darkcomet | 7634a9fc59d55c2c6825af629eec999b3c8f59e1a00eba5afa672c93ce81bba1

Analysis

max time kernel
24s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
20-06-2024 10:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0529d67672dae586e351a9ee52d41578_JaffaCakes118.exe
Size

725KB
MD5

0529d67672dae586e351a9ee52d41578
SHA1

b0b0f00591e257f0209680e764f3e7a89b6e4783
SHA256

7634a9fc59d55c2c6825af629eec999b3c8f59e1a00eba5afa672c93ce81bba1
SHA512

a6d496ab1df8f0e0d39957b712d3dc93ba95cfa7097e59d54037ed06034e948c61e90c4976e960bf8d7e0247447d2e8ffff20d3f1785add5742686d98886a09b
SSDEEP

12288:UR/MxDiuJuP8OVWXN2/Y321+Hl3aW0bRPwhWEI/XMmeFZGuKPr:Iuo0vNyerHl3aWIwhWD/XMlu

Score

10^/10

darkcomet facebook ransomware rat trojan

Malware Config

Extracted

Family

darkcomet

Botnet

Facebook

bl4cks0ul.no-ip.info:1338

Mutex

DC_MUTEX-W4MYS1V

Attributes

gencode
pTh6taM9e32j
install
false
offline_keylogger
true
password
1234
persistence
false

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet
Renames multiple (147) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

0529d67672dae586e351a9ee52d41578_JaffaCakes118.exenetworkexplorer.exewinrsmgr.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\Control Panel\International\Geo\Nation	0529d67672dae586e351a9ee52d41578_JaffaCakes118.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\Control Panel\International\Geo\Nation	networkexplorer.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\Control Panel\International\Geo\Nation	winrsmgr.exe

Executes dropped EXE 64 IoCs

Processes:

networkexplorer.exewinrsmgr.exenetworkexplorer.exenetworkexplorer.exenetworkexplorer.exenetworkexplorer.exenetworkexplorer.exenetworkexplorer.exenetworkexplorer.exenetworkexplorer.exenetworkexplorer.exenetworkexplorer.exenetworkexplorer.exenetworkexplorer.exenetworkexplorer.exenetworkexplorer.exenetworkexplorer.exenetworkexplorer.exenetworkexplorer.exenetworkexplorer.exenetworkexplorer.exenetworkexplorer.exenetworkexplorer.exenetworkexplorer.exenetworkexplorer.exenetworkexplorer.exenetworkexplorer.exenetworkexplorer.exenetworkexplorer.exenetworkexplorer.exenetworkexplorer.exenetworkexplorer.exenetworkexplorer.exenetworkexplorer.exenetworkexplorer.exenetworkexplorer.exenetworkexplorer.exenetworkexplorer.exenetworkexplorer.exenetworkexplorer.exenetworkexplorer.exenetworkexplorer.exenetworkexplorer.exenetworkexplorer.exenetworkexplorer.exenetworkexplorer.exenetworkexplorer.exenetworkexplorer.exenetworkexplorer.exenetworkexplorer.exenetworkexplorer.exenetworkexplorer.exenetworkexplorer.exenetworkexplorer.exenetworkexplorer.exenetworkexplorer.exenetworkexplorer.exenetworkexplorer.exenetworkexplorer.exenetworkexplorer.exenetworkexplorer.exenetworkexplorer.exenetworkexplorer.exenetworkexplorer.exe

pid	process
3344	networkexplorer.exe
3704	winrsmgr.exe
1664	networkexplorer.exe
4828	networkexplorer.exe
1348	networkexplorer.exe
1360	networkexplorer.exe
1052	networkexplorer.exe
1980	networkexplorer.exe
1740	networkexplorer.exe
4432	networkexplorer.exe
2280	networkexplorer.exe
1336	networkexplorer.exe
116	networkexplorer.exe
344	networkexplorer.exe
2516	networkexplorer.exe
928	networkexplorer.exe
2576	networkexplorer.exe
4304	networkexplorer.exe
3148	networkexplorer.exe
3360	networkexplorer.exe
1436	networkexplorer.exe
3404	networkexplorer.exe
4660	networkexplorer.exe
772	networkexplorer.exe
3572	networkexplorer.exe
4364	networkexplorer.exe
3604	networkexplorer.exe
3688	networkexplorer.exe
1032	networkexplorer.exe
4836	networkexplorer.exe
3672	networkexplorer.exe
1752	networkexplorer.exe
1436	networkexplorer.exe
3512	networkexplorer.exe
2380	networkexplorer.exe
592	networkexplorer.exe
1972	networkexplorer.exe
4848	networkexplorer.exe
2816	networkexplorer.exe
5088	networkexplorer.exe
2332	networkexplorer.exe
3236	networkexplorer.exe
3184	networkexplorer.exe
536	networkexplorer.exe
2488	networkexplorer.exe
4660	networkexplorer.exe
3376	networkexplorer.exe
1536	networkexplorer.exe
1652	networkexplorer.exe
1360	networkexplorer.exe
1904	networkexplorer.exe
2616	networkexplorer.exe
2624	networkexplorer.exe
4232	networkexplorer.exe
1480	networkexplorer.exe
1776	networkexplorer.exe
1608	networkexplorer.exe
4960	networkexplorer.exe
1528	networkexplorer.exe
4648	networkexplorer.exe
1508	networkexplorer.exe
3360	networkexplorer.exe
3228	networkexplorer.exe
4784	networkexplorer.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

0529d67672dae586e351a9ee52d41578_JaffaCakes118.exewinrsmgr.exe

description	pid	process	target process
PID 2080 set thread context of 2296	2080	0529d67672dae586e351a9ee52d41578_JaffaCakes118.exe	AppLaunch.exe
PID 3704 set thread context of 4376	3704	winrsmgr.exe	AppLaunch.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 64 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

dw20.exedw20.exedw20.exedw20.exedw20.exedw20.exedw20.exedw20.exedw20.exedw20.exedw20.exedw20.exedw20.exedw20.exedw20.exedw20.exedw20.exedw20.exedw20.exedw20.exedw20.exedw20.exedw20.exedw20.exedw20.exedw20.exedw20.exedw20.exedw20.exedw20.exedw20.exedw20.exedw20.exedw20.exedw20.exedw20.exedw20.exedw20.exedw20.exedw20.exedw20.exedw20.exedw20.exedw20.exedw20.exedw20.exedw20.exedw20.exedw20.exedw20.exedw20.exedw20.exedw20.exedw20.exedw20.exedw20.exedw20.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	dw20.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	dw20.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	dw20.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	dw20.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	dw20.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	dw20.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	dw20.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	dw20.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	dw20.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	dw20.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	dw20.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	dw20.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	dw20.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	dw20.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	dw20.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	dw20.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	dw20.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	dw20.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	dw20.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	dw20.exe

Enumerates system info in registry 2 TTPs 64 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dw20.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dw20.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dw20.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	dw20.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dw20.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	dw20.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	dw20.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	dw20.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	dw20.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	dw20.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	dw20.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dw20.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dw20.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dw20.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	dw20.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	dw20.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	dw20.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	dw20.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dw20.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dw20.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dw20.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dw20.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	dw20.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	dw20.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	dw20.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dw20.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	dw20.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	dw20.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	dw20.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dw20.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	dw20.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	dw20.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dw20.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dw20.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	dw20.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	dw20.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

0529d67672dae586e351a9ee52d41578_JaffaCakes118.exenetworkexplorer.exewinrsmgr.exenetworkexplorer.exenetworkexplorer.exenetworkexplorer.exenetworkexplorer.exe

pid	process
2080	0529d67672dae586e351a9ee52d41578_JaffaCakes118.exe
2080	0529d67672dae586e351a9ee52d41578_JaffaCakes118.exe
3344	networkexplorer.exe
2080	0529d67672dae586e351a9ee52d41578_JaffaCakes118.exe
2080	0529d67672dae586e351a9ee52d41578_JaffaCakes118.exe
2080	0529d67672dae586e351a9ee52d41578_JaffaCakes118.exe
2080	0529d67672dae586e351a9ee52d41578_JaffaCakes118.exe
2080	0529d67672dae586e351a9ee52d41578_JaffaCakes118.exe
2080	0529d67672dae586e351a9ee52d41578_JaffaCakes118.exe
2080	0529d67672dae586e351a9ee52d41578_JaffaCakes118.exe
2080	0529d67672dae586e351a9ee52d41578_JaffaCakes118.exe
2080	0529d67672dae586e351a9ee52d41578_JaffaCakes118.exe
2080	0529d67672dae586e351a9ee52d41578_JaffaCakes118.exe
2080	0529d67672dae586e351a9ee52d41578_JaffaCakes118.exe
2080	0529d67672dae586e351a9ee52d41578_JaffaCakes118.exe
2080	0529d67672dae586e351a9ee52d41578_JaffaCakes118.exe
2080	0529d67672dae586e351a9ee52d41578_JaffaCakes118.exe
2080	0529d67672dae586e351a9ee52d41578_JaffaCakes118.exe
2080	0529d67672dae586e351a9ee52d41578_JaffaCakes118.exe
2080	0529d67672dae586e351a9ee52d41578_JaffaCakes118.exe
2080	0529d67672dae586e351a9ee52d41578_JaffaCakes118.exe
2080	0529d67672dae586e351a9ee52d41578_JaffaCakes118.exe
2080	0529d67672dae586e351a9ee52d41578_JaffaCakes118.exe
2080	0529d67672dae586e351a9ee52d41578_JaffaCakes118.exe
2080	0529d67672dae586e351a9ee52d41578_JaffaCakes118.exe
2080	0529d67672dae586e351a9ee52d41578_JaffaCakes118.exe
3704	winrsmgr.exe
1664	networkexplorer.exe
2080	0529d67672dae586e351a9ee52d41578_JaffaCakes118.exe
3704	winrsmgr.exe
3704	winrsmgr.exe
2080	0529d67672dae586e351a9ee52d41578_JaffaCakes118.exe
2080	0529d67672dae586e351a9ee52d41578_JaffaCakes118.exe
3704	winrsmgr.exe
2080	0529d67672dae586e351a9ee52d41578_JaffaCakes118.exe
2080	0529d67672dae586e351a9ee52d41578_JaffaCakes118.exe
3704	winrsmgr.exe
2080	0529d67672dae586e351a9ee52d41578_JaffaCakes118.exe
1664	networkexplorer.exe
2080	0529d67672dae586e351a9ee52d41578_JaffaCakes118.exe
3704	winrsmgr.exe
4828	networkexplorer.exe
2080	0529d67672dae586e351a9ee52d41578_JaffaCakes118.exe
2080	0529d67672dae586e351a9ee52d41578_JaffaCakes118.exe
2080	0529d67672dae586e351a9ee52d41578_JaffaCakes118.exe
2080	0529d67672dae586e351a9ee52d41578_JaffaCakes118.exe
2080	0529d67672dae586e351a9ee52d41578_JaffaCakes118.exe
4828	networkexplorer.exe
2080	0529d67672dae586e351a9ee52d41578_JaffaCakes118.exe
2080	0529d67672dae586e351a9ee52d41578_JaffaCakes118.exe
2080	0529d67672dae586e351a9ee52d41578_JaffaCakes118.exe
1348	networkexplorer.exe
2080	0529d67672dae586e351a9ee52d41578_JaffaCakes118.exe
2080	0529d67672dae586e351a9ee52d41578_JaffaCakes118.exe
2080	0529d67672dae586e351a9ee52d41578_JaffaCakes118.exe
3704	winrsmgr.exe
1360	networkexplorer.exe
3704	winrsmgr.exe
2080	0529d67672dae586e351a9ee52d41578_JaffaCakes118.exe
3704	winrsmgr.exe
2080	0529d67672dae586e351a9ee52d41578_JaffaCakes118.exe
2080	0529d67672dae586e351a9ee52d41578_JaffaCakes118.exe
3704	winrsmgr.exe
2080	0529d67672dae586e351a9ee52d41578_JaffaCakes118.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

Processes:

0529d67672dae586e351a9ee52d41578_JaffaCakes118.exewinrsmgr.exe

pid process

2080 0529d67672dae586e351a9ee52d41578_JaffaCakes118.exe
3704 winrsmgr.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

0529d67672dae586e351a9ee52d41578_JaffaCakes118.exeAppLaunch.exenetworkexplorer.exedw20.exewinrsmgr.exenetworkexplorer.exeAppLaunch.exedw20.exenetworkexplorer.exedw20.exenetworkexplorer.exedw20.exe

description	pid	process
Token: SeDebugPrivilege	2080	0529d67672dae586e351a9ee52d41578_JaffaCakes118.exe
Token: SeIncreaseQuotaPrivilege	2296	AppLaunch.exe
Token: SeSecurityPrivilege	2296	AppLaunch.exe
Token: SeTakeOwnershipPrivilege	2296	AppLaunch.exe
Token: SeLoadDriverPrivilege	2296	AppLaunch.exe
Token: SeSystemProfilePrivilege	2296	AppLaunch.exe
Token: SeSystemtimePrivilege	2296	AppLaunch.exe
Token: SeProfSingleProcessPrivilege	2296	AppLaunch.exe
Token: SeIncBasePriorityPrivilege	2296	AppLaunch.exe
Token: SeCreatePagefilePrivilege	2296	AppLaunch.exe
Token: SeBackupPrivilege	2296	AppLaunch.exe
Token: SeRestorePrivilege	2296	AppLaunch.exe
Token: SeShutdownPrivilege	2296	AppLaunch.exe
Token: SeDebugPrivilege	2296	AppLaunch.exe
Token: SeSystemEnvironmentPrivilege	2296	AppLaunch.exe
Token: SeChangeNotifyPrivilege	2296	AppLaunch.exe
Token: SeRemoteShutdownPrivilege	2296	AppLaunch.exe
Token: SeUndockPrivilege	2296	AppLaunch.exe
Token: SeManageVolumePrivilege	2296	AppLaunch.exe
Token: SeImpersonatePrivilege	2296	AppLaunch.exe
Token: SeCreateGlobalPrivilege	2296	AppLaunch.exe
Token: 33	2296	AppLaunch.exe
Token: 34	2296	AppLaunch.exe
Token: 35	2296	AppLaunch.exe
Token: 36	2296	AppLaunch.exe
Token: SeDebugPrivilege	3344	networkexplorer.exe
Token: SeRestorePrivilege	1032	dw20.exe
Token: SeBackupPrivilege	1032	dw20.exe
Token: SeBackupPrivilege	1032	dw20.exe
Token: SeBackupPrivilege	1032	dw20.exe
Token: SeDebugPrivilege	3704	winrsmgr.exe
Token: SeDebugPrivilege	1664	networkexplorer.exe
Token: SeIncreaseQuotaPrivilege	4376	AppLaunch.exe
Token: SeSecurityPrivilege	4376	AppLaunch.exe
Token: SeTakeOwnershipPrivilege	4376	AppLaunch.exe
Token: SeLoadDriverPrivilege	4376	AppLaunch.exe
Token: SeSystemProfilePrivilege	4376	AppLaunch.exe
Token: SeSystemtimePrivilege	4376	AppLaunch.exe
Token: SeProfSingleProcessPrivilege	4376	AppLaunch.exe
Token: SeIncBasePriorityPrivilege	4376	AppLaunch.exe
Token: SeCreatePagefilePrivilege	4376	AppLaunch.exe
Token: SeBackupPrivilege	4376	AppLaunch.exe
Token: SeRestorePrivilege	4376	AppLaunch.exe
Token: SeShutdownPrivilege	4376	AppLaunch.exe
Token: SeDebugPrivilege	4376	AppLaunch.exe
Token: SeSystemEnvironmentPrivilege	4376	AppLaunch.exe
Token: SeChangeNotifyPrivilege	4376	AppLaunch.exe
Token: SeRemoteShutdownPrivilege	4376	AppLaunch.exe
Token: SeUndockPrivilege	4376	AppLaunch.exe
Token: SeManageVolumePrivilege	4376	AppLaunch.exe
Token: SeImpersonatePrivilege	4376	AppLaunch.exe
Token: SeCreateGlobalPrivilege	4376	AppLaunch.exe
Token: 33	4376	AppLaunch.exe
Token: 34	4376	AppLaunch.exe
Token: 35	4376	AppLaunch.exe
Token: SeBackupPrivilege	688	dw20.exe
Token: 36	4376	AppLaunch.exe
Token: SeBackupPrivilege	688	dw20.exe
Token: SeDebugPrivilege	4828	networkexplorer.exe
Token: SeBackupPrivilege	1248	dw20.exe
Token: SeBackupPrivilege	1248	dw20.exe
Token: SeDebugPrivilege	1348	networkexplorer.exe
Token: SeBackupPrivilege	2332	dw20.exe
Token: SeBackupPrivilege	2332	dw20.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

AppLaunch.exe

pid process

2296 AppLaunch.exe

pid	process
2296	AppLaunch.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

0529d67672dae586e351a9ee52d41578_JaffaCakes118.exeAppLaunch.exenetworkexplorer.exewinrsmgr.exenetworkexplorer.exe

description	pid	process	target process
PID 2080 wrote to memory of 2296	2080	0529d67672dae586e351a9ee52d41578_JaffaCakes118.exe	AppLaunch.exe
PID 2080 wrote to memory of 2296	2080	0529d67672dae586e351a9ee52d41578_JaffaCakes118.exe	AppLaunch.exe
PID 2080 wrote to memory of 2296	2080	0529d67672dae586e351a9ee52d41578_JaffaCakes118.exe	AppLaunch.exe
PID 2080 wrote to memory of 2296	2080	0529d67672dae586e351a9ee52d41578_JaffaCakes118.exe	AppLaunch.exe
PID 2080 wrote to memory of 2296	2080	0529d67672dae586e351a9ee52d41578_JaffaCakes118.exe	AppLaunch.exe
PID 2080 wrote to memory of 2296	2080	0529d67672dae586e351a9ee52d41578_JaffaCakes118.exe	AppLaunch.exe
PID 2080 wrote to memory of 2296	2080	0529d67672dae586e351a9ee52d41578_JaffaCakes118.exe	AppLaunch.exe
PID 2080 wrote to memory of 2296	2080	0529d67672dae586e351a9ee52d41578_JaffaCakes118.exe	AppLaunch.exe
PID 2080 wrote to memory of 2296	2080	0529d67672dae586e351a9ee52d41578_JaffaCakes118.exe	AppLaunch.exe
PID 2080 wrote to memory of 2296	2080	0529d67672dae586e351a9ee52d41578_JaffaCakes118.exe	AppLaunch.exe
PID 2080 wrote to memory of 2296	2080	0529d67672dae586e351a9ee52d41578_JaffaCakes118.exe	AppLaunch.exe
PID 2080 wrote to memory of 2296	2080	0529d67672dae586e351a9ee52d41578_JaffaCakes118.exe	AppLaunch.exe
PID 2080 wrote to memory of 2296	2080	0529d67672dae586e351a9ee52d41578_JaffaCakes118.exe	AppLaunch.exe
PID 2080 wrote to memory of 2296	2080	0529d67672dae586e351a9ee52d41578_JaffaCakes118.exe	AppLaunch.exe
PID 2296 wrote to memory of 228	2296	AppLaunch.exe	notepad.exe
PID 2296 wrote to memory of 228	2296	AppLaunch.exe	notepad.exe
PID 2296 wrote to memory of 228	2296	AppLaunch.exe	notepad.exe
PID 2296 wrote to memory of 228	2296	AppLaunch.exe	notepad.exe
PID 2296 wrote to memory of 228	2296	AppLaunch.exe	notepad.exe
PID 2296 wrote to memory of 228	2296	AppLaunch.exe	notepad.exe
PID 2296 wrote to memory of 228	2296	AppLaunch.exe	notepad.exe
PID 2296 wrote to memory of 228	2296	AppLaunch.exe	notepad.exe
PID 2296 wrote to memory of 228	2296	AppLaunch.exe	notepad.exe
PID 2296 wrote to memory of 228	2296	AppLaunch.exe	notepad.exe
PID 2296 wrote to memory of 228	2296	AppLaunch.exe	notepad.exe
PID 2296 wrote to memory of 228	2296	AppLaunch.exe	notepad.exe
PID 2296 wrote to memory of 228	2296	AppLaunch.exe	notepad.exe
PID 2296 wrote to memory of 228	2296	AppLaunch.exe	notepad.exe
PID 2296 wrote to memory of 228	2296	AppLaunch.exe	notepad.exe
PID 2296 wrote to memory of 228	2296	AppLaunch.exe	notepad.exe
PID 2296 wrote to memory of 228	2296	AppLaunch.exe	notepad.exe
PID 2296 wrote to memory of 228	2296	AppLaunch.exe	notepad.exe
PID 2296 wrote to memory of 228	2296	AppLaunch.exe	notepad.exe
PID 2296 wrote to memory of 228	2296	AppLaunch.exe	notepad.exe
PID 2296 wrote to memory of 228	2296	AppLaunch.exe	notepad.exe
PID 2296 wrote to memory of 228	2296	AppLaunch.exe	notepad.exe
PID 2080 wrote to memory of 3344	2080	0529d67672dae586e351a9ee52d41578_JaffaCakes118.exe	networkexplorer.exe
PID 2080 wrote to memory of 3344	2080	0529d67672dae586e351a9ee52d41578_JaffaCakes118.exe	networkexplorer.exe
PID 2080 wrote to memory of 3344	2080	0529d67672dae586e351a9ee52d41578_JaffaCakes118.exe	networkexplorer.exe
PID 3344 wrote to memory of 1032	3344	networkexplorer.exe	dw20.exe
PID 3344 wrote to memory of 1032	3344	networkexplorer.exe	dw20.exe
PID 3344 wrote to memory of 1032	3344	networkexplorer.exe	dw20.exe
PID 3344 wrote to memory of 3704	3344	networkexplorer.exe	winrsmgr.exe
PID 3344 wrote to memory of 3704	3344	networkexplorer.exe	winrsmgr.exe
PID 3344 wrote to memory of 3704	3344	networkexplorer.exe	winrsmgr.exe
PID 2080 wrote to memory of 1664	2080	0529d67672dae586e351a9ee52d41578_JaffaCakes118.exe	networkexplorer.exe
PID 2080 wrote to memory of 1664	2080	0529d67672dae586e351a9ee52d41578_JaffaCakes118.exe	networkexplorer.exe
PID 2080 wrote to memory of 1664	2080	0529d67672dae586e351a9ee52d41578_JaffaCakes118.exe	networkexplorer.exe
PID 3704 wrote to memory of 4376	3704	winrsmgr.exe	AppLaunch.exe
PID 3704 wrote to memory of 4376	3704	winrsmgr.exe	AppLaunch.exe
PID 3704 wrote to memory of 4376	3704	winrsmgr.exe	AppLaunch.exe
PID 3704 wrote to memory of 4376	3704	winrsmgr.exe	AppLaunch.exe
PID 3704 wrote to memory of 4376	3704	winrsmgr.exe	AppLaunch.exe
PID 3704 wrote to memory of 4376	3704	winrsmgr.exe	AppLaunch.exe
PID 3704 wrote to memory of 4376	3704	winrsmgr.exe	AppLaunch.exe
PID 3704 wrote to memory of 4376	3704	winrsmgr.exe	AppLaunch.exe
PID 3704 wrote to memory of 4376	3704	winrsmgr.exe	AppLaunch.exe
PID 3704 wrote to memory of 4376	3704	winrsmgr.exe	AppLaunch.exe
PID 3704 wrote to memory of 4376	3704	winrsmgr.exe	AppLaunch.exe
PID 3704 wrote to memory of 4376	3704	winrsmgr.exe	AppLaunch.exe
PID 3704 wrote to memory of 4376	3704	winrsmgr.exe	AppLaunch.exe
PID 3704 wrote to memory of 4376	3704	winrsmgr.exe	AppLaunch.exe
PID 1664 wrote to memory of 688	1664	networkexplorer.exe	dw20.exe
PID 1664 wrote to memory of 688	1664	networkexplorer.exe	dw20.exe

C:\Users\Admin\AppData\Local\Temp\0529d67672dae586e351a9ee52d41578_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0529d67672dae586e351a9ee52d41578_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2080

C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2296

C:\Windows\SysWOW64\notepad.exe
notepad
3⤵
PID:228

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3344

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 940
3⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
PID:1032

C:\Users\Admin\AppData\Local\Temp\winrsmgr.exe
"C:\Users\Admin\AppData\Local\Temp\winrsmgr.exe"
3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3704

C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
4⤵
- Suspicious use of AdjustPrivilegeToken
PID:4376

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1360

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 876
5⤵
PID:1656

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
4⤵
- Executes dropped EXE
PID:1980

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
5⤵
PID:1520

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
4⤵
- Executes dropped EXE
PID:1740

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
5⤵
PID:3676

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
4⤵
- Executes dropped EXE
PID:2280

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
5⤵
- Checks processor information in registry
PID:1976

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
4⤵
- Executes dropped EXE
PID:344

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
5⤵
PID:2300

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
4⤵
- Executes dropped EXE
PID:2516

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
5⤵
- Checks processor information in registry
PID:60

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
4⤵
- Executes dropped EXE
PID:4304

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
5⤵
- Checks processor information in registry
- Enumerates system info in registry
PID:1840

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
4⤵
- Executes dropped EXE
PID:3360

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 876
5⤵
- Checks processor information in registry
PID:3460

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
4⤵
- Executes dropped EXE
PID:1436

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
5⤵
- Enumerates system info in registry
PID:1104

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
4⤵
- Executes dropped EXE
PID:4660

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
5⤵
PID:1628

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
4⤵
- Executes dropped EXE
PID:3572

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 876
5⤵
PID:1976

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
4⤵
- Executes dropped EXE
PID:3604

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
5⤵
- Checks processor information in registry
PID:5020

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
4⤵
- Executes dropped EXE
PID:1032

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
5⤵
PID:1556

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
4⤵
- Executes dropped EXE
PID:3672

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
5⤵
- Checks processor information in registry
PID:2240

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
4⤵
- Executes dropped EXE
PID:1436

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
5⤵
- Checks processor information in registry
- Enumerates system info in registry
PID:3520

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
4⤵
- Executes dropped EXE
PID:592

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
5⤵
PID:1900

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
4⤵
- Executes dropped EXE
PID:4848

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
5⤵
PID:4136

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
4⤵
- Executes dropped EXE
PID:5088

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
5⤵
PID:1596

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
4⤵
- Executes dropped EXE
PID:2332

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
5⤵
- Enumerates system info in registry
PID:4232

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
4⤵
- Executes dropped EXE
PID:536

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 876
5⤵
PID:4436

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
4⤵
- Executes dropped EXE
PID:4660

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 876
5⤵
PID:3080

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
4⤵
- Executes dropped EXE
PID:1536

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 876
5⤵
PID:2496

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
4⤵
- Executes dropped EXE
PID:1360

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
5⤵
- Checks processor information in registry
- Enumerates system info in registry
PID:3148

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
4⤵
- Executes dropped EXE
PID:2616

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
5⤵
PID:4296

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
4⤵
- Executes dropped EXE
PID:4232

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
5⤵
PID:2376

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
4⤵
- Executes dropped EXE
PID:1480

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
5⤵
- Checks processor information in registry
- Enumerates system info in registry
PID:1900

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
4⤵
- Executes dropped EXE
PID:1608

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
5⤵
PID:64

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
4⤵
- Executes dropped EXE
PID:4648

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
5⤵
- Checks processor information in registry
- Enumerates system info in registry
PID:3280

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
4⤵
- Executes dropped EXE
PID:1508

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 876
5⤵
PID:972

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
4⤵
- Executes dropped EXE
PID:3228

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
5⤵
- Checks processor information in registry
PID:2616

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
4⤵
PID:2656

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
5⤵
- Checks processor information in registry
- Enumerates system info in registry
PID:3668

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
4⤵
PID:4896

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
5⤵
PID:3548

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
4⤵
PID:3376

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
5⤵
PID:1976

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
4⤵
PID:1336

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
5⤵
PID:3580

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
4⤵
PID:3460

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 884
5⤵
- Enumerates system info in registry
PID:2896

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
4⤵
PID:3404

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
5⤵
- Enumerates system info in registry
PID:4296

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
4⤵
PID:4480

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
5⤵
PID:4880

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
4⤵
PID:5096

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
5⤵
PID:3488

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
4⤵
PID:1632

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 876
5⤵
- Checks processor information in registry
PID:952

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
4⤵
PID:4348

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
5⤵
PID:3304

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
4⤵
PID:1972

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
5⤵
- Checks processor information in registry
PID:1696

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
4⤵
PID:3516

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
5⤵
- Enumerates system info in registry
PID:772

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
4⤵
PID:5004

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
5⤵
PID:2280

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
4⤵
PID:3128

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
5⤵
- Checks processor information in registry
PID:3548

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
4⤵
PID:4956

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
5⤵
PID:3332

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
4⤵
PID:2984

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
5⤵
PID:3580

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
4⤵
PID:4668

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
5⤵
- Checks processor information in registry
- Enumerates system info in registry
PID:2240

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
4⤵
PID:652

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
5⤵
PID:736

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
4⤵
PID:2280

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
5⤵
PID:3188

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
4⤵
PID:2376

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
5⤵
- Enumerates system info in registry
PID:4820

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
4⤵
PID:5056

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
5⤵
PID:3952

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
4⤵
PID:4992

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
5⤵
PID:2176

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
4⤵
PID:1972

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
5⤵
- Checks processor information in registry
PID:2240

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
4⤵
PID:4924

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
5⤵
- Enumerates system info in registry
PID:4480

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
4⤵
PID:1176

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
5⤵
- Checks processor information in registry
- Enumerates system info in registry
PID:3188

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
4⤵
PID:4772

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
5⤵
- Enumerates system info in registry
PID:688

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
4⤵
PID:4960

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
5⤵
- Enumerates system info in registry
PID:3700

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
4⤵
PID:2424

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
5⤵
- Checks processor information in registry
- Enumerates system info in registry
PID:3632

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
4⤵
PID:1904

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
5⤵
- Enumerates system info in registry
PID:1752

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
4⤵
PID:2624

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
5⤵
- Enumerates system info in registry
PID:4784

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
4⤵
PID:4436

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
5⤵
PID:1176

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
4⤵
PID:1980

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
5⤵
PID:968

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
4⤵
PID:1060

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
5⤵
- Checks processor information in registry
- Enumerates system info in registry
PID:5056

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
4⤵
PID:1608

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
5⤵
- Checks processor information in registry
PID:5048

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
4⤵
PID:5088

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
5⤵
PID:2032

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
4⤵
PID:2920

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
5⤵
PID:4808

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
4⤵
PID:4028

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
5⤵
- Checks processor information in registry
- Enumerates system info in registry
PID:2420

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
4⤵
PID:5032

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
5⤵
PID:4792

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
4⤵
PID:2384

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
5⤵
- Checks processor information in registry
PID:1740

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
4⤵
PID:536

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
5⤵
- Enumerates system info in registry
PID:4344

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
4⤵
PID:3772

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
5⤵
PID:1608

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
4⤵
PID:1528

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
5⤵
- Enumerates system info in registry
PID:4732

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
4⤵
PID:4368

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
5⤵
- Enumerates system info in registry
PID:2480

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
4⤵
PID:2656

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
5⤵
- Checks processor information in registry
PID:592

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
4⤵
PID:4060

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
5⤵
- Enumerates system info in registry
PID:2108

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
4⤵
PID:4328

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
5⤵
- Enumerates system info in registry
PID:2984

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
4⤵
PID:1976

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
5⤵
- Checks processor information in registry
PID:1348

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
4⤵
PID:2032

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
5⤵
- Enumerates system info in registry
PID:3556

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
4⤵
PID:1596

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 880
5⤵
PID:1528

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
4⤵
PID:4380

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
5⤵
PID:3120

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
4⤵
PID:3500

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
5⤵
PID:3132

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
4⤵
PID:1740

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
5⤵
PID:4060

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
4⤵
PID:4328

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
5⤵
PID:2504

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
4⤵
PID:3760

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
5⤵
PID:2596

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
4⤵
PID:920

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
5⤵
PID:3656

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
4⤵
PID:3188

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
5⤵
PID:772

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
4⤵
PID:4640

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
5⤵
PID:4968

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
4⤵
PID:1536

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
5⤵
PID:4144

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
4⤵
PID:4960

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
5⤵
PID:4724

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
4⤵
PID:2256

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
5⤵
PID:1180

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
4⤵
PID:2156

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
5⤵
PID:756

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
4⤵
PID:4784

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
5⤵
PID:1480

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
4⤵
PID:772

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
5⤵
PID:1696

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
4⤵
PID:4368

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
5⤵
PID:2576

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
4⤵
PID:1428

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
5⤵
PID:2420

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
4⤵
PID:3468

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
5⤵
PID:3236

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
4⤵
PID:2300

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
5⤵
PID:4304

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
4⤵
PID:4548

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
5⤵
PID:920

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
4⤵
PID:3512

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
5⤵
PID:4660

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
4⤵
PID:1588

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
5⤵
PID:4324

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
4⤵
PID:3152

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
5⤵
PID:2332

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
4⤵
PID:5108

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
5⤵
PID:3540

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
4⤵
PID:4260

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
5⤵
PID:4624

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
4⤵
PID:1976

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
5⤵
PID:2656

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
4⤵
PID:628

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
5⤵
PID:4796

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
4⤵
PID:4792

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
5⤵
PID:1660

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
4⤵
PID:388

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 876
5⤵
PID:1980

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
4⤵
PID:2332

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
5⤵
PID:4580

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
4⤵
PID:4880

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
5⤵
PID:4668

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
4⤵
PID:1852

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
5⤵
PID:1064

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
4⤵
PID:1976

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
5⤵
PID:4436

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
4⤵
PID:1480

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
5⤵
PID:4956

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
4⤵
PID:4960

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
5⤵
PID:4848

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
4⤵
PID:1236

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 876
5⤵
PID:64

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
4⤵
PID:4772

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
5⤵
PID:5048

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
4⤵
PID:3228

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
5⤵
PID:1896

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
4⤵
PID:3876

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
5⤵
PID:1528

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
4⤵
PID:1436

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
5⤵
PID:4660

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
4⤵
PID:1480

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
5⤵
PID:3672

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
4⤵
PID:1428

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
5⤵
PID:4876

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
4⤵
PID:4124

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
5⤵
PID:1192

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
4⤵
PID:5108

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
5⤵
PID:4772

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
4⤵
PID:2480

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
5⤵
PID:2256

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
4⤵
PID:5020

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
5⤵
PID:3876

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
4⤵
PID:1436

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
5⤵
PID:3668

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
4⤵
PID:1480

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
5⤵
PID:3164

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
4⤵
PID:4484

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
5⤵
PID:2488

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
4⤵
PID:4624

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
5⤵
PID:4124

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
4⤵
PID:4556

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
5⤵
PID:3304

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
4⤵
PID:1712

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
5⤵
PID:2340

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
4⤵
PID:5032

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
5⤵
PID:4060

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
4⤵
PID:3604

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
5⤵
PID:4348

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
4⤵
PID:1508

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 876
5⤵
PID:3036

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
4⤵
PID:2476

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 876
5⤵
PID:2488

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
4⤵
PID:5076

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
5⤵
PID:1372

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
4⤵
PID:2696

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
5⤵
PID:4556

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
4⤵
PID:1120

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
5⤵
PID:4372

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
4⤵
PID:1248

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
5⤵
PID:4192

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
4⤵
PID:1052

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
5⤵
PID:2596

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
4⤵
PID:4296

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 876
5⤵
PID:1104

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
4⤵
PID:2496

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
5⤵
PID:968

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
4⤵
PID:2372

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
5⤵
PID:3760

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
4⤵
PID:4968

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 876
5⤵
PID:3952

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
4⤵
PID:1660

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
5⤵
PID:1336

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
4⤵
PID:4952

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
5⤵
PID:4044

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
4⤵
PID:4880

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
5⤵
PID:2424

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
4⤵
PID:1068

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
5⤵
PID:4912

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
4⤵
PID:4772

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
5⤵
PID:3128

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
4⤵
PID:3952

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
5⤵
PID:2552

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
4⤵
PID:1012

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
5⤵
PID:4580

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
4⤵
PID:4596

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
5⤵
PID:4552

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
4⤵
PID:3884

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
5⤵
PID:2032

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
4⤵
PID:2424

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
5⤵
PID:4808

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
4⤵
PID:2480

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
5⤵
PID:1752

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
4⤵
PID:2696

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
5⤵
PID:4372

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
4⤵
PID:1184

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
5⤵
PID:4360

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
4⤵
PID:3036

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
5⤵
PID:2852

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
4⤵
PID:2240

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
5⤵
PID:4196

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
4⤵
PID:4880

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
5⤵
PID:3676

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
4⤵
PID:2340

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
5⤵
PID:1064

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
4⤵
PID:3672

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
5⤵
PID:4004

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
4⤵
PID:2072

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
5⤵
PID:3912

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
4⤵
PID:3296

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
5⤵
PID:2376

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
4⤵
PID:5040

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
5⤵
PID:3332

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
4⤵
PID:208

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
5⤵
PID:4152

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
4⤵
PID:968

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 880
5⤵
PID:3508

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
4⤵
PID:936

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
5⤵
PID:1692

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
4⤵
PID:4808

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
5⤵
PID:2552

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
4⤵
PID:1248

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 880
5⤵
PID:4484

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
4⤵
PID:1032

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
5⤵
PID:1516

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
4⤵
PID:2896

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
5⤵
PID:2504

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
4⤵
PID:1064

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
5⤵
PID:3760

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
4⤵
PID:4960

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
5⤵
PID:972

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
4⤵
PID:3988

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
5⤵
PID:3632

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
4⤵
PID:3404

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
5⤵
PID:2376

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
4⤵
PID:4252

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
5⤵
PID:1104

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
4⤵
PID:1032

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
5⤵
PID:1192

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
4⤵
PID:2896

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
5⤵
PID:708

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
4⤵
PID:4732

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
5⤵
PID:1064

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
4⤵
PID:3128

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
5⤵
PID:2696

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
4⤵
PID:4372

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
5⤵
PID:4808

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
4⤵
PID:4328

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
5⤵
PID:1608

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
4⤵
PID:4992

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
5⤵
PID:5096

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
4⤵
PID:3700

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
5⤵
PID:208

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
4⤵
PID:2892

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
5⤵
PID:3360

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
4⤵
PID:2108

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
5⤵
PID:4188

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
4⤵
PID:1588

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
5⤵
PID:592

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
4⤵
PID:1248

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
5⤵
PID:3632

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
4⤵
PID:4260

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
5⤵
PID:4200

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
4⤵
PID:2168

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
5⤵
PID:4008

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
4⤵
PID:1516

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
5⤵
PID:2380

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
4⤵
PID:1176

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 876
5⤵
PID:628

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
4⤵
PID:2476

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
5⤵
PID:3540

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
4⤵
PID:4324

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
5⤵
PID:4968

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
4⤵
PID:2384

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
5⤵
PID:3672

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
4⤵
PID:2852

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
5⤵
PID:2624

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
4⤵
PID:3512

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
5⤵
PID:4640

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
4⤵
PID:3508

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
5⤵
PID:2504

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
4⤵
PID:2576

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
5⤵
PID:4804

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
4⤵
PID:3460

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
5⤵
PID:4732

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
4⤵
PID:3984

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 876
5⤵
PID:2420

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
4⤵
PID:5004

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
5⤵
PID:5096

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
4⤵
PID:1236

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
5⤵
PID:1352

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
4⤵
PID:1532

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
5⤵
PID:3808

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
4⤵
PID:1180

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
5⤵
PID:4624

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
4⤵
PID:1176

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
5⤵
PID:4876

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
4⤵
PID:3772

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
5⤵
PID:4432

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
4⤵
PID:4324

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
5⤵
PID:1588

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
4⤵
PID:4796

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
5⤵
PID:4668

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
4⤵
PID:2624

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
5⤵
PID:4196

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
4⤵
PID:756

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
5⤵
PID:1476

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
4⤵
PID:2428

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
5⤵
PID:2892

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
4⤵
PID:4124

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
5⤵
PID:4544

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
4⤵
PID:2740

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
5⤵
PID:3564

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
4⤵
PID:1624

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
5⤵
PID:4152

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
4⤵
PID:2384

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
5⤵
PID:5116

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
4⤵
PID:4608

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
5⤵
PID:3296

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
4⤵
PID:4912

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
5⤵
PID:1388

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
4⤵
PID:4640

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
5⤵
PID:4548

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
4⤵
PID:1212

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
5⤵
PID:4508

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
4⤵
PID:936

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
5⤵
PID:3656

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
4⤵
PID:1508

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
5⤵
PID:3236

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
4⤵
PID:2596

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
5⤵
PID:4964

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
4⤵
PID:4616

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
5⤵
PID:4720

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
4⤵
PID:1336

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
5⤵
PID:5020

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
4⤵
PID:3808

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 876
5⤵
PID:2496

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
4⤵
PID:5056

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
5⤵
PID:628

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
4⤵
PID:1212

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 880
5⤵
PID:4360

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
4⤵
PID:3460

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
5⤵
PID:2552

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
4⤵
PID:5004

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
5⤵
PID:3648

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
4⤵
PID:5076

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
5⤵
PID:4556

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
4⤵
PID:2376

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
5⤵
PID:2336

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
4⤵
PID:3540

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
5⤵
PID:4568

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
4⤵
PID:2496

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
5⤵
PID:2896

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
4⤵
PID:628

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
5⤵
PID:4960

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
4⤵
PID:3912

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
5⤵
PID:4324

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
4⤵
PID:2240

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
5⤵
PID:1452

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
4⤵
PID:4392

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
5⤵
PID:2612

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
4⤵
PID:2624

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
5⤵
PID:2256

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
4⤵
PID:1104

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
5⤵
PID:2428

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
4⤵
PID:688

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
5⤵
PID:1360

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
4⤵
PID:4452

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
5⤵
PID:3432

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
4⤵
PID:5064

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
5⤵
PID:1520

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
4⤵
PID:3604

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
5⤵
PID:3672

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
4⤵
PID:648

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
5⤵
PID:464

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
4⤵
PID:1428

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
5⤵
PID:4296

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
4⤵
PID:5020

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
5⤵
PID:3516

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
4⤵
PID:3512

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
5⤵
PID:2476

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
4⤵
PID:736

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
5⤵
PID:3656

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
4⤵
PID:2896

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
5⤵
PID:4908

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
4⤵
PID:1068

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
5⤵
PID:2796

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
4⤵
PID:4324

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
5⤵
PID:4392

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1664

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
3⤵
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
PID:688

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4828

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
3⤵
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1248

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1348

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
3⤵
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2332

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
2⤵
- Executes dropped EXE
PID:1052

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
3⤵
- Checks processor information in registry
PID:4216

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
2⤵
- Executes dropped EXE
PID:4432

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
3⤵
PID:3632

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
2⤵
- Executes dropped EXE
PID:1336

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
3⤵
- Checks processor information in registry
PID:5008

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
2⤵
- Executes dropped EXE
PID:116

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
3⤵
PID:4536

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
2⤵
- Executes dropped EXE
PID:928

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
3⤵
- Enumerates system info in registry
PID:4836

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
2⤵
- Executes dropped EXE
PID:2576

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
3⤵
PID:3204

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
2⤵
- Executes dropped EXE
PID:3148

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
3⤵
PID:1752

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
2⤵
- Executes dropped EXE
PID:3404

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
3⤵
PID:4296

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
2⤵
- Executes dropped EXE
PID:772

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
3⤵
- Enumerates system info in registry
PID:3632

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
2⤵
- Executes dropped EXE
PID:4364

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
3⤵
PID:2280

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
2⤵
- Executes dropped EXE
PID:3688

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
3⤵
- Checks processor information in registry
PID:1068

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
2⤵
- Executes dropped EXE
PID:4836

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
3⤵
- Enumerates system info in registry
PID:1504

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
2⤵
- Executes dropped EXE
PID:1752

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
3⤵
- Checks processor information in registry
PID:3516

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
2⤵
- Executes dropped EXE
PID:3512

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
3⤵
- Checks processor information in registry
PID:2596

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
2⤵
- Executes dropped EXE
PID:2380

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
3⤵
- Checks processor information in registry
PID:2740

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
2⤵
- Executes dropped EXE
PID:1972

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
3⤵
- Checks processor information in registry
PID:4648

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
2⤵
- Executes dropped EXE
PID:2816

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
3⤵
- Checks processor information in registry
PID:3700

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
2⤵
- Executes dropped EXE
PID:3236

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
3⤵
- Enumerates system info in registry
PID:1884

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
2⤵
- Executes dropped EXE
PID:3184

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
3⤵
PID:2480

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
2⤵
- Executes dropped EXE
PID:2488

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
3⤵
PID:1976

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
2⤵
- Executes dropped EXE
PID:3376

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
3⤵
- Checks processor information in registry
PID:1564

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
2⤵
- Executes dropped EXE
PID:1652

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
3⤵
- Checks processor information in registry
- Enumerates system info in registry
PID:4152

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
2⤵
- Executes dropped EXE
PID:1904

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
3⤵
- Checks processor information in registry
PID:5072

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
2⤵
- Executes dropped EXE
PID:2624

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
3⤵
- Checks processor information in registry
- Enumerates system info in registry
PID:3340

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
2⤵
- Executes dropped EXE
PID:1776

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
3⤵
PID:4896

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
2⤵
- Executes dropped EXE
PID:4960

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
3⤵
PID:4792

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
2⤵
- Executes dropped EXE
PID:1528

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
3⤵
- Checks processor information in registry
- Enumerates system info in registry
PID:3816

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
2⤵
- Executes dropped EXE
PID:3360

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
3⤵
PID:1348

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
2⤵
- Executes dropped EXE
PID:4784

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
3⤵
- Enumerates system info in registry
PID:4296

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
2⤵
PID:3128

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
3⤵
PID:2108

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
2⤵
PID:1776

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
3⤵
- Checks processor information in registry
- Enumerates system info in registry
PID:1988

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
2⤵
PID:4348

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
3⤵
- Checks processor information in registry
- Enumerates system info in registry
PID:440

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
2⤵
PID:3280

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
3⤵
- Checks processor information in registry
- Enumerates system info in registry
PID:4668

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
2⤵
PID:1652

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
3⤵
PID:2920

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
2⤵
PID:2332

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
3⤵
- Checks processor information in registry
PID:1596

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
2⤵
PID:2504

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
3⤵
PID:3512

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
2⤵
PID:2376

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
3⤵
PID:1900

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
2⤵
PID:2420

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
3⤵
- Checks processor information in registry
PID:64

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
2⤵
PID:440

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 876
3⤵
- Enumerates system info in registry
PID:1360

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
2⤵
PID:3280

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
3⤵
- Checks processor information in registry
PID:1904

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
2⤵
PID:3460

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 876
3⤵
PID:3520

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
2⤵
PID:636

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
3⤵
- Enumerates system info in registry
PID:4368

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
2⤵
PID:2504

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
3⤵
- Checks processor information in registry
PID:4548

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
2⤵
PID:3376

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
3⤵
- Enumerates system info in registry
PID:1564

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
2⤵
PID:2156

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
3⤵
- Checks processor information in registry
- Enumerates system info in registry
PID:1680

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
2⤵
PID:1652

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
3⤵
PID:2816

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
2⤵
PID:3340

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
3⤵
PID:4028

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
2⤵
PID:3668

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
3⤵
- Checks processor information in registry
PID:4436

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
2⤵
PID:1060

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
3⤵
PID:3468

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
2⤵
PID:3908

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
3⤵
PID:4920

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
2⤵
PID:4596

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 876
3⤵
- Checks processor information in registry
PID:1896

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
2⤵
PID:4644

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
3⤵
PID:1528

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
2⤵
PID:1000

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 876
3⤵
- Enumerates system info in registry
PID:4880

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
2⤵
PID:4372

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
3⤵
PID:60

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
2⤵
PID:1428

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
3⤵
- Checks processor information in registry
PID:4216

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
2⤵
PID:4548

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 876
3⤵
PID:1976

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
2⤵
PID:4144

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
3⤵
PID:2380

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
2⤵
PID:3676

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
3⤵
- Checks processor information in registry
- Enumerates system info in registry
PID:4724

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
2⤵
PID:1096

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
3⤵
- Checks processor information in registry
- Enumerates system info in registry
PID:4388

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
2⤵
PID:4480

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
3⤵
PID:400

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
2⤵
PID:4060

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
3⤵
- Enumerates system info in registry
PID:3668

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
2⤵
PID:4640

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 876
3⤵
- Checks processor information in registry
PID:3500

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
2⤵
PID:4344

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
3⤵
PID:2504

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
2⤵
PID:2380

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
3⤵
- Checks processor information in registry
- Enumerates system info in registry
PID:4356

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
2⤵
PID:2496

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
3⤵
PID:1884

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
2⤵
PID:2480

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
3⤵
PID:3404

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
2⤵
PID:4052

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
3⤵
PID:4928

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
2⤵
PID:956

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
3⤵
- Enumerates system info in registry
PID:4796

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
2⤵
PID:4836

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
3⤵
PID:1980

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
2⤵
PID:3468

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
3⤵
PID:4848

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
2⤵
PID:3540

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
3⤵
PID:3464

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
2⤵
PID:1352

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
3⤵
PID:1360

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
2⤵
PID:1588

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 876
3⤵
- Enumerates system info in registry
PID:2180

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
2⤵
PID:3132

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
3⤵
- Checks processor information in registry
PID:4028

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
2⤵
PID:4792

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
3⤵
- Enumerates system info in registry
PID:2520

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
2⤵
PID:1032

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
3⤵
PID:1980

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
2⤵
PID:944

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
3⤵
PID:844

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
2⤵
PID:836

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 876
3⤵
- Enumerates system info in registry
PID:3540

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
2⤵
PID:4004

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 836
3⤵
- Enumerates system info in registry
PID:4732

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
2⤵
PID:2072

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
3⤵
PID:3116

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
2⤵
PID:4216

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
3⤵
PID:3164

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
2⤵
PID:3228

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
3⤵
PID:952

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
2⤵
PID:464

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
3⤵
PID:1972

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
2⤵
PID:3684

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
3⤵
PID:844

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
2⤵
PID:3512

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
3⤵
PID:3876

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
2⤵
PID:3404

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
3⤵
PID:3816

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
2⤵
PID:4380

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 876
3⤵
PID:3988

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
2⤵
PID:3500

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
3⤵
PID:3024

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
2⤵
PID:4568

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
3⤵
PID:3228

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
2⤵
PID:1976

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 876
3⤵
PID:1064

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
2⤵
PID:3632

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
3⤵
PID:4728

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
2⤵
PID:3556

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
3⤵
PID:4232

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
2⤵
PID:4912

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
3⤵
PID:3404

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
2⤵
PID:4928

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 876
3⤵
PID:3988

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
2⤵
PID:4296

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
3⤵
PID:1536

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
2⤵
PID:968

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
3⤵
PID:1740

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
2⤵
PID:1348

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
3⤵
PID:2372

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
2⤵
PID:2552

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
3⤵
PID:1356

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
2⤵
PID:4588

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
3⤵
PID:3340

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
2⤵
PID:1336

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
3⤵
PID:3024

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
2⤵
PID:4480

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 876
3⤵
PID:3652

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
2⤵
PID:4644

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
3⤵
PID:4580

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
2⤵
PID:968

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
3⤵
PID:4328

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
2⤵
PID:1896

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
3⤵
PID:4784

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
2⤵
PID:1904

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
3⤵
PID:4468

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
2⤵
PID:4020

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
3⤵
PID:636

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
2⤵
PID:3024

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 876
3⤵
PID:3908

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
2⤵
PID:2108

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
3⤵
PID:2256

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
2⤵
PID:3228

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
3⤵
PID:4728

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
2⤵
PID:3148

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
3⤵
PID:3448

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
2⤵
PID:4788

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
3⤵
PID:3700

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
2⤵
PID:2032

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
3⤵
PID:1532

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
2⤵
PID:4368

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
3⤵
PID:3200

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
2⤵
PID:1536

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
3⤵
PID:3468

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
2⤵
PID:5096

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 876
3⤵
PID:4964

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
2⤵
PID:2340

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
3⤵
PID:1000

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
2⤵
PID:208

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
3⤵
PID:3360

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
2⤵
PID:4436

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
3⤵
PID:1120

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
2⤵
PID:4640

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
3⤵
PID:3652

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
2⤵
PID:3200

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
3⤵
PID:844

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
2⤵
PID:4996

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
3⤵
PID:3508

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
2⤵
PID:708

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
3⤵
PID:1740

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
2⤵
PID:4448

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
3⤵
PID:2380

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
2⤵
PID:1356

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
3⤵
PID:4548

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
2⤵
PID:2520

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
3⤵
PID:4436

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
2⤵
PID:4848

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
3⤵
PID:4952

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
2⤵
PID:1104

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
3⤵
PID:1972

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
2⤵
PID:2896

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
3⤵
PID:1236

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
2⤵
PID:1064

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
3⤵
PID:2612

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
2⤵
PID:4448

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
3⤵
PID:1360

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
2⤵
PID:2740

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
3⤵
PID:3876

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
2⤵
PID:1588

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
3⤵
PID:3068

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
2⤵
PID:3364

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
3⤵
PID:2332

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
2⤵
PID:2424

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
3⤵
PID:3540

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
2⤵
PID:968

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
3⤵
PID:4668

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
2⤵
PID:708

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
3⤵
PID:1884

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
2⤵
PID:5072

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
3⤵
PID:3668

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
2⤵
PID:4792

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
3⤵
PID:3116

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
2⤵
PID:4920

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
3⤵
PID:3404

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
2⤵
PID:1348

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
3⤵
PID:4008

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
2⤵
PID:4624

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 876
3⤵
PID:3304

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
2⤵
PID:1064

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
3⤵
PID:736

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
2⤵
PID:1528

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
3⤵
PID:592

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
2⤵
PID:3116

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 876
3⤵
PID:4436

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
2⤵
PID:1180

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
3⤵
PID:3884

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
2⤵
PID:2896

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
3⤵
PID:4876

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
2⤵
PID:1596

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 876
3⤵
PID:3692

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
2⤵
PID:2696

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
3⤵
PID:2372

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
2⤵
PID:4216

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
3⤵
PID:3672

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
2⤵
PID:1572

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
3⤵
PID:2072

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
2⤵
PID:4924

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
3⤵
PID:4328

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
2⤵
PID:1180

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
3⤵
PID:2384

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
2⤵
PID:2176

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
3⤵
PID:4568

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
2⤵
PID:1068

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 876
3⤵
PID:3648

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
2⤵
PID:3128

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
3⤵
PID:592

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
2⤵
PID:1060

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
3⤵
PID:1660

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
2⤵
PID:3468

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
3⤵
PID:1032

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
2⤵
PID:3448

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
3⤵
PID:756

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
2⤵
PID:2032

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
3⤵
PID:1904

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
2⤵
PID:3540

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
3⤵
PID:3500

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
2⤵
PID:1976

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
3⤵
PID:592

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
2⤵
PID:4372

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
3⤵
PID:2656

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
2⤵
PID:2180

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
3⤵
PID:2332

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
2⤵
PID:2928

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
3⤵
PID:2816

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
2⤵
PID:2156

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
3⤵
PID:3188

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
2⤵
PID:4020

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
3⤵
PID:4960

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
2⤵
PID:4772

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
3⤵
PID:3988

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
2⤵
PID:4796

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
3⤵
PID:1852

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
2⤵
PID:4252

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 876
3⤵
PID:4260

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
2⤵
PID:1660

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
3⤵
PID:3080

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
2⤵
PID:2816

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
3⤵
PID:4912

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
2⤵
PID:3516

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
3⤵
PID:2372

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
2⤵
PID:4020

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
3⤵
PID:5072

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
2⤵
PID:4772

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
3⤵
PID:3460

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
2⤵
PID:4976

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
3⤵
PID:3468

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
2⤵
PID:1564

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
3⤵
PID:4992

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
2⤵
PID:1236

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
3⤵
PID:1740

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
2⤵
PID:2424

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
3⤵
PID:2892

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
2⤵
PID:2108

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
3⤵
PID:1452

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
2⤵
PID:4968

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
3⤵
PID:3556

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
2⤵
PID:3672

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
3⤵
PID:3988

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
2⤵
PID:4144

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
3⤵
PID:3884

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
2⤵
PID:1972

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
3⤵
PID:1104

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
2⤵
PID:3340

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
3⤵
PID:3132

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
2⤵
PID:2424

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
3⤵
PID:5064

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
2⤵
PID:1976

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
3⤵
PID:3500

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
2⤵
PID:3556

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
3⤵
PID:4324

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
2⤵
PID:3692

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
3⤵
PID:4580

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
2⤵
PID:3448

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
3⤵
PID:636

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
2⤵
PID:4016

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
3⤵
PID:3580

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
2⤵
PID:1904

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
3⤵
PID:2032

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
2⤵
PID:1068

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
3⤵
PID:5056

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
2⤵
PID:4052

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
3⤵
PID:2740

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
2⤵
PID:3908

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
3⤵
PID:5100

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
2⤵
PID:2376

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
3⤵
PID:1396

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
2⤵
PID:1608

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
3⤵
PID:4144

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
2⤵
PID:756

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
3⤵
PID:2280

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
2⤵
PID:2428

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
3⤵
PID:4348

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
2⤵
PID:4444

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
3⤵
PID:5048

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
2⤵
PID:4028

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
3⤵
PID:2740

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
2⤵
PID:2552

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
3⤵
PID:4968

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
2⤵
PID:2376

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
3⤵
PID:5076

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
2⤵
PID:1896

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
3⤵
PID:3296

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
2⤵
PID:1116

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
3⤵
PID:64

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
2⤵
PID:3024

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 876
3⤵
PID:2496

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
2⤵
PID:5056

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
3⤵
PID:5048

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
2⤵
PID:4960

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
3⤵
PID:1184

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
2⤵
PID:4448

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
3⤵
PID:1504

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
2⤵
PID:3884

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
3⤵
PID:3344

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
2⤵
PID:2404

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
3⤵
PID:2480

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
2⤵
PID:4640

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
3⤵
PID:5072

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
2⤵
PID:1032

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
3⤵
PID:3508

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
2⤵
PID:2372

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
3⤵
PID:3684

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
2⤵
PID:4044

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
3⤵
PID:3908

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
2⤵
PID:4848

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
3⤵
PID:2596

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
2⤵
PID:3036

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
3⤵
PID:3404

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
2⤵
PID:388

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
3⤵
PID:1608

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
2⤵
PID:3512

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
3⤵
PID:1516

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
2⤵
PID:5072

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
3⤵
PID:2576

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
2⤵
PID:2504

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
3⤵
PID:4732

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
2⤵
PID:3604

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 876
3⤵
PID:4808

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
2⤵
PID:4044

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
3⤵
PID:4380

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
2⤵
PID:1052

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
3⤵
PID:4864

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
2⤵
PID:2376

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
3⤵
PID:2480

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
2⤵
PID:388

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
3⤵
PID:1532

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
2⤵
PID:2404

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
3⤵
PID:1120

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
2⤵
PID:5072

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
3⤵
PID:5088

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
2⤵
PID:2740

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
3⤵
PID:1528

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
2⤵
PID:2168

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
3⤵
PID:4484

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
2⤵
PID:4380

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
3⤵
PID:2796

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
2⤵
PID:2596

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
3⤵
PID:4260

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
2⤵
PID:2380

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
3⤵
PID:2656

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
2⤵
PID:688

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
3⤵
PID:4724

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
2⤵
PID:3808

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
3⤵
PID:4444

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
2⤵
PID:5056

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
3⤵
PID:936

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
2⤵
PID:1796

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
3⤵
PID:1396

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
2⤵
PID:3024

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 876
3⤵
PID:2384

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
2⤵
PID:1428

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
3⤵
PID:3296

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
2⤵
PID:4216

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
3⤵
PID:4364

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
2⤵
PID:4820

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 876
3⤵
PID:1192

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
2⤵
PID:3340

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
3⤵
PID:4804

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
2⤵
PID:3068

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
3⤵
PID:1064

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
2⤵
PID:4772

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
3⤵
PID:2552

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
2⤵
PID:4788

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
3⤵
PID:1652

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
2⤵
PID:3024

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
3⤵
PID:5040

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
2⤵
PID:2036

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
3⤵
PID:2420

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
2⤵
PID:772

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
3⤵
PID:972

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
2⤵
PID:2376

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
3⤵
PID:1000

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
2⤵
PID:1388

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
3⤵
PID:4124

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
2⤵
PID:4432

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
3⤵
PID:3908

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
2⤵
PID:3876

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
3⤵
PID:4136

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"
2⤵
PID:1640

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 872
3⤵
PID:4952

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
1⤵
PID:2516

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
1⤵
PID:1840

C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding
1⤵
PID:4928

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Microsoft\Windows\WER\Temp\WER7252.tmp.xml
Filesize
4KB

MD5
67b8223696838620467ac12d47863038

SHA1
f6708360f557aa3815f6c66ea7d3348346216486

SHA256
8de4b8fd8703f4c5f648ef4fe4c0eb3b9ba2d304973852c4ce8aae71fc2c056f

SHA512
4373f7e29c89734b0c68787a0304cb6a53660ec4694701f0a0568b872c50349a812128831d5176ef84b41ad7fa92305dad6b46ac511949f1128105144d8f95af

Download Submit
C:\ProgramData\Microsoft\Windows\WER\Temp\WER74B3.tmp.WERInternalMetadata.xml
Filesize
7KB

MD5
125135413f3d9934a5d38907cb7aa1f3

SHA1
c36ffe3541ee08d9835abacd2b09ba31bd7f3ab5

SHA256
b08d95555dc6003d97e2107b196c765e015f9670e283c0a31528994fefc41b94

SHA512
b400cb5b2069534f3798c2f7c936f633687bf68fa6812429e42592a7b1a81b99d0597e9383fed87967909a39c35df9c8928e3dd273ceca7cb7c0d0bb795310fd

Download Submit
C:\ProgramData\Microsoft\Windows\WER\Temp\WER77D1.tmp.xml
Filesize
4KB

MD5
39ed7417396961deffd0c7d1716ac391

SHA1
add23423382e4b933161b886a654403c355e5a3b

SHA256
a2e586de582da185071e07e331a96d7ff246a4e33fd086a61856858bd4b33a2f

SHA512
12b9923fd669c3d8d7df527ba8f60a4d984a2a1b4010be0de6677a54bd701fd744a7f041a34cde79a1578733d3dc4e37ff976075978ecebe336d06a9c1aa31ec

Download Submit
C:\ProgramData\Microsoft\Windows\WER\Temp\WER7A42.tmp.xml
Filesize
4KB

MD5
a534231932a9ebdcd4345cf446050465

SHA1
5f4206fd5b3fcbf653d1b3ddfe73c759a052aa25

SHA256
9188fac03c91851161b2c243857bd30bd5eab99277b5937f50108173b0c84b77

SHA512
325fb69dbfa161c3e6d5746e3e83890cbb70f80e14a83ea18bcda57bb863d4267adef5c1be7d45f9e39b97965ea165477c8bad82c79f2bdb72f1486fa7efca84

Download Submit
C:\ProgramData\Microsoft\Windows\WER\Temp\WER7B5B.tmp.xml
Filesize
4KB

MD5
c0863804c92a7d759970e71aabe780d1

SHA1
b54aad000c211d2e916c00a0978ff49c8e017256

SHA256
ca2476cc89b278f817ee526ff0eb4a562f8e6c01dd6eea61fcb9ee03804d9d22

SHA512
7790cf1da3d339742e1a0d7b42b548eabd860a93335c6a64197d1ed118182e3bbc4092eedb7697b13cf19480df3dad2d2656aa2a2ff54b525169f578ee1ba0cc

Download Submit
C:\ProgramData\Microsoft\Windows\WER\Temp\WER7DDB.tmp.WERInternalMetadata.xml
Filesize
7KB

MD5
84d69b686a317db37356666b59a00db1

SHA1
ebd664202ea7ba5a4623cbb1e1f418f0c6cf9c6a

SHA256
fb2222cb908c7ad90388386a7e6a1885b37591dce797ebbeefdec86268803bed

SHA512
1baa8de0e6df7272228c722585362b5eaa37b35e6c8a7bb20144c11b089191afabef13bd3d2a6292cb5c676279cfa5e12e0635f75ee619b80401216b8733bdce

Download Submit
C:\ProgramData\Microsoft\Windows\WER\Temp\WER805B.tmp.WERInternalMetadata.xml
Filesize
7KB

MD5
9078cfbe8e5bb07a996758b3c601be00

SHA1
4b5dce6307875356456eeb0177bbdba046f68f4a

SHA256
bf79e406a999e9d3c4026d679720609211768ba6a88169885fe59e0257dea84a

SHA512
1439848b88d2e348d7b6e19a9ab30e591a0961ca755d47d49d0af2fb72cf713fa7c765130d55b18081e3b3dd0516886d564b3bf1692c590fea6bee547cb16d79

Download Submit
C:\Users\Admin\AppData\Local\Temp\winrsmgr.exe
Filesize
725KB

MD5
0529d67672dae586e351a9ee52d41578

SHA1
b0b0f00591e257f0209680e764f3e7a89b6e4783

SHA256
7634a9fc59d55c2c6825af629eec999b3c8f59e1a00eba5afa672c93ce81bba1

SHA512
a6d496ab1df8f0e0d39957b712d3dc93ba95cfa7097e59d54037ed06034e948c61e90c4976e960bf8d7e0247447d2e8ffff20d3f1785add5742686d98886a09b

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
Filesize
7KB

MD5
0279c2146d62cae9662118f4e8800deb

SHA1
8d0da4b751a854bb0d915f3391a4bb90c439b7ed

SHA256
995b97bbe99a22c37fe19b1f2119c652520f2d6871ab4f40dfddddc6bbe85efb

SHA512
259afe5223f2354102fa5c6ebe12d7feb6be5d5039820052d81551e1ddb53308644b6649781b393da79c96c217eade74fc7620f1208bce4dc15b1b44bbac4001

Download Submit
memory/228-11-0x0000000000800000-0x0000000000801000-memory.dmp

Filesize
4KB

Download
memory/1608-928-0x0000000071AA0000-0x0000000071B05000-memory.dmp

Filesize
404KB

Download
memory/1608-4097-0x0000000071AA0000-0x0000000071B05000-memory.dmp

Filesize
404KB

Download
memory/1608-2620-0x0000000071AA0000-0x0000000071B05000-memory.dmp

Filesize
404KB

Download
memory/1608-2220-0x0000000071AA0000-0x0000000071B05000-memory.dmp

Filesize
404KB

Download
memory/2080-681-0x00000000753D2000-0x00000000753D3000-memory.dmp

Filesize
4KB

Download
memory/2080-2-0x00000000753D0000-0x0000000075981000-memory.dmp

Filesize
5.7MB

Download
memory/2080-1-0x00000000753D0000-0x0000000075981000-memory.dmp

Filesize
5.7MB

Download
memory/2080-771-0x00000000753D0000-0x0000000075981000-memory.dmp

Filesize
5.7MB

Download
memory/2080-0-0x00000000753D2000-0x00000000753D3000-memory.dmp

Filesize
4KB

Download
memory/2296-9-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/2296-7-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/2296-8-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/2296-12-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/2296-10-0x00000000023A0000-0x00000000023A1000-memory.dmp

Filesize
4KB

Download
memory/2296-13-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/3344-24-0x0000000001320000-0x0000000001330000-memory.dmp

Filesize
64KB

Download