Overview
overview
10Static
static
7Windows/000.exe
windows7-x64
Windows/000.exe
windows10-2004-x64
Windows/BUG32.exe
windows7-x64
Windows/BUG32.exe
windows10-2004-x64
Windows/Bonzify.exe
windows7-x64
8Windows/Bonzify.exe
windows10-2004-x64
8Windows/Em...99.exe
windows7-x64
5Windows/Em...99.exe
windows10-2004-x64
5Windows/Em...tr.exe
windows7-x64
1Windows/Em...tr.exe
windows10-2004-x64
1Windows/Em...al.exe
windows7-x64
5Windows/Em...al.exe
windows10-2004-x64
5Windows/Em...en.exe
windows7-x64
1Windows/Em...en.exe
windows10-2004-x64
1Windows/Em...hu.exe
windows7-x64
5Windows/Em...hu.exe
windows10-2004-x64
1Windows/Fa...ye.exe
windows7-x64
6Windows/Fa...ye.exe
windows10-2004-x64
6Windows/PC...er.exe
windows7-x64
1Windows/PC...er.exe
windows10-2004-x64
7Windows/Ra...ac.exe
windows7-x64
10Windows/Ra...ac.exe
windows10-2004-x64
Windows/Ra...it.exe
windows7-x64
10Windows/Ra...it.exe
windows10-2004-x64
10Windows/Ra...or.exe
windows7-x64
Windows/Ra...or.exe
windows10-2004-x64
Windows/Ra...on.exe
windows7-x64
10Windows/Ra...on.exe
windows10-2004-x64
7Windows/Ra...ye.exe
windows7-x64
10Windows/Ra...ye.exe
windows10-2004-x64
10Windows/Ra...Eye.js
windows7-x64
10Windows/Ra...Eye.js
windows10-2004-x64
10Analysis
-
max time kernel
9s -
max time network
34s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
10-03-2024 23:01
Behavioral task
behavioral1
Sample
Windows/000.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
Windows/000.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral3
Sample
Windows/BUG32.exe
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
Windows/BUG32.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral5
Sample
Windows/Bonzify.exe
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
Windows/Bonzify.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral7
Sample
Windows/Email-Worm/Email-Worm.Win32.Happy99/Happy99.exe
Resource
win7-20240221-en
Behavioral task
behavioral8
Sample
Windows/Email-Worm/Email-Worm.Win32.Happy99/Happy99.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral9
Sample
Windows/Email-Worm/Email-Worm.Win32.Magistr/Magistr.exe
Resource
win7-20240215-en
Behavioral task
behavioral10
Sample
Windows/Email-Worm/Email-Worm.Win32.Magistr/Magistr.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral11
Sample
Windows/Email-Worm/Email-Worm.Win32.Maldal/Maldal.exe
Resource
win7-20240221-en
Behavioral task
behavioral12
Sample
Windows/Email-Worm/Email-Worm.Win32.Maldal/Maldal.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral13
Sample
Windows/Email-Worm/Email-Worm.Win32.MeltingScreen/MeltingScreen.exe
Resource
win7-20240220-en
Behavioral task
behavioral14
Sample
Windows/Email-Worm/Email-Worm.Win32.MeltingScreen/MeltingScreen.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral15
Sample
Windows/Email-Worm/Email-Worm.Win32.Pikachu/Pikachu.exe
Resource
win7-20240221-en
Behavioral task
behavioral16
Sample
Windows/Email-Worm/Email-Worm.Win32.Pikachu/Pikachu.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral17
Sample
Windows/Fake GoldenEye/FakeGoldenEye.exe
Resource
win7-20240221-en
Behavioral task
behavioral18
Sample
Windows/Fake GoldenEye/FakeGoldenEye.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral19
Sample
Windows/PCToaster/PCToaster.exe
Resource
win7-20240215-en
Behavioral task
behavioral20
Sample
Windows/PCToaster/PCToaster.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral21
Sample
Windows/Ransomware/Annabelle Ransomware/716335ba5cd1e7186c40295b199190e2b6655e48f1c1cbe12139ba67faa5e1ac.exe
Resource
win7-20240221-en
Behavioral task
behavioral22
Sample
Windows/Ransomware/Annabelle Ransomware/716335ba5cd1e7186c40295b199190e2b6655e48f1c1cbe12139ba67faa5e1ac.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral23
Sample
Windows/Ransomware/BadRabbit Ransomware/BadRabbit.exe
Resource
win7-20231129-en
Behavioral task
behavioral24
Sample
Windows/Ransomware/BadRabbit Ransomware/BadRabbit.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral25
Sample
Windows/Ransomware/Monster Ransomware (second new version)/tunamor.exe
Resource
win7-20240221-en
Behavioral task
behavioral26
Sample
Windows/Ransomware/Monster Ransomware (second new version)/tunamor.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral27
Sample
Windows/Ransomware/Monster Ransomware/XMoon.exe
Resource
win7-20240221-en
Behavioral task
behavioral28
Sample
Windows/Ransomware/Monster Ransomware/XMoon.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral29
Sample
Windows/Ransomware/Trojan.Ransom.GoldenEye/GoldenEye.exe
Resource
win7-20240221-en
Behavioral task
behavioral30
Sample
Windows/Ransomware/Trojan.Ransom.GoldenEye/GoldenEye.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral31
Sample
Windows/Ransomware/Trojan.Ransom.GoldenEye/GoldenEye.js
Resource
win7-20240221-en
Behavioral task
behavioral32
Sample
Windows/Ransomware/Trojan.Ransom.GoldenEye/GoldenEye.js
Resource
win10v2004-20240226-en
Errors
General
-
Target
Windows/BUG32.exe
-
Size
3.0MB
-
MD5
149cc2ec1900cb778afb50d8026eadf5
-
SHA1
a7bc1bbc7bdc970757ec369ef0b51dc53989f131
-
SHA256
817a695e53a1d6e24f2c701751b4d18468f20698f30fada420dfba6e21a09797
-
SHA512
d617654478beb6325d86c108cddaff8f8d658a235d26b8e0282ed85dca826bdb62b0b67e749c7cd421dbae1d98084220e2f4d5779badb8fd7ab07ff333a35553
-
SSDEEP
49152:Or2U5IahDUGN97rkqOAackLjQ0rZEAh3oA6wHE+K60Kk0aCLkfAZKt0OJTcL:4H2ahFNNrg3QbQoA6wHEnFN4IJu
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, wscript.exe \"C:\\bug32\\runner.vbs\"" wscript.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Consentpromptbehavioradmin = "0" wscript.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" wscript.exe -
Renames multiple (136) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistrytools = "1" wscript.exe -
Disables Task Manager via registry modification
-
Modifies system executable filetype association 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\DefaultIcon wscript.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\DefaultIcon\ = "C:\\Bug32\\icon.ico" wscript.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 16 IoCs
description ioc Process File created C:\Users\Admin\Downloads\desktop.ini wscript.exe File created C:\Users\Admin\Pictures\desktop.ini wscript.exe File created C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\266EQP1S\desktop.ini wscript.exe File created C:\Users\Admin\Searches\desktop.ini wscript.exe File created C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\desktop.ini wscript.exe File created C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\2Y0HPGOE\desktop.ini wscript.exe File created C:\Users\Admin\Contacts\desktop.ini wscript.exe File created C:\Users\Admin\Documents\desktop.ini wscript.exe File created C:\Users\Admin\Favorites\desktop.ini wscript.exe File created C:\Users\Admin\Music\desktop.ini wscript.exe File created C:\Users\Admin\Saved Games\desktop.ini wscript.exe File created C:\Users\Admin\Videos\desktop.ini wscript.exe File created C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\JP38OXIN\desktop.ini wscript.exe File created C:\Users\Admin\Desktop\desktop.ini wscript.exe File created C:\Users\Admin\Links\desktop.ini wscript.exe File created C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\AS4I30IR\desktop.ini wscript.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies Control Panel 4 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Control Panel\Cursors\Hand = "C:\\bug32\\bx.cur" wscript.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Control Panel\Cursors wscript.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Control Panel\Cursors\Arrow = "C:\\bug32\\bx.cur" wscript.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Control Panel\Cursors\AppStarting = "C:\\bug32\\bx.cur" wscript.exe -
Modifies registry class 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\DefaultIcon\ = "C:\\Bug32\\icon.ico" wscript.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\DefaultIcon wscript.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1948 wscript.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1720 wrote to memory of 2612 1720 BUG32.exe 28 PID 1720 wrote to memory of 2612 1720 BUG32.exe 28 PID 1720 wrote to memory of 2612 1720 BUG32.exe 28 PID 1720 wrote to memory of 2612 1720 BUG32.exe 28 PID 2612 wrote to memory of 2392 2612 wscript.exe 29 PID 2612 wrote to memory of 2392 2612 wscript.exe 29 PID 2612 wrote to memory of 2392 2612 wscript.exe 29 PID 2392 wrote to memory of 1948 2392 wscript.exe 30 PID 2392 wrote to memory of 1948 2392 wscript.exe 30 PID 2392 wrote to memory of 1948 2392 wscript.exe 30 PID 1948 wrote to memory of 1004 1948 wscript.exe 31 PID 1948 wrote to memory of 1004 1948 wscript.exe 31 PID 1948 wrote to memory of 1004 1948 wscript.exe 31 PID 1948 wrote to memory of 1004 1948 wscript.exe 31 PID 1948 wrote to memory of 2360 1948 wscript.exe 315 PID 1948 wrote to memory of 2360 1948 wscript.exe 315 PID 1948 wrote to memory of 2360 1948 wscript.exe 315 PID 1004 wrote to memory of 276 1004 wmplayer.exe 34 PID 1004 wrote to memory of 276 1004 wmplayer.exe 34 PID 1004 wrote to memory of 276 1004 wmplayer.exe 34 PID 1004 wrote to memory of 276 1004 wmplayer.exe 34 PID 1004 wrote to memory of 276 1004 wmplayer.exe 34 PID 1004 wrote to memory of 276 1004 wmplayer.exe 34 PID 1004 wrote to memory of 276 1004 wmplayer.exe 34 PID 1948 wrote to memory of 2596 1948 wscript.exe 35 PID 1948 wrote to memory of 2596 1948 wscript.exe 35 PID 1948 wrote to memory of 2596 1948 wscript.exe 35 PID 1948 wrote to memory of 2468 1948 wscript.exe 473 PID 1948 wrote to memory of 2468 1948 wscript.exe 473 PID 1948 wrote to memory of 2468 1948 wscript.exe 473 PID 1948 wrote to memory of 2728 1948 wscript.exe 478 PID 1948 wrote to memory of 2728 1948 wscript.exe 478 PID 1948 wrote to memory of 2728 1948 wscript.exe 478 PID 1948 wrote to memory of 1836 1948 wscript.exe 322 PID 1948 wrote to memory of 1836 1948 wscript.exe 322 PID 1948 wrote to memory of 1836 1948 wscript.exe 322 PID 1948 wrote to memory of 1296 1948 wscript.exe 576 PID 1948 wrote to memory of 1296 1948 wscript.exe 576 PID 1948 wrote to memory of 1296 1948 wscript.exe 576 PID 1948 wrote to memory of 760 1948 wscript.exe 513 PID 1948 wrote to memory of 760 1948 wscript.exe 513 PID 1948 wrote to memory of 760 1948 wscript.exe 513 PID 1948 wrote to memory of 920 1948 wscript.exe 47 PID 1948 wrote to memory of 920 1948 wscript.exe 47 PID 1948 wrote to memory of 920 1948 wscript.exe 47 PID 1948 wrote to memory of 540 1948 wscript.exe 620 PID 1948 wrote to memory of 540 1948 wscript.exe 620 PID 1948 wrote to memory of 540 1948 wscript.exe 620 PID 1948 wrote to memory of 3068 1948 wscript.exe 735 PID 1948 wrote to memory of 3068 1948 wscript.exe 735 PID 1948 wrote to memory of 3068 1948 wscript.exe 735 PID 1948 wrote to memory of 2332 1948 wscript.exe 628 PID 1948 wrote to memory of 2332 1948 wscript.exe 628 PID 1948 wrote to memory of 2332 1948 wscript.exe 628 PID 1948 wrote to memory of 1980 1948 wscript.exe 624 PID 1948 wrote to memory of 1980 1948 wscript.exe 624 PID 1948 wrote to memory of 1980 1948 wscript.exe 624 PID 1948 wrote to memory of 1512 1948 wscript.exe 433 PID 1948 wrote to memory of 1512 1948 wscript.exe 433 PID 1948 wrote to memory of 1512 1948 wscript.exe 433 PID 1948 wrote to memory of 1564 1948 wscript.exe 537 PID 1948 wrote to memory of 1564 1948 wscript.exe 537 PID 1948 wrote to memory of 1564 1948 wscript.exe 537 PID 1948 wrote to memory of 1728 1948 wscript.exe 379 -
System policy modification 1 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System wscript.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Consentpromptbehavioradmin = "0" wscript.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System wscript.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" wscript.exe -
Views/modifies file attributes 1 TTPs 1 IoCs
pid Process 564 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Windows\BUG32.exe"C:\Users\Admin\AppData\Local\Temp\Windows\BUG32.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1720 -
C:\Windows\system32\wscript.exe"C:\Windows\sysnative\wscript.exe" C:\Users\Admin\AppData\Local\Temp\894C.tmp\894D.vbs2⤵
- UAC bypass
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2612 -
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" "C:\BUG32\admin.vbs"3⤵
- Suspicious use of WriteProcessMemory
PID:2392 -
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" "C:\bug32\jaq.vbs" RunAsAdministrator4⤵
- Modifies WinLogon for persistence
- UAC bypass
- Disables RegEdit via registry modification
- Modifies system executable filetype association
- Drops desktop.ini file(s)
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1948 -
C:\Program Files (x86)\Windows Media Player\wmplayer.exe"C:\Program Files (x86)\Windows Media Player\wmplayer.exe"5⤵
- Suspicious use of WriteProcessMemory
PID:1004 -
C:\Program Files (x86)\Windows Media Player\setup_wm.exe"C:\Program Files (x86)\Windows Media Player\setup_wm.exe" /RunOnce:"C:\Program Files (x86)\Windows Media Player\wmplayer.exe"6⤵PID:276
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c dir "C:\Users\Admin\" /s/b/o:n/a:d > "C:\BUG32\list.lnk" & echo :ok:>>"C:\bug32\list.lnk"5⤵PID:2360
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\*.*" "*.exe"5⤵PID:2596
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\Application Data\*.*" "*.exe"5⤵PID:2468
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\Contacts\*.*" "*.exe"5⤵PID:2728
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\Cookies\*.*" "*.exe"5⤵PID:1836
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\Desktop\*.*" "*.exe"5⤵PID:1296
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\Documents\*.*" "*.exe"5⤵PID:760
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\Downloads\*.*" "*.exe"5⤵PID:920
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\Favorites\*.*" "*.exe"5⤵PID:540
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\Links\*.*" "*.exe"5⤵PID:3068
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\Local Settings\*.*" "*.exe"5⤵PID:2332
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\Music\*.*" "*.exe"5⤵PID:1980
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\My Documents\*.*" "*.exe"5⤵PID:1512
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\NetHood\*.*" "*.exe"5⤵PID:1564
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\Pictures\*.*" "*.exe"5⤵PID:1728
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\PrintHood\*.*" "*.exe"5⤵PID:2052
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\Recent\*.*" "*.exe"5⤵PID:2488
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\Saved Games\*.*" "*.exe"5⤵PID:2572
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\Searches\*.*" "*.exe"5⤵PID:1592
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\SendTo\*.*" "*.exe"5⤵PID:2624
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\Start Menu\*.*" "*.exe"5⤵PID:2620
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\Templates\*.*" "*.exe"5⤵PID:2484
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\Videos\*.*" "*.exe"5⤵PID:2496
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Local\*.*" "*.exe"5⤵PID:2520
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\LocalLow\*.*" "*.exe"5⤵PID:2384
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Roaming\*.*" "*.exe"5⤵PID:1720
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Local\Adobe\*.*" "*.exe"5⤵PID:2636
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Local\Application Data\*.*" "*.exe"5⤵PID:2716
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Local\Google\*.*" "*.exe"5⤵PID:1836
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Local\History\*.*" "*.exe"5⤵PID:1476
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Local\Microsoft\*.*" "*.exe"5⤵PID:2324
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Local\Microsoft Help\*.*" "*.exe"5⤵PID:2016
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Local\Mozilla\*.*" "*.exe"5⤵PID:1628
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Local\Temp\*.*" "*.exe"5⤵PID:2064
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Local\Temporary Internet Files\*.*" "*.exe"5⤵PID:1108
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Local\Adobe\Acrobat\*.*" "*.exe"5⤵PID:1964
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Local\Adobe\Color\*.*" "*.exe"5⤵PID:824
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Local\Adobe\Acrobat\9.0\*.*" "*.exe"5⤵PID:1436
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Local\Adobe\Acrobat\9.0\Cache\*.*" "*.exe"5⤵PID:1528
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Local\Adobe\Color\Profiles\*.*" "*.exe"5⤵PID:3020
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Local\Google\Chrome\*.*" "*.exe"5⤵PID:1480
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\*.*" "*.exe"5⤵PID:3032
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\AutofillStates\*.*" "*.exe"5⤵PID:1544
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\BrowserMetrics\*.*" "*.exe"5⤵PID:1088
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\CertificateRevocation\*.*" "*.exe"5⤵PID:940
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ClientSidePhishing\*.*" "*.exe"5⤵PID:1800
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\*.*" "*.exe"5⤵PID:540
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crowd Deny\*.*" "*.exe"5⤵PID:684
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\*.*" "*.exe"5⤵PID:2904
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\DesktopSharingHub\*.*" "*.exe"5⤵PID:2216
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\FileTypePolicies\*.*" "*.exe"5⤵PID:2908
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\FirstPartySetsPreloaded\*.*" "*.exe"5⤵PID:2492
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\FontLookupTableCache\*.*" "*.exe"5⤵PID:2472
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\GrShaderCache\*.*" "*.exe"5⤵PID:2184
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\hyphen-data\*.*" "*.exe"5⤵PID:1588
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\MEIPreload\*.*" "*.exe"5⤵PID:2616
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\OnDeviceHeadSuggestModel\*.*" "*.exe"5⤵PID:2552
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\OptimizationHints\*.*" "*.exe"5⤵PID:2484
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\OriginTrials\*.*" "*.exe"5⤵PID:2612
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\PKIMetadata\*.*" "*.exe"5⤵PID:2520
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\pnacl\*.*" "*.exe"5⤵PID:2396
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\RecoveryImproved\*.*" "*.exe"5⤵PID:788
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\SafetyTips\*.*" "*.exe"5⤵PID:1568
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\*.*" "*.exe"5⤵PID:2444
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\SSLErrorAssistant\*.*" "*.exe"5⤵PID:2468
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Subresource Filter\*.*" "*.exe"5⤵PID:2804
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\SwReporter\*.*" "*.exe"5⤵PID:1836
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ThirdPartyModuleList64\*.*" "*.exe"5⤵PID:1472
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\UrlParamClassifications\*.*" "*.exe"5⤵PID:2324
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\WidevineCdm\*.*" "*.exe"5⤵PID:2016
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ZxcvbnData\*.*" "*.exe"5⤵PID:2076
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\attachments\*.*" "*.exe"5⤵PID:620
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\reports\*.*" "*.exe"5⤵PID:524
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\AutofillStrikeDatabase\*.*" "*.exe"5⤵PID:1892
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\blob_storage\*.*" "*.exe"5⤵PID:1972
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BudgetDatabase\*.*" "*.exe"5⤵PID:1388
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\*.*" "*.exe"5⤵PID:1456
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\*.*" "*.exe"5⤵PID:2040
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\commerce_subscription_db\*.*" "*.exe"5⤵PID:1780
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\coupon_db\*.*" "*.exe"5⤵PID:2948
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DawnCache\*.*" "*.exe"5⤵PID:1772
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Download Service\*.*" "*.exe"5⤵PID:3020
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extension Scripts\*.*" "*.exe"5⤵PID:2800
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extension State\*.*" "*.exe"5⤵PID:1664
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\*.*" "*.exe"5⤵PID:1652
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\*.*" "*.exe"5⤵PID:2876
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\*.*" "*.exe"5⤵PID:2808
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Local Storage\*.*" "*.exe"5⤵PID:2100
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\*.*" "*.exe"5⤵PID:600
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_hint_cache_store\*.*" "*.exe"5⤵PID:1732
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_model_metadata_store\*.*" "*.exe"5⤵PID:2588
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Safe Browsing Network\*.*" "*.exe"5⤵PID:2216
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform\*.*" "*.exe"5⤵PID:2528
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Session Storage\*.*" "*.exe"5⤵PID:2080
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sessions\*.*" "*.exe"5⤵PID:1584
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\*.*" "*.exe"5⤵PID:2408
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\*.*" "*.exe"5⤵PID:2532
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\*.*" "*.exe"5⤵PID:2484
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\blob_storage\a96217b6-9f15-45a8-ab1e-36777804e8eb\*.*" "*.exe"5⤵PID:2420
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\*.*" "*.exe"5⤵PID:556
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\*.*" "*.exe"5⤵PID:2608
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\wasm\*.*" "*.exe"5⤵PID:1148
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\*.*" "*.exe"5⤵PID:596
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\wasm\index-dir\*.*" "*.exe"5⤵PID:2284
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Download Service\Files\*.*" "*.exe"5⤵PID:1720
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\AvailabilityDB\*.*" "*.exe"5⤵PID:2316
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\EventDB\*.*" "*.exe"5⤵PID:1920
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\*.*" "*.exe"5⤵PID:1080
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\*.*" "*.exe"5⤵PID:2228
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform\SegmentInfoDB\*.*" "*.exe"5⤵PID:2060
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform\SignalDB\*.*" "*.exe"5⤵PID:1124
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform\SignalStorageConfigDB\*.*" "*.exe"5⤵PID:2320
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata\*.*" "*.exe"5⤵PID:1308
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\*.*" "*.exe"5⤵PID:2004
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Subresource Filter\Unindexed Rules\*.*" "*.exe"5⤵PID:388
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Local\Microsoft\Credentials\*.*" "*.exe"5⤵PID:760
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Local\Microsoft\Feeds\*.*" "*.exe"5⤵PID:1480
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\*.*" "*.exe"5⤵PID:1600
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\*.*" "*.exe"5⤵PID:3020
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Local\Microsoft\Media Player\*.*" "*.exe"5⤵PID:1452
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Local\Microsoft\Office\*.*" "*.exe"5⤵PID:1932
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Local\Microsoft\PlayReady\*.*" "*.exe"5⤵PID:540
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Local\Microsoft\Windows\*.*" "*.exe"5⤵PID:1676
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\*.*" "*.exe"5⤵PID:2876
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Local\Microsoft\Windows Media\*.*" "*.exe"5⤵PID:1164
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Local\Microsoft\Windows Sidebar\*.*" "*.exe"5⤵PID:2332
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Local\Microsoft\Feeds\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\*.*" "*.exe"5⤵PID:2904
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Local\Microsoft\Feeds\Feeds for United States~\*.*" "*.exe"5⤵PID:2784
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Local\Microsoft\Feeds\Microsoft Feeds~\*.*" "*.exe"5⤵PID:2588
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Local\Microsoft\Feeds\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\WebSlices~\*.*" "*.exe"5⤵PID:2540
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\13GJQKNF\*.*" "*.exe"5⤵PID:2528
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\266EQP1S\*.*" "*.exe"5⤵PID:2472
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\2Y0HPGOE\*.*" "*.exe"5⤵PID:2576
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\AS4I30IR\*.*" "*.exe"5⤵PID:2488
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\JP38OXIN\*.*" "*.exe"5⤵PID:2568
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\Q1TIA27L\*.*" "*.exe"5⤵PID:2408
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\Q75FKZKV\*.*" "*.exe"5⤵PID:1144
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\SOOCQOHS\*.*" "*.exe"5⤵PID:2704
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\IECompatData\*.*" "*.exe"5⤵PID:788
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\*.*" "*.exe"5⤵PID:556
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\*.*" "*.exe"5⤵PID:2360
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\TabRoaming\*.*" "*.exe"5⤵PID:2700
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Tiles\*.*" "*.exe"5⤵PID:2220
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Tracking Protection\*.*" "*.exe"5⤵PID:932
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\q905y6j\*.*" "*.exe"5⤵PID:1048
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\*.*" "*.exe"5⤵PID:2924
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\*.*" "*.exe"5⤵PID:1900
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Last Active\*.*" "*.exe"5⤵PID:2324
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-2845162440\*.*" "*.exe"5⤵PID:1956
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Tiles\pin9728060290\*.*" "*.exe"5⤵PID:620
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Local\Microsoft\Media Player\Sync Playlists\*.*" "*.exe"5⤵PID:1756
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\*.*" "*.exe"5⤵PID:3000
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\000088CE\*.*" "*.exe"5⤵PID:612
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Local\Microsoft\Office\Groove\*.*" "*.exe"5⤵PID:3016
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Local\Microsoft\Office\Groove\System\*.*" "*.exe"5⤵PID:2768
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Local\Microsoft\Office\Groove\User\*.*" "*.exe"5⤵PID:2232
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\*.*" "*.exe"5⤵PID:3012
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\*.*" "*.exe"5⤵PID:1688
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\*.*" "*.exe"5⤵PID:760
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Local\Microsoft\Windows\GameExplorer\*.*" "*.exe"5⤵PID:1480
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Local\Microsoft\Windows\History\*.*" "*.exe"5⤵PID:2180
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Local\Microsoft\Windows\Ringtones\*.*" "*.exe"5⤵PID:1152
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\*.*" "*.exe"5⤵PID:2188
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Local\Microsoft\Windows\WebCache\*.*" "*.exe"5⤵PID:1580
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\*.*" "*.exe"5⤵PID:2844
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Local\Microsoft\Windows\History\History.IE5\*.*" "*.exe"5⤵PID:2888
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Local\Microsoft\Windows\History\Low\*.*" "*.exe"5⤵PID:2100
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\*.*" "*.exe"5⤵PID:2868
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\*.*" "*.exe"5⤵PID:1164
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Virtualized\*.*" "*.exe"5⤵PID:2812
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\1OEGTYQG\*.*" "*.exe"5⤵PID:1072
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5DKX8QD5\*.*" "*.exe"5⤵PID:1564
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\9M0HR0P6\*.*" "*.exe"5⤵PID:1728
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\BB0Z8TKM\*.*" "*.exe"5⤵PID:2588
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\L9PN2QMY\*.*" "*.exe"5⤵PID:2640
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LS99WIMF\*.*" "*.exe"5⤵PID:2384
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\U8A9A2DI\*.*" "*.exe"5⤵PID:2080
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WZPJ6IGS\*.*" "*.exe"5⤵PID:2548
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Backup\*.*" "*.exe"5⤵PID:2820
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\*.*" "*.exe"5⤵PID:1592
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Backup\new\*.*" "*.exe"5⤵PID:1004
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\*.*" "*.exe"5⤵PID:1408
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Local\Microsoft\Windows Sidebar\Gadgets\*.*" "*.exe"5⤵PID:2728
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Local\Mozilla\Firefox\*.*" "*.exe"5⤵PID:1472
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\*.*" "*.exe"5⤵PID:932
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\gdoevwuq.Admin\*.*" "*.exe"5⤵PID:2804
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\gdoevwuq.default-release\*.*" "*.exe"5⤵PID:1988
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\gdoevwuq.default-release\cache2\*.*" "*.exe"5⤵PID:2328
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\gdoevwuq.default-release\safebrowsing\*.*" "*.exe"5⤵PID:1300
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\gdoevwuq.default-release\settings\*.*" "*.exe"5⤵PID:3000
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\gdoevwuq.default-release\startupCache\*.*" "*.exe"5⤵PID:676
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\gdoevwuq.default-release\thumbnails\*.*" "*.exe"5⤵PID:1436
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\gdoevwuq.default-release\cache2\doomed\*.*" "*.exe"5⤵PID:968
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\gdoevwuq.default-release\cache2\entries\*.*" "*.exe"5⤵PID:1604
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\gdoevwuq.default-release\settings\main\*.*" "*.exe"5⤵PID:3028
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\gdoevwuq.default-release\settings\main\ms-language-packs\*.*" "*.exe"5⤵PID:1520
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\gdoevwuq.default-release\settings\main\ms-language-packs\browser\*.*" "*.exe"5⤵PID:832
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\gdoevwuq.default-release\settings\main\ms-language-packs\browser\newtab\*.*" "*.exe"5⤵PID:3032
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Local\Temp\1861773781\*.*" "*.exe"5⤵PID:1800
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Local\Temp\894C.tmp\*.*" "*.exe"5⤵PID:1512
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\*.*" "*.exe"5⤵PID:2188
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Local\Temp\Low\*.*" "*.exe"5⤵PID:1548
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\*.*" "*.exe"5⤵PID:2968
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\*.*" "*.exe"5⤵PID:2888
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\*.*" "*.exe"5⤵PID:1664
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Local\Temp\Windows\*.*" "*.exe"5⤵PID:2876
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Local\Temp\WPDNSE\*.*" "*.exe"5⤵PID:1616
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Local\Temp\894C.tmp\BUG32\*.*" "*.exe"5⤵PID:1876
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Local\Temp\Windows\Email-Worm\*.*" "*.exe"5⤵PID:2124
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Local\Temp\Windows\Fake GoldenEye\*.*" "*.exe"5⤵PID:2588
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Local\Temp\Windows\PCToaster\*.*" "*.exe"5⤵PID:2940
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Local\Temp\Windows\Ransomware\*.*" "*.exe"5⤵PID:2504
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Local\Temp\Windows\Trojan.VBS.Bolbi\*.*" "*.exe"5⤵PID:2612
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Local\Temp\Windows\Win16\*.*" "*.exe"5⤵PID:2456
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Local\Temp\Windows\Win32\*.*" "*.exe"5⤵PID:1644
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Local\Temp\Windows\Win9x\*.*" "*.exe"5⤵PID:2392
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Local\Temp\Windows\Email-Worm\Email-Worm.Win32.Happy99\*.*" "*.exe"5⤵PID:2396
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Local\Temp\Windows\Email-Worm\Email-Worm.Win32.Magistr\*.*" "*.exe"5⤵PID:788
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Local\Temp\Windows\Email-Worm\Email-Worm.Win32.Maldal\*.*" "*.exe"5⤵PID:2508
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Local\Temp\Windows\Email-Worm\Email-Worm.Win32.MeltingScreen\*.*" "*.exe"5⤵PID:2468
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Local\Temp\Windows\Email-Worm\Email-Worm.Win32.Pikachu\*.*" "*.exe"5⤵PID:1196
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Local\Temp\Windows\Ransomware\Annabelle Ransomware\*.*" "*.exe"5⤵PID:2260
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Local\Temp\Windows\Ransomware\BadRabbit Ransomware\*.*" "*.exe"5⤵PID:2444
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Local\Temp\Windows\Ransomware\Monster Ransomware\*.*" "*.exe"5⤵PID:932
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Local\Temp\Windows\Ransomware\Monster Ransomware (second new version)\*.*" "*.exe"5⤵PID:1952
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Local\Temp\Windows\Ransomware\Trojan.Ransom.GoldenEye\*.*" "*.exe"5⤵PID:544
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Local\Temp\Windows\Ransomware\Trojan.Ransom.NotPetya\*.*" "*.exe"5⤵PID:2228
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Local\Temp\Windows\Ransomware\Trojan.Ransom.PetrWrap\*.*" "*.exe"5⤵PID:2008
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Local\Temp\Windows\Ransomware\WannaCrypt0r\*.*" "*.exe"5⤵PID:2476
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Local\Temp\Windows\Win16\Virus.Win16.Apparition\*.*" "*.exe"5⤵PID:2308
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Local\Temp\Windows\Win16\Virus.Win16.Gollum\*.*" "*.exe"5⤵PID:820
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Local\Temp\Windows\Win32\Joke.Win32.Badgame\*.*" "*.exe"5⤵PID:1460
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Local\Temp\Windows\Win32\Joke.Win32.FakePetya\*.*" "*.exe"5⤵PID:2096
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Local\Temp\Windows\Win32\Net-Worm.Win32.Opaserv\*.*" "*.exe"5⤵PID:1464
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Local\Temp\Windows\Win32\Trojan.Win32.Alerta\*.*" "*.exe"5⤵PID:1936
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Local\Temp\Windows\Win32\Trojan.Win32.IconDance\*.*" "*.exe"5⤵PID:2004
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Local\Temp\Windows\Win32\Trojan.Win32.Sevgi\*.*" "*.exe"5⤵PID:2116
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Local\Temp\Windows\Win32\Trojan.Win32.Whiter\*.*" "*.exe"5⤵PID:1688
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Local\Temp\Windows\Win32\Virus.VBS.Karma\*.*" "*.exe"5⤵PID:2800
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Local\Temp\Windows\Win32\Virus.Win32.Antares\*.*" "*.exe"5⤵PID:760
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Local\Temp\Windows\Win32\Virus.Win32.Rigel\*.*" "*.exe"5⤵PID:960
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Local\Temp\Windows\Win32\Virus.Win32.Winfig\*.*" "*.exe"5⤵PID:1696
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Local\Temp\Windows\Win9x\Trojan.Win9x.FlashKiller\*.*" "*.exe"5⤵PID:272
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Local\Temp\Windows\Win9x\Virus.Win9x.CIH\*.*" "*.exe"5⤵PID:2020
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Local\Temp\Windows\Win9x\Virus.Win9x.CIH (Infected AlZip program)\*.*" "*.exe"5⤵PID:2808
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Local\Temp\Windows\Win9x\Virus.Win9x.Prizm\*.*" "*.exe"5⤵PID:3068
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Local\Temp\Windows\Win9x\Virus.Win9x.Shoerec\*.*" "*.exe"5⤵PID:1500
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Local\Temp\Windows\Win9x\Virus.Win9x.Smash\*.*" "*.exe"5⤵PID:2092
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\LocalLow\Microsoft\*.*" "*.exe"5⤵PID:2868
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\LocalLow\Mozilla\*.*" "*.exe"5⤵PID:2264
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\LocalLow\Sun\*.*" "*.exe"5⤵PID:1940
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\*.*" "*.exe"5⤵PID:1564
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\*.*" "*.exe"5⤵PID:2732
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\*.*" "*.exe"5⤵PID:2528
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\*.*" "*.exe"5⤵PID:2616
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\*.*" "*.exe"5⤵PID:2388
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\LocalLow\Sun\Java\*.*" "*.exe"5⤵PID:2940
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\*.*" "*.exe"5⤵PID:2416
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\LocalLow\Sun\Java\jdk1.7.0_80_x64\*.*" "*.exe"5⤵PID:2624
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\*.*" "*.exe"5⤵PID:2820
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\security\*.*" "*.exe"5⤵PID:1644
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\*.*" "*.exe"5⤵PID:1588
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\0\*.*" "*.exe"5⤵PID:1592
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\1\*.*" "*.exe"5⤵PID:2988
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\10\*.*" "*.exe"5⤵PID:2508
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\11\*.*" "*.exe"5⤵PID:596
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\12\*.*" "*.exe"5⤵PID:2608
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\13\*.*" "*.exe"5⤵PID:2244
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\14\*.*" "*.exe"5⤵PID:1612
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\15\*.*" "*.exe"5⤵PID:1960
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\16\*.*" "*.exe"5⤵PID:2928
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\17\*.*" "*.exe"5⤵PID:1296
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\18\*.*" "*.exe"5⤵PID:1068
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\19\*.*" "*.exe"5⤵PID:2064
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\2\*.*" "*.exe"5⤵PID:2008
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\20\*.*" "*.exe"5⤵PID:1624
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\21\*.*" "*.exe"5⤵PID:432
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\22\*.*" "*.exe"5⤵PID:1760
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\23\*.*" "*.exe"5⤵PID:840
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\24\*.*" "*.exe"5⤵PID:1436
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\25\*.*" "*.exe"5⤵PID:684
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\26\*.*" "*.exe"5⤵PID:2040
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\27\*.*" "*.exe"5⤵PID:1968
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\28\*.*" "*.exe"5⤵PID:1540
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\29\*.*" "*.exe"5⤵PID:1128
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\3\*.*" "*.exe"5⤵PID:2128
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\30\*.*" "*.exe"5⤵PID:2116
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\31\*.*" "*.exe"5⤵PID:1180
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\32\*.*" "*.exe"5⤵PID:1632
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\33\*.*" "*.exe"5⤵PID:1832
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\34\*.*" "*.exe"5⤵PID:940
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\35\*.*" "*.exe"5⤵PID:2188
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\36\*.*" "*.exe"5⤵PID:1052
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\37\*.*" "*.exe"5⤵PID:540
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\38\*.*" "*.exe"5⤵PID:1392
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\39\*.*" "*.exe"5⤵PID:1880
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\4\*.*" "*.exe"5⤵PID:1664
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\40\*.*" "*.exe"5⤵PID:1676
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\41\*.*" "*.exe"5⤵PID:2864
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\42\*.*" "*.exe"5⤵PID:2788
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\43\*.*" "*.exe"5⤵PID:2412
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\44\*.*" "*.exe"5⤵PID:2492
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\45\*.*" "*.exe"5⤵PID:2580
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\46\*.*" "*.exe"5⤵PID:1708
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\47\*.*" "*.exe"5⤵PID:2536
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\48\*.*" "*.exe"5⤵PID:1072
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\49\*.*" "*.exe"5⤵PID:2488
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\5\*.*" "*.exe"5⤵PID:2156
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\50\*.*" "*.exe"5⤵PID:2408
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\51\*.*" "*.exe"5⤵PID:2940
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\52\*.*" "*.exe"5⤵PID:2704
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\53\*.*" "*.exe"5⤵PID:1716
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\54\*.*" "*.exe"5⤵PID:2392
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\55\*.*" "*.exe"5⤵PID:988
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\56\*.*" "*.exe"5⤵PID:2196
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\57\*.*" "*.exe"5⤵PID:1592
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\58\*.*" "*.exe"5⤵PID:556
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\59\*.*" "*.exe"5⤵PID:1648
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\6\*.*" "*.exe"5⤵PID:1472
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\60\*.*" "*.exe"5⤵PID:2444
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\61\*.*" "*.exe"5⤵PID:1672
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\62\*.*" "*.exe"5⤵PID:1720
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\63\*.*" "*.exe"5⤵PID:2928
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\7\*.*" "*.exe"5⤵PID:1988
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\8\*.*" "*.exe"5⤵PID:1296
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\9\*.*" "*.exe"5⤵PID:620
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\host\*.*" "*.exe"5⤵PID:1268
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\muffin\*.*" "*.exe"5⤵PID:1740
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Roaming\Adobe\*.*" "*.exe"5⤵PID:1260
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Roaming\Identities\*.*" "*.exe"5⤵PID:2644
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Roaming\Macromedia\*.*" "*.exe"5⤵PID:3000
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Roaming\Media Center Programs\*.*" "*.exe"5⤵PID:2240
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Roaming\Microsoft\*.*" "*.exe"5⤵PID:1436
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Roaming\Mozilla\*.*" "*.exe"5⤵PID:676
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\*.*" "*.exe"5⤵PID:2796
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Roaming\Adobe\Flash Player\*.*" "*.exe"5⤵PID:2712
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\*.*" "*.exe"5⤵PID:1904
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\Collab\*.*" "*.exe"5⤵PID:2128
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Roaming\Adobe\Flash Player\AssetCache\*.*" "*.exe"5⤵PID:3032
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Roaming\Adobe\Flash Player\NativeCache\*.*" "*.exe"5⤵PID:3012
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Roaming\Adobe\Flash Player\AssetCache\W2PX52CE\*.*" "*.exe"5⤵PID:1544
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Roaming\Identities\{F7E0A1CC-10C1-4208-A9B9-3E8B64D61CEF}\*.*" "*.exe"5⤵PID:1928
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Roaming\Macromedia\Flash Player\*.*" "*.exe"5⤵PID:2976
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\*.*" "*.exe"5⤵PID:888
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Roaming\Macromedia\Flash Player\macromedia.com\*.*" "*.exe"5⤵PID:1692
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\YQTXB6Z2\*.*" "*.exe"5⤵PID:272
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Roaming\Macromedia\Flash Player\macromedia.com\support\*.*" "*.exe"5⤵PID:2684
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Roaming\Macromedia\Flash Player\macromedia.com\support\flashplayer\*.*" "*.exe"5⤵PID:1548
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Roaming\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\*.*" "*.exe"5⤵PID:2000
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Roaming\Microsoft\Credentials\*.*" "*.exe"5⤵PID:1676
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\*.*" "*.exe"5⤵PID:3068
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\*.*" "*.exe"5⤵PID:2832
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Roaming\Microsoft\Protect\*.*" "*.exe"5⤵PID:2412
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Roaming\Microsoft\SystemCertificates\*.*" "*.exe"5⤵PID:2784
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\*.*" "*.exe"5⤵PID:2564
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\*.*" "*.exe"5⤵PID:1876
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-330940541-141609230-1670313778-1000\*.*" "*.exe"5⤵PID:2544
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\*.*" "*.exe"5⤵PID:2572
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\UserData\*.*" "*.exe"5⤵PID:2724
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\*.*" "*.exe"5⤵PID:2416
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\ImplicitAppShortcuts\*.*" "*.exe"5⤵PID:2612
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\*.*" "*.exe"5⤵PID:2704
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\UserData\Low\*.*" "*.exe"5⤵PID:1716
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Roaming\Microsoft\Protect\S-1-5-21-330940541-141609230-1670313778-1000\*.*" "*.exe"5⤵PID:788
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Roaming\Microsoft\SystemCertificates\My\*.*" "*.exe"5⤵PID:1608
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Roaming\Microsoft\SystemCertificates\My\Certificates\*.*" "*.exe"5⤵PID:1476
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Roaming\Microsoft\SystemCertificates\My\CRLs\*.*" "*.exe"5⤵PID:2424
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Roaming\Microsoft\SystemCertificates\My\CTLs\*.*" "*.exe"5⤵PID:1744
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\*.*" "*.exe"5⤵PID:1196
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\DNTException\*.*" "*.exe"5⤵PID:2716
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\IECompatCache\*.*" "*.exe"5⤵PID:2260
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\IECompatUACache\*.*" "*.exe"5⤵PID:2728
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\IEDownloadHistory\*.*" "*.exe"5⤵PID:1720
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\IETldCache\*.*" "*.exe"5⤵PID:2928
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\*.*" "*.exe"5⤵PID:1892
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Network Shortcuts\*.*" "*.exe"5⤵PID:1116
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Printer Shortcuts\*.*" "*.exe"5⤵PID:2772
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PrivacIE\*.*" "*.exe"5⤵PID:2592
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\*.*" "*.exe"5⤵PID:2368
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\*.*" "*.exe"5⤵PID:1740
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\*.*" "*.exe"5⤵PID:2304
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\*.*" "*.exe"5⤵PID:2328
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\*.*" "*.exe"5⤵PID:2024
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\*.*" "*.exe"5⤵PID:2796
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\DNTException\Low\*.*" "*.exe"5⤵PID:1936
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\IECompatCache\Low\*.*" "*.exe"5⤵PID:2348
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\IECompatUACache\Low\*.*" "*.exe"5⤵PID:1904
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\IETldCache\Low\*.*" "*.exe"5⤵PID:3032
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PrivacIE\Low\*.*" "*.exe"5⤵PID:1088
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\*.*" "*.exe"5⤵PID:3028
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\*.*" "*.exe"5⤵PID:1632
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\*.*" "*.exe"5⤵PID:1800
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\*.*" "*.exe"5⤵PID:2036
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\*.*" "*.exe"5⤵PID:1732
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\*.*" "*.exe"5⤵PID:2344
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\*.*" "*.exe"5⤵PID:2092
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\*.*" "*.exe"5⤵PID:1652
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\*.*" "*.exe"5⤵PID:2864
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Roaming\Mozilla\Extensions\*.*" "*.exe"5⤵PID:2376
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\*.*" "*.exe"5⤵PID:2876
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\*.*" "*.exe"5⤵PID:2784
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Pending Pings\*.*" "*.exe"5⤵PID:2600
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\*.*" "*.exe"5⤵PID:2124
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\events\*.*" "*.exe"5⤵PID:2384
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\gdoevwuq.Admin\*.*" "*.exe"5⤵PID:2388
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\gdoevwuq.default-release\*.*" "*.exe"5⤵PID:2504
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\gdoevwuq.default-release\bookmarkbackups\*.*" "*.exe"5⤵PID:1716
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\gdoevwuq.default-release\crashes\*.*" "*.exe"5⤵PID:1588
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\gdoevwuq.default-release\datareporting\*.*" "*.exe"5⤵PID:596
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\gdoevwuq.default-release\minidumps\*.*" "*.exe"5⤵PID:916
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\gdoevwuq.default-release\security_state\*.*" "*.exe"5⤵PID:2988
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\gdoevwuq.default-release\sessionstore-backups\*.*" "*.exe"5⤵PID:2608
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\gdoevwuq.default-release\storage\*.*" "*.exe"5⤵PID:2284
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\gdoevwuq.default-release\crashes\events\*.*" "*.exe"5⤵PID:2260
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\gdoevwuq.default-release\datareporting\glean\*.*" "*.exe"5⤵PID:1680
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\gdoevwuq.default-release\datareporting\glean\db\*.*" "*.exe"5⤵PID:1048
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\gdoevwuq.default-release\datareporting\glean\events\*.*" "*.exe"5⤵PID:1900
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\gdoevwuq.default-release\datareporting\glean\pending_pings\*.*" "*.exe"5⤵PID:2068
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\gdoevwuq.default-release\datareporting\glean\tmp\*.*" "*.exe"5⤵PID:1756
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\gdoevwuq.default-release\storage\permanent\*.*" "*.exe"5⤵PID:2060
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\gdoevwuq.default-release\storage\permanent\chrome\*.*" "*.exe"5⤵PID:620
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\gdoevwuq.default-release\storage\permanent\chrome\idb\*.*" "*.exe"5⤵PID:1460
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\gdoevwuq.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.files\*.*" "*.exe"5⤵PID:684
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\gdoevwuq.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.files\*.*" "*.exe"5⤵PID:1056
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\gdoevwuq.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.files\*.*" "*.exe"5⤵PID:2200
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\gdoevwuq.default-release\storage\permanent\chrome\idb\2918063365piupsah.files\*.*" "*.exe"5⤵PID:1536
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\gdoevwuq.default-release\storage\permanent\chrome\idb\3561288849sdhlie.files\*.*" "*.exe"5⤵PID:2096
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\gdoevwuq.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.files\*.*" "*.exe"5⤵PID:1936
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\Documents\My Music\*.*" "*.exe"5⤵PID:1540
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\Documents\My Pictures\*.*" "*.exe"5⤵PID:1772
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\Documents\My Videos\*.*" "*.exe"5⤵PID:1180
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\Favorites\Links\*.*" "*.exe"5⤵PID:1696
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\Favorites\Links for United States\*.*" "*.exe"5⤵PID:1512
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\Favorites\Microsoft Websites\*.*" "*.exe"5⤵PID:760
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\Favorites\MSN Websites\*.*" "*.exe"5⤵PID:2020
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\Favorites\Windows Live\*.*" "*.exe"5⤵PID:1272
-
-
C:\Windows\System32\shutdown.exe"C:\Windows\System32\shutdown.exe" -r -t 055⤵PID:1732
-
-
C:\Windows\System32\attrib.exe"C:\Windows\System32\attrib.exe" +h "C:\BUG32"5⤵
- Views/modifies file attributes
PID:564
-
-
-
-
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "55271875-505177093745606983-642866322179645899410657037516850264781445189653"1⤵PID:2216
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "1823857300-670658659160428957312998323813009049393851743081866736418-282006859"1⤵PID:1836
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-786886448-754068759-157972059718522283316935625301846265242-7861500321866453850"1⤵PID:1628
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-4796207118304799951656693174-378775597-570616987-1714946877-1973926521-2034297893"1⤵PID:1964
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "11767326911876820285-317271850-330933531-12715653957613824129678653691890092269"1⤵PID:1584
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "1604015548-14676041531482404184-294299391-454205061127707253219795754891579447881"1⤵PID:1920
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-1117681430-1826377646-53664404879797793-1757812750-212020292-1304439880-567545790"1⤵PID:1780
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-87787848824006942-163016183-1546447530161560342126860385517442842431754435212"1⤵PID:2360
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "318558997-1505584661731399817-993067301-1346504630-20887663620510182182120259528"1⤵PID:2728
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "1005038323-317733081-1870533209619210574-919396077-14202615961480185308987937354"1⤵PID:824
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-715399145-131155032915103896001635414708731669254200439987-12541352591682394958"1⤵PID:2100
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "1839755231176824099317721131321641195756-176099503-90407297410513318131622612200"1⤵PID:2484
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "15115892612026498324-6670182101482162127-21382854321408851871-205894921776416295"1⤵PID:2396
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-1745397703458690349-3281952761589689170-427103352-1913307503399445471-594437023"1⤵PID:2316
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "1471889991-430195203734069126-1449304075-918088734-12111089611700644517-1670859982"1⤵PID:1972
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "52146065-1176846371-1161473235-161084468511444499343472158-1266108108-192988730"1⤵PID:1308
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "961960658-2093917171-72804627018769590552081094483-938872907-636761626-1867561928"1⤵PID:1980
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-207612756912685729-897347308485739853-222637688493401000-926420800-169761175"1⤵PID:2332
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-73254988171213852913780477881910422210198582475473362790-940016334-2067374349"1⤵PID:1568
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "104983418719608107392095789478-1089575787-1390527678-1753781374-5730898271026116008"1⤵PID:1148
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "941600545-153370564218776985271948452065-9852879401469505636-9145409981466078224"1⤵PID:2016
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-122219811100569605216341998541183806169468795981657061425744618703-1193753621"1⤵PID:1080
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-826480613-122293126313412016-1592822923145065751068586064-11843754232050424686"1⤵PID:2620
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-18372888291147076852-326481342-62336553-1141863822602663351528775197914142585"1⤵PID:2040
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-13111148781606588424837085011998220429-1008265968-882563151-368032721-1751966565"1⤵PID:388
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-1801955374-358121446-36531445541219237416610186-1763108753-1507826199-1709643469"1⤵PID:1664
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "6718201121191845716-2057555218204301715421259215333065000331265047859-1758981474"1⤵PID:2904
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-1169686586509854703-10915553061245912026-1466453290-1301938219-1359355506-234642506"1⤵PID:2184
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "657481809-1112423974442391218-250061539-15084049799031863652110077865-1355960619"1⤵PID:2576
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-14748138261828998208-907808869-596212620112657601-724558816-10933420111680020897"1⤵PID:2408
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-344520997-93474941210902546-1308904235103339848-1791243692-1242789643-1093596050"1⤵PID:1144
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "1240188380-1519957368-1399706856-1354700952-10274458271873143572229753927350636536"1⤵PID:2496
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-1887820854211179253752858962612611788291179770022-1709497940-1805143222-76604136"1⤵PID:2468
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-646938547-1792017497-1251501199-364932891-5865889041549230941-199868756869189065"1⤵PID:2804
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "1618122513600603709-13219870073309798652017054703-5463887141346764704-110820018"1⤵PID:1436
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "297268588-19317922121604594771-1318188470-20423160347276271792034063891-890271726"1⤵PID:2948
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "18499986012553407452108617769201227485616076315031908025181678005263-1650266047"1⤵PID:1600
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "147797077818907012331001128315-165869505310153363601732626173546565398497759863"1⤵PID:2540
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "16274857401517812784186064136-1775254030-1671890452-5229900861863395829-156472008"1⤵PID:2908
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "465500648305530447-45529325164927099-301140835-20207606041980170947-1106487515"1⤵PID:2588
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-19741277992046663049-1247205711-896368755-1681713311788345251-729400508-882823800"1⤵PID:2532
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "693804301435641851-2090668461-995174907-998743331-152381796505153677-414125844"1⤵PID:2520
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "2035855063150219663612325978841868854627-25926631520505754551281286377204722406"1⤵PID:1836
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "180047055917167405544571890501568859743-68305456017729256271313789842-1095811158"1⤵PID:2076
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "5855978822104885950-2119155753-18832539512046100991250167197593164055-1026199668"1⤵PID:1388
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "1109500401-6272674261561827685-445562183-79866282918775553091572222270796305214"1⤵PID:2064
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-20852592511406087647-377457310-923522953-121867748112388391211612394080-785325638"1⤵PID:1108
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "15194194265130971641940943752-692098282307785861-9903534-590951091765050348"1⤵PID:1456
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-21393930301972450814141831559066083612813106054191381399603-187859840-1781132250"1⤵PID:1452
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-10929811401812633392012717301-62016124127681282313528134592595487091900703555"1⤵PID:3032
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "4288635761229893074121686133217497588933072628531907615119790415283724055839"1⤵PID:1932
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-1527715446-1026270001-1872387637-654532941-995867100-1233624550-1146347130261994177"1⤵PID:940
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x01⤵PID:1560
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x11⤵PID:2672
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Winlogon Helper DLL
1Event Triggered Execution
1Change Default File Association
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Winlogon Helper DLL
1Event Triggered Execution
1Change Default File Association
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
182B
MD5052bc547687f4b9136a4d21ccb9be339
SHA1897dfc37a8d89c9fbe390f9663495a2940457100
SHA2562b1c03ec095baa8004183d2d9dc2a42d012c22969ee9923215cf73982e4bb122
SHA51285e9a4092ed12d426fc5903c4f576b0085b3e794060382a87b8c8c871139a7968dd43b797088e303f4583374551102e4dc064b9b1e8af4fe89ab20799a981a31
-
Filesize
513B
MD5739efd2b7b9737d3d191e9fc5b983824
SHA16ad90c8406ae243fbb5ce07172447879205b525c
SHA2561b51ef43c6e66683199c084b53b5b13d39a02ea6a94ca5f7293c7d68ba362583
SHA5127fa6ead55103ccf506192643ce608b84969a8bda28c7bc2855907d14b6e756574258924766920ea661d68507fca772a12a652aab7c85466e0d97a444098cf59c
-
Filesize
21KB
MD57999f942ff7190cb7c9f0e04d6dc3d41
SHA166c3743d7a3d0885a624600abd71486c63a52904
SHA2568c52ba6df441fea41e87285a7a79e790773407b4d377730b4f834b067d355776
SHA5129ea2f9e0e81b69895023da6a5e6f4850bdfb0e37d847a6086afaa3debb928673276fa149b2e8df154f6b0498191e5e7ab29c22bc415a761038435abcc4607cee
-
Filesize
2KB
MD5664a5626d7f9f5b991976b7c2fcd6176
SHA1cafdd6179df723c7a7dcfa96a774fd2dc92ef40f
SHA256691bbbad6b1d9b7c010cf63976e55e9c2b06ec0e9b29a7f16d8cf3b28e408cf8
SHA512d4f1eb1dac1404219915f882aeac2544f82465d8bf84d9af0e03fa671a4f0798ca42fcd801cce9715c05a06732a03ec31189943a4a001137f3a022a4b89991b7
-
Filesize
29B
MD59dbbdc7d01ea45c41f089d9c345b8100
SHA1c0d429a5e3a6e729583e6bcf0599a62466ccfbe2
SHA2569a3cfe496cf2c6b1efcba29320353194b3974ebeb49cadcbf83a72745c50fef6
SHA512530e8dbe050c7a073ff0efbf6e117f6bf86ad856ec43b8a7faefc495f603503a6e18994d8cb778f66ad1077904f64c7189b5a2c10c8899ebb6dcaaf5c4f3461e
-
Filesize
1.5MB
MD5fae94d96ac61b8d57365151e142ed9f4
SHA1bf9b9be54dcdadc9d8cdf427c16dc5ca9c8c28a8
SHA25686f9017cf6f3c95a43922e5e5c58d71cbc82064a78895b531d1f5aa368ea5b63
SHA5127b0d7026017dea8aa70975c023160e340cac7474bae5beedfb906f7378d033bb67c44b1c7085ac34ef061008ecd0cf545449e1da624c1408cda1e649ab1ca49d
-
Filesize
16KB
MD5e22ab01202357460eec9871c74e6212b
SHA1d16c867a6a32769b1cdab2ce2e37d4d7d48570b7
SHA2561bd0dbdbe78d8218968cf3d5f203abf52824870a39610c505e8fba695fd329bb
SHA5129535ad5c9d4b94ec525ab643e4f0ff37868465ae892f16c3465a5c0fc49a0bdb2075053bf1948502902e04996ef7dd3b8fa7dc6b9be4cb756ddfbd76544eb507
-
Filesize
50B
MD5faf4749b646b63a1df551fe0141727cb
SHA1eab00a1525581a6823d7216f3ec019012bab619f
SHA2566b2831b0c5bcac2f5f57aab8028cd486f4c6c26364a70ecc76ff71d7f710049c
SHA51228eea78034e7b6d09a32d9985d2731ec582c232425ee4d81a52d65aa5f3618f8d463c52caa881496116c47433140e7b1c79dc6add6b88ef2650ac7ae8cbfb67a
-
Filesize
200KB
MD5367b7179319f010f84b37acfc65082ba
SHA13c74537066cc79cf1505e9c79fe321b53ed3ab16
SHA256035cc52a0abb363a463e21787dc061a3b42376ba0b082bc9c2d7e2399365862f
SHA512d282fac9692b3ff1ab838b1a9a30727f7e166f92923503c65bca3bef85e75b300a1973d6fc1739f04f4058e743abdec29a08ecf1bda4730a02dcdaeb13749833
-
Filesize
398B
MD59e116f6eb010b8bff3211210e5b979fe
SHA1d81b32e7845a614a38e3902239ce978c908af8c2
SHA256cdeabd549e74e525e1baad3252246209667967399563f8be2b3275c8c276fc3e
SHA512fd5687206d013577577d68c65215cd4636a616b83e12e5acbae0b619e543ff06f67d3881c8c85d0e6e0ee13dd7f5e20246b9edafea26cb0d6bb39ee4362966b6
-
Filesize
344KB
MD577bb6c1e12d47eff938d2efb28e7fb9d
SHA17f4fc62fde5eb3beb6def399ab525380cc4b8965
SHA256926e24d85e847789a62f8ae3dae7af494ff329893a9a3c133b073b4b9cddbccb
SHA512a19afaa90822b0081d51612aea2a41992f5c4eb2f39767cf9ed96b1ffc88bbb4203b4a04e9942c2cef445866817f56802ef099ba4f034949861dd3da6c4b3b2f
-
Filesize
81B
MD500cf4877a187a307971f4fd650ac8c11
SHA12569ed07cbe4ab78d12cba571e83e1e1a7fc59b6
SHA2568fdd9f0aa62b3e365850970187311192f5e101768edad88b550cc39a6909bdce
SHA512039e90e66ed5fa8cd39a7525d1b7b0eba85b32d4954a41e60a113b61d3e1fda9b2356975a587873ca54cef129a894ac19e2d1c6d59e20a182412861b1205d4b9
-
Filesize
277B
MD5fe18d2d82dbfb9226cc424c0164252be
SHA1e058b9eff08e3a7370d49d78634c8c201db8f0e5
SHA2567922e452d5166bfa8e32e9392cb3b123cffc54b03218d8fcb584f5a2d97a0b96
SHA5126540372f658f6397eb836d979b4208c6507b4aafdb8eacce772d645cdc1f418690e50c275c0a71c305f0a9201688bbe955fb5023aff223f18c0e83e32735c996
-
Filesize
880KB
MD595aa92415c37bbf7e649d406f159853d
SHA1ff37bc8b297a81e78d31e27559a9c4e1e1307275
SHA256b9d6d86686222addc0048bdb7be1e5531a1d4b48d8d65e156e180e94035c3d02
SHA5126efa300352e64da46d343dad5ef2d810c7ee0b07dc9b7b1b8968ef9c8a4446ed4a17064194dfc44fbe16c95972e4866eb1042e34a2528b782f0ba0ee582fafed
-
Filesize
52KB
MD519d522cd15cc73b932f1ab4252d9d624
SHA127c0f04a38af403f84e1f2dc6965206e8b3f9b73
SHA25678c21952f543624fe51f92bc2f35b17f652e4fed695228aa530370ff05083a04
SHA5128c43e39a8affc34743b4e1521f85f578ea2b3b6f455d20983746ec4eb1f28f6f706889ba3ed1551b9a14ab3dc9723e719a48077de9fbd06dd77ee0f41b064a9c
-
Filesize
4KB
MD5e77aad670e295b9849a0d3d4f8501ec2
SHA10f0061209c15a0184bacfe87ff67c80a7283ded5
SHA256c1ffac115387d943660d11acea27a06a920f505a0f3142969c25c9fa2e830b6f
SHA512d2e9144a666600d407922a968ca8705f286d9b52ff43873a96a61fb39c63e11ad5d67e405cd5a95659d6309fc729b67269d19d405a9a2c9c8e18c2863515b760
-
Filesize
28KB
MD5d1f3e03544190dcaecd62923ba77bd76
SHA1dfab8960a9633d77701baf66d9f1c43c3f714bb3
SHA25690fcae5deaae179577d74bdb63ebb6a76612ea98ed813d4a74a10e1c2fc52361
SHA512716055c4a4788be4df1c8744279fedaa79ae3ba1123e5bf0798268009cd2fd5729519791310c5cc9dcf0761e9594539b11ce02493ba154b77c8eb0cb2fcc28d7