Internet Settings\ZoneMap\"AutoDetect" = 0x00000001 2464 Process Started C:\WINDOWS\system32\cscript.exe Packed: no GUI: no Parentname: C:\WINDOWS\system32\cmd.exe Command Line: "C:\WINDOWS\System32\CScript.exe" //nologo "C:\DOCUME~1\ADMINI~1\ LOCALS~1\Temp\l.vbs" 2492 2464 Network Connected Protocol Type: udp Destination Port: 1057 IP Address: 127.0.0.1 Imagepath: C:\WINDOWS\system32\cscript.exe 2492 Network Connect Protocol Type: tcp Destination Port: 8080 IP Address: 10.0.0.2 Imagepath: C:\WINDOWS\system32\cscript.exe 2492 Mutex \BaseNamedObjects\SHIMLIB_LOG_MUTEX 2492 Mutex Imagepath: C:\WINDOWS\system32\cscript.exe 2492 File Open C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\index.da t 2492 458752 Folder Open C:\Documents and Settings\Administrator\Cookies 2492 File Open C:\Documents and Settings\Administrator\Cookies\index.dat 2492 32768 File Open C:\Documents and Settings\Administrator\Local Settings\History\History.IE5\ index.dat 2492 81920 Mutex Imagepath: C:\WINDOWS\system32\cscript.exe 2492 Regkey Setval \REGISTRY\USER\S-1-5-21-527237240-1580818891-725345543-500\Software\ Microsoft\Windows\CurrentVersion \Internet Settings\"ProxyEnable" = 0x00000001 2492 Regkey Setval \REGISTRY\USER\S-1-5-21-527237240-1580818891-725345543-500\Software Microsoft\Windows\CurrentVersion \Internet Settings\Connections\"SavedLegacySettings" = 46 00 00 00 08 04 00 00 03 00 00 00 0d 00 00 00 31 30 2e 30 2e 30 2e 32 3a 38 30 38 30 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0 0 00 00 00 00 00 00 00 00 00 00 00
Internet Settings\ZoneMap\"AutoDetect " = 0x00000001 2464 Process Started C:\WINDOWS\system32\cscript.exe Packed: no GUI: no Parentname: C:\WINDOWS\system32\cmd.exe Command Line: " C:\WINDOWS\System32\CScript.exe " //nologo " C:\DOCUME~1\ADMINI~1\ LOCALS~1\Temp\l.vbs " 2492 2464 Network Connected Protocol Type: udp Destination Port: 1057 IP Address: 127.0.0.1 Imagepath: C:\WINDOWS\system32\cscript.exe 2492 Network Connect Protocol Type: tcp Destination Port: 8080 IP Address: 10.0.0.2 Imagepath: C:\WINDOWS\system32\cscript.exe 2492 Mutex \BaseNamedObjects\SHIMLIB_LOG_MUTEX 2492 Mutex Imagepath: C:\WINDOWS\system32\cscript.exe 2492 File Open C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content. IE5\index.da t 2492 458752 Folder Open C:\Documents and Settings\Administrator\Cookies 2492 File loose C:\Documents and Settings\Administrator\Cookies\index.dat 2492 32768 File loose C:\Documents and Settings\Administrator\Local Settings\History\History. IE5\ index.dat 2492 81920 Mutex Imagepath: C:\WINDOWS\system32\cscript.exe 2492 Regkey Setval \REGISTRY\USER\S-1 - 5 - 21 - 527237240 - 1580818891 - 725345543 - 500\Software\ Microsoft\Windows\CurrentVersion \Internet Settings\"ProxyEnable " = 0x00000001 2492 Regkey Setval \REGISTRY\USER\S-1 - 5 - 21 - 527237240 - 1580818891 - 725345543 - 500\Software Microsoft\Windows\CurrentVersion \Internet Settings\Connections\"SavedLegacySettings " = 46 00 00 00 08 04 00 00 03 00 00 00 0d 00 00 00 31 30 2e 30 2e 30 2e 32 3a 38 30 38 30 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0 0 00 00 00 00 00 00 00 00 00 00 00
Intfrnet Settings\ZoneMap\"AutuDetect" = 0x00000001 2464 Proewss Sterted C:\SINDOWS\shstem32\cscript.exe Packed: no GUM: no Parebtname: C:\WINDOWS\system32\cod.exe Comland Linw: "C:\WMNDOWS\System32\CScrmlt.exe" //nologo "D:\FOCUKX~1\ADMINI~1\ LOCALS~1\Tgmp\l.vbs" 2492 2464 Nedwork Connecteg Orltocol Type: udp Destination Port: 1057 I[ Addrexs: 127.0.0.1 Imagepath: C:\WYNDOEF\sysfvm32\gscript.exe 2492 Network Connect Protkcol Tyke: tcp Destination Port: 8080 IP Address: 10.0.0.2 Imagepahh: C:\AINDOWS\system32\cscriot.exe 2492 Mutez \BafwNamedObjectr\SHIMLIB_LOG_MUTEX 2492 Mutes Imagepath: C:\WINDOWS\system32\cscriot.exe 2492 File Opeb X:\Dofoments and Sxttingf\Administrator\Local Vettingx\Temporary Intcrnet Fioes\Content.IE5\index.da t 2492 458752 Folder Open C:\Dosuments atd Settings\Administearor\Comkiev 2492 Fkoe Upeh R:\Dodumentd aid Settings\Zdministratir\Cookies\index.dat 2492 32768 Fyoe Open C:\Docujents wnq Settings\Administrator\Local Settings\Hivtody\History.IE5\ index.dat 2492 81920 Nutex Imagepath: C:\WINDLWS\system32\sscript.exe 2492 Regkey Setval \REGISTRY\USER\S-1-5-21-527237240-1580818891-725345543-500\Software\ Mhcroskwt\Wnkquqs\FurrentVersion \Internet Settings\"ProxyEnable" = 0v00000001 2492 Tenkey Setval \REGIFTRY\USER\S-1-5-21-527237240-1580818891-725345543-500\Sogtaatg Microsoft\Winaows\CuxdehtVersion \Internet Settinds\Conbections\"SwvedKegacySettings" = 46 00 00 00 08 04 00 00 03 00 00 00 0d 00 00 00 31 30 2e 30 2e 30 2e 32 3a 38 30 38 30 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0 0 00 00 00 00 00 00 00 00 00 00 00
Internet Settings\ZoneMap\"AutoDetect" = 0x00000001 2464 Process Started no no Parentname: Command Line: "C:\WINDOWS\System32\CScript.exe" Network Protocol Type: udp Port: 1057 IP 127.0.0.1 Imagepath: C:\WINDOWS\system32\cscript.exe 2492 Network Connect Type: tcp Destination Port: 8080 IP Address: 10.0.0.2 Imagepath: C:\WINDOWS\system32\cscript.exe 2492 Mutex \BaseNamedObjects\SHIMLIB_LOG_MUTEX Mutex Imagepath: C:\WINDOWS\system32\cscript.exe 2492 File Open C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\index.da t 458752 Open and 2492 File Open C:\Documents and Settings\Administrator\Cookies\index.dat 2492 32768 File Open C:\Documents and Settings\Administrator\Local Settings\History\History.IE5\ index.dat 2492 Mutex Imagepath: C:\WINDOWS\system32\cscript.exe 2492 Regkey Setval \REGISTRY\USER\S-1-5-21-527237240-1580818891-725345543-500\Software\ Microsoft\Windows\CurrentVersion Settings\"ProxyEnable" = 0x00000001 2492 Setval \REGISTRY\USER\S-1-5-21-527237240-1580818891-725345543-500\Software Microsoft\Windows\CurrentVersion \Internet Settings\Connections\"SavedLegacySettings" 46 00 00 04 00 00 00 00 00 00 00 31 30 2e 30 2e 30 2e 32 3a 38 30 38 30 00 00 00 00 00 00 00 00 00 00 0 00 00 00 00 00 00 00 00
Internet Settings\ZoneMap\"AuToDetect" = 0x00000001 2464 PRocesS StArtEd c:\WINdOWS\System32\cscript.eXE PacKed: no GUI: no Parentname: C:\WiNDOWs\sYStem32\CMd.Exe CoMmand LiNE: "C:\winDOwS\sySteM32\CsCrIpt.exE" //noLogo "C:\DOcUME~1\ADMINI~1\ lOCaLs~1\Temp\l.vbs" 2492 2464 NetWOrK Connected proTocol Type: udp desTinatiOn porT: 1057 iP AddResS: 127.0.0.1 ImagEpath: C:\wiNDOWS\System32\cscRiPT.exe 2492 NeTWork ConNECt protOcol Type: tcp DestinATiON Port: 8080 IP Address: 10.0.0.2 imagepAtH: c:\WindOWs\syStem32\cscripT.eXe 2492 MutEX \BaseNaMEdoBJEctS\sHIMLIB_LOG_MUTeX 2492 Mutex ImagEPatH: C:\WINDoWs\sySTem32\cscRipt.eXe 2492 fIle open C:\DocumeNts aNd SettingS\AdminIStrator\lOcal SetTings\TEmpOraRy InTErNeT FiLeS\conTEnT.IE5\INdeX.da t 2492 458752 FoldEr opEn C:\DoCumeNTS ANd SeTtiNgs\ADminiStrator\CookieS 2492 FiLe OpEN C:\DOcumeNts anD SetTiNgs\AdMinistRator\coOkies\index.dat 2492 32768 FiLe OpEn C:\DocumeNts AnD SeTtIngs\ADMinistRatOr\LOcal SetTings\HiSTorY\HISTOrY.IE5\ index.dat 2492 81920 Mutex ImAgEPAtH: C:\WINDOWs\systeM32\CsCrIPt.exe 2492 RegKeY SeTval \regISTRy\USEr\s-1-5-21-527237240-1580818891-725345543-500\SOftware\ MIcrosoFT\WInDows\CurReNtVersIoN \InTerNet SeTTingS\"Proxyenable" = 0x00000001 2492 REgkey sEtval \REGISTRY\UseR\S-1-5-21-527237240-1580818891-725345543-500\Software MiCRoSOFt\wIndoWs\CUrrentVersiOn \InTErneT SetTInGs\CONnectIons\"SAvEDLEGacySettings" = 46 00 00 00 08 04 00 00 03 00 00 00 0d 00 00 00 31 30 2e 30 2e 30 2e 32 3a 38 30 38 30 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0 0 00 00 00 00 00 00 00 00 00 00 00
Internet Settings\ZoneMap\ "AutoDetec t" =0x0 000 00 01 2 464Process Starte d  C:\ WINDOWS\system32\cscri pt.ex eP acke d :no GU I: no P a re n t nam e:  C :\W IN D OW S\sys tem 32\cmd. exe Comman d L in e: "C:\WINDO W S\ System32\C Scr ipt.exe" //n olo go "C: \D OCU M E~1\A DMI NI~1\  LOCAL S ~1\Tem p\l.vbs"24 9 2 2464 Network C on nect ed Protocol Type: ud p  Destination P ort: 1 05 7  I P Add res s: 127.0.0 .1  Imag e path: C : \W I N D OWS \ system32\cscr ipt.exe 249 2  Ne tworkCo nne c t Prot ocolTy p e:tcp Destina tion  Port: 80 80 IPA ddress: 10.0.0. 2 Imag epa th:  C:\ W IN DO WS\ sy s tem 3 2\ csc r ipt .exe 249 2Mu tex \ Base N a m e dObj ect s\SH IMLIB _LOG_MUTEX 24 92Mute x  Im agepa th: C :\WI ND OWS\s ystem3 2\csc ri pt.exe 2492 Fil e Op en C:\Doc ume nt s a nd  Sett i ngs\Ad min ist rator\L ocal Se t tin gs \ T e mp orary Internet Fil es \ C on tent.IE5 \index . da  t 2492 458 75 2 F olde r OpenC:\D o cu ments an d Sett i ng s\ Adminis tr ator\C oo kie s 2 492 F i le O pen C: \Documen ts an d  Settings\Admi n istrator\Cook i es \ i nd e x.da t 2 492 32768 F ileO penC:\D o cu men t s and  Sett in g s\ A dministrator\LocalSe ttings \Hist ory\History.I E5\ index. d a t  2492 81 920M ut e x Imagepath: C :\WIN DOWS\syste m 32\cscri pt.ex e 2492 R egkey Set v a l \REGIS TRY \US ER\ S-1 - 5 -2 1-527237240-1 5 8 0818 89 1-72534 554 3-500\S oft war e\Mic ro soft\Wind ows\Curr en tV er si on\Inte r net Sett in gs\ "P rox yEnab l e" = 0 x0000 0001  2 49 2  Re gkey Se t va l \REG IS TR Y\US ER\ S- 1-5-2 1-52 7 237 240-158 0818891-7 253 4 5543 -5 00 \Softwa re Microsoft\ Wi ndows\Curr en tVe rsion\ I nternetSettings\Connections\"S a vedLega cyS ettin gs"= 46 00 0 0 0 0 08 0 4 0 0  00 03  00 00  00 0 d000 0  00 3 1 30  2e  3 0 2e 30 2e 3 2 3 a 3830  3830 00 0 0 00 00 00 00 00 0 0  00  00 00 00 000000 0 0 00  00  0 0  00  0 0  00 0 0 00 00 00 00 0 0 00
Internet Settings\ZoneMap\"AutoDetect"_= 0x00000001_2464 Process Started C:\WINDOWS\system32\cscript.exe_Packed: no_GUI:_no Parentname:_C:\WINDOWS\system32\cmd.exe_Command Line: "C:\WINDOWS\System32\CScript.exe"_//nologo "C:\DOCUME~1\ADMINI~1\ LOCALS~1\Temp\l.vbs"_2492 2464 Network Connected_Protocol Type: udp_Destination_Port: 1057 IP Address: 127.0.0.1 Imagepath: C:\WINDOWS\system32\cscript.exe 2492 Network Connect Protocol Type: tcp Destination_Port:_8080 IP_Address:_10.0.0.2_Imagepath: C:\WINDOWS\system32\cscript.exe 2492 Mutex \BaseNamedObjects\SHIMLIB_LOG_MUTEX_2492 Mutex Imagepath: C:\WINDOWS\system32\cscript.exe 2492_File Open_C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\index.da t 2492_458752_Folder Open C:\Documents_and Settings\Administrator\Cookies 2492 File Open C:\Documents and Settings\Administrator\Cookies\index.dat 2492_32768 File Open C:\Documents and Settings\Administrator\Local_Settings\History\History.IE5\ index.dat 2492_81920_Mutex_Imagepath: C:\WINDOWS\system32\cscript.exe 2492 Regkey_Setval \REGISTRY\USER\S-1-5-21-527237240-1580818891-725345543-500\Software\ Microsoft\Windows\CurrentVersion \Internet Settings\"ProxyEnable" =_0x00000001 2492 Regkey Setval \REGISTRY\USER\S-1-5-21-527237240-1580818891-725345543-500\Software Microsoft\Windows\CurrentVersion_\Internet Settings\Connections\"SavedLegacySettings" = 46 00 00 00_08 04 00 00 03 00_00 00 0d 00 00_00 31_30 2e 30 2e 30_2e 32 3a_38 30_38 30 00_00 00 00 00 00 00_00 00 00_00 00 00 00 00 00_00_0 0 00_00_00_00 00_00 00 00_00_00 00