stealc | b2c9dc45a604fb78f67c28c065e821a08ea22664d11fd98ef6e16380becefb7a

Analysis

max time kernel
164s
max time network
162s
platform
windows11-21h2_x64
resource
win11-20240508-en
resource tags

arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system
submitted
26-05-2024 12:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

RegAsm.exe.vbs
Size

796B
MD5

96b82317503924c7d6219ec82e62e077
SHA1

258195926162e7ea161893ce67726166b3d00e58
SHA256

8fa98d60d53c1c2e5f59c5b7cdd6018cc2ac2817fe7f44515488b1ebf1014259
SHA512

8df38cf55587d9a142d67c629bd9a2f3b4b2e6ea4656fbd7f702f3860fb265f240c4085edab13c4f68a4817c25f4d5f018f578ab14091085cad5949920ec9a6b

Score

10^/10

stealc vidar persistence stealer

Malware Config

Signatures

Detect Vidar Stealer 10 IoCs

stealer

Processes:

resource	yara_rule
behavioral2/memory/1028-414-0x0000000000EA0000-0x0000000000F03953-memory.dmp	family_vidar_v7
behavioral2/memory/1028-415-0x0000000000EA0000-0x0000000000F03953-memory.dmp	family_vidar_v7
behavioral2/memory/1028-418-0x0000000000EA0000-0x0000000000F03953-memory.dmp	family_vidar_v7
behavioral2/memory/1028-419-0x0000000000EA0000-0x0000000000F03953-memory.dmp	family_vidar_v7
behavioral2/memory/22876-422-0x0000000000900000-0x0000000000963953-memory.dmp	family_vidar_v7
behavioral2/memory/1028-421-0x0000000000EA0000-0x0000000000F03953-memory.dmp	family_vidar_v7
behavioral2/memory/22876-424-0x0000000000900000-0x0000000000963953-memory.dmp	family_vidar_v7
behavioral2/memory/1028-423-0x0000000000EA0000-0x0000000000F03953-memory.dmp	family_vidar_v7
behavioral2/memory/22876-420-0x0000000000900000-0x0000000000963953-memory.dmp	family_vidar_v7
behavioral2/memory/1028-427-0x0000000000EA0000-0x0000000000F03953-memory.dmp	family_vidar_v7

Stealc
Stealc is an infostealer written in C++.
stealer stealc
Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar

Sets file execution options in registry 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

regedit.exeregedit.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RegAsm.exe	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RegAsm.exe\Debugger = "cmd /c echo Set WshShell = CreateObject(\"WScript.Shell\") > %temp%\\warn.vbs && echo WshShell.Popup \"WARNING: This process may have started without your knowledge\", 10, \"Warning\", 64 >> %temp%\\warn.vbs && cscript %temp%\\warn.vbs"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RegAsm.exe	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RegAsm.exe\Debugger = "cmd /c echo Set WshShell = CreateObject(\"WScript.Shell\") > %temp%\\warn.vbs && echo WshShell.Popup \"WARNING: This process may have started without your knowledge\", 10, \"Warning\", 64 >> %temp%\\warn.vbs && cscript %temp%\\warn.vbs"	regedit.exe

Executes dropped EXE 1 IoCs

Processes:

Setup.exe

pid process

1028 Setup.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
1028	Setup.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

Processes:

msedge.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings msedge.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings	msedge.exe

NTFS ADS 2 IoCs

Processes:

msedge.exemsedge.exe

description	ioc	process
File opened for modification	C:\Users\Admin\Downloads\latest-x64.rar:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\latest-x86.rar:Zone.Identifier	msedge.exe

Opens file in notepad (likely ransom note) 1 IoCs
ransomware

Processes:

pid process

39068
Runs .reg file with regedit 3 IoCs

Processes:

regedit.exeregedit.exe

pid process

4988 regedit.exe
4008 regedit.exe
45752

pid	process
39068

pid	process
4988	regedit.exe
4008	regedit.exe
45752

Suspicious behavior: EnumeratesProcesses 12 IoCs

Processes:

msedge.exemsedge.exemsedge.exeidentity_helper.exemsedge.exemsedge.exe

pid	process
4896	msedge.exe
4896	msedge.exe
912	msedge.exe
912	msedge.exe
2944	msedge.exe
2944	msedge.exe
3568	identity_helper.exe
3568	identity_helper.exe
400	msedge.exe
400	msedge.exe
1468	msedge.exe
1468	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 15 IoCs

Processes:

msedge.exe

pid	process
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

7zG.exe

description	pid	process
Token: SeRestorePrivilege	1884	7zG.exe
Token: 35	1884	7zG.exe
Token: SeSecurityPrivilege	1884	7zG.exe
Token: SeSecurityPrivilege	1884	7zG.exe

Suspicious use of FindShellTrayWindow 43 IoCs

Processes:

msedge.exe7zG.exe

pid	process
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
1884	7zG.exe

Suspicious use of SendNotifyMessage 12 IoCs

Processes:

msedge.exe

pid	process
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

cmd.execmd.exemsedge.exe

description	pid	process	target process
PID 3816 wrote to memory of 4620	3816	cmd.exe	cmd.exe
PID 3816 wrote to memory of 4620	3816	cmd.exe	cmd.exe
PID 4620 wrote to memory of 912	4620	cmd.exe	msedge.exe
PID 4620 wrote to memory of 912	4620	cmd.exe	msedge.exe
PID 912 wrote to memory of 1856	912	msedge.exe	msedge.exe
PID 912 wrote to memory of 1856	912	msedge.exe	msedge.exe
PID 912 wrote to memory of 4480	912	msedge.exe	msedge.exe
PID 912 wrote to memory of 4480	912	msedge.exe	msedge.exe
PID 912 wrote to memory of 4480	912	msedge.exe	msedge.exe
PID 912 wrote to memory of 4480	912	msedge.exe	msedge.exe
PID 912 wrote to memory of 4480	912	msedge.exe	msedge.exe
PID 912 wrote to memory of 4480	912	msedge.exe	msedge.exe
PID 912 wrote to memory of 4480	912	msedge.exe	msedge.exe
PID 912 wrote to memory of 4480	912	msedge.exe	msedge.exe
PID 912 wrote to memory of 4480	912	msedge.exe	msedge.exe
PID 912 wrote to memory of 4480	912	msedge.exe	msedge.exe
PID 912 wrote to memory of 4480	912	msedge.exe	msedge.exe
PID 912 wrote to memory of 4480	912	msedge.exe	msedge.exe
PID 912 wrote to memory of 4480	912	msedge.exe	msedge.exe
PID 912 wrote to memory of 4480	912	msedge.exe	msedge.exe
PID 912 wrote to memory of 4480	912	msedge.exe	msedge.exe
PID 912 wrote to memory of 4480	912	msedge.exe	msedge.exe
PID 912 wrote to memory of 4480	912	msedge.exe	msedge.exe
PID 912 wrote to memory of 4480	912	msedge.exe	msedge.exe
PID 912 wrote to memory of 4480	912	msedge.exe	msedge.exe
PID 912 wrote to memory of 4480	912	msedge.exe	msedge.exe
PID 912 wrote to memory of 4480	912	msedge.exe	msedge.exe
PID 912 wrote to memory of 4480	912	msedge.exe	msedge.exe
PID 912 wrote to memory of 4480	912	msedge.exe	msedge.exe
PID 912 wrote to memory of 4480	912	msedge.exe	msedge.exe
PID 912 wrote to memory of 4480	912	msedge.exe	msedge.exe
PID 912 wrote to memory of 4480	912	msedge.exe	msedge.exe
PID 912 wrote to memory of 4480	912	msedge.exe	msedge.exe
PID 912 wrote to memory of 4480	912	msedge.exe	msedge.exe
PID 912 wrote to memory of 4480	912	msedge.exe	msedge.exe
PID 912 wrote to memory of 4480	912	msedge.exe	msedge.exe
PID 912 wrote to memory of 4480	912	msedge.exe	msedge.exe
PID 912 wrote to memory of 4480	912	msedge.exe	msedge.exe
PID 912 wrote to memory of 4480	912	msedge.exe	msedge.exe
PID 912 wrote to memory of 4480	912	msedge.exe	msedge.exe
PID 912 wrote to memory of 4480	912	msedge.exe	msedge.exe
PID 912 wrote to memory of 4480	912	msedge.exe	msedge.exe
PID 912 wrote to memory of 4480	912	msedge.exe	msedge.exe
PID 912 wrote to memory of 4480	912	msedge.exe	msedge.exe
PID 912 wrote to memory of 4480	912	msedge.exe	msedge.exe
PID 912 wrote to memory of 4480	912	msedge.exe	msedge.exe
PID 912 wrote to memory of 4896	912	msedge.exe	msedge.exe
PID 912 wrote to memory of 4896	912	msedge.exe	msedge.exe
PID 912 wrote to memory of 660	912	msedge.exe	msedge.exe
PID 912 wrote to memory of 660	912	msedge.exe	msedge.exe
PID 912 wrote to memory of 660	912	msedge.exe	msedge.exe
PID 912 wrote to memory of 660	912	msedge.exe	msedge.exe
PID 912 wrote to memory of 660	912	msedge.exe	msedge.exe
PID 912 wrote to memory of 660	912	msedge.exe	msedge.exe
PID 912 wrote to memory of 660	912	msedge.exe	msedge.exe
PID 912 wrote to memory of 660	912	msedge.exe	msedge.exe
PID 912 wrote to memory of 660	912	msedge.exe	msedge.exe
PID 912 wrote to memory of 660	912	msedge.exe	msedge.exe
PID 912 wrote to memory of 660	912	msedge.exe	msedge.exe
PID 912 wrote to memory of 660	912	msedge.exe	msedge.exe
PID 912 wrote to memory of 660	912	msedge.exe	msedge.exe
PID 912 wrote to memory of 660	912	msedge.exe	msedge.exe
PID 912 wrote to memory of 660	912	msedge.exe	msedge.exe
PID 912 wrote to memory of 660	912	msedge.exe	msedge.exe

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\RegAsm.exe.vbs"
1⤵
PID:2568

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1636

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\RegAsm.exe.vbs"
1⤵
PID:888

C:\Windows\regedit.exe
"regedit.exe" "C:\Users\Admin\AppData\Local\Temp\RegAsm.exe.reg"
1⤵
- Sets file execution options in registry
- Runs .reg file with regedit
PID:4988

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\GG.cmd" "
1⤵
- Suspicious use of WriteProcessMemory
PID:3816
- C:\Windows\system32\cmd.exe
  cmd /c start https://github.com/unileprionis/hudsight-2-free
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4620
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/unileprionis/hudsight-2-free
    3⤵
    - Enumerates system info in registry
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:912
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x10c,0x110,0x114,0xdc,0x118,0x7ff909c83cb8,0x7ff909c83cc8,0x7ff909c83cd8
      4⤵
      PID:1856
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1944,1608467732161801824,8402296686016426116,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1984 /prefetch:2
      4⤵
      PID:4480
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1944,1608467732161801824,8402296686016426116,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2112 /prefetch:3
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4896
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1944,1608467732161801824,8402296686016426116,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2580 /prefetch:8
      4⤵
      PID:660
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,1608467732161801824,8402296686016426116,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3372 /prefetch:1
      4⤵
      PID:1880
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,1608467732161801824,8402296686016426116,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
      4⤵
      PID:3292
  - - C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1944,1608467732161801824,8402296686016426116,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5640 /prefetch:8
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3568
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1944,1608467732161801824,8402296686016426116,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5212 /prefetch:8
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2944
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,1608467732161801824,8402296686016426116,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5856 /prefetch:1
      4⤵
      PID:2692
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1944,1608467732161801824,8402296686016426116,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6004 /prefetch:8
      4⤵
      NTFS ADS
      Suspicious behavior: EnumeratesProcesses
      PID:400
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1944,1608467732161801824,8402296686016426116,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5064 /prefetch:8
      4⤵
      NTFS ADS
      Suspicious behavior: EnumeratesProcesses
      PID:1468
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,1608467732161801824,8402296686016426116,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5992 /prefetch:1
      4⤵
      PID:1008
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,1608467732161801824,8402296686016426116,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5664 /prefetch:1
      4⤵
      PID:2868
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,1608467732161801824,8402296686016426116,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6380 /prefetch:1
      4⤵
      PID:4680
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,1608467732161801824,8402296686016426116,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6400 /prefetch:1
      4⤵
      PID:2784
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,1608467732161801824,8402296686016426116,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6280 /prefetch:1
      4⤵
      PID:1920
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,1608467732161801824,8402296686016426116,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6420 /prefetch:1
      4⤵
      PID:2720
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,1608467732161801824,8402296686016426116,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6744 /prefetch:1
      4⤵
      PID:4672
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,1608467732161801824,8402296686016426116,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6760 /prefetch:1
      4⤵
      PID:1904
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,1608467732161801824,8402296686016426116,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6780 /prefetch:1
      4⤵
      PID:3620
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,1608467732161801824,8402296686016426116,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6784 /prefetch:1
      4⤵
      PID:1440
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,1608467732161801824,8402296686016426116,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6844 /prefetch:1
      4⤵
      PID:3592
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,1608467732161801824,8402296686016426116,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6852 /prefetch:1
      4⤵
      PID:1480

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4352

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:464

C:\Windows\regedit.exe
"regedit.exe" "C:\Users\Admin\AppData\Local\Temp\RegAsm.exe.reg"
1⤵
- Sets file execution options in registry
- Runs .reg file with regedit
PID:4008

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\*\" -spe -an -ai#7zMap16451:162:7zEvent32141
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1884

C:\Users\Admin\Downloads\latest-x64\Setup.exe
"C:\Users\Admin\Downloads\latest-x64\Setup.exe"
1⤵
- Executes dropped EXE
PID:1028
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:1664
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:3308
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:1564
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:1832
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:1908
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:1952
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:3680
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:2436
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:3744
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:2896
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:956
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:4424
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:644
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:3144
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:2948
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:2000
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:1524
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:1092
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:3632
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:3236
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:3028
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:4600
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:780
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:4872
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:2196
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:2120
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:1072
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:3892
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:1468
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:1220
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:1200
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:2112
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:3392
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:5028
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:3016
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:3760
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:4928
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:948
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:3376
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:5008
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:680
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:3916
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:2508
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:2496
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:2680
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:2260
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:4284
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:1636
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:4224
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:2536
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:4068
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:1244
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:1448
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:3260
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:2772
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:4628
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:4132
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:1488
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:4840
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:2080
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:4640
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:1336
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:5104
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:3272
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:4032
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:4708
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:4076
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:248
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:3488
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:2944
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:3704
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:5080
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:2200
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:3940
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:2860
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:2640
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:2784
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:4860
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:4680
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:3592
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:3304
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:4160
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:3128
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:4040
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:1588
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:1988
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:2660
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:3944
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:3336
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:2736
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:1388
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:1184
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:3804
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:1656
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:3040
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:4136
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:3808
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:3904
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:3736
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:3460
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:4580
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:4320
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:2148
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:2636
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:920
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:4504
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:3148
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:4736
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:4516
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:3532
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:1400
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:4700
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:4564
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:4720
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:4124
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:4672
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:416
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:2676
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:3776
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:3596
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:2912
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:1948
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:3908
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:1800
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:2812
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:1696
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:5108
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:3796
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:3576
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:3948
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:4468
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:4464
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:3560
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:3644
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:1672
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:3516
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:1452
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:2732
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:4900
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:1536
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:648
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:3288
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:1912
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:960
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:3100
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:2864
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:4896
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:1544
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:4976
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:1416
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:2960
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:4532
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:1284
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:3480
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:3292
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:1792
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:1096
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:3568
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:4656
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:3216
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:2384
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:1008
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:3708
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:2868
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:1036
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:4984
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:3876
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:1120
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:3108
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:1860
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:3780
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:2396
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:3572
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:4052
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:1188
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:4636
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:2544
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:1580
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:3104
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:1984
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:2116
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:3476
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:900
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:4952
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:2420
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:4864
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:4588
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:2888
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:1752
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:2652
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:4852
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:3620
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:4616
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:4688
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:3140
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:4412
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:784
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:1540
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:2236
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:1148
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:3372
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:4128
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:5128
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:5136
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:5144
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:5152
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:5160
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:5168
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:5176
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:5184
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:5192
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:5200
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:5208
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:5216
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:5224
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:5232
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:5240
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:5248
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:5256
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:5264
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:5272
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:5280
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:5288
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:5296
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:5304
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:5312
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:5320
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:5328
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:5336
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:5344
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:5352
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:5360
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:5368
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:5376
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:5384
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:5392
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:5400
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:5408
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:5416
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:5424
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:5432
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:5440
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:5448
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:5456
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:5464
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:5472
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:5480
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:5488
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:5496
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:5504
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:5512
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:5520
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:5528
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:5536
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:5544
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:5552
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:5560
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:5568
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:5576
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:5584
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:5592
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:5600
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:5608
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:5616
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:5624
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:5632
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:5640
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:5648
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:5656
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:5664
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:5672
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:5680
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:5688
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:5696
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:5704
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:5712
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:5720
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:5728
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:5736
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:5744
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:5752
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:5760
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:5768
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:5776
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:5784
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:5792
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:5800
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:5808
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:5816
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:5824
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:5832
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:5840
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:5848
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:5856
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:5864
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:5872
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:5880
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:5888
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:5896
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:5904
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:5912
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:5920
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:5928
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:5936
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:5944
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:5952
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:5960
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:5968
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:5976
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:5984
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:5992
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:6000
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:6008
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:6016
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:6024
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:6032
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:6040
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:6048
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:6056
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:6064
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:6072
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:6080
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:6088
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:6096
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:6104
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:6112
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:6120
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:6128
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:6136
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:6148
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:6156
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:6164
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:6172
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:6180
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:6188
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:6196
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:6204
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:6212
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:6220
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:6228
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:6236
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:6244
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:6252
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:6260
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:6268
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:6276
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:6284
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:6292
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:6300
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:6308
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:6316
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:6324
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:6332
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:6340
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:6348
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:6356
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:6364
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:6372
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:6380
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:6388
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:6396
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:6404
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:6412
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:6420
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:6428
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:6436
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:6444
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:6452
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:6460
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:6468
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:6476
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:6484
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:6492
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:6500
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:6508
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:6516
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:6524
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:6532
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:6540
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:6548
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:6556
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:6564
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:6572
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:6580
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:6588
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:6596
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:6604
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:6612
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:6620
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:6628
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:6636
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:6644
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:6652
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:6660
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:6668
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:6676
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:6684
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:6692
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:6700
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:6708
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:6716
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:6724
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:6732
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:6740
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:6748
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:6756
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:6764
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:6772
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:6780
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:6788
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:6796
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:6804
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:6812
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:6820
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:6828
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:6836
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:6844
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:6852
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:6860
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:6868
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:6876
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:6884
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:6892
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:6900
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:6908
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:6916
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:6924
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:6932
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:6940
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:6948
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:6956
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:6964
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:6972
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:6980
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:6988
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:6996
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:7004
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:7012
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:7020
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:7028
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:7036
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:7044
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:7052
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:7060
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:7068
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:7076
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:7084
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:7092
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:7100
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:7108
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:7116
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:7124
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:7132
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:7140
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:7148
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:7156
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:7164
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:7172
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:7180
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:7188
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:7196
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:7204
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:7212
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:7220
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:7228
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:7236
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:7244
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:7252
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:7260
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:7268
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:7276
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:7284
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:7292
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:7300
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:7308
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:7316
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:7324
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:7332
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:7340
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:7348
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:7356
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:7364
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:7372
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:7380
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:7388
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:7396
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:7404
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:7412
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:7420
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:7428
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:7436
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:7444
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:7452
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:7460
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:7468
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:7476
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:7484
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:7492
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:7500
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:7508
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:7516
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:7524
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:7532
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:7540
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:7548
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:7556
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:7564
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:7572
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:7580
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:7588
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:7596
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:7604
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:7612
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:7620
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:7628
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:7636
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:7644
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:7652
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:7660
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:7668
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:7676
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:7684
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:7692
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:7700
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:7708
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:7716
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:7724
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:7732
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:7740
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:7748
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:7756
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:7764
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:7772
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:7780
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:7788
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:7796
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:7804
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:7812
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:7820
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:7828
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:7836
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:7844
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:7852
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:7860
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:7868
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:7876
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:7884
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:7892
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:7900
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:7908
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:7916
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:7924
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:7932
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:7940
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:7948
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:7956
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:7964
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:7972
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:7980
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:7988
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:7996
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:8004
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:8012
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:8020
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:8028
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:8036
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:8044
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:8052
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:8060
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:8068
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:8076
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:8084
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:8092
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:8100
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:8108
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:8116
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:8124
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:8132
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:8140
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:8148
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:8156
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:8164
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:8172
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:8180
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:8188
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:8196
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:8204
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:8212
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:8220
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:8228
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:8236
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:8244
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:8252
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:8260
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:8268
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:8276
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:8284
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:8292
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:8300
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:8308
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:8316
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:8324
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:8332
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:8340
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:8348
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:8356
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:8364
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:8372
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:8380
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:8388
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:8396
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:8404
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:8412
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:8420
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:8428
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:8436
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:8444
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:8452
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:8460
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:8468
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:8476
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:8484
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:8492
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:8500
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:8508
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:8516
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:8524
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:8532
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:8540
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:8548
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:8556
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:8564
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:8572
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:8580
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:8588
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:8596
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:8604
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:8612
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:8620
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:8628
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:8636
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:8644
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:8652
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:8660
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:8668
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:8676
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:8684
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:8692
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:8700
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:8708
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:8716
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:8724
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:8732
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:8740
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:8748
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:8756
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:8764
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:8772
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:8780
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:8788
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:8796
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:8804
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:8812
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:8820
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:8828
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:8836
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:8844
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:8852
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:8860
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:8868
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:8876
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:8884
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:8892
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:8900
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:8908
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:8916
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:8924
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:8932
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:8940
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:8948
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:8956
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:8964
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:8972
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:8980
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:8988
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:8996
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:9004
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:9012
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:9020
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:9028
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:9036
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:9044
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:9052
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:9060
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:9068
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:9076
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:9084
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:9092
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:9100
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:9108
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:9116
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:9124
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:9132
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:9140
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:9148
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:9156
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:9164
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:9172
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:9180
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:9188
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:9196
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:9204
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:9212
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:9224
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:9232
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:9240
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:9248
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:9256
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:9264
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:9272
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:9280
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:9288
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:9296
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:9304
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:9312
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:9320
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:9328
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:9336
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:9344
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:9352
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:9360
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:9368
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:9376
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:9384
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:9392
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:9400
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:9408
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:9416
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:9424
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:9432
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:9440
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:9448
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:9456
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:9464
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:9472
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:9480
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:9488
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:9496
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:9504
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:9512
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:9520
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:9528
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:9536
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:9544
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:9552
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:9560
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:9568
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:9576
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:9584
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:9592
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:9600
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:9608
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:9616
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:9624
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:9632
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:9640
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:9648
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:9656
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:9664
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:9672
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:9680
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:9688
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:9696
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:9704
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:9712
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:9720
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:9728
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:9736
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:9744
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:9752
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:9760
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:9768
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:9776
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:9784
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:9792
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:9800
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:9808
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:9816
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:9824
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:9832
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:9840
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:9848
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:9856
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:9864
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:9872
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:9880
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:9888
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:9896
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:9904
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:9912
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:9920
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:9928
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:9936
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:9944
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:9952
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:9960
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:9968
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:9976
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:9984
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:9992
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:10000
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:10008
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:10016
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:10024
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:10032
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:10040
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:10048
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:10056
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:10064
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:10072
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:10080
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:10088
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:10096
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:10104
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:10112
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:10120
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:10128
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:10136
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:10144
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:10152
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:10160
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:10168
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:10176
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:10184
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:10192
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:10200
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:10208
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:10216
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:10224
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:10232
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:3976
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:10248
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:10256
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:10264
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:10272
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:10280
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:10288
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:10296
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:10304
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:10312
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:10320
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:10328
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:10336
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:10344
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:10352
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:10360
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:10368
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:10376
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:10384
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:10392
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:10400
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:10408
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:10416
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:10424
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:10432
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:10440
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:10448
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:10456
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:10464
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:10472
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:10480
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:10488
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:10496
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:10504
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:10512
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:10520
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:10528
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:10536
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:10544
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:10552
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:10560
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:10568
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:10576
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:10584
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:10592
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:10600
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:10608
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:10616
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:10624
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:10632
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:10640
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:10648
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:10656
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:10664
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:10672
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:10680
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:10688
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:10696
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:10704
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:10712
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:10720
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:10728
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:10736
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:10744
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:10752
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:10760
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:10768
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:10776
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:10784
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:10792
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:10800
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:10808
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:10816
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:10824
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:10832
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:10840
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:10848
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:10856
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:10864
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:10872
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:10880
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:10888
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:10896
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:10904
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:10912
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:10920
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:10928
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:10936
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:10944
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:10952
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:10960
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:10968
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:10976
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:10984
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:10992
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:11000
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:11008
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:11016
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:11024
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:11032
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:11040
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:11048
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:11056
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:11064
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:11072
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:11080
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:11088
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:11096
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:11104
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:11112
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:11120
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:11128
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:11136
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:11144
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:11152
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:11160
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:11168
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:11176
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:11184
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:11192
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:11200
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:11208
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:11216
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:11224
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:11232
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:11240
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:11248
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:11256
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:4964
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:11272
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:11280
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:11288
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:11296
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:11304
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:11312
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:11320
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:11328
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:11336
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:11344
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:11352
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:11360
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:11368
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:11376
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:11384
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:11392
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:11400
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:11408
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:11416
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Set WshShell = CreateObject("WScript.Shell") > %temp%\warn.vbs && echo WshShell.Popup "WARNING: This process may have started without your knowledge", 10, "Warning", 64 >> %temp%\warn.vbs && cscript %temp%\warn.vbs "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:11424

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
390187670cb1e0eb022f4f7735263e82

SHA1
ea1401ccf6bf54e688a0dc9e6946eae7353b26f1

SHA256
3e6c56356d6509a3fd4b2403555be55e251f4a962379b29735c1203e57230947

SHA512
602f64d74096d4fb7a23b23374603246d42b17cc854835e3b2f4d464997b73f289a3b40eb690e3ee707829d4ff886865e982f72155d96be6bc00166f44878062

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8294f1821fd3419c0a42b389d19ecfc6

SHA1
cd4982751377c2904a1d3c58e801fa013ea27533

SHA256
92a96c9309023c8b9e1396ff41f7d9d3ff8a3687972e76b9ebd70b04e3bf223a

SHA512
372d369f7ad1b0e07200d3aa6b2cfce5beafa7a97f63932d4c9b3b01a0e8b7eb39881867f87ded55a9973abea973b2d2c9b6fc4892f81cec644702b9edb1566d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
4425cd7d6d98459dc16025cf9f4e901b

SHA1
d42d69b1b4ce30f40cb0f1c98577730b16211344

SHA256
229159b487af0abb9072894cabb275c6b9c6cf69a7e5b03c7ed465ec2fbeb2cc

SHA512
7d60b0ce1c97f304121f37635d04e5d05579ab0a0e6d479543fddf74245d2097bfeec8e184a2e9f2c3f2daf542127d75b7af6367693d787e3724148b23a0bb2a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
807419ca9a4734feaf8d8563a003b048

SHA1
a723c7d60a65886ffa068711f1e900ccc85922a6

SHA256
aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

SHA512
f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
496B

MD5
2ff4b0a28cbb1d79ad892d29eff5a289

SHA1
610ad5f22ba0b14005becaf3fe50512ed011fde4

SHA256
8684f55e8c85397e73ab1714db4ea03eacbd1299de8cd35bef22c687ea791785

SHA512
f91f60d325396329c1b6bc944b317b2a0d67f92c9dab1dd91a114054b1674ede3adb28319acdeb6d254c3a51ab8b016afbc42bf7665015e8f70038ce77434189

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
e065b01d7f8c4678dc9c29a78deae968

SHA1
077cf0945806cdaf592af727799a6d77abbeaef9

SHA256
8ec9fbaf6e0a7ab0f0f8c202edf5406a81662089b2eeced987d6dc482a449a9c

SHA512
f8aacf04434644af3205070a00b68c70ce1dd76596a5d7296759b6c07a1118102bbbb9064d371cf9428ecec4c44e3c4416e736d91e5f2ae662a2f1dead07af71

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
2c8b3a28053de1ca35eeb407b0f937a7

SHA1
f7605bb326c24a2474ac877c9a35ef2b057250c3

SHA256
d508bf3d6d1c765df6130f4e3f666bf901c785838c4ff1937ff8bca9a290bcbe

SHA512
f51978aa0a029d5639cab5ac27837787cce48a969f5fd79653a810e329b28577c7a8802556b6c87e8839b3c7d0276d789a212e8016c57f1bb21f75eb4226a0df

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
5ae5f40428fbaa79efab0cc86b61c838

SHA1
2ba23d4aeaa71753b75a77917df3a067920ef8e7

SHA256
96e2d1d8f4a71eef88bc7b4511d6acb42d73665aa78446dcdd8297349d490634

SHA512
167c1bb5b27c7c214a4613a45a9761c75201d57a1d0c20475598cafec43ab4727611f71c9a2468abb6001d1309ac69179c086f184aaf01818eb4f2820ba69b1a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
44550b5b2e6922150d79f3f8da41cda1

SHA1
03f2f957ae6497cef216035a9e2d017edfcefbeb

SHA256
2bd88e47095dd72064cd7c46b0529c087e3967e5b8a06d53c3ce8136725ea196

SHA512
1581afe6744fcf34e53180fab07c1bc6f50604acdb138ecb5115f476a15f4d3b1ad7cf0765ae3a77cf5b3e89fd6fcb13a5a07974ca0564051f2a6d470eb10c85

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a2c9d496c117872486377a75d3adb1b4

SHA1
3eb160f0bd1a975a4e1f0f2fc3a1b6627884c2d8

SHA256
5d37893e62b8473ac654b95b8ce0824da1e57b07f70a3caf59f95eabbccc2f43

SHA512
6af9ad1dbd1ef49a15d698139f0fe5329ad930d67e40d25a65751b3c9f3d4de6c6776488e38a232da89e03fc84df3bd788d625c5f7571f65ec910ae54a96bd28

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
874B

MD5
b3801b2ca881ec0326cebcd4c835314c

SHA1
9f69bc7fe987e97f35d369d1678ae58dcce722d5

SHA256
d049eca3dc4713356966746123cea43ce5b82b4af4c11b6a3dc36a6977a1b5b0

SHA512
fe8dadb312d7d5c039a9a7de66fd7471e519b9b0c6d633360c471fe9fc810f71cb055536cdf8d4a90b2321b2e1b13aea9c02e97d5b7efbd261cbf75db2902a42

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
874B

MD5
29febfde08d8800aa9bd93a74291d973

SHA1
0fa9dde1fb7ba4f153860b3fd0e8fdc40c6c063d

SHA256
63ec0b13224e0724076c5ad98ef3c253a38462281fff5f3f7eb1c037f87e526b

SHA512
f965b7585ca0e16a0de7f955e453dd173353d586fecdcf6f7ad832b90bc2623bed7de444bd6e3459c629341d37fcb4a0d5bdd5ac00ad1de3bb3d47aa68d1d164

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
874B

MD5
fa756cebf791e683e60556d8f8ed06f0

SHA1
3f2b9e6d3e5013de6895bc0829b6c4161eaf20fc

SHA256
c5144826180d0e1c171b8dc2ab092e46b66f2c1a2021af2434f0c9163e4b1f4a

SHA512
94267d1d37dfb692bf844b2661c3d3236cc0a14ad3d06c9bc474006bd689efd66aba4b883d8d77e27ab2b3cae78c6668ffa498d93fa5b575a4d3c193149238ea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe584c27.TMP

Filesize
539B

MD5
34b0b7d96fbb352c8928f5dec3e0f1a7

SHA1
fb660136565ad9f74a7bde6438026b75d52c7d69

SHA256
76066a94e8d8a58fa6490c295681125a6f5ba0de74055cee5f774ccd76188036

SHA512
ea18c2947013cb206cebd51a9efabe8fbee0256b82cf9455480ed26a663ba5e20a64ea5506c73cd1f6772f50244b19c0b42147987deb348ee556e2e05edf362a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
6ad5604aef9c13872f605e24cd0bf06b

SHA1
3a3dfb999e3999e504515686e9ab5f7686d0b9df

SHA256
df769ebd5cee97707a3fe27da1561547aab899182a03c62c2b1c45915a29600b

SHA512
bb23c276ad96560c3d3ca90041be28ee64195a0402c9cd2694fb8222a1a4cd5cf9f7a2f3828818a29fcce6f46ea56fe14f8de928c9c574a93b1fd36f783d8767

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
36f55737cfefeac42a0588ae234ca718

SHA1
847c6d05272be8526e254280ff9bf369421368bd

SHA256
bdd22e1a5db3daa35af54b03955c6da1a7042403721128db5e812393c934546e

SHA512
46c5a4891cf67040d270759a3bfeaf3b6e3b780d9df6e15063e15c62089e6a0d51b538655bd85c93b409c185fa6d6b4e226ab28a8da98c4859488815bf5bad07

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
acb7f7f72d607fb480829390fde694d3

SHA1
db02674b138a3084c592246ad689af1c576dc15a

SHA256
bc61e8e2120f35c828a10bb4e05444c645948b5ca0a21d26524bb8cf61f63407

SHA512
a6edb13624e6b4c6586e10541d1d200062fa0aed0b4b60e3ae346344ebe77700acb9f877121c8f975a797396676cdf03fb7eee5898fd7c4f907db544073bf5db

Download Submit
C:\Users\Admin\Downloads\latest-x64.rar

Filesize
289KB

MD5
3b36ee091b09654e2b2fed489b35bc3c

SHA1
3604e245f5e8583c3c2e6b4821dc858cab8ea43e

SHA256
6b713e4af3a0b7172d571a3a67554cd6b93a4d3568cc5041a76b7c882758dfa3

SHA512
a0bd861d7187fdfff3c65da3c65d2befccc96b5e258f41391d2e82eedb0495ba30798afbdd2edacd5bca19fa4d95e8326d43da785438b80f168942f19f4df928

Download Submit
C:\Users\Admin\Downloads\latest-x64.rar:Zone.Identifier

Filesize
668B

MD5
8cf9068048408ae397384eae76fcbea7

SHA1
c306a0353cac77c5dccc137959c4346ff6abd104

SHA256
157f9dde08d37c51017ba5dc5cd6ded977509284f4f077db6ced0f4c4fd1179f

SHA512
dda81f3d4e239cd25c2691768520745c0bc2bb6e2fc1ae7d8f99c5c2603e98dea369a276c596971eb980076297ac31cfe05ceead765c523ab128def4c25ca98e

Download Submit
C:\Users\Admin\Downloads\latest-x64\Setup.exe

Filesize
395KB

MD5
546fb827f57c6cb310e8a8ade43c0d84

SHA1
2aba2876216723adfad7c468711b1749bd1c2fef

SHA256
ac239ac48dbf99b5c7d8e4e7387f682188bd310af9ce1e11efe3d0ad3c738146

SHA512
5ca25a1b90b2a911c6c5d785d3e140bdbe689a5ef63b307cb455e13e998b0df7eedc0c09d7bb5149ef447fd6cc5a50f83530fc9625876c5dc1d7cde070f7da1b

Download Submit
\??\pipe\LOCAL\crashpad_912_TNMSUSUOSLDINLXW

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/1028-414-0x0000000000EA0000-0x0000000000F03953-memory.dmp

Filesize
398KB

Download
memory/1028-415-0x0000000000EA0000-0x0000000000F03953-memory.dmp

Filesize
398KB

Download
memory/1028-418-0x0000000000EA0000-0x0000000000F03953-memory.dmp

Filesize
398KB

Download
memory/1028-419-0x0000000000EA0000-0x0000000000F03953-memory.dmp

Filesize
398KB

Download
memory/1028-421-0x0000000000EA0000-0x0000000000F03953-memory.dmp

Filesize
398KB

Download
memory/1028-423-0x0000000000EA0000-0x0000000000F03953-memory.dmp

Filesize
398KB

Download
memory/1028-427-0x0000000000EA0000-0x0000000000F03953-memory.dmp

Filesize
398KB

Download
memory/22876-422-0x0000000000900000-0x0000000000963953-memory.dmp

Filesize
398KB

Download
memory/22876-424-0x0000000000900000-0x0000000000963953-memory.dmp

Filesize
398KB

Download
memory/22876-420-0x0000000000900000-0x0000000000963953-memory.dmp

Filesize
398KB

Download