agenttesla | 799adf5563cca6365b1290711e311947ed6618e1854d91ae021aa51a5028e6d6

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\System32\\userinit.exe,C:\\Users\\Admin\\AppData\\Roaming\\firefox.exe"	PowerCheatEmuHider.exe

Umbral
Umbral stealer is an opensource moduler stealer written in C#.
stealer umbral

AgentTesla payload 1 IoCs

resource	yara_rule
behavioral1/memory/1244-597-0x0000027E3BAE0000-0x0000027E3BCF4000-memory.dmp	family_agenttesla

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
3264	powershell.exe

Downloads MZ/PE file

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	Ldplayer.exe

Modifies AppInit DLL entries 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1547.001

Modify Registry
T1112

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\Control Panel\International\Geo\Nation	PowerCheat free.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\Control Panel\International\Geo\Nation	WScript.exe

Executes dropped EXE 4 IoCs

pid	Process
5132	PowerCheat free.exe
1244	PowerCheat_free.exe
1932	PowerCheatEmuHider.exe
5772	Ldplayer.exe

Loads dropped DLL 64 IoCs

pid	Process
6712	Process not Found
6840	Process not Found
6960	Process not Found
7160	Process not Found
336	WmiApSrv.exe
4648	Process not Found
6512	Process not Found
6724	Process not Found
4556	Process not Found
6508	Process not Found
6496	Process not Found
1128	Process not Found
6500	Process not Found
5748	Process not Found
3444	Process not Found
6600	Process not Found
6928	Process not Found
2512	Process not Found
2808	Process not Found
6728	Process not Found
2416	Process not Found
5132	Process not Found
2396	Process not Found
860	Process not Found
2540	Process not Found
3464	Process not Found
1776	Process not Found
6424	Process not Found
5400	Process not Found
6156	Process not Found
1124	Process not Found
816	Process not Found
6680	Process not Found
6620	Process not Found
6596	Process not Found
1896	Process not Found
7040	Process not Found
6920	Process not Found
4532	Process not Found
1712	msedge.exe
6460	Process not Found
728	Process not Found
1232	Process not Found
2736	rundll32.exe
6408	Process not Found
6608	Process not Found
2144	Process not Found
3964	WScript.exe
5084	Process not Found
4560	Process not Found
4704	Process not Found
6424	Process not Found
2348	Process not Found
3040	Process not Found
6500	Process not Found
1560	Process not Found
4980	Process not Found
6488	Process not Found
5884	Process not Found
6404	Process not Found
6328	Process not Found
5432	Process not Found
3252	Process not Found
1372	Process not Found

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\PowerCheatEmuHider.exe"	Process not Found
Set value (str)	\REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\PowerCheatEmuHider.exe"	Process not Found
Set value (str)	\REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\PowerCheatEmuHider.exe"	Process not Found
Set value (str)	\REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\PowerCheatEmuHider.exe"	Process not Found
Set value (str)	\REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\PowerCheatEmuHider.exe"	Process not Found
Set value (str)	\REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\PowerCheatEmuHider.exe"	Process not Found
Set value (str)	\REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\PowerCheatEmuHider.exe"	Process not Found
Set value (str)	\REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\PowerCheatEmuHider.exe"	Process not Found
Set value (str)	\REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\PowerCheatEmuHider.exe"	Process not Found
Set value (str)	\REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\PowerCheatEmuHider.exe"	Process not Found
Set value (str)	\REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\PowerCheatEmuHider.exe"	Process not Found
Set value (str)	\REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\PowerCheatEmuHider.exe"	Process not Found
Set value (str)	\REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\PowerCheatEmuHider.exe"	Process not Found
Set value (str)	\REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\PowerCheatEmuHider.exe"	Process not Found
Set value (str)	\REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\PowerCheatEmuHider.exe"	Process not Found
Set value (str)	\REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\PowerCheatEmuHider.exe"	Process not Found
Set value (str)	\REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\PowerCheatEmuHider.exe"	Process not Found
Set value (str)	\REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\PowerCheatEmuHider.exe"	Process not Found
Set value (str)	\REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\PowerCheatEmuHider.exe"	Process not Found
Set value (str)	\REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\PowerCheatEmuHider.exe"	Process not Found
Set value (str)	\REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\PowerCheatEmuHider.exe"	Process not Found
Set value (str)	\REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\PowerCheatEmuHider.exe"	Process not Found
Set value (str)	\REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\PowerCheatEmuHider.exe"	Process not Found
Set value (str)	\REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\PowerCheatEmuHider.exe"	Process not Found
Set value (str)	\REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\PowerCheatEmuHider.exe"	Process not Found
Set value (str)	\REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\PowerCheatEmuHider.exe"	Process not Found
Set value (str)	\REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\PowerCheatEmuHider.exe"	Process not Found
Set value (str)	\REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\PowerCheatEmuHider.exe"	Process not Found
Set value (str)	\REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\PowerCheatEmuHider.exe"	Process not Found
Set value (str)	\REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\PowerCheatEmuHider.exe"	Process not Found
Set value (str)	\REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\PowerCheatEmuHider.exe"	Process not Found
Set value (str)	\REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\PowerCheatEmuHider.exe"	Process not Found
Set value (str)	\REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\PowerCheatEmuHider.exe"	Process not Found
Set value (str)	\REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\PowerCheatEmuHider.exe"	Process not Found
Set value (str)	\REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\PowerCheatEmuHider.exe"	Process not Found
Set value (str)	\REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\PowerCheatEmuHider.exe"	Process not Found
Set value (str)	\REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\PowerCheatEmuHider.exe"	Process not Found
Set value (str)	\REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\PowerCheatEmuHider.exe"	Process not Found
Set value (str)	\REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\PowerCheatEmuHider.exe"	Process not Found
Set value (str)	\REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\PowerCheatEmuHider.exe"	Process not Found
Set value (str)	\REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\PowerCheatEmuHider.exe"	Process not Found
Set value (str)	\REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\PowerCheatEmuHider.exe"	Process not Found
Set value (str)	\REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\PowerCheatEmuHider.exe"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\PowerCheatEmuHider.exe"	Process not Found
Set value (str)	\REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\PowerCheatEmuHider.exe"	Process not Found
Set value (str)	\REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\PowerCheatEmuHider.exe"	Process not Found
Set value (str)	\REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\PowerCheatEmuHider.exe"	Process not Found
Set value (str)	\REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\PowerCheatEmuHider.exe"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\PowerCheatEmuHider.exe"	Process not Found
Set value (str)	\REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\PowerCheatEmuHider.exe"	Process not Found
Set value (str)	\REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\PowerCheatEmuHider.exe"	Process not Found
Set value (str)	\REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\PowerCheatEmuHider.exe"	Process not Found
Set value (str)	\REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\PowerCheatEmuHider.exe"	Process not Found
Set value (str)	\REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\PowerCheatEmuHider.exe"	Process not Found
Set value (str)	\REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\PowerCheatEmuHider.exe"	Process not Found
Set value (str)	\REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\PowerCheatEmuHider.exe"	Process not Found
Set value (str)	\REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\PowerCheatEmuHider.exe"	Process not Found
Set value (str)	\REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\PowerCheatEmuHider.exe"	Process not Found
Set value (str)	\REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\PowerCheatEmuHider.exe"	Process not Found
Set value (str)	\REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\PowerCheatEmuHider.exe"	Process not Found
Set value (str)	\REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\PowerCheatEmuHider.exe"	Process not Found
Set value (str)	\REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\PowerCheatEmuHider.exe"	Process not Found
Set value (str)	\REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\PowerCheatEmuHider.exe"	Process not Found
Set value (str)	\REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\PowerCheatEmuHider.exe"	Process not Found

Drops desktop.ini file(s) 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	PowerCheatEmuHider.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
File opened (read-only)	\??\R:	unregmp2.exe
File opened (read-only)	\??\A:	unregmp2.exe
File opened (read-only)	\??\E:	unregmp2.exe
File opened (read-only)	\??\G:	unregmp2.exe
File opened (read-only)	\??\N:	unregmp2.exe
File opened (read-only)	\??\X:	unregmp2.exe
File opened (read-only)	\??\Y:	unregmp2.exe
File opened (read-only)	\??\I:	unregmp2.exe
File opened (read-only)	\??\J:	unregmp2.exe
File opened (read-only)	\??\M:	unregmp2.exe
File opened (read-only)	\??\W:	unregmp2.exe
File opened (read-only)	\??\K:	unregmp2.exe
File opened (read-only)	\??\O:	unregmp2.exe
File opened (read-only)	\??\P:	unregmp2.exe
File opened (read-only)	\??\Q:	unregmp2.exe
File opened (read-only)	\??\T:	unregmp2.exe
File opened (read-only)	\??\U:	unregmp2.exe
File opened (read-only)	\??\V:	unregmp2.exe
File opened (read-only)	\??\Z:	unregmp2.exe
File opened (read-only)	\??\B:	unregmp2.exe
File opened (read-only)	\??\H:	unregmp2.exe
File opened (read-only)	\??\L:	unregmp2.exe
File opened (read-only)	\??\S:	unregmp2.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
362	discord.com
363	discord.com

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
312	ip-api.com

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\conshost.exe	PowerCheatEmuHider.exe
File opened for modification	C:\Windows\conshost.exe	PowerCheatEmuHider.exe
File created	C:\Windows\xdwd.dll	PowerCheatEmuHider.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe

Creates scheduled task(s) 1 TTPs 64 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

pid	Process
2044	Process not Found
6928	Process not Found
5100	Process not Found
10968	Process not Found
2924	Process not Found
7072	schtasks.exe
12904	Process not Found
10104	Process not Found
6908	schtasks.exe
6668	Process not Found
5988	Process not Found
13068	Process not Found
5984	Process not Found
6516	Process not Found
7096	Process not Found
6620	Process not Found
11360	Process not Found
8952	Process not Found
12268	Process not Found
5460	Process not Found
7096	Process not Found
5100	Process not Found
3216	Process not Found
13268	Process not Found
7348	Process not Found
3460	schtasks.exe
10820	Process not Found
11496	Process not Found
5416	Process not Found
7548	Process not Found
12668	Process not Found
6968	Process not Found
7080	Process not Found
8984	Process not Found
8784	Process not Found
452	Process not Found
8980	Process not Found
9092	Process not Found
4704	Process not Found
7912	Process not Found
1088	Process not Found
3768	Process not Found
1712	Process not Found
6648	Process not Found
7136	Process not Found
532	Process not Found
5796	Process not Found
4108	Process not Found
4444	schtasks.exe
3472	Process not Found
3252	Process not Found
1428	Process not Found
10112	Process not Found
6264	schtasks.exe
4532	Process not Found
4252	Process not Found
6608	Process not Found
6816	Process not Found
536	schtasks.exe
11076	Process not Found
9504	Process not Found
10568	Process not Found
10568	Process not Found
12284	Process not Found

Detects videocard installed 1 TTPs 1 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

pid	Process
1852	wmic.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	PowerCheat_free.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	PowerCheat_free.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemVersion	PowerCheat_free.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies Internet Explorer settings 1 TTPs 17 IoCs

adware spyware

Modify Registry

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\Software\Microsoft\Internet Explorer\GPU	Process not Found
Set value (str)	\REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	Process not Found
Key created	\REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	Process not Found
Key created	\REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	Process not Found
Set value (str)	\REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	Process not Found
Set value (int)	\REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	Process not Found
Set value (str)	\REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	Process not Found
Set value (int)	\REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	Process not Found
Set value (str)	\REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\""	Process not Found
Key created	\REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	Process not Found
Key created	\REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\Software\Microsoft\Internet Explorer\Main	Process not Found
Set value (int)	\REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{299B50F6-28E9-11EF-8383-429904AF4EC5} = "0"	Process not Found
Key created	\REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\Software\Microsoft\Internet Explorer\Main	Process not Found
Key created	\REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\Software\Microsoft\Internet Explorer\IESettingSync	Process not Found
Set value (int)	\REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	Process not Found
Set value (data)	\REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	Process not Found
Key created	\REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	Process not Found

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000_Classes\Local Settings	firefox.exe

NTFS ADS 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\PowerCheat free.exe:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\simpleunlocker_release.zip:Zone.Identifier	firefox.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
1544	PING.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
668	Process not Found

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5772	Ldplayer.exe
5772	Ldplayer.exe
3264	powershell.exe
3264	powershell.exe
3264	powershell.exe
1244	PowerCheat_free.exe
1244	PowerCheat_free.exe
1244	PowerCheat_free.exe
2640	powershell.exe
2640	powershell.exe
2640	powershell.exe
5456	powershell.exe
5456	powershell.exe
1244	PowerCheat_free.exe
1244	PowerCheat_free.exe
5456	powershell.exe
1424	msedge.exe
1424	msedge.exe
4156	msedge.exe
4156	msedge.exe
1244	PowerCheat_free.exe
1244	PowerCheat_free.exe
1244	PowerCheat_free.exe
5164	powershell.exe
5164	powershell.exe
5164	powershell.exe
1244	PowerCheat_free.exe
1244	PowerCheat_free.exe
1544	powershell.exe
1544	powershell.exe
1544	powershell.exe
1244	PowerCheat_free.exe
1244	PowerCheat_free.exe
1244	PowerCheat_free.exe
1244	PowerCheat_free.exe
552	identity_helper.exe
552	identity_helper.exe
1244	PowerCheat_free.exe
1244	PowerCheat_free.exe
1244	PowerCheat_free.exe
1244	PowerCheat_free.exe
1244	PowerCheat_free.exe
1244	PowerCheat_free.exe
1244	PowerCheat_free.exe
1244	PowerCheat_free.exe
1244	PowerCheat_free.exe
1244	PowerCheat_free.exe
1244	PowerCheat_free.exe
1244	PowerCheat_free.exe
1244	PowerCheat_free.exe
1244	PowerCheat_free.exe
1244	PowerCheat_free.exe
1244	PowerCheat_free.exe
1244	PowerCheat_free.exe
1244	PowerCheat_free.exe
1244	PowerCheat_free.exe
1244	PowerCheat_free.exe
1932	PowerCheatEmuHider.exe
1932	PowerCheatEmuHider.exe
1932	PowerCheatEmuHider.exe
1932	PowerCheatEmuHider.exe
1244	PowerCheat_free.exe
1244	PowerCheat_free.exe
1932	PowerCheatEmuHider.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
6500	Process not Found
668	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1432	firefox.exe
Token: SeDebugPrivilege	1432	firefox.exe
Token: SeShutdownPrivilege	5188	unregmp2.exe
Token: SeCreatePagefilePrivilege	5188	unregmp2.exe
Token: SeDebugPrivilege	1932	PowerCheatEmuHider.exe
Token: SeDebugPrivilege	5772	Ldplayer.exe
Token: SeDebugPrivilege	1244	PowerCheat_free.exe
Token: SeIncreaseQuotaPrivilege	1480	wmic.exe
Token: SeSecurityPrivilege	1480	wmic.exe
Token: SeTakeOwnershipPrivilege	1480	wmic.exe
Token: SeLoadDriverPrivilege	1480	wmic.exe
Token: SeSystemProfilePrivilege	1480	wmic.exe
Token: SeSystemtimePrivilege	1480	wmic.exe
Token: SeProfSingleProcessPrivilege	1480	wmic.exe
Token: SeIncBasePriorityPrivilege	1480	wmic.exe
Token: SeCreatePagefilePrivilege	1480	wmic.exe
Token: SeBackupPrivilege	1480	wmic.exe
Token: SeRestorePrivilege	1480	wmic.exe
Token: SeShutdownPrivilege	1480	wmic.exe
Token: SeDebugPrivilege	1480	wmic.exe
Token: SeSystemEnvironmentPrivilege	1480	wmic.exe
Token: SeRemoteShutdownPrivilege	1480	wmic.exe
Token: SeUndockPrivilege	1480	wmic.exe
Token: SeManageVolumePrivilege	1480	wmic.exe
Token: SeImpersonatePrivilege	1480	wmic.exe
Token: 33	1480	wmic.exe
Token: 34	1480	wmic.exe
Token: 35	1480	wmic.exe
Token: 36	1480	wmic.exe
Token: SeIncreaseQuotaPrivilege	1480	wmic.exe
Token: SeSecurityPrivilege	1480	wmic.exe
Token: SeTakeOwnershipPrivilege	1480	wmic.exe
Token: SeLoadDriverPrivilege	1480	wmic.exe
Token: SeSystemProfilePrivilege	1480	wmic.exe
Token: SeSystemtimePrivilege	1480	wmic.exe
Token: SeProfSingleProcessPrivilege	1480	wmic.exe
Token: SeIncBasePriorityPrivilege	1480	wmic.exe
Token: SeCreatePagefilePrivilege	1480	wmic.exe
Token: SeBackupPrivilege	1480	wmic.exe
Token: SeRestorePrivilege	1480	wmic.exe
Token: SeShutdownPrivilege	1480	wmic.exe
Token: SeDebugPrivilege	1480	wmic.exe
Token: SeSystemEnvironmentPrivilege	1480	wmic.exe
Token: SeRemoteShutdownPrivilege	1480	wmic.exe
Token: SeUndockPrivilege	1480	wmic.exe
Token: SeManageVolumePrivilege	1480	wmic.exe
Token: SeImpersonatePrivilege	1480	wmic.exe
Token: 33	1480	wmic.exe
Token: 34	1480	wmic.exe
Token: 35	1480	wmic.exe
Token: 36	1480	wmic.exe
Token: SeDebugPrivilege	3264	powershell.exe
Token: SeDebugPrivilege	2640	powershell.exe
Token: SeDebugPrivilege	5456	powershell.exe
Token: SeDebugPrivilege	5164	powershell.exe
Token: SeIncreaseQuotaPrivilege	4444	wmic.exe
Token: SeSecurityPrivilege	4444	wmic.exe
Token: SeTakeOwnershipPrivilege	4444	wmic.exe
Token: SeLoadDriverPrivilege	4444	wmic.exe
Token: SeSystemProfilePrivilege	4444	wmic.exe
Token: SeSystemtimePrivilege	4444	wmic.exe
Token: SeProfSingleProcessPrivilege	4444	wmic.exe
Token: SeIncBasePriorityPrivilege	4444	wmic.exe
Token: SeCreatePagefilePrivilege	4444	wmic.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1432	firefox.exe
1432	firefox.exe
1432	firefox.exe
1432	firefox.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
6500	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found
2384	Process not Found

Suspicious use of SendNotifyMessage 29 IoCs

pid	Process
1432	firefox.exe
1432	firefox.exe
1432	firefox.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
668	Process not Found
668	Process not Found

Suspicious use of SetWindowsHookEx 13 IoCs

pid	Process
4660	OpenWith.exe
1432	firefox.exe
1432	firefox.exe
1432	firefox.exe
1432	firefox.exe
1432	firefox.exe
1432	firefox.exe
1432	firefox.exe
668	Process not Found
2384	Process not Found
2384	Process not Found
5368	Process not Found
5368	Process not Found

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1112 wrote to memory of 1432	1112	firefox.exe	87
PID 1112 wrote to memory of 1432	1112	firefox.exe	87
PID 1112 wrote to memory of 1432	1112	firefox.exe	87
PID 1112 wrote to memory of 1432	1112	firefox.exe	87
PID 1112 wrote to memory of 1432	1112	firefox.exe	87
PID 1112 wrote to memory of 1432	1112	firefox.exe	87
PID 1112 wrote to memory of 1432	1112	firefox.exe	87
PID 1112 wrote to memory of 1432	1112	firefox.exe	87
PID 1112 wrote to memory of 1432	1112	firefox.exe	87
PID 1112 wrote to memory of 1432	1112	firefox.exe	87
PID 1112 wrote to memory of 1432	1112	firefox.exe	87
PID 1432 wrote to memory of 4032	1432	firefox.exe	89
PID 1432 wrote to memory of 4032	1432	firefox.exe	89
PID 1432 wrote to memory of 4032	1432	firefox.exe	89
PID 1432 wrote to memory of 4032	1432	firefox.exe	89
PID 1432 wrote to memory of 4032	1432	firefox.exe	89
PID 1432 wrote to memory of 4032	1432	firefox.exe	89
PID 1432 wrote to memory of 4032	1432	firefox.exe	89
PID 1432 wrote to memory of 4032	1432	firefox.exe	89
PID 1432 wrote to memory of 4032	1432	firefox.exe	89
PID 1432 wrote to memory of 4032	1432	firefox.exe	89
PID 1432 wrote to memory of 4032	1432	firefox.exe	89
PID 1432 wrote to memory of 4032	1432	firefox.exe	89
PID 1432 wrote to memory of 4032	1432	firefox.exe	89
PID 1432 wrote to memory of 4032	1432	firefox.exe	89
PID 1432 wrote to memory of 4032	1432	firefox.exe	89
PID 1432 wrote to memory of 4032	1432	firefox.exe	89
PID 1432 wrote to memory of 4032	1432	firefox.exe	89
PID 1432 wrote to memory of 4032	1432	firefox.exe	89
PID 1432 wrote to memory of 4032	1432	firefox.exe	89
PID 1432 wrote to memory of 4032	1432	firefox.exe	89
PID 1432 wrote to memory of 4032	1432	firefox.exe	89
PID 1432 wrote to memory of 4032	1432	firefox.exe	89
PID 1432 wrote to memory of 4032	1432	firefox.exe	89
PID 1432 wrote to memory of 4032	1432	firefox.exe	89
PID 1432 wrote to memory of 4032	1432	firefox.exe	89
PID 1432 wrote to memory of 4032	1432	firefox.exe	89
PID 1432 wrote to memory of 4032	1432	firefox.exe	89
PID 1432 wrote to memory of 4032	1432	firefox.exe	89
PID 1432 wrote to memory of 4032	1432	firefox.exe	89
PID 1432 wrote to memory of 4032	1432	firefox.exe	89
PID 1432 wrote to memory of 4032	1432	firefox.exe	89
PID 1432 wrote to memory of 4032	1432	firefox.exe	89
PID 1432 wrote to memory of 4032	1432	firefox.exe	89
PID 1432 wrote to memory of 4032	1432	firefox.exe	89
PID 1432 wrote to memory of 4032	1432	firefox.exe	89
PID 1432 wrote to memory of 4032	1432	firefox.exe	89
PID 1432 wrote to memory of 4032	1432	firefox.exe	89
PID 1432 wrote to memory of 4032	1432	firefox.exe	89
PID 1432 wrote to memory of 4032	1432	firefox.exe	89
PID 1432 wrote to memory of 4032	1432	firefox.exe	89
PID 1432 wrote to memory of 4032	1432	firefox.exe	89
PID 1432 wrote to memory of 4032	1432	firefox.exe	89
PID 1432 wrote to memory of 4032	1432	firefox.exe	89
PID 1432 wrote to memory of 5756	1432	firefox.exe	90
PID 1432 wrote to memory of 5756	1432	firefox.exe	90
PID 1432 wrote to memory of 5756	1432	firefox.exe	90
PID 1432 wrote to memory of 5756	1432	firefox.exe	90
PID 1432 wrote to memory of 5756	1432	firefox.exe	90
PID 1432 wrote to memory of 5756	1432	firefox.exe	90
PID 1432 wrote to memory of 5756	1432	firefox.exe	90
PID 1432 wrote to memory of 5756	1432	firefox.exe	90
PID 1432 wrote to memory of 5756	1432	firefox.exe	90
PID 1432 wrote to memory of 5756	1432	firefox.exe	90

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

Views/modifies file attributes 1 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
3528	attrib.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\macros.exp
1⤵
- Modifies registry class
PID:4636

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4660

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1112
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1432
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1432.0.1759867127\927508730" -parentBuildID 20230214051806 -prefsHandle 1772 -prefMapHandle 1756 -prefsLen 22076 -prefMapSize 235121 -appDir "C:\Program Files\Mozilla Firefox\browser" - {bc03e41f-ae3d-442b-a40a-245da75cebfa} 1432 "\\.\pipe\gecko-crash-server-pipe.1432" 1852 199e052f158 gpu
    3⤵
    PID:4032
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1432.1.1416351548\451002647" -parentBuildID 20230214051806 -prefsHandle 2408 -prefMapHandle 2396 -prefsLen 22112 -prefMapSize 235121 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c156ac9a-b19d-4fc4-8ebf-f9673d321cfe} 1432 "\\.\pipe\gecko-crash-server-pipe.1432" 2420 199d3689358 socket
    3⤵
    PID:5756
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1432.2.488122313\508829768" -childID 1 -isForBrowser -prefsHandle 2960 -prefMapHandle 2956 -prefsLen 22150 -prefMapSize 235121 -jsInitHandle 1292 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {89802908-5ac0-4d0d-9b6a-d184ecc7cb22} 1432 "\\.\pipe\gecko-crash-server-pipe.1432" 2972 199e2ce0858 tab
    3⤵
    PID:3280
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1432.3.237950009\389492049" -childID 2 -isForBrowser -prefsHandle 3924 -prefMapHandle 3920 -prefsLen 27616 -prefMapSize 235121 -jsInitHandle 1292 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {91a8904d-acb6-49b4-b216-c8c63a1d9368} 1432 "\\.\pipe\gecko-crash-server-pipe.1432" 3936 199e4c30058 tab
    3⤵
    PID:4676
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1432.4.2089605213\1916953466" -childID 3 -isForBrowser -prefsHandle 5032 -prefMapHandle 5028 -prefsLen 27616 -prefMapSize 235121 -jsInitHandle 1292 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3666e87e-02d2-4d8c-bc7b-c4219316e855} 1432 "\\.\pipe\gecko-crash-server-pipe.1432" 5020 199e700f258 tab
    3⤵
    PID:3104
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1432.5.1539081429\1909138659" -childID 4 -isForBrowser -prefsHandle 5180 -prefMapHandle 5184 -prefsLen 27616 -prefMapSize 235121 -jsInitHandle 1292 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {937b5a95-bcde-43a6-a2db-15baee40ed4e} 1432 "\\.\pipe\gecko-crash-server-pipe.1432" 5168 199e700ce58 tab
    3⤵
    PID:2288
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1432.6.1692727064\815021646" -childID 5 -isForBrowser -prefsHandle 5364 -prefMapHandle 5368 -prefsLen 27616 -prefMapSize 235121 -jsInitHandle 1292 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {45a4a644-b0ca-40e9-b560-80f220e7f34f} 1432 "\\.\pipe\gecko-crash-server-pipe.1432" 5448 199e700cb58 tab
    3⤵
    PID:2512
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1432.7.703705905\1965761104" -childID 6 -isForBrowser -prefsHandle 5808 -prefMapHandle 5760 -prefsLen 27776 -prefMapSize 235121 -jsInitHandle 1292 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0b1fda45-83e2-4f1f-b4c6-b47ed43b64f8} 1432 "\\.\pipe\gecko-crash-server-pipe.1432" 5924 199e8acd158 tab
    3⤵
    PID:2456
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1432.8.1274851021\642159405" -childID 7 -isForBrowser -prefsHandle 5836 -prefMapHandle 5832 -prefsLen 27776 -prefMapSize 235121 -jsInitHandle 1292 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9d56aec9-3272-40a8-bd82-8c5d90fbc682} 1432 "\\.\pipe\gecko-crash-server-pipe.1432" 6064 199e8ace958 tab
    3⤵
    PID:5460
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1432.9.1077691436\1953468313" -childID 8 -isForBrowser -prefsHandle 5728 -prefMapHandle 4852 -prefsLen 28041 -prefMapSize 235121 -jsInitHandle 1292 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6066fab3-55d8-4bce-918c-96b727a03d8b} 1432 "\\.\pipe\gecko-crash-server-pipe.1432" 4336 199e541dd58 tab
    3⤵
    PID:544
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1432.10.2074160865\835495621" -childID 9 -isForBrowser -prefsHandle 9912 -prefMapHandle 9916 -prefsLen 28041 -prefMapSize 235121 -jsInitHandle 1292 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {16594ea8-5561-493b-9373-f1516c34b0f0} 1432 "\\.\pipe\gecko-crash-server-pipe.1432" 9896 199e4954b58 tab
    3⤵
    PID:1400
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1432.11.1085075553\1736359236" -childID 10 -isForBrowser -prefsHandle 9832 -prefMapHandle 9828 -prefsLen 28041 -prefMapSize 235121 -jsInitHandle 1292 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c26bbaae-1b42-43c4-84d0-bdb4244afc85} 1432 "\\.\pipe\gecko-crash-server-pipe.1432" 9848 199e2847158 tab
    3⤵
    PID:3784
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1432.12.754323495\163493495" -childID 11 -isForBrowser -prefsHandle 7576 -prefMapHandle 9816 -prefsLen 28041 -prefMapSize 235121 -jsInitHandle 1292 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a9a9e7f1-d496-4577-9067-922c5e932dff} 1432 "\\.\pipe\gecko-crash-server-pipe.1432" 9660 199e5741058 tab
    3⤵
    PID:4068
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1432.13.163998533\1971451096" -childID 12 -isForBrowser -prefsHandle 6168 -prefMapHandle 6180 -prefsLen 28041 -prefMapSize 235121 -jsInitHandle 1292 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {66877454-d737-4cff-aaf2-1ae6dd9fc12c} 1432 "\\.\pipe\gecko-crash-server-pipe.1432" 1580 199e8e05958 tab
    3⤵
    PID:4080
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1432.14.1257643736\534631925" -childID 13 -isForBrowser -prefsHandle 9856 -prefMapHandle 9872 -prefsLen 28041 -prefMapSize 235121 -jsInitHandle 1292 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {901f7598-0abd-4f7d-b81d-c6d8fd6949ef} 1432 "\\.\pipe\gecko-crash-server-pipe.1432" 7628 199e4955158 tab
    3⤵
    PID:1512
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1432.15.1110416151\976190113" -childID 14 -isForBrowser -prefsHandle 7392 -prefMapHandle 7384 -prefsLen 28041 -prefMapSize 235121 -jsInitHandle 1292 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3b85b1e0-ba31-416a-9dad-86ba5bea4836} 1432 "\\.\pipe\gecko-crash-server-pipe.1432" 7400 199e541e958 tab
    3⤵
    PID:1368
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1432.16.889208404\258023396" -childID 15 -isForBrowser -prefsHandle 9796 -prefMapHandle 9800 -prefsLen 28041 -prefMapSize 235121 -jsInitHandle 1292 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a03dec0a-24a6-4b60-b525-01f134e2b565} 1432 "\\.\pipe\gecko-crash-server-pipe.1432" 9916 199e5740a58 tab
    3⤵
    PID:4288
- - C:\Users\Admin\Downloads\PowerCheat free.exe
    "C:\Users\Admin\Downloads\PowerCheat free.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    PID:5132
  - - C:\Users\Admin\AppData\Local\Temp\PowerCheat_free.exe
      "C:\Users\Admin\AppData\Local\Temp\PowerCheat_free.exe"
      4⤵
      Executes dropped EXE
      Enumerates system info in registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1244
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/powergirlso2
        5⤵
        Enumerates system info in registry
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:4156
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffd93e846f8,0x7ffd93e84708,0x7ffd93e84718
        6⤵
        
        PID:3068
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1956,6035885907978136504,17212030570777268472,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1968 /prefetch:2
        6⤵
        
        PID:4496
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1956,6035885907978136504,17212030570777268472,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2496 /prefetch:3
        6⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:1424
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1956,6035885907978136504,17212030570777268472,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2744 /prefetch:8
        6⤵
        
        PID:1312
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1956,6035885907978136504,17212030570777268472,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3356 /prefetch:1
        6⤵
        
        PID:1900
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1956,6035885907978136504,17212030570777268472,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3364 /prefetch:1
        6⤵
        
        PID:3468
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1956,6035885907978136504,17212030570777268472,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5004 /prefetch:1
        6⤵
        
        PID:2168
      - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1956,6035885907978136504,17212030570777268472,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5140 /prefetch:8
        6⤵
        
        PID:4464
      - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1956,6035885907978136504,17212030570777268472,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5140 /prefetch:8
        6⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:552
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1956,6035885907978136504,17212030570777268472,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4300 /prefetch:1
        6⤵
        
        PID:5356
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1956,6035885907978136504,17212030570777268472,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5256 /prefetch:1
        6⤵
        
        PID:3296
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1956,6035885907978136504,17212030570777268472,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5620 /prefetch:1
        6⤵
        
        PID:6164
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1956,6035885907978136504,17212030570777268472,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5652 /prefetch:1
        6⤵
        
        PID:6172
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1956,6035885907978136504,17212030570777268472,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4192 /prefetch:2
        6⤵
        Loads dropped DLL
        
        PID:1712
  - - C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
      "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
      4⤵
      Modifies WinLogon for persistence
      Executes dropped EXE
      Drops desktop.ini file(s)
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1932
    - - C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /C SchTaSKs /CrEAte /F /sc OnLoGoN /rl HighEst /tn "conhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" & exit
        5⤵
        
        PID:6460
      - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /CrEAte /F /sc OnLoGoN /rl HighEst /tn "conhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe"
        6⤵
        
        PID:6528
    - - C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
        5⤵
        
        PID:6580
      - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
        6⤵
        
        PID:6652
    - - C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo 5 /tn "dllhost" /tr "C:\Windows\conshost.exe" /RL HIGHEST & exit
        5⤵
        
        PID:6704
      - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo 5 /tn "dllhost" /tr "C:\Windows\conshost.exe" /RL HIGHEST
        6⤵
        
        PID:6796
    - - C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
        5⤵
        
        PID:6824
      - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
        6⤵
        Creates scheduled task(s)
        
        PID:6908
    - - C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
        5⤵
        
        PID:7136
      - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
        6⤵
        
        PID:1544
    - - C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
        5⤵
        
        PID:6484
      - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
        6⤵
        
        PID:6552
    - - C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
        5⤵
        
        PID:6688
      - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
        6⤵
        
        PID:6756
    - - C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
        5⤵
        
        PID:6592
      - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
        6⤵
        
        PID:6700
    - - C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
        5⤵
        
        PID:6424
      - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
        6⤵
        
        PID:6660
    - - C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
        5⤵
        
        PID:6520
      - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
        6⤵
        
        PID:6544
    - - C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
        5⤵
        
        PID:6436
      - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
        6⤵
        
        PID:6528
    - - C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
        5⤵
        
        PID:5732
      - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
        6⤵
        
        PID:2688
    - - C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
        5⤵
        
        PID:7144
      - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
        6⤵
        Creates scheduled task(s)
        
        PID:4444
    - - C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
        5⤵
        
        PID:6884
      - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
        6⤵
        
        PID:2348
    - - C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
        5⤵
        
        PID:4536
      - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
        6⤵
        
        PID:2196
    - - C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
        5⤵
        
        PID:5632
      - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
        6⤵
        
        PID:6520
    - - C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
        5⤵
        
        PID:6756
      - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
        6⤵
        
        PID:3960
    - - C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
        5⤵
        
        PID:7160
      - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
        6⤵
        
        PID:1552
    - - C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
        5⤵
        
        PID:1772
      - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
        6⤵
        
        PID:6492
    - - C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
        5⤵
        
        PID:6788
      - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
        6⤵
        
        PID:6904
    - - C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
        5⤵
        
        PID:7092
      - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
        6⤵
        
        PID:6876
    - - C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
        5⤵
        
        PID:7136
      - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
        6⤵
        
        PID:540
    - - C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
        5⤵
        
        PID:6580
      - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
        6⤵
        
        PID:6316
    - - C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
        5⤵
        
        PID:4952
      - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
        6⤵
        Creates scheduled task(s)
        
        PID:536
    - - C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
        5⤵
        
        PID:6492
      - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
        6⤵
        
        PID:6680
    - - C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
        5⤵
        
        PID:6604
      - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
        6⤵
        
        PID:3508
    - - C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
        5⤵
        
        PID:860
      - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
        6⤵
        
        PID:2416
    - - C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
        5⤵
        
        PID:6264
      - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
        6⤵
        
        PID:6092
    - - C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
        5⤵
        
        PID:5796
      - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
        6⤵
        
        PID:6408
    - - C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
        5⤵
        
        PID:3784
      - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
        6⤵
        
        PID:2004
    - - C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
        5⤵
        
        PID:3928
      - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
        6⤵
        
        PID:3192
    - - C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
        5⤵
        
        PID:860
      - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
        6⤵
        
        PID:2540
    - - C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
        5⤵
        
        PID:4908
      - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
        6⤵
        Creates scheduled task(s)
        
        PID:7072
    - - C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
        5⤵
        
        PID:6600
      - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
        6⤵
        
        PID:6860
    - - C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
        5⤵
        
        PID:1992
      - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
        6⤵
        Creates scheduled task(s)
        
        PID:6264
    - - C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
        5⤵
        
        PID:4980
      - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
        6⤵
        
        PID:5848
    - - C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
        5⤵
        
        PID:2520
      - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
        6⤵
        
        PID:5356
    - - C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
        5⤵
        
        PID:1476
      - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
        6⤵
        
        PID:4180
    - - C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
        5⤵
        
        PID:6792
      - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
        6⤵
        
        PID:6476
    - - C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
        5⤵
        
        PID:3412
      - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
        6⤵
        Creates scheduled task(s)
        
        PID:3460
    - - C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
        5⤵
        
        PID:3444
      - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
        6⤵
        
        PID:4936
    - - C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
        5⤵
        
        PID:4952
      - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
        6⤵
        
        PID:3144
    - - C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
        5⤵
        
        PID:5960
      - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
        6⤵
        
        PID:7132
    - - C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST & exit
        5⤵
        
        PID:4652
      - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\firefox.exe" /RL HIGHEST
        6⤵
        
        PID:6948
  - - C:\Users\Admin\AppData\Local\Temp\Ldplayer.exe
      "C:\Users\Admin\AppData\Local\Temp\Ldplayer.exe"
      4⤵
      Drops file in Drivers directory
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5772
    - - C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" csproduct get uuid
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1480
    - - C:\Windows\SYSTEM32\attrib.exe
        
        "attrib.exe" +h +s "C:\Users\Admin\AppData\Local\Temp\Ldplayer.exe"
        5⤵
        Views/modifies file attributes
        
        PID:3528
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Ldplayer.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3264
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2640
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5456
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5164
    - - C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" os get Caption
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4444
    - - C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" computersystem get totalphysicalmemory
        5⤵
        
        PID:2132
    - - C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" csproduct get uuid
        5⤵
        
        PID:1396
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:1544
    - - C:\Windows\System32\Wbem\wmic.exe
        
        "wmic" path win32_VideoController get name
        5⤵
        Detects videocard installed
        
        PID:1852
    - - C:\Windows\SYSTEM32\cmd.exe
        
        "cmd.exe" /c ping localhost && del /F /A h "C:\Users\Admin\AppData\Local\Temp\Ldplayer.exe" && pause
        5⤵
        
        PID:4588
      - C:\Windows\system32\PING.EXE
        
        ping localhost
        6⤵
        Runs ping.exe
        
        PID:1544
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1432.17.1530179142\1161056623" -childID 16 -isForBrowser -prefsHandle 4456 -prefMapHandle 9808 -prefsLen 31340 -prefMapSize 235121 -jsInitHandle 1292 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f4ba48b3-ae72-49f6-b1c2-7ea3390854a8} 1432 "\\.\pipe\gecko-crash-server-pipe.1432" 5188 199e4955d58 tab
    3⤵
    PID:6876
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1432.18.1193140488\2097688157" -childID 17 -isForBrowser -prefsHandle 7432 -prefMapHandle 5476 -prefsLen 31349 -prefMapSize 235121 -jsInitHandle 1292 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {304487eb-f323-4624-aff6-5ddbc94e5e0f} 1432 "\\.\pipe\gecko-crash-server-pipe.1432" 7444 199e88b9e58 tab
    3⤵
    PID:244
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1432.19.82989942\2099530447" -childID 18 -isForBrowser -prefsHandle 3524 -prefMapHandle 9928 -prefsLen 31349 -prefMapSize 235121 -jsInitHandle 1292 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {23cb6c9f-ec7e-4200-9210-f9bc5cfafa34} 1432 "\\.\pipe\gecko-crash-server-pipe.1432" 2840 199e8d27a58 tab
    3⤵
    PID:7068
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1432.20.628216566\1437735571" -childID 19 -isForBrowser -prefsHandle 9908 -prefMapHandle 7348 -prefsLen 31349 -prefMapSize 235121 -jsInitHandle 1292 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b8c68506-d64a-4caa-84c2-9af76f44bd61} 1432 "\\.\pipe\gecko-crash-server-pipe.1432" 7412 199e8de8858 tab
    3⤵
    PID:6700
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1432.21.1820089033\375121265" -childID 20 -isForBrowser -prefsHandle 5324 -prefMapHandle 5088 -prefsLen 31349 -prefMapSize 235121 -jsInitHandle 1292 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {795ef27b-b307-4861-8749-2cf334f007e5} 1432 "\\.\pipe\gecko-crash-server-pipe.1432" 4476 199e4955d58 tab
    3⤵
    PID:5536

C:\Program Files (x86)\Windows Media Player\wmplayer.exe
"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /Play -Embedding
1⤵
PID:4956
- C:\Program Files (x86)\Windows Media Player\setup_wm.exe
  "C:\Program Files (x86)\Windows Media Player\setup_wm.exe" /RunOnce:"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /Play -Embedding
  2⤵
  PID:5548
- C:\Windows\SysWOW64\unregmp2.exe
  "C:\Windows\System32\unregmp2.exe" /AsyncFirstLogon
  2⤵
  PID:4972
- - C:\Windows\system32\unregmp2.exe
    "C:\Windows\SysNative\unregmp2.exe" /AsyncFirstLogon /REENTRANT
    3⤵
    - Enumerates connected drives
    - Suspicious use of AdjustPrivilegeToken
    PID:5188

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5384

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4964

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Loads dropped DLL
PID:336

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
- Loads dropped DLL
PID:2736

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\ssssss.vbs"
1⤵
- Checks computer location settings
- Loads dropped DLL
PID:3964
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\ssss.bat" "
  2⤵
  PID:6704
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:2620
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:752
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:6740
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:6792
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:4148
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:6948
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:4468
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:2864
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:5044
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:6368
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:5252
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:5368
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:6456
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:4912
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:6620
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:3140
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:4276
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:2348
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:5456
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:6652
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:1772
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:3012
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:2648
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:6592
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:3020
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:428
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:6624
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:1780
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:3568
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:5356
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:6604
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:6572
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:860
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:6824
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:1600
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:6488
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:6924
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:2624
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:6976
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:5324
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:6464
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:4868
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:4180
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:2072
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:6648
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:5296
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:5632
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:6400
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:6880
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:3412
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:6112
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:6460
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:4320
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:2892
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:5136
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:2744
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:3488
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:5644
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:6396
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:6424
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:2172
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:4288
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:6576
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:5960
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:608
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:7076
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:532
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:7044
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:4848
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:7132
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:1356
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:4908
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:3944
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:4416
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:3536
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:6932
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:6328
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:1652
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:3272
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:7112
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:6548
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:6324
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:1232
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:5036
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:6792
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:4148
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:6948
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:4468
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:2864
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:5044
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:6264
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:5252
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:6628
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:1524
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:5744
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:116
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:3140
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:4276
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:2348
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:3252
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:6684
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:1816
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:6876
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:6912
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:6848
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:2736
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:4444
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:6624
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:6524
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:3568
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:5356
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:6616
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:4104
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:5032
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:3956
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:1844
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:6816
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:3460
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:1712
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:6532
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:6332
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:4868
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:2588
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:5976
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:6316
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:6400
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:3540
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:3384
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:7136
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:7024
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:1456
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:5572
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:5656
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:1896
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:1440
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:2192
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:3736
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:4940
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:6968
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:7060
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:5096
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:3944
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:4416
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:4672
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:1560
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:644
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:5808
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:2608
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:4876
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:6920
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:2032
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:1916
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:4076
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:6132
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:4980
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:4664
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:2132
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:5028
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:5044
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:1124
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:7056
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:4172
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:2412
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:3204
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:5020
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:5708
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:3216
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:3252
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:6684
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:1816
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:6476
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:1088
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:6848
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:2736
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:1648
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:5456
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:6596
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:816
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:5516
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:6828
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:6572
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:6096
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:6824
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:2248
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:6488
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:6816
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:4952
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:1712
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:6464
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:6332
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:728
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:3820
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:5132
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:972
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:5184
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:6400
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:3412
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:6112
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:3384
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:2004
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:7024
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:1456
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:4044
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:736
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:6424
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:6972
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:5276
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:3736
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:4772
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:1584
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:6968
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:4848
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:6436
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:5096
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:232
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:3000
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:2492
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:4560
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:3052
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:3536
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:4672
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:400
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:3272
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:6384
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:3964
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:984
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:6920
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:2032
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:1916
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:4076
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:6132
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:4980
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:4664
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:2132
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:6564
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:6668
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:6628
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:4912
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:5744
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:6908
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:512
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:5020
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:4252
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:6652
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:1128
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:6412
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:3040
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:6876
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:3020
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:3064
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:6848
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:2736
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:876
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:6524
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:5720
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:4180
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:5632
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:2892
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:3568
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:5516
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:6828
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:6572
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:6096
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:2248
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:6488
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:7080
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:6484
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:1384
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:464
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:6880
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:7072
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:6500
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:3540
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:6112
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:752
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:6472
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:6964
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:6992
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:4292
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:5572
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:5656
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:1896
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:1440
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:6972
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:6576
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:4940
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:608
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:7060
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:4960
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:7132
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:5476
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:1368
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:3764
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:6860
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:6328
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:1560
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:4652
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:7112
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:6548
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:6324
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:1992
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:2032
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:3928
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:6792
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:6612
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:6132
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:896
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:5452
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:6840
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:5060
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:5252
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:7056
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:4912
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:116
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:3140
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:3460
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:1852
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:5136
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:6620
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:6320
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:4252
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:5188
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:6684
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:1824
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:6476
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:1088
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:6540
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:4324
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:1648
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:864
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:2536
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:1776
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:1528
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:4320
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:5560
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:6604
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:5356
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:6616
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:4104
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:1600
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:2248
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:6488
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:7080
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:6408
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:3144
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:4952
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:2588
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:1384
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:4480
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:4112
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:972
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:6404
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:7072
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:6500
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:2520
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:3384
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:7020
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:752
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:6472
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:6964
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:6992
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:7024
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:1456
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:5656
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:1724
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:2192
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:4772
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:4940
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:7028
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:7060
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:1356
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:2808
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:4908
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:5960
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:3764
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:4560
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:7092
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:3536
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:4672
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:1288
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:2608
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:4876
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:3964
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:2620
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:6920
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:7116
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:3928
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:4148
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:5904
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:4264
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:2864
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:6264
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:1124
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:6432
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:4172
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:4108
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:5548
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:512
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:4868
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:2664
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:644
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:4276
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:5708
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:3216
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:3508
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:3012
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:2648
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:6592
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:1808
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:5384
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:6336
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:6624
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:1780
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:5296
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:3108
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:6524
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:5936
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:4180
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:4396
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:816
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:1520
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:860
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:6528
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:6572
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:6924
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:5800
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:6464
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:6332
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:6824
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:2624
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:1712
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:7004
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:3104
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:5976
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:464
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:6676
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:3896
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:6888
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:4224
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:2520
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:7016
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:6980
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:6988
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:6472
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:6964
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:3488
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:4044
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:2600
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:1896
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:2192
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:7076
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:4284
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:1584
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:7132
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:5476
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:232
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:2492
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:7100
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:3000
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:3052
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:7092
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:3536
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:4672
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:1288
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:2608
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:4876
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:6448
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:6324
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:1992
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:2032
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:6792
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:3928
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:4148
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:5904
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:4264
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:2864
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:6264
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:1124
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:6432
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:4172
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:4108
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:4936
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:6532
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:3244
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:2264
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:6620
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:6652
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:4252
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:1128
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:1816
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:3040
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:6476
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:1088
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:6540
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:4324
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    - Adds Run key to start application
    PID:1648
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:864
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:2172
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:6596
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:6368
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:6556
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:5632
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:2892
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:5560
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:816
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:2752
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:6828
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:6528
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:6572
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:6924
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:5424
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:7080
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:6408
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:3144
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:4952
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:6648
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:1384
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:3952
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:5428
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:5184
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:3896
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:6888
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:4224
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:2520
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:752
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:6988
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:6472
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:6964
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:6928
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:1724
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:1896
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:7076
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:4960
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:7132
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:5268
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:1372
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:532
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:6860
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:7092
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:1652
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:7040
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:5984
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:5036
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:4856
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:1104
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:2080
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:6436
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:2864
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:1524
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:7056
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:3204
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:540
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:3304
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:7136
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:4984
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:5028
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:5020
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:6652
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:4252
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:1128
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:1816
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:6876
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:3020
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:4444
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:6848
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:4536
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:2072
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:3040
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:2172
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:6596
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:6368
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:6556
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:5632
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:6208
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:5516
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:5356
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:6616
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:1844
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:1600
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:2248
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:6464
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:4596
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:6824
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:2144
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:6608
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:2588
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:728
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:3784
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:3952
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:6880
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:2044
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:6400
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:6500
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:3384
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:7012
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:2520
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:6316
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:3208
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:2744
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:5644
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:4044
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:1724
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:2472
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:368
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:7076
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:1356
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:2808
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:1368
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:7044
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:4416
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:3944
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:6732
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:6960
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:6956
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:1652
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:6384
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:1288
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:1232
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:6920
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:4532
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:6792
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:1104
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:6948
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:3964
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:6424
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:2080
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:4264
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:6564
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:6264
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:1124
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:5744
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:4172
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:4108
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:4936
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:1524
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:7136
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:4984
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:5028
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:5020
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:3216
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:4252
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:1128
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:1816
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:6876
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:3020
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:5384
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:6336
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:6624
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:1780
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:5296
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:2536
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:1776
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:5936
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:4180
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:4396
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:5560
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:1520
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:3956
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:5032
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:1476
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:5800
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:5008
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:6464
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:4596
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:6824
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:2144
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:7020
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:2600
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:7004
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:7008
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:3104
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:3784
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:5428
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:3412
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:6400
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:6500
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:2004
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:2520
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:6988
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:4292
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:6928
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:5172
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:4940
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:6968
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:368
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:7076
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:3988
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:7132
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:5268
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:5960
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:532
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:4560
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:6860
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:2500
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:6956
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:7112
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:7040
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:2620
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:5036
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:4856
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:4980
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:4468
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:2032
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:4876
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:4664
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:5044
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:5368
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:6456
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:5252
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:6432
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:7056
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:3204
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:540
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:3304
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:2664
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:5136
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:2348
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:6320
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:1772
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:5188
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:4252
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:1128
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:1816
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    - Adds Run key to start application
    PID:6876
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:3020
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:5384
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:6336
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:6624
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:1780
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:5296
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:2536
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:1776
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:5936
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:4180
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:4396
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:5560
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:1520
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:3956
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:5032
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:1476
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:5800
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:5008
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:6464
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:4596
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:6824
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:2144
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:7020
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:2600
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:7004
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:7008
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:3104
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:3784
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:5428
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:3412
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:6400
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:6996
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:6980
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:6988
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:5644
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:2192
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:384
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:7028
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:6744
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:6984
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:7024
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:1724
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:368
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:4960
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:5096
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:4908
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:2492
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:3000
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:6932
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:4348
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:6600
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:3536
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:1652
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:6384
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:1288
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:6740
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:1992
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:6132
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:6612
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:4076
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:6948
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:896
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:7092
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:6424
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:2080
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:4264
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:6564
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:6628
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:1124
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:5548
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:4172
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:4108
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:4936
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:3244
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:6264
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:6620
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:5028
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:6684
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:5188
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:2648
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:428
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:1808
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:6540
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:4444
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:6848
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:4536
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:3492
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:3108
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:5720
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:1528
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:6368
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:6556
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:5632
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:6208
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:2752
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:4104
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:6616
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:3444
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:1600
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:5424
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:5800
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:5008
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:6976
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:1712
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:972
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:3488
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:5708
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:3820
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:1384
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:5976
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:3952
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:6880
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:2044
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:6888
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:6112
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:2004
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:2120
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:6472
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:1456
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:4044
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:5172
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:4940
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:6968
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:7012
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:3208
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:1440
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:1584
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:4612
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:4960
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:5096
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:4908
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:5268
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:6584
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:4416
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:6932
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:4348
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:6600
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:2500
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:6956
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:7112
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:7040
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:6740
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:1992
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe" /f
    3⤵
    PID:6132

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

Remote System Discovery

T1018

System Information Discovery