Malware Analysis Report

2024-08-06 18:56

Sample ID 240620-mkap1swhpn
Target 0529d67672dae586e351a9ee52d41578_JaffaCakes118
SHA256 7634a9fc59d55c2c6825af629eec999b3c8f59e1a00eba5afa672c93ce81bba1
Tags
darkcomet facebook rat trojan ransomware
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

7634a9fc59d55c2c6825af629eec999b3c8f59e1a00eba5afa672c93ce81bba1

Threat Level: Known bad

The file 0529d67672dae586e351a9ee52d41578_JaffaCakes118 was found to be: Known bad.

Malicious Activity Summary

darkcomet facebook rat trojan ransomware

Darkcomet

Renames multiple (147) files with added filename extension

Checks computer location settings

Loads dropped DLL

Executes dropped EXE

Suspicious use of SetThreadContext

Enumerates physical storage devices

Unsigned PE

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: EnumeratesProcesses

Checks processor information in registry

Suspicious use of WriteProcessMemory

Enumerates system info in registry

Suspicious use of SetWindowsHookEx

Suspicious behavior: GetForegroundWindowSpam

MITRE ATT&CK Matrix V13

Initial Access
TA0001
Execution
TA0002
Persistence
TA0003
Privilege Escalation
TA0004
Defense Evasion
TA0005
Credential Access
TA0006
Discovery
TA0007
System Information Discovery
T1082
Query Registry
T1012
Lateral Movement
TA0008
Collection
TA0009
Exfiltration
TA0010
Command and Control
TA0011
Impact
TA0040
Resource Development
TA0042
Reconnaissance
TA0043

Analysis: static1

Detonation Overview

Reported

2024-06-20 10:30

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-20 10:30

Reported

2024-06-20 10:33

Platform

win7-20240221-en

Max time kernel

150s

Max time network

139s

Command Line

"C:\Users\Admin\AppData\Local\Temp\0529d67672dae586e351a9ee52d41578_JaffaCakes118.exe"

Signatures

Darkcomet

trojan rat darkcomet

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\winrsmgr.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\0529d67672dae586e351a9ee52d41578_JaffaCakes118.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2884 set thread context of 2912 N/A C:\Users\Admin\AppData\Local\Temp\0529d67672dae586e351a9ee52d41578_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 3032 set thread context of 308 N/A C:\Users\Admin\AppData\Local\Temp\winrsmgr.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\0529d67672dae586e351a9ee52d41578_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0529d67672dae586e351a9ee52d41578_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0529d67672dae586e351a9ee52d41578_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0529d67672dae586e351a9ee52d41578_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0529d67672dae586e351a9ee52d41578_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0529d67672dae586e351a9ee52d41578_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0529d67672dae586e351a9ee52d41578_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0529d67672dae586e351a9ee52d41578_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0529d67672dae586e351a9ee52d41578_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0529d67672dae586e351a9ee52d41578_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0529d67672dae586e351a9ee52d41578_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0529d67672dae586e351a9ee52d41578_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0529d67672dae586e351a9ee52d41578_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0529d67672dae586e351a9ee52d41578_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0529d67672dae586e351a9ee52d41578_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0529d67672dae586e351a9ee52d41578_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0529d67672dae586e351a9ee52d41578_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0529d67672dae586e351a9ee52d41578_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0529d67672dae586e351a9ee52d41578_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\winrsmgr.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\winrsmgr.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0529d67672dae586e351a9ee52d41578_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\winrsmgr.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0529d67672dae586e351a9ee52d41578_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\winrsmgr.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0529d67672dae586e351a9ee52d41578_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\winrsmgr.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0529d67672dae586e351a9ee52d41578_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0529d67672dae586e351a9ee52d41578_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\winrsmgr.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\winrsmgr.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0529d67672dae586e351a9ee52d41578_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\winrsmgr.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0529d67672dae586e351a9ee52d41578_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\winrsmgr.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0529d67672dae586e351a9ee52d41578_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\winrsmgr.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0529d67672dae586e351a9ee52d41578_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0529d67672dae586e351a9ee52d41578_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\winrsmgr.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\winrsmgr.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0529d67672dae586e351a9ee52d41578_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\winrsmgr.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0529d67672dae586e351a9ee52d41578_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0529d67672dae586e351a9ee52d41578_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\winrsmgr.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0529d67672dae586e351a9ee52d41578_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\winrsmgr.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0529d67672dae586e351a9ee52d41578_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\winrsmgr.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\winrsmgr.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0529d67672dae586e351a9ee52d41578_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0529d67672dae586e351a9ee52d41578_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\winrsmgr.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\winrsmgr.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0529d67672dae586e351a9ee52d41578_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\winrsmgr.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0529d67672dae586e351a9ee52d41578_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\winrsmgr.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0529d67672dae586e351a9ee52d41578_JaffaCakes118.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0529d67672dae586e351a9ee52d41578_JaffaCakes118.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeImpersonatePrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: 33 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: 34 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: 35 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\winrsmgr.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeImpersonatePrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: 33 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: 34 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: 35 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2884 wrote to memory of 2912 N/A C:\Users\Admin\AppData\Local\Temp\0529d67672dae586e351a9ee52d41578_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 2884 wrote to memory of 2912 N/A C:\Users\Admin\AppData\Local\Temp\0529d67672dae586e351a9ee52d41578_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 2884 wrote to memory of 2912 N/A C:\Users\Admin\AppData\Local\Temp\0529d67672dae586e351a9ee52d41578_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 2884 wrote to memory of 2912 N/A C:\Users\Admin\AppData\Local\Temp\0529d67672dae586e351a9ee52d41578_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 2884 wrote to memory of 2912 N/A C:\Users\Admin\AppData\Local\Temp\0529d67672dae586e351a9ee52d41578_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 2884 wrote to memory of 2912 N/A C:\Users\Admin\AppData\Local\Temp\0529d67672dae586e351a9ee52d41578_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 2884 wrote to memory of 2912 N/A C:\Users\Admin\AppData\Local\Temp\0529d67672dae586e351a9ee52d41578_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 2884 wrote to memory of 2912 N/A C:\Users\Admin\AppData\Local\Temp\0529d67672dae586e351a9ee52d41578_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 2884 wrote to memory of 2912 N/A C:\Users\Admin\AppData\Local\Temp\0529d67672dae586e351a9ee52d41578_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 2884 wrote to memory of 2912 N/A C:\Users\Admin\AppData\Local\Temp\0529d67672dae586e351a9ee52d41578_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 2884 wrote to memory of 2912 N/A C:\Users\Admin\AppData\Local\Temp\0529d67672dae586e351a9ee52d41578_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 2884 wrote to memory of 2912 N/A C:\Users\Admin\AppData\Local\Temp\0529d67672dae586e351a9ee52d41578_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 2884 wrote to memory of 2912 N/A C:\Users\Admin\AppData\Local\Temp\0529d67672dae586e351a9ee52d41578_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 2884 wrote to memory of 2912 N/A C:\Users\Admin\AppData\Local\Temp\0529d67672dae586e351a9ee52d41578_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 2884 wrote to memory of 2912 N/A C:\Users\Admin\AppData\Local\Temp\0529d67672dae586e351a9ee52d41578_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 2884 wrote to memory of 2912 N/A C:\Users\Admin\AppData\Local\Temp\0529d67672dae586e351a9ee52d41578_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 2912 wrote to memory of 2792 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\SysWOW64\notepad.exe
PID 2912 wrote to memory of 2792 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\SysWOW64\notepad.exe
PID 2912 wrote to memory of 2792 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\SysWOW64\notepad.exe
PID 2912 wrote to memory of 2792 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\SysWOW64\notepad.exe
PID 2912 wrote to memory of 2792 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\SysWOW64\notepad.exe
PID 2912 wrote to memory of 2792 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\SysWOW64\notepad.exe
PID 2912 wrote to memory of 2792 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\SysWOW64\notepad.exe
PID 2912 wrote to memory of 2792 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\SysWOW64\notepad.exe
PID 2912 wrote to memory of 2792 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\SysWOW64\notepad.exe
PID 2912 wrote to memory of 2792 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\SysWOW64\notepad.exe
PID 2912 wrote to memory of 2792 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\SysWOW64\notepad.exe
PID 2912 wrote to memory of 2792 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\SysWOW64\notepad.exe
PID 2912 wrote to memory of 2792 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\SysWOW64\notepad.exe
PID 2912 wrote to memory of 2792 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\SysWOW64\notepad.exe
PID 2912 wrote to memory of 2792 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\SysWOW64\notepad.exe
PID 2912 wrote to memory of 2792 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\SysWOW64\notepad.exe
PID 2912 wrote to memory of 2792 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\SysWOW64\notepad.exe
PID 2912 wrote to memory of 2792 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\SysWOW64\notepad.exe
PID 2912 wrote to memory of 2792 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\SysWOW64\notepad.exe
PID 2912 wrote to memory of 2792 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\SysWOW64\notepad.exe
PID 2912 wrote to memory of 2792 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\SysWOW64\notepad.exe
PID 2912 wrote to memory of 2792 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\SysWOW64\notepad.exe
PID 2912 wrote to memory of 2792 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\SysWOW64\notepad.exe
PID 2912 wrote to memory of 2792 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\SysWOW64\notepad.exe
PID 2912 wrote to memory of 2792 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\SysWOW64\notepad.exe
PID 2912 wrote to memory of 2792 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\SysWOW64\notepad.exe
PID 2884 wrote to memory of 2172 N/A C:\Users\Admin\AppData\Local\Temp\0529d67672dae586e351a9ee52d41578_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
PID 2884 wrote to memory of 2172 N/A C:\Users\Admin\AppData\Local\Temp\0529d67672dae586e351a9ee52d41578_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
PID 2884 wrote to memory of 2172 N/A C:\Users\Admin\AppData\Local\Temp\0529d67672dae586e351a9ee52d41578_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
PID 2884 wrote to memory of 2172 N/A C:\Users\Admin\AppData\Local\Temp\0529d67672dae586e351a9ee52d41578_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
PID 2172 wrote to memory of 2508 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
PID 2172 wrote to memory of 2508 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
PID 2172 wrote to memory of 2508 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
PID 2172 wrote to memory of 2508 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
PID 2172 wrote to memory of 3032 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe C:\Users\Admin\AppData\Local\Temp\winrsmgr.exe
PID 2172 wrote to memory of 3032 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe C:\Users\Admin\AppData\Local\Temp\winrsmgr.exe
PID 2172 wrote to memory of 3032 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe C:\Users\Admin\AppData\Local\Temp\winrsmgr.exe
PID 2172 wrote to memory of 3032 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe C:\Users\Admin\AppData\Local\Temp\winrsmgr.exe
PID 3032 wrote to memory of 308 N/A C:\Users\Admin\AppData\Local\Temp\winrsmgr.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 3032 wrote to memory of 308 N/A C:\Users\Admin\AppData\Local\Temp\winrsmgr.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 3032 wrote to memory of 308 N/A C:\Users\Admin\AppData\Local\Temp\winrsmgr.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 3032 wrote to memory of 308 N/A C:\Users\Admin\AppData\Local\Temp\winrsmgr.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 3032 wrote to memory of 308 N/A C:\Users\Admin\AppData\Local\Temp\winrsmgr.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 3032 wrote to memory of 308 N/A C:\Users\Admin\AppData\Local\Temp\winrsmgr.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 3032 wrote to memory of 308 N/A C:\Users\Admin\AppData\Local\Temp\winrsmgr.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 3032 wrote to memory of 308 N/A C:\Users\Admin\AppData\Local\Temp\winrsmgr.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 3032 wrote to memory of 308 N/A C:\Users\Admin\AppData\Local\Temp\winrsmgr.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 3032 wrote to memory of 308 N/A C:\Users\Admin\AppData\Local\Temp\winrsmgr.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe

Processes

C:\Users\Admin\AppData\Local\Temp\0529d67672dae586e351a9ee52d41578_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\0529d67672dae586e351a9ee52d41578_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe

C:\Windows\SysWOW64\notepad.exe

notepad

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 532

C:\Users\Admin\AppData\Local\Temp\winrsmgr.exe

"C:\Users\Admin\AppData\Local\Temp\winrsmgr.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 bl4cks0ul.no-ip.info udp
ES 94.73.33.36:1338 bl4cks0ul.no-ip.info tcp
ES 94.73.33.36:1338 bl4cks0ul.no-ip.info tcp
ES 94.73.33.36:1338 bl4cks0ul.no-ip.info tcp
US 8.8.8.8:53 bl4cks0ul.no-ip.info udp
ES 94.73.33.36:1338 bl4cks0ul.no-ip.info tcp
ES 94.73.33.36:1338 bl4cks0ul.no-ip.info tcp
ES 94.73.33.36:1338 bl4cks0ul.no-ip.info tcp
US 8.8.8.8:53 bl4cks0ul.no-ip.info udp
ES 94.73.33.36:1338 bl4cks0ul.no-ip.info tcp

Files

memory/2884-0-0x00000000744E1000-0x00000000744E2000-memory.dmp

memory/2884-2-0x00000000744E0000-0x0000000074A8B000-memory.dmp

memory/2884-1-0x00000000744E0000-0x0000000074A8B000-memory.dmp

memory/2912-7-0x0000000000400000-0x00000000004B5000-memory.dmp

memory/2912-8-0x0000000000400000-0x00000000004B5000-memory.dmp

memory/2912-15-0x0000000000400000-0x00000000004B5000-memory.dmp

memory/2912-24-0x0000000000400000-0x00000000004B5000-memory.dmp

memory/2912-21-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/2912-19-0x0000000000400000-0x00000000004B5000-memory.dmp

memory/2912-17-0x0000000000400000-0x00000000004B5000-memory.dmp

memory/2912-13-0x0000000000400000-0x00000000004B5000-memory.dmp

memory/2912-23-0x0000000000400000-0x00000000004B5000-memory.dmp

memory/2912-9-0x0000000000400000-0x00000000004B5000-memory.dmp

memory/2912-11-0x0000000000400000-0x00000000004B5000-memory.dmp

memory/2912-25-0x0000000000400000-0x00000000004B5000-memory.dmp

memory/2912-27-0x0000000000400000-0x00000000004B5000-memory.dmp

memory/2912-28-0x0000000000400000-0x00000000004B5000-memory.dmp

memory/2792-29-0x0000000000090000-0x0000000000091000-memory.dmp

\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

MD5 0279c2146d62cae9662118f4e8800deb
SHA1 8d0da4b751a854bb0d915f3391a4bb90c439b7ed
SHA256 995b97bbe99a22c37fe19b1f2119c652520f2d6871ab4f40dfddddc6bbe85efb
SHA512 259afe5223f2354102fa5c6ebe12d7feb6be5d5039820052d81551e1ddb53308644b6649781b393da79c96c217eade74fc7620f1208bce4dc15b1b44bbac4001

memory/2912-57-0x0000000000400000-0x00000000004B5000-memory.dmp

memory/2912-56-0x0000000000400000-0x00000000004B5000-memory.dmp

memory/2792-55-0x0000000000230000-0x0000000000231000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\winrsmgr.exe

MD5 0529d67672dae586e351a9ee52d41578
SHA1 b0b0f00591e257f0209680e764f3e7a89b6e4783
SHA256 7634a9fc59d55c2c6825af629eec999b3c8f59e1a00eba5afa672c93ce81bba1
SHA512 a6d496ab1df8f0e0d39957b712d3dc93ba95cfa7097e59d54037ed06034e948c61e90c4976e960bf8d7e0247447d2e8ffff20d3f1785add5742686d98886a09b

memory/2884-82-0x00000000744E0000-0x0000000074A8B000-memory.dmp

memory/2912-83-0x0000000000400000-0x00000000004B5000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-20 10:30

Reported

2024-06-20 10:33

Platform

win10v2004-20240611-en

Max time kernel

24s

Max time network

147s

Command Line

"C:\Users\Admin\AppData\Local\Temp\0529d67672dae586e351a9ee52d41578_JaffaCakes118.exe"

Signatures

Darkcomet

trojan rat darkcomet

Renames multiple (147) files with added filename extension

ransomware

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\0529d67672dae586e351a9ee52d41578_JaffaCakes118.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\winrsmgr.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\winrsmgr.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2080 set thread context of 2296 N/A C:\Users\Admin\AppData\Local\Temp\0529d67672dae586e351a9ee52d41578_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 3704 set thread context of 4376 N/A C:\Users\Admin\AppData\Local\Temp\winrsmgr.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe

Enumerates physical storage devices

Checks processor information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe N/A
Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe N/A
Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe N/A
Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe N/A
Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe N/A
Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe N/A
Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe N/A
Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe N/A
Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe N/A
Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe N/A
Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe N/A
Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe N/A
Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe N/A
Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe N/A
Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe N/A
Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe N/A
Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe N/A
Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe N/A
Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe N/A
Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe N/A
Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe N/A
Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe N/A
Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe N/A
Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe N/A
Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe N/A
Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe N/A
Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe N/A
Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe N/A
Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe N/A
Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe N/A
Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe N/A
Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe N/A
Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe N/A
Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe N/A
Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe N/A
Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe N/A
Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe N/A
Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe N/A
Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe N/A
Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe N/A
Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe N/A
Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe N/A
Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe N/A
Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe N/A
Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe N/A
Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe N/A
Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe N/A
Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe N/A
Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe N/A
Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe N/A
Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe N/A
Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe N/A
Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe N/A
Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe N/A
Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\0529d67672dae586e351a9ee52d41578_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0529d67672dae586e351a9ee52d41578_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0529d67672dae586e351a9ee52d41578_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0529d67672dae586e351a9ee52d41578_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0529d67672dae586e351a9ee52d41578_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0529d67672dae586e351a9ee52d41578_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0529d67672dae586e351a9ee52d41578_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0529d67672dae586e351a9ee52d41578_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0529d67672dae586e351a9ee52d41578_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0529d67672dae586e351a9ee52d41578_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0529d67672dae586e351a9ee52d41578_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0529d67672dae586e351a9ee52d41578_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0529d67672dae586e351a9ee52d41578_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0529d67672dae586e351a9ee52d41578_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0529d67672dae586e351a9ee52d41578_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0529d67672dae586e351a9ee52d41578_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0529d67672dae586e351a9ee52d41578_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0529d67672dae586e351a9ee52d41578_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0529d67672dae586e351a9ee52d41578_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0529d67672dae586e351a9ee52d41578_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0529d67672dae586e351a9ee52d41578_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0529d67672dae586e351a9ee52d41578_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0529d67672dae586e351a9ee52d41578_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0529d67672dae586e351a9ee52d41578_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0529d67672dae586e351a9ee52d41578_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\winrsmgr.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0529d67672dae586e351a9ee52d41578_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\winrsmgr.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\winrsmgr.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0529d67672dae586e351a9ee52d41578_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0529d67672dae586e351a9ee52d41578_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\winrsmgr.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0529d67672dae586e351a9ee52d41578_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0529d67672dae586e351a9ee52d41578_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\winrsmgr.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0529d67672dae586e351a9ee52d41578_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0529d67672dae586e351a9ee52d41578_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\winrsmgr.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0529d67672dae586e351a9ee52d41578_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0529d67672dae586e351a9ee52d41578_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0529d67672dae586e351a9ee52d41578_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0529d67672dae586e351a9ee52d41578_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0529d67672dae586e351a9ee52d41578_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0529d67672dae586e351a9ee52d41578_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0529d67672dae586e351a9ee52d41578_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0529d67672dae586e351a9ee52d41578_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0529d67672dae586e351a9ee52d41578_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0529d67672dae586e351a9ee52d41578_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0529d67672dae586e351a9ee52d41578_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\winrsmgr.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\winrsmgr.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0529d67672dae586e351a9ee52d41578_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\winrsmgr.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0529d67672dae586e351a9ee52d41578_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0529d67672dae586e351a9ee52d41578_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\winrsmgr.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0529d67672dae586e351a9ee52d41578_JaffaCakes118.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\0529d67672dae586e351a9ee52d41578_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\winrsmgr.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0529d67672dae586e351a9ee52d41578_JaffaCakes118.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeImpersonatePrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: 33 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: 34 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: 35 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: 36 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\winrsmgr.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeImpersonatePrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: 33 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: 34 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: 35 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe N/A
Token: 36 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2080 wrote to memory of 2296 N/A C:\Users\Admin\AppData\Local\Temp\0529d67672dae586e351a9ee52d41578_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 2080 wrote to memory of 2296 N/A C:\Users\Admin\AppData\Local\Temp\0529d67672dae586e351a9ee52d41578_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 2080 wrote to memory of 2296 N/A C:\Users\Admin\AppData\Local\Temp\0529d67672dae586e351a9ee52d41578_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 2080 wrote to memory of 2296 N/A C:\Users\Admin\AppData\Local\Temp\0529d67672dae586e351a9ee52d41578_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 2080 wrote to memory of 2296 N/A C:\Users\Admin\AppData\Local\Temp\0529d67672dae586e351a9ee52d41578_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 2080 wrote to memory of 2296 N/A C:\Users\Admin\AppData\Local\Temp\0529d67672dae586e351a9ee52d41578_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 2080 wrote to memory of 2296 N/A C:\Users\Admin\AppData\Local\Temp\0529d67672dae586e351a9ee52d41578_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 2080 wrote to memory of 2296 N/A C:\Users\Admin\AppData\Local\Temp\0529d67672dae586e351a9ee52d41578_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 2080 wrote to memory of 2296 N/A C:\Users\Admin\AppData\Local\Temp\0529d67672dae586e351a9ee52d41578_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 2080 wrote to memory of 2296 N/A C:\Users\Admin\AppData\Local\Temp\0529d67672dae586e351a9ee52d41578_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 2080 wrote to memory of 2296 N/A C:\Users\Admin\AppData\Local\Temp\0529d67672dae586e351a9ee52d41578_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 2080 wrote to memory of 2296 N/A C:\Users\Admin\AppData\Local\Temp\0529d67672dae586e351a9ee52d41578_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 2080 wrote to memory of 2296 N/A C:\Users\Admin\AppData\Local\Temp\0529d67672dae586e351a9ee52d41578_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 2080 wrote to memory of 2296 N/A C:\Users\Admin\AppData\Local\Temp\0529d67672dae586e351a9ee52d41578_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 2296 wrote to memory of 228 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\SysWOW64\notepad.exe
PID 2296 wrote to memory of 228 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\SysWOW64\notepad.exe
PID 2296 wrote to memory of 228 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\SysWOW64\notepad.exe
PID 2296 wrote to memory of 228 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\SysWOW64\notepad.exe
PID 2296 wrote to memory of 228 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\SysWOW64\notepad.exe
PID 2296 wrote to memory of 228 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\SysWOW64\notepad.exe
PID 2296 wrote to memory of 228 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\SysWOW64\notepad.exe
PID 2296 wrote to memory of 228 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\SysWOW64\notepad.exe
PID 2296 wrote to memory of 228 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\SysWOW64\notepad.exe
PID 2296 wrote to memory of 228 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\SysWOW64\notepad.exe
PID 2296 wrote to memory of 228 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\SysWOW64\notepad.exe
PID 2296 wrote to memory of 228 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\SysWOW64\notepad.exe
PID 2296 wrote to memory of 228 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\SysWOW64\notepad.exe
PID 2296 wrote to memory of 228 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\SysWOW64\notepad.exe
PID 2296 wrote to memory of 228 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\SysWOW64\notepad.exe
PID 2296 wrote to memory of 228 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\SysWOW64\notepad.exe
PID 2296 wrote to memory of 228 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\SysWOW64\notepad.exe
PID 2296 wrote to memory of 228 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\SysWOW64\notepad.exe
PID 2296 wrote to memory of 228 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\SysWOW64\notepad.exe
PID 2296 wrote to memory of 228 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\SysWOW64\notepad.exe
PID 2296 wrote to memory of 228 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\SysWOW64\notepad.exe
PID 2296 wrote to memory of 228 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\SysWOW64\notepad.exe
PID 2080 wrote to memory of 3344 N/A C:\Users\Admin\AppData\Local\Temp\0529d67672dae586e351a9ee52d41578_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
PID 2080 wrote to memory of 3344 N/A C:\Users\Admin\AppData\Local\Temp\0529d67672dae586e351a9ee52d41578_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
PID 2080 wrote to memory of 3344 N/A C:\Users\Admin\AppData\Local\Temp\0529d67672dae586e351a9ee52d41578_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
PID 3344 wrote to memory of 1032 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
PID 3344 wrote to memory of 1032 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
PID 3344 wrote to memory of 1032 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
PID 3344 wrote to memory of 3704 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe C:\Users\Admin\AppData\Local\Temp\winrsmgr.exe
PID 3344 wrote to memory of 3704 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe C:\Users\Admin\AppData\Local\Temp\winrsmgr.exe
PID 3344 wrote to memory of 3704 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe C:\Users\Admin\AppData\Local\Temp\winrsmgr.exe
PID 2080 wrote to memory of 1664 N/A C:\Users\Admin\AppData\Local\Temp\0529d67672dae586e351a9ee52d41578_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
PID 2080 wrote to memory of 1664 N/A C:\Users\Admin\AppData\Local\Temp\0529d67672dae586e351a9ee52d41578_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
PID 2080 wrote to memory of 1664 N/A C:\Users\Admin\AppData\Local\Temp\0529d67672dae586e351a9ee52d41578_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe
PID 3704 wrote to memory of 4376 N/A C:\Users\Admin\AppData\Local\Temp\winrsmgr.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 3704 wrote to memory of 4376 N/A C:\Users\Admin\AppData\Local\Temp\winrsmgr.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 3704 wrote to memory of 4376 N/A C:\Users\Admin\AppData\Local\Temp\winrsmgr.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 3704 wrote to memory of 4376 N/A C:\Users\Admin\AppData\Local\Temp\winrsmgr.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 3704 wrote to memory of 4376 N/A C:\Users\Admin\AppData\Local\Temp\winrsmgr.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 3704 wrote to memory of 4376 N/A C:\Users\Admin\AppData\Local\Temp\winrsmgr.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 3704 wrote to memory of 4376 N/A C:\Users\Admin\AppData\Local\Temp\winrsmgr.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 3704 wrote to memory of 4376 N/A C:\Users\Admin\AppData\Local\Temp\winrsmgr.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 3704 wrote to memory of 4376 N/A C:\Users\Admin\AppData\Local\Temp\winrsmgr.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 3704 wrote to memory of 4376 N/A C:\Users\Admin\AppData\Local\Temp\winrsmgr.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 3704 wrote to memory of 4376 N/A C:\Users\Admin\AppData\Local\Temp\winrsmgr.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 3704 wrote to memory of 4376 N/A C:\Users\Admin\AppData\Local\Temp\winrsmgr.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 3704 wrote to memory of 4376 N/A C:\Users\Admin\AppData\Local\Temp\winrsmgr.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 3704 wrote to memory of 4376 N/A C:\Users\Admin\AppData\Local\Temp\winrsmgr.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 1664 wrote to memory of 688 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
PID 1664 wrote to memory of 688 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

Processes

C:\Users\Admin\AppData\Local\Temp\0529d67672dae586e351a9ee52d41578_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\0529d67672dae586e351a9ee52d41578_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe

C:\Windows\SysWOW64\notepad.exe

notepad

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 940

C:\Users\Admin\AppData\Local\Temp\winrsmgr.exe

"C:\Users\Admin\AppData\Local\Temp\winrsmgr.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 876

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 876

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 876

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Windows\system32\wbem\wmiprvse.exe

C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 876

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 876

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 876

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 876

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 884

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 876

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 876

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 876

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 876

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 876

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 876

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 876

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 876

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 876

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 836

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 880

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 876

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 876

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 876

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 876

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 876

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 876

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe

C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 876

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 876

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 876

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 876

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 876

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 876

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 876

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 876

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 876

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 876

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 880

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 880

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 876

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 876

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 876

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 876

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 876

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 876

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 880

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 876

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 876

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 872

Network

Country Destination Domain Proto
US 8.8.8.8:53 bl4cks0ul.no-ip.info udp
ES 94.73.33.36:1338 bl4cks0ul.no-ip.info tcp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 73.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 13.107.21.237:443 g.bing.com tcp
US 8.8.8.8:53 205.47.74.20.in-addr.arpa udp
US 8.8.8.8:53 237.21.107.13.in-addr.arpa udp
NL 23.62.61.106:443 www.bing.com tcp
US 8.8.8.8:53 106.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
ES 94.73.33.36:1338 bl4cks0ul.no-ip.info tcp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 34.56.20.217.in-addr.arpa udp
ES 94.73.33.36:1338 bl4cks0ul.no-ip.info tcp
US 8.8.8.8:53 106.90.14.23.in-addr.arpa udp
US 8.8.8.8:53 bl4cks0ul.no-ip.info udp
ES 94.73.33.36:1338 bl4cks0ul.no-ip.info tcp
ES 94.73.33.36:1338 bl4cks0ul.no-ip.info tcp
US 8.8.8.8:53 30.243.111.52.in-addr.arpa udp
ES 94.73.33.36:1338 bl4cks0ul.no-ip.info tcp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 10.27.171.150.in-addr.arpa udp
US 8.8.8.8:53 bl4cks0ul.no-ip.info udp
ES 94.73.33.36:1338 bl4cks0ul.no-ip.info tcp

Files

memory/2080-0-0x00000000753D2000-0x00000000753D3000-memory.dmp

memory/2080-1-0x00000000753D0000-0x0000000075981000-memory.dmp

memory/2080-2-0x00000000753D0000-0x0000000075981000-memory.dmp

memory/2296-8-0x0000000000400000-0x00000000004B5000-memory.dmp

memory/2296-7-0x0000000000400000-0x00000000004B5000-memory.dmp

memory/2296-9-0x0000000000400000-0x00000000004B5000-memory.dmp

memory/2296-10-0x00000000023A0000-0x00000000023A1000-memory.dmp

memory/2296-13-0x0000000000400000-0x00000000004B5000-memory.dmp

memory/2296-12-0x0000000000400000-0x00000000004B5000-memory.dmp

memory/228-11-0x0000000000800000-0x0000000000801000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\networkexplorer.exe

MD5 0279c2146d62cae9662118f4e8800deb
SHA1 8d0da4b751a854bb0d915f3391a4bb90c439b7ed
SHA256 995b97bbe99a22c37fe19b1f2119c652520f2d6871ab4f40dfddddc6bbe85efb
SHA512 259afe5223f2354102fa5c6ebe12d7feb6be5d5039820052d81551e1ddb53308644b6649781b393da79c96c217eade74fc7620f1208bce4dc15b1b44bbac4001

memory/3344-24-0x0000000001320000-0x0000000001330000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\winrsmgr.exe

MD5 0529d67672dae586e351a9ee52d41578
SHA1 b0b0f00591e257f0209680e764f3e7a89b6e4783
SHA256 7634a9fc59d55c2c6825af629eec999b3c8f59e1a00eba5afa672c93ce81bba1
SHA512 a6d496ab1df8f0e0d39957b712d3dc93ba95cfa7097e59d54037ed06034e948c61e90c4976e960bf8d7e0247447d2e8ffff20d3f1785add5742686d98886a09b

C:\ProgramData\Microsoft\Windows\WER\Temp\WER7252.tmp.xml

MD5 67b8223696838620467ac12d47863038
SHA1 f6708360f557aa3815f6c66ea7d3348346216486
SHA256 8de4b8fd8703f4c5f648ef4fe4c0eb3b9ba2d304973852c4ce8aae71fc2c056f
SHA512 4373f7e29c89734b0c68787a0304cb6a53660ec4694701f0a0568b872c50349a812128831d5176ef84b41ad7fa92305dad6b46ac511949f1128105144d8f95af

C:\ProgramData\Microsoft\Windows\WER\Temp\WER74B3.tmp.WERInternalMetadata.xml

MD5 125135413f3d9934a5d38907cb7aa1f3
SHA1 c36ffe3541ee08d9835abacd2b09ba31bd7f3ab5
SHA256 b08d95555dc6003d97e2107b196c765e015f9670e283c0a31528994fefc41b94
SHA512 b400cb5b2069534f3798c2f7c936f633687bf68fa6812429e42592a7b1a81b99d0597e9383fed87967909a39c35df9c8928e3dd273ceca7cb7c0d0bb795310fd

C:\ProgramData\Microsoft\Windows\WER\Temp\WER77D1.tmp.xml

MD5 39ed7417396961deffd0c7d1716ac391
SHA1 add23423382e4b933161b886a654403c355e5a3b
SHA256 a2e586de582da185071e07e331a96d7ff246a4e33fd086a61856858bd4b33a2f
SHA512 12b9923fd669c3d8d7df527ba8f60a4d984a2a1b4010be0de6677a54bd701fd744a7f041a34cde79a1578733d3dc4e37ff976075978ecebe336d06a9c1aa31ec

C:\ProgramData\Microsoft\Windows\WER\Temp\WER7A42.tmp.xml

MD5 a534231932a9ebdcd4345cf446050465
SHA1 5f4206fd5b3fcbf653d1b3ddfe73c759a052aa25
SHA256 9188fac03c91851161b2c243857bd30bd5eab99277b5937f50108173b0c84b77
SHA512 325fb69dbfa161c3e6d5746e3e83890cbb70f80e14a83ea18bcda57bb863d4267adef5c1be7d45f9e39b97965ea165477c8bad82c79f2bdb72f1486fa7efca84

C:\ProgramData\Microsoft\Windows\WER\Temp\WER7B5B.tmp.xml

MD5 c0863804c92a7d759970e71aabe780d1
SHA1 b54aad000c211d2e916c00a0978ff49c8e017256
SHA256 ca2476cc89b278f817ee526ff0eb4a562f8e6c01dd6eea61fcb9ee03804d9d22
SHA512 7790cf1da3d339742e1a0d7b42b548eabd860a93335c6a64197d1ed118182e3bbc4092eedb7697b13cf19480df3dad2d2656aa2a2ff54b525169f578ee1ba0cc

C:\ProgramData\Microsoft\Windows\WER\Temp\WER7DDB.tmp.WERInternalMetadata.xml

MD5 84d69b686a317db37356666b59a00db1
SHA1 ebd664202ea7ba5a4623cbb1e1f418f0c6cf9c6a
SHA256 fb2222cb908c7ad90388386a7e6a1885b37591dce797ebbeefdec86268803bed
SHA512 1baa8de0e6df7272228c722585362b5eaa37b35e6c8a7bb20144c11b089191afabef13bd3d2a6292cb5c676279cfa5e12e0635f75ee619b80401216b8733bdce

C:\ProgramData\Microsoft\Windows\WER\Temp\WER805B.tmp.WERInternalMetadata.xml

MD5 9078cfbe8e5bb07a996758b3c601be00
SHA1 4b5dce6307875356456eeb0177bbdba046f68f4a
SHA256 bf79e406a999e9d3c4026d679720609211768ba6a88169885fe59e0257dea84a
SHA512 1439848b88d2e348d7b6e19a9ab30e591a0961ca755d47d49d0af2fb72cf713fa7c765130d55b18081e3b3dd0516886d564b3bf1692c590fea6bee547cb16d79

memory/2080-681-0x00000000753D2000-0x00000000753D3000-memory.dmp

memory/2080-771-0x00000000753D0000-0x0000000075981000-memory.dmp

memory/1608-928-0x0000000071AA0000-0x0000000071B05000-memory.dmp

memory/1608-2220-0x0000000071AA0000-0x0000000071B05000-memory.dmp

memory/1608-2620-0x0000000071AA0000-0x0000000071B05000-memory.dmp

memory/1608-4097-0x0000000071AA0000-0x0000000071B05000-memory.dmp