --mojo-platform-channel-handle=4340 /prefetch:14
  2⤵
  PID:6136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=de --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3332,i,7330825273692241523,2715155109409311434,524288 --field-trial-handle=2424,i,18164175057595890054,15352478856686848097,262144 --variations-seed-version --mojo-platform-channel-handle=5740 /prefetch:14
  2⤵
  PID:3260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=de --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6976,i,17105663565426370838,1819889101041620209,524288 --field-trial-handle=2424,i,18164175057595890054,15352478856686848097,262144 --variations-seed-version --mojo-platform-channel-handle=6072 /prefetch:14
  2⤵
  PID:1592

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5248

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2780

C:\Windows\system32\control.exe
"C:\Windows\system32\control.exe" /name Microsoft.AdministrativeTools
1⤵
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:3792

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
1⤵
- System Location Discovery: System Language Discovery
PID:1164

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{5BD95610-9434-43C2-886C-57852CC8A120} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3704
- C:\Windows\system32\iscsicpl.exe
  "C:\Windows\system32\iscsicpl.exe"
  2⤵
  PID:4652
- C:\Windows\system32\mmc.exe
  "C:\Windows\system32\mmc.exe" "C:\Windows\system32\comexp.msc"
  2⤵
  - Drops file in System32 directory
  - Modifies registry class
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious behavior: SetClipboardViewer
  - Suspicious use of SetWindowsHookEx
  PID:1044
- C:\Windows\system32\msconfig.exe
  "C:\Windows\system32\msconfig.exe"
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:2480

C:\Windows\system32\SystemSettingsAdminFlows.exe
"C:\Windows\system32\SystemSettingsAdminFlows.exe" OptionalFeaturesAdminHelper
1⤵
PID:3024

C:\Windows\system32\mmc.exe
"C:\Windows\system32\mmc.exe" "C:\Windows\system32\taskschd.msc"
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:764

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /7
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:772

C:\Windows\system32\dllhost.exe
C:\Windows\system32\dllhost.exe /Processid:{02D4B3F1-FD88-11D1-960D-00805FC79235}
1⤵
- Drops file in Windows directory
PID:3516

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:1916

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k AxInstSVGroup -s AxInstSV
1⤵
PID:2108

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /7
1⤵
PID:2732

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:1276

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

53e5ffa0-5b7f-4eff-9c45-53cfb294fb0e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\53e5ffa0-5b7f-4eff-9c45-53cfb294fb0e.tmp
Size 35KB
SHA256 3dd850983d108689a6d05cf3195514536c737ff0b1e2777551f75ddccf576147
MD5 60e96110629aab71032e7f047033e35d
SHA1 f0782c906593d31285e336c2cf6613d99bd9bd9f
SHA512 a984f656c2877bf2fbc344d1b9482d09d89364350f1a3b4d67ff498c467ee792d07c0d419475f8b48098ecbc06b570a8acd5da28af05ed6410b7832da0c4401c
SSDEEP 768:wj+9q3S8Ms0rjfef9Yf9gkZ0SEbuRpag62Dai+fAh4/+0+vo:P9q3tYfefufCrijag6E+IC/Kvo
TLSH
T1DBF2BF718879CDB34CEB9399B51A3ACA6EB41953D4C51F888EDC5B0E05C72ED170782B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 02e83107bdf4cefad04d7dffca4065fb67146265abf734fc1a0a6c97297b321d
MD5 e502aaa276aa06e6296f6ef4749253aa
SHA1 99b55990cdf0fa9357771717d8ade2d2ba1023a1
SHA512 2f9d794c6e91e4888f5f7323dc7b92a27fbabf3cf561300c11be8833a6a0a6f5855daaa7cfc1901faab9b2932d40d1361bee35e50c2951c0e558a06150e71a6f
TLSH
T131D080707755F505D5CA25B9FD146315523B8A5220E3C61D7160D00DEE940D5EB8B457
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a73b32029b5d0c6ff7ae727c0f35079c0207fb5160bb2094317e96e23daf1cee
MD5 5fd2ab1b84f4c46ecb80443cacd9d150
SHA1 dd5f53ee71d94f4de7f9196f7dd42d06437a3320
SHA512 80afd342835e5b7c47013c2e8821b8636a9782f5c0541da2d81ad7da7f1be3e061af3ccb4f9143b3b85ff16c6113c3f6bf41ea64da18da643b2cf34c67ef65d1
TLSH
T1C2D0C0303300F601C0CA24B4FC106311123B8A1230E3C21D7020D00DEE940D0EB8B45B
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 fd98ada947cd1aacd31b75327249ed589bf3d36cedaa230f2766af72bd942f1d
MD5 3e3c4070376ddad4a8361d8262f1e860
SHA1 23e9795e5c11987c5a8b7ad6bbdfc041e175c0d6
SHA512 20639dc8ca04587901271c6c4e33fd68b44b70663c95fbb541061973b55744d433b0fe860fbc045e22bec6460862fe2e1b50c4975c8846d3d4f89b107212e8a9
TLSH
T13251E94C8EEE08A3CF361CF950DC5D08AFF5E567082A1B633428687469676C71A7388D
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe60471f.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe60471f.TMP
Size 1KB
SHA256 a48398e7f05aecfe6a1c7b9eb3cb3c8de5c3b08013f0bc4fa8138cd5d34c965e
MD5 36c8a2674033772c2e098f8a9f600f21
SHA1 710ef68bcd39825733bfad0838cdd538a6deef13
SHA512 bd91af85316e2c6497a5ae940210e680fa6314066306729050a7b96fb7f60782880d1cc46d4d25316189db36dd858d34da3b789bc8d3cf502e0dcf5313393664
TLSH
T1103164999E6F15D3D7171DBA20D0A28A3374C87659132E736E546D34DEAB30B3307889
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 d0ccfc8e9fa622249b191a53b9101d19c2b408e2cc712086eb9ce0a04558ce1e
MD5 1a0fe6260e65b486bab9686b1de9d9c9
SHA1 1e5de3343e0bb6159992a9e55da4682bbe67d2ad
SHA512 21257399d05484405e1d72ffe5fe5aa57c3dc0d207c7b4655cfc727e1029c7e845303974ff8d57e827da649249a465df91bba1191c3eb74cd0a0469cb65803d8
TLSH
T1DA61CDF3C3E9862DC90191F0BA147F1BCE190851536C3D4A89E4AF4BA3F28B1E151B8E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 e1e8c2b88c3cdfb378b94c94b7e4c976862ef140f2faca3525e48bdae5a3f76e
MD5 35a30de256da9743beea93671da2b0dd
SHA1 81e16d610195b49d77fb7100227dc623e1497162
SHA512 35187625f237fc7d04479016cbebc72f3f2f218d74b19395b2aba8195d4a0fa01b1a1da0b41281a32f397393a2f2625b9eb67f917a9dc37f3574e866a25789e1
SSDEEP 384:sxRrnvfq/i/fqs7Oc44BbfWe/584/itsci:snvi/i/fZOKpF/58qitsJ
TLSH
T19272C70AA924497BDCDBD219F9567F93D6F81473B1941E48A6FCCA0C04E6ADD131382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 fbc8cdf9feaa2e9a68bddc6ea3bda0084e574e5857e63fc8b34984d9054d88cc
MD5 53566329b05bbf9bbc25e3936d1bccf1
SHA1 2664e61813fb24312ca3e6813c591f6d953f1327
SHA512 4641ca68a6fe9e6be123f9675760c090e7db1b6d21fd7ac3cd31c674d141ca11d605603e390c9eac1701cddd6b68ca159a97c9a277b4e60bdf3a41f7d94a642e
SSDEEP 384:sxRrnvfxi/fqs7sc44BbfWo/584/htscE:snv5i/fZsKpX/58qhts/
TLSH
T1D372D70AA924593BDCDBD219F9567F93D6F81463B1941E48EAFCCA0C04E6ADD131382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 44b4f2e7c1b05ee3100eb8f00a21681d08b2056e56e5abfb35eb1b68188b0b18
MD5 98277ee6a3675f60d3028b56fb580544
SHA1 b0c445d0d200c7cdd93be2966ff5fa19d721e59d
SHA512 67051b3a39e7d2e71ad383b02233c041ccf705a6add70e5432d4723a4442a09d496c0addd7bf5cff423b6c7c7e24baee9336770caa7a5896415c1d6d90fee7de
SSDEEP 384:sxR0nvfxi/fqsNsc44BbfWo/584/htsc3:sav5i/fLsKpX/58qhtsW
TLSH
T12D72D60AA924593BDDDBD219F9567F93D6F81423B1941E48EAFCCA0C04E6ADD131382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 19febaa2bca98ad72e9554bdb10960c7500c65f557731201d6713b9a1eb17644
MD5 3ac868256344e83ad88b203ad463fe42
SHA1 29f06b9721fb4566e17cd92dbe35c412305f37a3
SHA512 f12e8bd427dbc988097547eb3c91f36e7d4c7136aa63bbc25c745b13fcad03c3d073552f0a3705e5139de6f4e2664a26b47d3cf049a9f983797d1d692f8fd574
SSDEEP 768:QMUh917pLkdL7TCWgmcfXw8F1+UoAYDCx9Tuqh0VfUC9xbog/OVcCi2oK8ro2Qe8:QMUh9DkJ7TCWgmcfXwu1jafCidKn2Qe8
TLSH
T193E20D3B280CC77E4F804DDCFC2ABD8A6DA801CF5698C95447EE891C03C6AEB551A5DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\24940266-1cb4-4ed3-8f4e-b0bfa3bf91f6\index-dir\the-real-index
Size 72B
SHA256 6d8b0f49a9121286ae65f2316dca57e878d6a4a90402450f419d735940d105a0
MD5 2841dfd02e15803afe31615a6da3b4b9
SHA1 27bd51cf2ca9370fcf1dacfe8eb8d80c4069a3a7
SHA512 efb08589846ca9fb90791254088e57377bcdda7dea63ee64cbbced50cda429130c4e71bd7b81ea41cc1721c8b185f6ba10d6f78002c65df966ccf43d3338a428
TLSH
T110A0023056D44A17C011437C70CA05602615C960A622074140904268CA711E7418304E
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\c404dd0d-bd2c-49de-9bf6-c5bb72b4c6d5\index-dir\the-real-index
Size 3KB
SHA256 c6f64db55e81c5b1bfade723b2a3be7c92603dcfee224b80d76c56dd79c44bb6
MD5 5c845a5bc40baff810e86bdb9580c109
SHA1 13ba2243e573f5fc3cb9a805e61b9e16d515bb1b
SHA512 1df4fa1c6099deb55503a464fffbec29c879be305eac739612dcbd19358a2eaf75a34c41f78655ab012baa0bfb4e35db08a872c5f9dc699d58aa5b440734bc67
TLSH
T10D51955E5C97172EDD78127364B714483B39AACC3A48CE1325FC5138ACC7E392D6926E
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe604a8a.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\c404dd0d-bd2c-49de-9bf6-c5bb72b4c6d5\index-dir\the-real-index~RFe604a8a.TMP
Size 48B
SHA256 b3f5ef09ba1cabf4e2b3fccbd1b3cdad8bbbda4631a66231223f1bea34efa91c
MD5 ee675d9bc2bd7b7f5632c4a5b1adc717
SHA1 1fe7745ca43048ffbce4e24e0fee88b717a91777
SHA512 7cbcad57fb536bea9dd4c4903606215a646747c5a7b92c54b1c5b149368eb7ca8cdb3fa160842668b0a1a3133a43b2a628f807dde351437b0126d9ed8ef87662
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 375B
SHA256 f8aa39b8990f471bc822074d0022babea793d90ce7bc87c0d0620ddd8726c630
MD5 43d66f2e67eeb7b705840d1ec74ca40c
SHA1 e40349283940aa0b9fd041f5473e37f809596226
SHA512 1e6c8f8738ae3759910fb4e392ed3aea2e9a1c3b503405bede9770927d2071d45a4548fa94dbb1729dec0824360491a0ef589a393059d84d20aeda041aac8ce0
TLSH
T18DE0D8BB2DE71824F97A97D7587550A600457C54C444ECCE202BA5D7E0B1326251AD36
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 da5cd5f962dc69fa64fdb5b6c75b9aaabf60429668f45f6b0ea8edea28aee5fa
MD5 55265e99611aaeef16b514e10d11b1b2
SHA1 2db1ced350be4e80a5840416bf9006e0c37a699c
SHA512 7d0c117f2997beb51d6ccc78478e33ac2ff2d5c52d973b2eeabeb3b74dfd84cdc57e468a3ca55ebd0c4c2a59396ff4f5dbf2b2071feb0ff936c65c402b864e3d
TLSH
T198E0D8BB2DE71824F9AA97E65475906600417454C454ECCE202AD5D7D0A17252516D36
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 0d7c4fb3fab119c590ebdfd3076875792766b6418b063efbe8792ad57b386b96
MD5 884387cec1f9de83aa3230c1c4e5e3ea
SHA1 e0ca0e8266f89fb7c9afe0323f6ec4d49d9172ba
SHA512 6e0aa1c68a7c37a81e4e059bda219f0089b1402a4b75a9a44fede1c6d649b58ead9927ded4781cf7e17fd92af25a5f467094f9c588c8b1bad69836ed68eea32a
TLSH
T1EFA00252CD46100DD25043B5369612D627A6CE549D052229C0E2E156EC546414521844
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe602ea5.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe602ea5.TMP
Size 48B
SHA256 879b3031000cf46143c49e31f5b674b0d6e743b6a7f9348c9a069cd4987239f2
MD5 28c82600ec13c32f5fc7d8d83ccb6b3d
SHA1 79ea77bc4c369531b9d4732b97194ac580316d27
SHA512 db04e5f41911ac6587168fab9b5d81c14a6d14f1a188829e17fb0055bea843e5f991bc42fb88c3a062966adc4929b77a29f6043e07ecbf59c07f1a1772a4ea7a
MD5 SHA1 SHA512

Submit Download

0485c797-e288-4235-9437-928352f00d28.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\0485c797-e288-4235-9437-928352f00d28.tmp
Size 22KB
SHA256 e482e0287f5d53c3ba44f707953029fd78a279155339825c80835c329a77ac98
MD5 c349164cd27e763456564bba6d4ced8d
SHA1 081af2cb261854522b6712ab8e0340eaeb01ea0b
SHA512 a24eeaabe2490e290180b02f40b4ca6138c60b7e8916b334f2ad0cb5fe1483bb97cfa581edb09860dbd044810cd390d855aa365138be3d96ad8dc1773ca37f7a
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/uj:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAe
TLSH
T1B3A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 90524fb21c35c1ff1ca185dabc3702cfb2b6edfee0233a8620e6b1f8437a5e8c
MD5 f4a9da81855a532b0277a714d96f0506
SHA1 67869a2dcdc2ec7cf691d7b98e4015c3d1cc6d63
SHA512 e5d7544f7d0898b4d57b1ff770c437ebf515812d11329e8f50e6f3e104d462f38ac3c455a4b42384b4fe9200f6ce04ce4f611e5414d050bcc5e4fded65ba13b2
SSDEEP 768:hjaeqD4MlshiLdMmM3e8Ss0rjfef9Yf9gmZ0SEbuRpag62Dai+fAh4PQTj:hqcjhIdMz3ZifefufClijag6E+ICE
TLSH
T12803C0799C7CCC738CBBA289B6163AC66EB00553C5D56F88DDDC170E06932DE160782B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 bc1f475cc30cf3906616e269427099d0f9c548e03b9576f07b7c283583edfabe
MD5 5f5a142ea94928c04f0d041a08ebfc57
SHA1 46dda50ef3bd0c5fa8ae9bdc1da3a3f85b52f826
SHA512 46819da82cb9e944349036d82a6a05d79ddcc10f8c52f61d5817f869f31190f7ddd9f7c4bec816b8350752ae736d9b6ced1e25723e87a20d9a833d2f90c4b376
SSDEEP 768:Yj+9q3d8Ms0rjfef9Yf9gkZ0SEbuRpag62Dai+fAh4/+0+vo:H9q3WYfefufCrijag6E+IC/Kvo
TLSH
T146F2BF718C79CDB34CEBA399B51A3ACA6EB41553D4C51F888EDC5B0D05872ED170782B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 bfad2583548bba8165147781ec3c431d10a76e1a5b911952c4c43ee8ad1604a2
MD5 65921342ff88d1e8195bd9e9ad7a1f7b
SHA1 bbb66d589d597af4654c668af54ff22c2f756bbf
SHA512 cc81f4414ee3762cdb04da31b0a281fe0bc3756573727e7a6e90eca01c57e8d1d2fa47d35cd2bf96d1063a4f2c40b7289f1deeac208fb0ed46891d8b9cedcaa7
SSDEEP 768:GjaeqD4MlshiLdMmi3ds0rjfef9rZ0SEbuRpag62Dai+fAdUyjWtUkTu:GqcjhIdMl3FfefQijag6E+Imyj2U
TLSH
T1B603C07A98748C778CF76385BA173A966E740583C6D67F889DDC270D06AB2DE1303827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 6db2bdace8b6e9d62efe36439a7b5d471f2373689142a604119dbefb36b5cf25
MD5 b1751ba7627f167a8998f852deebb62f
SHA1 a524d9c7269ee2c7db9c892ac2bc192e1ec9c107
SHA512 d000876ecf70f0f9ab2accb94f7c6d07bef1d04bda7e8bc999972f1978a4fe01b1918c815e391723a863ced781738eaab75a277ac66009043263cade8f63d142
SSDEEP 768:wFOj+9n3owgw8M6ofef9Yf9g6Z0SEbuRpag62Dai+fAh4/+0+vo:O9n3AOfefufCpijag6E+IC/Kvo
TLSH
T1D8038D76C869CE779CE797C5B6193A8AAEE00593C4C95EC4DACC5E4D00C72EE1707C1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 492B
SHA256 9107e613905835c00077a499d2faa20bb70b974e6309d1f2f33ae52933318f07
MD5 2012d4de563c653f56f62ccbf46db598
SHA1 fb24881003593f1ceb79019e52ce5ee9e94c889c
SHA512 c03d6584395c1c97c75af7dc6df57df358d3957035521bb6833c538679683aebe0410bb12586472b84dc98111e703984dd37868464fa9c66fdafb423e763b555
TLSH
T10CF00E829C3E25C086E90F7FE44725F840C46517B0883879088DE9D8813A40F11414BE
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
MD5 2a1939fc3b2926cf2b82fae71c5f6bee
SHA1 3f9d6974ce660bbc0c85f3d9741b734cfd466fac
SHA512 cceb75873ca288bfcb71f5d74fec5ad8ca61807ec55369055f4fbd095fd904097c974102d3296db3a1aa949c6edc5abd1a7c320e53daaf947ee61c28f5659707
TLSH
T1A3E068C29D7D26C196E60F7FD04B69F844C4580AF048697A088DE8C8913A94B258287E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 612B
SHA256 98d9b184e4c7220b5aaf7ae412b0c1b3f32e3dc4933afcf852538b8082017b9e
MD5 c20138f2b92ee0645ce99eebc563daa6
SHA1 8e20392ea25dec3d3cef957c8ebbe1a0c589ea3b
SHA512 151098a27cb44d715d48210b12b95a9d1341beb7ca1de3096edc0434ba70c3d274e446604c7692d7a4d92af7b41872166747a30fd452fd0279407a6993fc02c0
TLSH
T15DF00CD28C3E21C2C5EA0F7ED04B2AF884D46507F0887439088DEAD4C17A80F118247E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 732B
SHA256 a5548ca519cf47ecb420c8f1299a8a50517fa463459a704ef2ff17c4db35117a
MD5 b2c40634bbfa57be0d4fad8adfbd6ccb
SHA1 6f8b9ba2f40d9aa42d217ed2bc6dbcdedd1763ad
SHA512 3cfbef4e4a4a7d8fa1530c69ea34fbc3b84627888361a9d201b21e6ead15f5d4e51fea8bc95edd07415b6d2d06a3c19beb1bcea3195e05a6d8af4939b95f77b5
TLSH
T1220110D29C7E26C2C5AA0FBFD08B26EC44C4A516F098747A1CCCF9D4823980E148243E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

d5484396-8941-440c-a3d2-00f1bded88bc.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\d5484396-8941-440c-a3d2-00f1bded88bc.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

thumbcache_idx.db

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_idx.db
Size 14KB
SHA256 8ce46114ffd459efefb3b3a4e70df7ff3e8f4670610276941246ec9aebabe4fa
MD5 82fd879a3c8516970d5504ad2442db29
SHA1 5556f4564231be481363388d48e53c955c4cbc6f
SHA512 bb502943b28dfa22f8a6ba570d5e05983eb44937ebf1cc44fb0ebf3c6d48979aa6beaece4f8a46b78b31e1b92f236bb8ed619126132017e6685da13fed7414bf
SSDEEP 48:JoMP8TI6EAqwNFuPx7oV3Aj4j2j3QlL49d:hPaEScVoWg+
TLSH
T1B262831ABA52C522DC082E3A2FC9DFDD6912FEC0CE25164377F4F74F59B68834522984
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3624_2071201338\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AddRestore.m4a

Path C:\Users\Admin\Desktop\AddRestore.m4a
Size 579KB
SHA256 12fbf04f1dd3115b17391fc669dea379f4114db1fef8d8f9c2ff1d82df58326d
MD5 e2088f113e42a517b228e617278b5916
SHA1 48c88fa06a682ac32d3ecf6122bb284313050640
SHA512 498f75b67648e0ee7f97d7bd28f32034fdb4bef294e4d7faa91641e399019e7236422b279a0455dcbd1b6db1b7529f67f7620647378c414608ba82f05aa59fde
SSDEEP 12288:7Sc71i05h5COLBANGtbJMkWqS3LesUzK9VrlJW:7S4JxCOLBFbJMHbLEzK35Q
TLSH
T1D6C42332629BF8CC10AD9A025DC5DA131BC8C54A7EBE7F0E4D43A47E88177442D4DB5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CheckpointEnter.3gp2

Path C:\Users\Admin\Desktop\CheckpointEnter.3gp2
Size 219KB
SHA256 8b6ab2ffd12b722e9c6d24667cbfc203f1c7a4e500152cc2bc951d3e99846bb1
MD5 d7613e64c484a53d77673cf4046088bc
SHA1 083640729df9b2991830aae7efd6da3bf802f640
SHA512 e19f23bb5a4948bf8b7f367bee2b89e618d72645883fbeae2bc48b88880895ca300bb6c5fa0e2d6cf325951327759cd4211d80840f29a348637c8c5ca66b9cc9
SSDEEP 3072:ZeaFfvQN1gq0H0kZciALO0xnk1PtZYTorHXNku1sLlYc179vW4xnL2hYKIaP:T9vCgwO0xUPtZYsTXNtKL2w1y++
TLSH
T1C02423911442AFCE086598D813D67E407F2D48852E02739A29E7F50B9F4F9A8DCFE6F4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ClosePush.xht

Path C:\Users\Admin\Desktop\ClosePush.xht
Size 861KB
SHA256 091989388064b7cb98e9545591bd5fc08cdc447c738858dc5180e7b13e9abd9b
MD5 4a5e80718a74e000153c6f1356351fab
SHA1 901861d2c5e81053e67c5ca70625b5ea158117f0
SHA512 a36996dda2ab680272efc503e05c7c996f34cb4060a65e965642b3654ce0b6a77945c170502657560608a1572f012fd0bd040ccd685d51134198c8d67fc3c35c
SSDEEP 24576:GJ+S/8IrO4zzugTDET3YV2YXcWEJx0UPd6KsLscdlnwD1E:jSUYOkzuXT3CJWJx0fxj7SO
TLSH
T1971533E3C6C1CA0B7AF9074534EF2DAC4886FFC026A5D561DD43F2B7BA1689C4192A47
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ConnectGet.rle

Path C:\Users\Admin\Desktop\ConnectGet.rle
Size 235KB
SHA256 2c74bdcf38a61d918f7cf366567af8365f442d77b4b1152013ed0d7a624f7a7c
MD5 197c43543393764de06087e5e0f0e01b
SHA1 945964e8b37f227740d46d7c528b0418774d70b0
SHA512 6cc0c2ed905d82962af45c54adf0b18d309e7d73f90ad1efcb61fe60de381315f844fee7e5f4d64d4c480b2b7ae74fad80d94569b8d2bfa64b8026833f87fde1
SSDEEP 6144:sWVfudcXdSGSO64tKqB5f5SyHf/Z1odrtUkaf4KrQXeUDe:sCXdKO9f5tHfh1ozUkU9r
TLSH
T1523412E04D4EDB21D602AEAC5E6434DC9DA3FADD8FB6CA0D51482AF8CE15CCC4B564B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ConvertInitialize.htm

Path C:\Users\Admin\Desktop\ConvertInitialize.htm
Size 266KB
SHA256 b744ae2db5b87b6e80762861d86f83700872f8a45dfeec5ce3b1639891b3d2cd
MD5 e7829e32772087d8d298c6e8884b5441
SHA1 d25331a3e15af201535af12de2d8e8d45a6723fd
SHA512 11712ab4a1474c7008d45fd57d51a8d0f669c78eee3199240647efc4ac572529a0ef8a6ead043f88ea181c57c1493603534b6a90b4ab2d51cd6ddc4ad453f485
SSDEEP 6144:Sp/IIo026MxEYcO2FW9wKgvipHe92EBUoVzF2GC9HL3xRzc:pIo09PW93gqpHjEBPV7QH7xhc
TLSH
T1DD44232347A5AB254FC2E97598F2F9D5502AE3EF24FBF04E0B3C285A699503C5B14B0C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ConvertRequest.wm

Path C:\Users\Admin\Desktop\ConvertRequest.wm
Size 376KB
SHA256 9253e439bc95d5901d4a645c96366de0c6289c1f0fe9b88564d7a1e084614449
MD5 b20503b379763e519dcd4487bf77dab8
SHA1 f88c5322b7ee12b67fb12c62420c13fc4de8d37d
SHA512 c6cd7a888958987bda87c83fef3a0b5d4df86a2035e1b65d7dd7e3cc2a1ea84e85f569bb7a8fada01c3273995caf093599ed2aff78d4ed92eaef49936fbb87d8
SSDEEP 6144:999HJV2hjtrPIjZSfkPPsy6UIx6IuNvqOVLoEFx4Pqz41XtbnQU3we5PzbO0rmlT:FpsttrPI46t7CuNCOVLJG9tbnQUAGzbY
TLSH
T14884239E09469DAB48983B3EB3B6FF4309444DC14DF2F54E4A04A2E9066DA7CCC46F6D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DenyPing.edrwx

Path C:\Users\Admin\Desktop\DenyPing.edrwx
Size 501KB
SHA256 fdeb0a5b2ace0d8005cfd6b7544e374faec78c130db7594094e900c6e6c1ee25
MD5 4275a4d5b7983725a4be164e7b22a03d
SHA1 8291d4b8299556b42559af639b954bf593b7b374
SHA512 d5eb766860047856717ff8650bcc4531e26000dfd9d0179ab5eb7481b8780b277a3c27896c8e54cf6cd23ca23a37911f9d4c14d95a8be0821a4e5250d6c4d463
SSDEEP 12288:D7n11aytoWg2zcW9c5RUpusyCvcZhmZQY7/HzsmtC3KL:DPa2TLYPrsyMczmp7/Hz/1L
TLSH
T1CDB423368DF6FFD43B281B08EF7B26CDB9A5437321D468161F8A52A0D5844F85B29CE1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DenyReset.midi

Path C:\Users\Admin\Desktop\DenyReset.midi
Size 344KB
SHA256 5511bfaac1e64515c9cb57523a612ac6cd6ed69ba5fcde75422f33e505da8f3f
MD5 e7ddf5ae16f39f99bd43df1c4e93c50a
SHA1 8e38a02f6899cb397345a51e93d8097ff053bf23
SHA512 c8fae35f4e6f8c4546b5a3ed4ae354a5f54830b29253bf788523d02ded01a3750b75be9577498fd9a290e5f5779a515f0128803cbc470abeddba18a5bd669981
SSDEEP 6144:mnsehDQACXX0YiqZ51xKY8uQU29WQF4nZkUkt/aShsHApgXK1jE515kXRb4pyCF:e/cXX0Ytd8hUM/F4ZspaSF6+YaXR0gCF
TLSH
T1237423C2AF3666D6EAFC73CB00847117F031D563A2D8AD29B0835F2EACB55B58058F59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DenyShow.dotx

Path C:\Users\Admin\Desktop\DenyShow.dotx
Size 360KB
SHA256 d345cabefb537bdba84ad0dfadc52e5f8159e8f2ef7ad2deebe14ddeaccf2aad
MD5 11e339e04e09fba39a6407dd035be0bc
SHA1 2cd9f6125ccf83b49ec3a24f03d9e5ea59791f14
SHA512 4066eeba53b1c3705f042df7f942a528f367f4e334b24c7bfebae5f2775d287be8126a6d5178d71640f83aa1dfe546c0677f661394f3675b8eb7575b9a6c3f0f
SSDEEP 6144:1cdjWQpxv5lBGRpE9gdFxb0IE+Lb58Ds6zdnM/7gQC0YvbeFUJw6mdWxdklrR:Cdxx+0CdDgIE+RM5zdn6gQ9YF2DWxdk7
TLSH
T15D742338A0FA7DF4B42E4AB2B26CF0B73617244D5F3697B9B462A1C3613468159502FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

EnterCompare.docx

Path C:\Users\Admin\Desktop\EnterCompare.docx
Size 13KB
SHA256 a8b5337855907b72339f2cfce7b57b67ce24f83c3daf727f7127e732a806dc53
MD5 61ef8a174d357fa182fc1b164eaa7bfd
SHA1 cd57ae068b0653a708ef124e2f4f252be661ed8b
SHA512 8d95a65aa0c5e8a075cb86eef6a17d5906f941429af84f4c87d5cdc843883d1a83c73fbdf8a09b6a4396217c5dda07016c8f6b369eeb1eeb7e638be96078beb1
SSDEEP 384:aqi3C/MZ/7sdNxt/ZtNNeu9FnLIFHDJdLqbd4E:ZMZ/cxllNeAFLItD/qBB
TLSH
T11B529E7AF5052811DB634BBCF00A22F2E12960437B46A943709B6E8D835AF664B526DE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FindClear.lnk

Path C:\Users\Admin\Desktop\FindClear.lnk
Size 485KB
SHA256 a88ab63260d6f66173bfbb346d1e7ac55b2a43b8bea7af87bbbeed32973a1a16
MD5 48c72c6546b17320d9e59bfeebb5ea06
SHA1 a6443de9f8be560dff701d52e2046df144446c34
SHA512 cd74fb95e67895d847fca389d8b626da2bbb1a9a14326afcfddf1037ecf2c71683462c99e1ce371cd09c643dff42e5ece50589ebb30a81354ce540094963c746
SSDEEP 12288:VHJF6GDKXv3p8y+2H3DmUhCkLxVobhN7NeNZZKEEfNPFhZk0+BqjiVMp:JFif+2XDPCQKXNgROJa3qjBp
TLSH
T137B4230C5DA6EBF5B098325FF96842118F9D05012F7DDF7A8A987076FC329F8252129B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FormatUnlock.odp

Path C:\Users\Admin\Desktop\FormatUnlock.odp
Size 595KB
SHA256 79291fbee51fb5ab8088834d0a04e5e248dad0593d032afb4e33e76a19c937f2
MD5 12c64aef5d4b5eccd7428c9676885106
SHA1 1b7587412299e8ab17976613d2de2c5c26f973ea
SHA512 4b4a1a5a1c5ac8a07e74d0d87e2df185fa01e4e930a994eaeb6d8d83cd300d4989a5bc0b9d4387cd0bd5d09eb3600ea53358bd61dbe0513112784e16687bbea9
SSDEEP 12288:vu2qr5ESDCjsZW6KQ7obiR6nt2dAMJRR5ntnQd3sxEU5:vNqr5HasZWko2dASRR5tnQd8t
TLSH
T1DDD4234A9F3AA4F91D367CA3678A57420060273349D52CEB1A7AAFCCB615D64C1B1CFC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HideWait.bin

Path C:\Users\Admin\Desktop\HideWait.bin
Size 407KB
SHA256 e006aaba0e0f2b95f74deb03c393c55950024576b27bcbddac4adc6a142551c0
MD5 857fe17f8d5ab4d24e64f96572cf13f6
SHA1 7ca3ca9d8231c720688d27e25842ad722227e511
SHA512 bf399b317513c45653563bbe0a098e18e99f80e6005276d8ffbd4a43333c7c1e4bb5c67c521d3f92af1c4ff69870790b379dd6d563e556a4bbff5bd7caebfb94
SSDEEP 12288:ARanCkNbWwa7Bc9bFrGa+Rgt+hcm6Nhw4WD:AoNbB9bF+R1hc3QR
TLSH
T16F942394C8D230974185B9FD20B39CF6E5A619C444E9E7E99FE503C2059ECDBA34F22E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LimitGet.exe

Path C:\Users\Admin\Desktop\LimitGet.exe
Size 329KB
SHA256 b2beb1d54079a5e6fad0e62ef70dd98f52e6088709535500aa6abf7e4d39d39e
MD5 a77d50dafca1fba1893cdbe8595c86b5
SHA1 dfc82faf737705c00845b78346dbbbaafa40eaef
SHA512 482a470ebde09eb9e6476a4ed794df6b7b9634e43a68b875e597af4bfaff1e764194e0dc53d5dd8c89bbe424fd6a5c7a880b10813cebde297e4daa0607a32c59
SSDEEP 6144:1eXB9QmSdH9S6wzn4ddr6AXNk9dhlfqDTBbZ0A7tmJiVt0mNYFWGrE4afiEAH:6BKN+3Kdr6AXu9dhJqDTpZcJkxNOg7AH
TLSH
T10E642312659E0D884B1AF0C5F0DA27752CB919900577E9DDF9CAC1747FEA8BF032A6B0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LimitOut.TTS

Path C:\Users\Admin\Desktop\LimitOut.TTS
Size 564KB
SHA256 4972439d34aa34b98607e7c4753af4e7e716075b83e3a9dd5bb482214f3ecd05
MD5 11bc7d9f1f6b7489231ea038ded6bb33
SHA1 e88f8b097acceb9348041e9e1ac35683886489d9
SHA512 75842ceb98e843378ff070310a13c15f76563ccd2911d425632e1b7328ad60b461caea376b3227e0776331b30bc6c78d4161c9a17bf9e395673968a37888ab6e
SSDEEP 12288:+sSGcYYxLzH3S7SdqKBdncJBNd4RtVRK5EgAocIfcx9agQSV+jr2:sGx2XXS7uHCBNiRVjoTcQSmr2
TLSH
T1BBC42302FFD6CC5E1B50A29A7EDA50DC45B8ACEE3429E093E708192C749DCDA009D9DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LimitReceive.vb

Path C:\Users\Admin\Desktop\LimitReceive.vb
Size 391KB
SHA256 9bb8a714800c973503bb5b74d238a5821bd9c1195d9b2f6aae18d4143bde22d4
MD5 6d1fb9943f176735d7b116b548f68d4b
SHA1 517a2d776571fbe05bd0bb5b07fd840e13329467
SHA512 e329729b549083f63ba65b2da32e5da2eb53cd62cb00e39f02ab425d6aac83baf2ba78231d60ae520828f773bf0bc632ae5ad619f239612811ace3152382a66d
SSDEEP 6144:tmGBUVa0BIvwog0Z4GOzZq8b9LQkL9EASt4pe2EiNVgpTRT235E//s/opa:QGSR2w2dOthbt/LaASt4HEe+//xa
TLSH
T10A84236F6AE207595C21773DA122F474A8C077E81103FD339ABAD268569D680C0E67FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MountWait.ex_

Path C:\Users\Admin\Desktop\MountWait.ex_
Size 470KB
SHA256 7956a551d3318a48a5f60c446312a7d18bc8279c1c700c158fb18edbe7897fa8
MD5 be137c28dd7a9cf2dbe464242d033635
SHA1 41bed3d54d715fc231c2affd27d4ff36afdd6363
SHA512 c244c23e3708b52837696dcc6443f99fb37cc6598b1d686afbb8b10790a405df7dc666ab9df3ad2b80353cd0642298c5c81426657387c2e6eebc0657e9cbf076
SSDEEP 12288:RBuVjeV/s4RZcWGYUyLq/4sclqUny33AaQjabs719VqI:RSjeV/WLa+zcq3smoVqI
TLSH
T187A423CBE60E91806537F8571129B2F673E88912CCC38C848D364BFBFF655591D92B8A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MoveSubmit.xlsx

Path C:\Users\Admin\Desktop\MoveSubmit.xlsx
Size 11KB
SHA256 0b70b56a9348104825aee1479d2555c703fd604ce5d3dc1739aa28c2a92ba937
MD5 cc4709a6bfb5b3338050c168a1203743
SHA1 f4387c616cd9c503c60b036d8e5c39c5b6d2d0b6
SHA512 63e9aa4951672608ba9c7d555ecf29e13c09bd9c5d42805443f892239eebc86e45a416ea1f8b2d8134654a92b77bbf3f68aced76cdf87d54b7fa0b6eb068aa6b
SSDEEP 192:wc8mV1TKEb3UCqLR79aFUlbVvevUqzQXpS0rzN/O5rjUMao0+:wc3P3v0OUlM9z6pfN/TMao/
TLSH
T14F328D5DF560843FC32F847E928B00EAB79C71D18B8638D96420E99D53D61A723AF399
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OutRename.docm

Path C:\Users\Admin\Desktop\OutRename.docm
Size 297KB
SHA256 b4fde909e48de7f755e0737b79a664f9b4e11c8b44619147e778f0f4b75076ba
MD5 767908b405f6cef2efdbe9cb448bd892
SHA1 ff7cb4eaf22034c02ad45070173df14f57613ba4
SHA512 1a703a0e26439909076bd34d70c12277e369e7d86ce99dbeb4bbd490f2c341ac1b907490a07defac286b0272d0ad91825a1077d66a5bbc0d17f2171220157d4f
SSDEEP 6144:oGgl2VZRt8LiiUmthf4ae+dp8ZVE3rHiOFzbghR4MgnPj8R80T5uXq8YIBV:fglMsJtSae+dpWW3rHLzbgvBgPjTfj
TLSH
T1F15423FDAD13D52EE1325895DED38666C0F69F8AACE443BF410A605A8D42F6133A604E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PingResume.txt

Path C:\Users\Admin\Desktop\PingResume.txt
Size 611KB
SHA256 932f46a2a0c1a2a9eaf2d397f78754703fe30a72e7eb01e5067317bd9cc87ea3
MD5 953bb974291bdb6704c62f2a13064cd4
SHA1 ddaeaf8cbd0ceff5002f857d48e39e9c40de3685
SHA512 508964f539a26cb0a997a3f05f60c1fed082a8732963027cc17cb670c60d91c96b505170124748d551c012518c496ccc4ac31a585d73cf86fe66b17b6adff12a
SSDEEP 12288:DyH9XqoFQT3Jdf4XLN0I0RtJoR8HqfaPNOHqSqGcUraeljwt8:DyH5qoFQbXFRtSMSa1OFqGcUrLWe
TLSH
T138D42361F77299F42B813C240537656C0239ADBEFB50D8F096D46A006FBA6DEBF41836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RenameSelect.txt

Path C:\Users\Admin\Desktop\RenameSelect.txt
Size 250KB
SHA256 fb9f973e0fbfb6818764b4c1eee5dd86658b88d9dad6476599c51c40c42ad9e5
MD5 3a120a2cd878861bcdbdd320585487c4
SHA1 42c4c202ef517ca5118fb7e7ff7dcc5f84899f21
SHA512 74ebebf5cc9e18ea323665fd2c4ccd8dc12490b67c38cc2c65c398463d037cb575a57d7aa81027f5d6a650035b296d64a5064ae92410086f8ce4429a4612cba0
SSDEEP 6144:8A4qLohYd45vMRuX73TLkId7ZNEoaQJGogg:828ueBmKvtElQJh5
TLSH
T17B4423FE2AF168C5BF5BC9E0A5BDBAE7363DD74A0F2511AD4D56BD304C49A0850823C8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ResizeSet.mpg

Path C:\Users\Admin\Desktop\ResizeSet.mpg
Size 626KB
SHA256 fbdca75da95bb9f33368f227809a847e2dcc4ec91b8994fdef425982d2964eca
MD5 1e6f0c8a4cf7650229da4f654c0d486e
SHA1 5794e188708eceffe15cccf08b9f08310e3ca31e
SHA512 2fe36effb711c846935700850801c8ad6043e6d6192b4de82d7d3eb54dec2136de70c419d918bef2d24082c7ab2de40e6908b463f90b5d7dea135e456c13ffee
SSDEEP 12288:eKir5UIEvK9yoL5BVHYscS+Ua9rSc9R6+VWY7R0JMkyty50AttaKe05sH:eKctaK9yovpcSk9bVN1zkyg5b/aKhE
TLSH
T156D423C3BB50E816E4E723708417A9CBD4FDA4D6A99568FE1ED13CED3A0920786136F4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RestorePop.docx

Path C:\Users\Admin\Desktop\RestorePop.docx
Size 16KB
SHA256 abcff705cd7458f31c9c7aa9dcfe7a66f87004e2178b2a31d54dcf2f1f3ec375
MD5 f5199281b0792c2cc0afab3cddbe9fc5
SHA1 7fa8345da7920ca51e60277b703c3d8d1180a20e
SHA512 982c2621f5bbee1d1dde8d1491300c6eccb8104b6cdb8cf7775a2ddc0ef2785f600da6b52e8a8cb2ceafad040114f32164839a9894d98416330fce18acfed67f
SSDEEP 384:atHeyg4du82dNxt/ZtNNOgIFHDJkf7JEKb:weyfyxllNxItDwy8
TLSH
T16072BE3AC6442420EDA2467CF26A11FBF5164C527A17DD83321FBB8E517AF9707875C8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StepSwitch.vssx

Path C:\Users\Admin\Desktop\StepSwitch.vssx
Size 532KB
SHA256 7a6c3f650e3b0d64c7fca19330b00edcbb0c30dfcca530c3284ad8bcbe7af0cb
MD5 e2411632bce677f077c7437c044e3f99
SHA1 b9b278c4d307cecdf3001bc0932b38cc8c2fa9ae
SHA512 93652c19eb2fc12010854dc9ae606f4da8d6ef41b526e45a76a2c41ad939385357c9105f5e356c892dc8aada405c7676d5645bfaf3582d225e642a30b8449865
SSDEEP 12288:HNlwQpwdWzT1iByoFQX8Am9zNbocwVJi1+p8Lszao3ak5wHk5zckSsnG:tafOYU3QoKRL+p5wHIzB4
TLSH
T1FFC42315D37C269A405F07E4AB7CBF61C9E1E72AF10422543A81CA36DDFFE1DA91423A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SuspendClose.docx

Path C:\Users\Admin\Desktop\SuspendClose.docx
Size 16KB
SHA256 7632e61664bb0da4278c0de3dc9f291c059d37a671def415fa11ebd55f39419f
MD5 5d6d6f172d75a6c21a93937d8385fb5c
SHA1 d0597058f565056fdd11179ace8e7d0c169e1a95
SHA512 43a7042cabb2d473e206a2dd3fe947da27a1ef275197b365b9143a922e25107d17365b7fcba14aecc30413f58a69ea38786902707f8a651b0daaaec79c39721d
SSDEEP 384:apEpQdz0NgidzYjZAy1JR9JBdNxt/ZtNNYZ8IFHDJkfqGh7:TGPYzYjZt1PJxllNYqItD8x
TLSH
T10772BF7ADA006620EEA306BFB06872F5F51C24035763B447305E6ECD96A5E970B1F387
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SuspendMerge.mp3

Path C:\Users\Admin\Desktop\SuspendMerge.mp3
Size 282KB
SHA256 d074b8d533451459f01cdce39c42f4040f35da41a417cf7f018f27762e0c0b59
MD5 e0c1205591ab564651ed53f31e7c9190
SHA1 04a0af9131b7d93e9df6e2acd9d95c89b54e4ca3
SHA512 4fd3aa0a38f5bf7d4197117dab8ee45b8b6fe5876580543e045d38e74b8072aed40d8959653b740e12f2ddfd1253af4abca4062710909ababe72f5145190bdf9
SSDEEP 6144:GaU+3yOYh/1rcAnWr5Vdvz1x3jRNhaMtaOVImzMo1/hO9Ca48Uy:jUkYhNZWztJTa8p/hO9Hb
TLSH
T1C35423C3D79D8B35A7D596E6CB07D832F1A523848C07A2395E9F091D009CFC3AAD6A4D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SuspendStart.gif

Path C:\Users\Admin\Desktop\SuspendStart.gif
Size 548KB
SHA256 f4d5071aebda59ba59aa3372191c9356a5499b993de2bd9061986b846a496280
MD5 5ba7f519c337f539de4128ac6f575ea7
SHA1 5dc1e75c0850e09e78f036f602701fd3984a430f
SHA512 0a245f85fb4affd6182e0286b194058d6fbdfdcf55b7c7da0b6e81ce1b27fd2eec57f1f88995c239983103e0243553e7cda71fe92644163a0d2f897f5c9d68d2
SSDEEP 12288:T0geMgo4HuqjZfz/4bHwTh/9Y17xZv4Df/eppKUB3jGoXyvx2ogchL4:T0gIo4xLg8TYlzbjB3jGoCvc5M4
TLSH
T122C4234C9A89EE510DCE9B0352B2E50559E98EF3038B2F535DEA35526E0FD4F08D3E4A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SwitchCompare.pptx

Path C:\Users\Admin\Desktop\SwitchCompare.pptx
Size 517KB
SHA256 0114cc1e0f8e0fce1de2c45b000ede8c0508ca398d0e4a630dcc766c53b09279
MD5 354fea92a5f74d9ba923bdeb70b7ccd6
SHA1 89f4ebd310e11de86bf2bcf68aa8d0ee9aea06b7
SHA512 295a431a5eba987927a1dcaf65af354fc2513bf6eecd1282354bb39f91cc4d2d9968a50af93e8587673065bc61d12515989f7579e9c331d841ac16ee963a7f69
SSDEEP 12288:qQAl3djSQm4KZBdoBeuVb4/Eog4UbKIayi:2l3dHs3oBTbchpIKbyi
TLSH
T100B4230FFCB31B4FD587B9265F69852E90069D09CC0C8B65A4E18F60292FD7D839DB45
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TestSkip.ppsx

Path C:\Users\Admin\Desktop\TestSkip.ppsx
Size 438KB
SHA256 c954961a51e5df23fa0f94e97287ded74fa68d22ec6e8bb691466dc29c13d97f
MD5 505e1eef5c6303c88b3c49f51d4de9ff
SHA1 08d08a8ec1b6a27d1181f915d86546aed5a2922c
SHA512 2a3574bfca8bc0adacbc6bfd972da20001c52f8c89d1e767ea72ab7a3812c5a473b197624e411b1dd73c4a191132c75affd859bfe57ef249fe399e89a6da11fa
SSDEEP 12288:bDnNWPvyyDzUlbQoQm7WIrgG6q17CnTiRsgAazo:XNOvLZorSu6kGTiRsdeo
TLSH
T1F7A42365E977231474CBAFF3120C7BAF5E294D2913AB90FD4121436282BE893D779583
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UnblockExport.xlsx

Path C:\Users\Admin\Desktop\UnblockExport.xlsx
Size 11KB
SHA256 54c776f7b0d286e4d42a22f5056c7875df83b12d80f560f321a046ec5b64cdcf
MD5 bf37daf6f6b3dddf806ebddf538b9b69
SHA1 381896e00c8304bdaf475be155bb228a7f74746e
SHA512 7dfced189ec51643228625b995e52a2df8091fbcb9cba20b8e87516dd78bda8a013451bd92503cbd552b339d017983d8409e171da2a92eef5f9f989b34a4016f
SSDEEP 192:wc8mVp8b3U6+PwH82TEnkaFUlbVvevUqzQXpS0zAY9gTGIao/:wc3E3coXYnZUlM9z6pIhao/
TLSH
T1E3328E44C5A0D13AE377847CE14F52E5A37D61818786B94A2864F38E17C136793AF3EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UndoImport.jtx

Path C:\Users\Admin\Desktop\UndoImport.jtx
Size 454KB
SHA256 230dd2b95dfc882a4413cb88355e3c5aaa4e167064854d5beb8ed0440ff7b589
MD5 ce9594db3aac9d0c4d668b9ebfe4236c
SHA1 d0304546ad9ced69e0a2d957d34f175a0fe89e48
SHA512 a0470acf6f08fc7f193cc963732f0b3d816c17e59e89a17f31a02b9cbbe83ceabd29481b0fa8be4a5168698ecd33e204a9717845d9ecd3cec7e4fa922f65ec22
SSDEEP 6144:ZAPW85UHl3xXzHXGaMoVaQZbSLe9J+3Cm32++XE9ELLj1cebzfI5cA2JJ04o+V7F:ZATUVzGa1rZbGvXG+Z9ELLJcIN2EV7F
TLSH
T131A42368037B5511FA4D6F03537BE169604CB46CFAECF3BCBA699E800D90A82137AD75
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UnregisterLimit.lnk

Path C:\Users\Admin\Desktop\UnregisterLimit.lnk
Size 313KB
SHA256 508c3674bbe14945ce448f736d57b350d265c478ccb5f3ba48abe9dd4cd3e88b
MD5 a6f63e6b002259eb6b766a855c6d4a1a
SHA1 e522b3b8470469c05a07b58e383b035e5f854638
SHA512 399a14327e09a9bc807791312f1c73c2bb1c07de6dabdc2984e78c07bd2ef040e22f2f6c3010b0134c84b7421e6dd4cb8ee41df3b2fdde1645ef4768c414d92e
SSDEEP 6144:v5Aq68ju3Bo0jjC5Q0eWBbeDa0Id4hjQ9oERJjDFsa:hSWBkj0Qdybyz2TTjl
TLSH
T17664236B45CC8D7C4539164C06B12E86AD8CE64D09FAF999F05FD0783F3682E3E4A635
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UnregisterLock.temp

Path C:\Users\Admin\Desktop\UnregisterLock.temp
Size 423KB
SHA256 1655d8e14cf6ad4060cee5c5bdb81c6026d019283fb1198a458e7ff111d9ff2c
MD5 316aaf7a80d681d684afa684741475ae
SHA1 bf095c44dc19533126c54d7fd28cfb7f4e8d37b5
SHA512 539cc52fa3abb61c6afad090ba6a3e86c94585399d53b475a266cec1dd0cf1cffec16c819a35ac6dd123568856126f5e5a80384f64cb0aa2b16791423acd6f40
SSDEEP 12288:ONDtMxL8Z2a55hqSXP/0/pinOvZ4+vWdMh+eKP:OtUoPqS2ppZtedMhQ
TLSH
T1EC942383DA7C02961D17CB6BC7C56C8D325811BCFEAD5929893BC33496B542ECE842F2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

welcome.vbs

Path C:\Users\Admin\Desktop\welcome.vbs
Size 2KB
SHA256 6738c3990bb3ef92da2d43f671c043232229cf7469fcf9fc8319404e33365885
MD5 34434aaa8887148bfe655c6ae43933bc
SHA1 f66b09aba978ec2b6fca39753edda499059a2582
SHA512 034d5a957bf21176db6cf773deb1918a9bfa09b1c866df583fc5380b6b429eeefef261041e4fb111a5851cb6ad623078972be9afd605e17e7c203618504372b7
TLSH
T139411843370E98158B7227509292C54EBBA20AE7125DBF522C4FD03FC811BF885EA0A6
MD5 SHA1 SHA512 TLSH

Submit Download

Acrobat Reader DC.lnk

Path C:\Users\Public\Desktop\Acrobat Reader DC.lnk
Size 2KB
SHA256 02d9bde5e1863980513809cda79a32cbd8db0aa069b8b9df52c7ed1376f51ac6
MD5 2a41d3ebbb505b73545103840cff3aed
SHA1 1d6f0b84f4c814dd7b57d9a14469ce5487eb6d53
SHA512 a722aa3e29decbfdafb9d785ce08eb4880fe6a57b6cda72cc4f576f79df5c58155ebd43d9c2ebf4362722de740052a64344b971b2ce1ff9131af7bc5bf9ae559
TLSH
T16541C1204EF60316F2778AB75BF11922DB22BC54B2145E1E0584825B4DA1B0098A9F2F
MD5 SHA1 SHA512 TLSH

Submit Download

Firefox.lnk

Path C:\Users\Public\Desktop\Firefox.lnk
Size 1KB
SHA256 53624f8263fa08a6c35e1ace9a432101573981d402af5b1e10c71d509a8df755
MD5 63a15132adb5c02ff67446f6e98e53e3
SHA1 3638f3274a119ddc06d78bd598a4919094a395df
SHA512 c8025ddd792d3a25602ebb77173abcce7daba7a89518afc63e5749e3c70166e60188cb7fa5c87c68b4d967e880ddbb72c438899693280c9a13136502aa001bd2
TLSH
T15D11DC110BF20517F1F781322A326B634333BD01B675272D8288A2A04977210D46EF57
MD5 SHA1 SHA512 TLSH

Submit Download

Google Chrome.lnk

Path C:\Users\Public\Desktop\Google Chrome.lnk
Size 2KB
SHA256 da2c76dcd3cf7b835bb881bed78548474b190e335cbdb67450be10b5cf473251
MD5 bf13bcbb97007a9984e8ba1f4492565d
SHA1 b28d978b8e77ad8c27fe6d4be7b6f20592a909c9
SHA512 1cb78c31f2afd5b267b2ca72d819840aee46eed0fafa075cab1a5bc5246de13658d201405a0cd50e9ccb11e6eabf81569da5fb21226cd18ee1f50a851087cd15
TLSH
T1DB4157267BF91619F3F387326A337B210F7BF816DA341A1D519592840CA261069DEFB3
MD5 SHA1 SHA512 TLSH

Submit Download

VLC media player.lnk

Path C:\Users\Public\Desktop\VLC media player.lnk
Size 923B
SHA256 6f54316959837a774ca524434ec05116408558f85f4e9dcea832e9fa396de2b6
MD5 8cd6fe2dca3254031e35007a2e7a5f45
SHA1 daf64744f73e9d7c7907de3ffcfc46a0c3475dbc
SHA512 f0c41ce957289222e484d1f69b4a89c209d2d3b208cd1276a9babb2ac5ad532fc08a72527b7d1f82e771840e68340719697f2878e6534afc73c73ff08959ae7a
TLSH
T17F1120317AF2670AE3E380F11A32177147A7F50596902B0D8082815F6C3C200D99EF9A
MD5 SHA1 SHA512 TLSH

Submit Download

memory/764-1036-0x000000001E080000-0x000000001E0A2000-memory.dmp

Download

memory/764-1035-0x000000001E300000-0x000000001E482000-memory.dmp

Download

memory/764-1033-0x000000001DC80000-0x000000001DD84000-memory.dmp

Download

memory/764-1034-0x00000000057C0000-0x00000000057CC000-memory.dmp

Download

memory/772-1071-0x000001F8D7550000-0x000001F8D7551000-memory.dmp

Download

memory/772-1072-0x000001F8D7550000-0x000001F8D7551000-memory.dmp

Download

memory/772-1067-0x000001F8D7550000-0x000001F8D7551000-memory.dmp

Download

memory/772-1076-0x000001F8D7550000-0x000001F8D7551000-memory.dmp

Download

memory/772-1065-0x000001F8D7550000-0x000001F8D7551000-memory.dmp

Download

memory/772-1073-0x000001F8D7550000-0x000001F8D7551000-memory.dmp

Download

memory/772-1074-0x000001F8D7550000-0x000001F8D7551000-memory.dmp

Download

memory/772-1075-0x000001F8D7550000-0x000001F8D7551000-memory.dmp

Download

memory/1044-1115-0x000000001E0D0000-0x000000001E116000-memory.dmp

Download

memory/3704-977-0x0000000003270000-0x00000000034CF000-memory.dmp

Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads