Malware Analysis Report

2024-11-13 13:46

Sample ID 240720-vmy5dswbpl
Target CrackLauncher.exe
SHA256 371427ad07be3f9c39773c3c0c4b95c86f63dc2e427835565b159f3686818bd0
Tags
dcrat evasion infostealer rat trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

371427ad07be3f9c39773c3c0c4b95c86f63dc2e427835565b159f3686818bd0

Threat Level: Known bad

The file CrackLauncher.exe was found to be: Known bad.

Malicious Activity Summary

dcrat evasion infostealer rat trojan

UAC bypass

DcRat

Process spawned unexpected child process

DCRat payload

Loads dropped DLL

Checks computer location settings

Executes dropped EXE

Checks whether UAC is enabled

Drops file in Program Files directory

Drops file in Windows directory

Enumerates physical storage devices

Unsigned PE

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

Uses Task Scheduler COM API

Scheduled Task/Job: Scheduled Task

System policy modification

Suspicious behavior: CmdExeWriteProcessMemorySpam

Modifies registry class

Suspicious use of AdjustPrivilegeToken

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-07-20 17:07

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-07-20 17:07

Reported

2024-07-20 17:09

Platform

win7-20240708-en

Max time kernel

53s

Max time network

118s

Command Line

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

Signatures

DcRat

rat infostealer dcrat

Process spawned unexpected child process

Description Indicator Process Target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe

UAC bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\bridgeServercomponentFontDriver\MsHostsvc.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\bridgeServercomponentFontDriver\MsHostsvc.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\bridgeServercomponentFontDriver\MsHostsvc.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\bridgeServercomponentFontDriver\MsHostsvc.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\bridgeServercomponentFontDriver\MsHostsvc.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\bridgeServercomponentFontDriver\MsHostsvc.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\bridgeServercomponentFontDriver\MsHostsvc.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\bridgeServercomponentFontDriver\MsHostsvc.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\bridgeServercomponentFontDriver\MsHostsvc.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\bridgeServercomponentFontDriver\MsHostsvc.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\bridgeServercomponentFontDriver\MsHostsvc.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\bridgeServercomponentFontDriver\MsHostsvc.exe N/A

DCRat payload

rat
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\bridgeServercomponentFontDriver\MsHostsvc.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\bridgeServercomponentFontDriver\MsHostsvc.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\bridgeServercomponentFontDriver\MsHostsvc.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\bridgeServercomponentFontDriver\MsHostsvc.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\bridgeServercomponentFontDriver\MsHostsvc.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\bridgeServercomponentFontDriver\MsHostsvc.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\bridgeServercomponentFontDriver\MsHostsvc.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\bridgeServercomponentFontDriver\MsHostsvc.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\Microsoft Office\Office14\1033\0a1fd5f707cd16 C:\bridgeServercomponentFontDriver\MsHostsvc.exe N/A
File created C:\Program Files (x86)\Windows Photo Viewer\ja-JP\wscript.exe C:\bridgeServercomponentFontDriver\MsHostsvc.exe N/A
File created C:\Program Files (x86)\Windows Photo Viewer\ja-JP\817c8c8ec737a7 C:\bridgeServercomponentFontDriver\MsHostsvc.exe N/A
File opened for modification C:\Program Files\Microsoft Office\Office14\1033\sppsvc.exe C:\bridgeServercomponentFontDriver\MsHostsvc.exe N/A
File created C:\Program Files (x86)\Google\CrashReports\spoolsv.exe C:\bridgeServercomponentFontDriver\MsHostsvc.exe N/A
File created C:\Program Files\Windows Media Player\817c8c8ec737a7 C:\bridgeServercomponentFontDriver\MsHostsvc.exe N/A
File created C:\Program Files\Microsoft Office\Office14\1033\sppsvc.exe C:\bridgeServercomponentFontDriver\MsHostsvc.exe N/A
File created C:\Program Files\Microsoft Office\Office14\1033\0a1fd5f707cd16 C:\bridgeServercomponentFontDriver\MsHostsvc.exe N/A
File opened for modification C:\Program Files\Microsoft Office\Office14\1033\sppsvc.exe C:\bridgeServercomponentFontDriver\MsHostsvc.exe N/A
File created C:\Program Files (x86)\Google\CrashReports\f3b6ecef712a24 C:\bridgeServercomponentFontDriver\MsHostsvc.exe N/A
File created C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\wscript.exe C:\bridgeServercomponentFontDriver\MsHostsvc.exe N/A
File created C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\817c8c8ec737a7 C:\bridgeServercomponentFontDriver\MsHostsvc.exe N/A
File opened for modification C:\Program Files\Microsoft Office\Office14\1033\sppsvc.exe C:\bridgeServercomponentFontDriver\MsHostsvc.exe N/A
File opened for modification C:\Program Files\Microsoft Office\Office14\1033\0a1fd5f707cd16 C:\bridgeServercomponentFontDriver\MsHostsvc.exe N/A
File created C:\Program Files (x86)\Google\CrashReports\spoolsv.exe C:\bridgeServercomponentFontDriver\MsHostsvc.exe N/A
File opened for modification C:\Program Files (x86)\Google\CrashReports\spoolsv.exe C:\bridgeServercomponentFontDriver\MsHostsvc.exe N/A
File opened for modification C:\Program Files (x86)\Google\CrashReports\f3b6ecef712a24 C:\bridgeServercomponentFontDriver\MsHostsvc.exe N/A
File created C:\Program Files\Windows Media Player\wscript.exe C:\bridgeServercomponentFontDriver\MsHostsvc.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\Prefetch\ReadyBoot\817c8c8ec737a7 C:\bridgeServercomponentFontDriver\MsHostsvc.exe N/A
File created C:\Windows\Resources\Ease of Access Themes\dllhost.exe C:\bridgeServercomponentFontDriver\MsHostsvc.exe N/A
File created C:\Windows\Fonts\services.exe C:\bridgeServercomponentFontDriver\MsHostsvc.exe N/A
File created C:\Windows\CSC\v2.0.6\conhost.exe C:\bridgeServercomponentFontDriver\MsHostsvc.exe N/A
File opened for modification C:\Windows\Setup\State\cmd.exe C:\bridgeServercomponentFontDriver\MsHostsvc.exe N/A
File created C:\Windows\Setup\State\ebf1f9fa8afd6d C:\bridgeServercomponentFontDriver\MsHostsvc.exe N/A
File created C:\Windows\Prefetch\ReadyBoot\wscript.exe C:\bridgeServercomponentFontDriver\MsHostsvc.exe N/A
File created C:\Windows\Prefetch\ReadyBoot\817c8c8ec737a7 C:\bridgeServercomponentFontDriver\MsHostsvc.exe N/A
File created C:\Windows\Vss\b125b10b19ba76 C:\bridgeServercomponentFontDriver\MsHostsvc.exe N/A
File created C:\Windows\Setup\State\cmd.exe C:\bridgeServercomponentFontDriver\MsHostsvc.exe N/A
File created C:\Windows\Prefetch\ReadyBoot\wscript.exe C:\bridgeServercomponentFontDriver\MsHostsvc.exe N/A
File created C:\Windows\Fonts\c5b4cb5e9653cc C:\bridgeServercomponentFontDriver\MsHostsvc.exe N/A
File created C:\Windows\Prefetch\55e49458e81f34 C:\bridgeServercomponentFontDriver\MsHostsvc.exe N/A
File created C:\Windows\Vss\íóòèïàõóé.exe C:\bridgeServercomponentFontDriver\MsHostsvc.exe N/A
File opened for modification C:\Windows\Prefetch\ReadyBoot\wscript.exe C:\bridgeServercomponentFontDriver\MsHostsvc.exe N/A
File created C:\Windows\Resources\Ease of Access Themes\5940a34987c991 C:\bridgeServercomponentFontDriver\MsHostsvc.exe N/A
File created C:\Windows\de-DE\wscript.exe C:\bridgeServercomponentFontDriver\MsHostsvc.exe N/A
File created C:\Windows\de-DE\817c8c8ec737a7 C:\bridgeServercomponentFontDriver\MsHostsvc.exe N/A
File created C:\Windows\Prefetch\ReadyBoot\wscript.exe C:\bridgeServercomponentFontDriver\MsHostsvc.exe N/A
File opened for modification C:\Windows\Prefetch\ReadyBoot\wscript.exe C:\bridgeServercomponentFontDriver\MsHostsvc.exe N/A
File opened for modification C:\Windows\Prefetch\ReadyBoot\817c8c8ec737a7 C:\bridgeServercomponentFontDriver\MsHostsvc.exe N/A
File created C:\Windows\servicing\SQM\wscript.exe C:\bridgeServercomponentFontDriver\MsHostsvc.exe N/A
File created C:\Windows\Prefetch\MsHostsvc.exe C:\bridgeServercomponentFontDriver\MsHostsvc.exe N/A

Enumerates physical storage devices

Scheduled Task/Job: Scheduled Task

persistence execution
Description Indicator Process Target
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A

Suspicious behavior: CmdExeWriteProcessMemorySpam

Description Indicator Process Target
N/A N/A C:\Program Files\Microsoft Office\Office14\1033\sppsvc.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\bridgeServercomponentFontDriver\MsHostsvc.exe N/A
N/A N/A C:\bridgeServercomponentFontDriver\MsHostsvc.exe N/A
N/A N/A C:\bridgeServercomponentFontDriver\MsHostsvc.exe N/A
N/A N/A C:\bridgeServercomponentFontDriver\MsHostsvc.exe N/A
N/A N/A C:\bridgeServercomponentFontDriver\MsHostsvc.exe N/A
N/A N/A C:\bridgeServercomponentFontDriver\MsHostsvc.exe N/A
N/A N/A C:\bridgeServercomponentFontDriver\MsHostsvc.exe N/A
N/A N/A C:\bridgeServercomponentFontDriver\MsHostsvc.exe N/A
N/A N/A C:\bridgeServercomponentFontDriver\MsHostsvc.exe N/A
N/A N/A C:\bridgeServercomponentFontDriver\MsHostsvc.exe N/A
N/A N/A C:\bridgeServercomponentFontDriver\MsHostsvc.exe N/A
N/A N/A C:\bridgeServercomponentFontDriver\MsHostsvc.exe N/A
N/A N/A C:\bridgeServercomponentFontDriver\MsHostsvc.exe N/A
N/A N/A C:\bridgeServercomponentFontDriver\MsHostsvc.exe N/A
N/A N/A C:\bridgeServercomponentFontDriver\MsHostsvc.exe N/A
N/A N/A C:\bridgeServercomponentFontDriver\MsHostsvc.exe N/A
N/A N/A C:\bridgeServercomponentFontDriver\MsHostsvc.exe N/A
N/A N/A C:\bridgeServercomponentFontDriver\MsHostsvc.exe N/A
N/A N/A C:\bridgeServercomponentFontDriver\MsHostsvc.exe N/A
N/A N/A C:\bridgeServercomponentFontDriver\MsHostsvc.exe N/A
N/A N/A C:\bridgeServercomponentFontDriver\MsHostsvc.exe N/A
N/A N/A C:\bridgeServercomponentFontDriver\MsHostsvc.exe N/A
N/A N/A C:\bridgeServercomponentFontDriver\MsHostsvc.exe N/A
N/A N/A C:\bridgeServercomponentFontDriver\MsHostsvc.exe N/A
N/A N/A C:\bridgeServercomponentFontDriver\MsHostsvc.exe N/A
N/A N/A C:\bridgeServercomponentFontDriver\MsHostsvc.exe N/A
N/A N/A C:\bridgeServercomponentFontDriver\MsHostsvc.exe N/A
N/A N/A C:\bridgeServercomponentFontDriver\MsHostsvc.exe N/A
N/A N/A C:\bridgeServercomponentFontDriver\MsHostsvc.exe N/A
N/A N/A C:\bridgeServercomponentFontDriver\MsHostsvc.exe N/A
N/A N/A C:\bridgeServercomponentFontDriver\MsHostsvc.exe N/A
N/A N/A C:\bridgeServercomponentFontDriver\MsHostsvc.exe N/A
N/A N/A C:\bridgeServercomponentFontDriver\MsHostsvc.exe N/A
N/A N/A C:\bridgeServercomponentFontDriver\MsHostsvc.exe N/A
N/A N/A C:\bridgeServercomponentFontDriver\MsHostsvc.exe N/A
N/A N/A C:\bridgeServercomponentFontDriver\MsHostsvc.exe N/A
N/A N/A C:\bridgeServercomponentFontDriver\MsHostsvc.exe N/A
N/A N/A C:\bridgeServercomponentFontDriver\MsHostsvc.exe N/A
N/A N/A C:\bridgeServercomponentFontDriver\MsHostsvc.exe N/A
N/A N/A C:\bridgeServercomponentFontDriver\MsHostsvc.exe N/A
N/A N/A C:\bridgeServercomponentFontDriver\MsHostsvc.exe N/A
N/A N/A C:\bridgeServercomponentFontDriver\MsHostsvc.exe N/A
N/A N/A C:\bridgeServercomponentFontDriver\MsHostsvc.exe N/A
N/A N/A C:\bridgeServercomponentFontDriver\MsHostsvc.exe N/A
N/A N/A C:\bridgeServercomponentFontDriver\MsHostsvc.exe N/A
N/A N/A C:\bridgeServercomponentFontDriver\MsHostsvc.exe N/A
N/A N/A C:\bridgeServercomponentFontDriver\MsHostsvc.exe N/A
N/A N/A C:\bridgeServercomponentFontDriver\MsHostsvc.exe N/A
N/A N/A C:\bridgeServercomponentFontDriver\MsHostsvc.exe N/A
N/A N/A C:\bridgeServercomponentFontDriver\MsHostsvc.exe N/A
N/A N/A C:\bridgeServercomponentFontDriver\MsHostsvc.exe N/A
N/A N/A C:\bridgeServercomponentFontDriver\MsHostsvc.exe N/A
N/A N/A C:\bridgeServercomponentFontDriver\MsHostsvc.exe N/A
N/A N/A C:\bridgeServercomponentFontDriver\MsHostsvc.exe N/A
N/A N/A C:\bridgeServercomponentFontDriver\MsHostsvc.exe N/A
N/A N/A C:\bridgeServercomponentFontDriver\MsHostsvc.exe N/A
N/A N/A C:\bridgeServercomponentFontDriver\MsHostsvc.exe N/A
N/A N/A C:\bridgeServercomponentFontDriver\MsHostsvc.exe N/A
N/A N/A C:\bridgeServercomponentFontDriver\MsHostsvc.exe N/A
N/A N/A C:\bridgeServercomponentFontDriver\MsHostsvc.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\bridgeServercomponentFontDriver\MsHostsvc.exe N/A
Token: SeDebugPrivilege N/A C:\bridgeServercomponentFontDriver\MsHostsvc.exe N/A
Token: SeDebugPrivilege N/A C:\bridgeServercomponentFontDriver\MsHostsvc.exe N/A
Token: SeDebugPrivilege N/A C:\bridgeServercomponentFontDriver\MsHostsvc.exe N/A
Token: SeDebugPrivilege N/A C:\bridgeServercomponentFontDriver\MsHostsvc.exe N/A
Token: SeDebugPrivilege N/A C:\bridgeServercomponentFontDriver\MsHostsvc.exe N/A
Token: SeDebugPrivilege N/A C:\bridgeServercomponentFontDriver\MsHostsvc.exe N/A
Token: SeDebugPrivilege N/A C:\bridgeServercomponentFontDriver\MsHostsvc.exe N/A
Token: SeDebugPrivilege N/A C:\bridgeServercomponentFontDriver\MsHostsvc.exe N/A
Token: SeDebugPrivilege N/A C:\bridgeServercomponentFontDriver\MsHostsvc.exe N/A
Token: SeDebugPrivilege N/A C:\bridgeServercomponentFontDriver\MsHostsvc.exe N/A
Token: SeDebugPrivilege N/A C:\bridgeServercomponentFontDriver\MsHostsvc.exe N/A
Token: SeDebugPrivilege N/A C:\bridgeServercomponentFontDriver\MsHostsvc.exe N/A
Token: SeDebugPrivilege N/A C:\bridgeServercomponentFontDriver\MsHostsvc.exe N/A
Token: SeDebugPrivilege N/A C:\bridgeServercomponentFontDriver\MsHostsvc.exe N/A
Token: SeDebugPrivilege N/A C:\bridgeServercomponentFontDriver\MsHostsvc.exe N/A
Token: SeDebugPrivilege N/A C:\bridgeServercomponentFontDriver\MsHostsvc.exe N/A
Token: SeDebugPrivilege N/A C:\bridgeServercomponentFontDriver\MsHostsvc.exe N/A
Token: SeDebugPrivilege N/A C:\bridgeServercomponentFontDriver\MsHostsvc.exe N/A
Token: SeDebugPrivilege N/A C:\bridgeServercomponentFontDriver\MsHostsvc.exe N/A
Token: SeDebugPrivilege N/A C:\bridgeServercomponentFontDriver\MsHostsvc.exe N/A
Token: SeDebugPrivilege N/A C:\bridgeServercomponentFontDriver\MsHostsvc.exe N/A
Token: SeDebugPrivilege N/A C:\bridgeServercomponentFontDriver\MsHostsvc.exe N/A
Token: SeDebugPrivilege N/A C:\bridgeServercomponentFontDriver\MsHostsvc.exe N/A
Token: SeDebugPrivilege N/A C:\bridgeServercomponentFontDriver\MsHostsvc.exe N/A
Token: SeDebugPrivilege N/A C:\bridgeServercomponentFontDriver\MsHostsvc.exe N/A
Token: SeDebugPrivilege N/A C:\bridgeServercomponentFontDriver\MsHostsvc.exe N/A
Token: SeDebugPrivilege N/A C:\bridgeServercomponentFontDriver\MsHostsvc.exe N/A
Token: SeDebugPrivilege N/A C:\bridgeServercomponentFontDriver\MsHostsvc.exe N/A
Token: SeDebugPrivilege N/A C:\bridgeServercomponentFontDriver\MsHostsvc.exe N/A
Token: SeDebugPrivilege N/A C:\bridgeServercomponentFontDriver\MsHostsvc.exe N/A
Token: SeDebugPrivilege N/A C:\bridgeServercomponentFontDriver\MsHostsvc.exe N/A
Token: SeDebugPrivilege N/A C:\bridgeServercomponentFontDriver\MsHostsvc.exe N/A
Token: SeDebugPrivilege N/A C:\bridgeServercomponentFontDriver\MsHostsvc.exe N/A
Token: SeDebugPrivilege N/A C:\bridgeServercomponentFontDriver\MsHostsvc.exe N/A
Token: SeDebugPrivilege N/A C:\bridgeServercomponentFontDriver\MsHostsvc.exe N/A
Token: SeDebugPrivilege N/A C:\bridgeServercomponentFontDriver\MsHostsvc.exe N/A
Token: SeDebugPrivilege N/A C:\bridgeServercomponentFontDriver\MsHostsvc.exe N/A
Token: SeDebugPrivilege N/A C:\bridgeServercomponentFontDriver\MsHostsvc.exe N/A
Token: SeDebugPrivilege N/A C:\bridgeServercomponentFontDriver\MsHostsvc.exe N/A
Token: SeDebugPrivilege N/A C:\bridgeServercomponentFontDriver\MsHostsvc.exe N/A
Token: SeDebugPrivilege N/A C:\bridgeServercomponentFontDriver\MsHostsvc.exe N/A
Token: SeDebugPrivilege N/A C:\bridgeServercomponentFontDriver\MsHostsvc.exe N/A
Token: SeDebugPrivilege N/A C:\bridgeServercomponentFontDriver\MsHostsvc.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Microsoft Office\Office14\1033\sppsvc.exe N/A
Token: SeDebugPrivilege N/A C:\bridgeServercomponentFontDriver\MsHostsvc.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Prefetch\ReadyBoot\wscript.exe N/A
Token: SeDebugPrivilege N/A C:\bridgeServercomponentFontDriver\MsHostsvc.exe N/A
Token: SeDebugPrivilege N/A C:\bridgeServercomponentFontDriver\wscript.exe N/A
Token: SeDebugPrivilege N/A C:\bridgeServercomponentFontDriver\MsHostsvc.exe N/A
Token: SeDebugPrivilege N/A C:\bridgeServercomponentFontDriver\MsHostsvc.exe N/A
Token: SeDebugPrivilege N/A C:\bridgeServercomponentFontDriver\MsHostsvc.exe N/A
Token: SeDebugPrivilege N/A C:\bridgeServercomponentFontDriver\MsHostsvc.exe N/A
Token: SeDebugPrivilege N/A C:\bridgeServercomponentFontDriver\MsHostsvc.exe N/A
Token: SeDebugPrivilege N/A C:\bridgeServercomponentFontDriver\MsHostsvc.exe N/A
Token: SeDebugPrivilege N/A C:\bridgeServercomponentFontDriver\MsHostsvc.exe N/A
Token: SeDebugPrivilege N/A C:\bridgeServercomponentFontDriver\MsHostsvc.exe N/A
Token: SeDebugPrivilege N/A C:\bridgeServercomponentFontDriver\MsHostsvc.exe N/A
Token: SeDebugPrivilege N/A C:\bridgeServercomponentFontDriver\MsHostsvc.exe N/A
Token: SeDebugPrivilege N/A C:\bridgeServercomponentFontDriver\MsHostsvc.exe N/A
Token: SeDebugPrivilege N/A C:\bridgeServercomponentFontDriver\MsHostsvc.exe N/A
Token: SeDebugPrivilege N/A C:\bridgeServercomponentFontDriver\MsHostsvc.exe N/A
Token: SeDebugPrivilege N/A C:\bridgeServercomponentFontDriver\MsHostsvc.exe N/A
Token: SeDebugPrivilege N/A C:\bridgeServercomponentFontDriver\MsHostsvc.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2680 wrote to memory of 2192 N/A C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe
PID 2680 wrote to memory of 2192 N/A C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe
PID 2680 wrote to memory of 2192 N/A C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe
PID 2680 wrote to memory of 2192 N/A C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe
PID 2680 wrote to memory of 2192 N/A C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe
PID 2680 wrote to memory of 2192 N/A C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe
PID 2680 wrote to memory of 2192 N/A C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe
PID 2680 wrote to memory of 1808 N/A C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe
PID 2680 wrote to memory of 1808 N/A C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe
PID 2680 wrote to memory of 1808 N/A C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe
PID 2680 wrote to memory of 1808 N/A C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe
PID 2680 wrote to memory of 1808 N/A C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe
PID 2680 wrote to memory of 1808 N/A C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe
PID 2680 wrote to memory of 1808 N/A C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe
PID 2192 wrote to memory of 2524 N/A C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe
PID 2192 wrote to memory of 2524 N/A C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe
PID 2192 wrote to memory of 2524 N/A C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe
PID 2192 wrote to memory of 2524 N/A C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe
PID 2192 wrote to memory of 2524 N/A C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe
PID 2192 wrote to memory of 2524 N/A C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe
PID 2192 wrote to memory of 2524 N/A C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe
PID 2192 wrote to memory of 2248 N/A C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe
PID 2192 wrote to memory of 2248 N/A C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe
PID 2192 wrote to memory of 2248 N/A C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe
PID 2192 wrote to memory of 2248 N/A C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe
PID 2192 wrote to memory of 2248 N/A C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe
PID 2192 wrote to memory of 2248 N/A C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe
PID 2192 wrote to memory of 2248 N/A C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe
PID 2524 wrote to memory of 2340 N/A C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe
PID 2524 wrote to memory of 2340 N/A C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe
PID 2524 wrote to memory of 2340 N/A C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe
PID 2524 wrote to memory of 2340 N/A C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe
PID 2524 wrote to memory of 2340 N/A C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe
PID 2524 wrote to memory of 2340 N/A C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe
PID 2524 wrote to memory of 2340 N/A C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe
PID 1808 wrote to memory of 2744 N/A C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe C:\Windows\SysWOW64\WScript.exe
PID 1808 wrote to memory of 2744 N/A C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe C:\Windows\SysWOW64\WScript.exe
PID 1808 wrote to memory of 2744 N/A C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe C:\Windows\SysWOW64\WScript.exe
PID 1808 wrote to memory of 2744 N/A C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe C:\Windows\SysWOW64\WScript.exe
PID 1808 wrote to memory of 2744 N/A C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe C:\Windows\SysWOW64\WScript.exe
PID 1808 wrote to memory of 2744 N/A C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe C:\Windows\SysWOW64\WScript.exe
PID 1808 wrote to memory of 2744 N/A C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe C:\Windows\SysWOW64\WScript.exe
PID 2524 wrote to memory of 2868 N/A C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe C:\Windows\SysWOW64\WScript.exe
PID 2524 wrote to memory of 2868 N/A C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe C:\Windows\SysWOW64\WScript.exe
PID 2524 wrote to memory of 2868 N/A C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe C:\Windows\SysWOW64\WScript.exe
PID 2524 wrote to memory of 2868 N/A C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe C:\Windows\SysWOW64\WScript.exe
PID 2524 wrote to memory of 2868 N/A C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe C:\Windows\SysWOW64\WScript.exe
PID 2524 wrote to memory of 2868 N/A C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe C:\Windows\SysWOW64\WScript.exe
PID 2524 wrote to memory of 2868 N/A C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe C:\Windows\SysWOW64\WScript.exe
PID 2248 wrote to memory of 2912 N/A C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe C:\Windows\SysWOW64\WScript.exe
PID 2248 wrote to memory of 2912 N/A C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe C:\Windows\SysWOW64\WScript.exe
PID 2248 wrote to memory of 2912 N/A C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe C:\Windows\SysWOW64\WScript.exe
PID 2248 wrote to memory of 2912 N/A C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe C:\Windows\SysWOW64\WScript.exe
PID 2248 wrote to memory of 2912 N/A C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe C:\Windows\SysWOW64\WScript.exe
PID 2248 wrote to memory of 2912 N/A C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe C:\Windows\SysWOW64\WScript.exe
PID 2248 wrote to memory of 2912 N/A C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe C:\Windows\SysWOW64\WScript.exe
PID 2340 wrote to memory of 2604 N/A C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe
PID 2340 wrote to memory of 2604 N/A C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe
PID 2340 wrote to memory of 2604 N/A C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe
PID 2340 wrote to memory of 2604 N/A C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe
PID 2340 wrote to memory of 2604 N/A C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe
PID 2340 wrote to memory of 2604 N/A C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe
PID 2340 wrote to memory of 2604 N/A C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe
PID 2340 wrote to memory of 2976 N/A C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

System policy modification

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\bridgeServercomponentFontDriver\MsHostsvc.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\bridgeServercomponentFontDriver\MsHostsvc.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\bridgeServercomponentFontDriver\MsHostsvc.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\bridgeServercomponentFontDriver\MsHostsvc.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\bridgeServercomponentFontDriver\MsHostsvc.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\bridgeServercomponentFontDriver\MsHostsvc.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\bridgeServercomponentFontDriver\MsHostsvc.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\bridgeServercomponentFontDriver\MsHostsvc.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\bridgeServercomponentFontDriver\MsHostsvc.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\bridgeServercomponentFontDriver\MsHostsvc.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\bridgeServercomponentFontDriver\MsHostsvc.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\bridgeServercomponentFontDriver\MsHostsvc.exe N/A

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\Windows\system32\conhost.exe

\??\C:\Windows\system32\conhost.exe "-14354155321008134767865152972-598815325-1317719266-524890584193658167534900140"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\Windows\system32\conhost.exe

\??\C:\Windows\system32\conhost.exe "1272652512089450374-1779976591122109876-795176618140263615310582450371536544146"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 9 /tr "'C:\Program Files\Microsoft Office\Office14\1033\sppsvc.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 8 /tr "'C:\Windows\Setup\State\cmd.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 9 /tr "'C:\Program Files\Microsoft Office\Office14\1033\sppsvc.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 9 /tr "'C:\Program Files\Microsoft Office\Office14\1033\sppsvc.exe'" /f

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Program Files\Microsoft Office\Office14\1033\sppsvc.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Program Files\Microsoft Office\Office14\1033\sppsvc.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Program Files\Microsoft Office\Office14\1033\sppsvc.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\Windows\Setup\State\cmd.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 11 /tr "'C:\Windows\Setup\State\cmd.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 10 /tr "'C:\Program Files\Microsoft Office\Office14\1033\sppsvc.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 10 /tr "'C:\Program Files\Microsoft Office\Office14\1033\sppsvc.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 10 /tr "'C:\Program Files\Microsoft Office\Office14\1033\sppsvc.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "wscriptw" /sc MINUTE /mo 12 /tr "'C:\Windows\Prefetch\ReadyBoot\wscript.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "íóòèïàõóéí" /sc MINUTE /mo 14 /tr "'C:\Users\Public\Videos\Sample Videos\íóòèïàõóé.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "wscriptw" /sc MINUTE /mo 12 /tr "'C:\Windows\Prefetch\ReadyBoot\wscript.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "wscriptw" /sc MINUTE /mo 12 /tr "'C:\Windows\Prefetch\ReadyBoot\wscript.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "wscript" /sc ONLOGON /tr "'C:\Windows\Prefetch\ReadyBoot\wscript.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "wscript" /sc ONLOGON /tr "'C:\Windows\Prefetch\ReadyBoot\wscript.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "íóòèïàõóé" /sc ONLOGON /tr "'C:\Users\Public\Videos\Sample Videos\íóòèïàõóé.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "wscriptw" /sc MINUTE /mo 10 /tr "'C:\Windows\Prefetch\ReadyBoot\wscript.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "wscript" /sc ONLOGON /tr "'C:\Windows\Prefetch\ReadyBoot\wscript.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "íóòèïàõóéí" /sc MINUTE /mo 11 /tr "'C:\Users\Public\Videos\Sample Videos\íóòèïàõóé.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "wscriptw" /sc MINUTE /mo 10 /tr "'C:\Windows\Prefetch\ReadyBoot\wscript.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 5 /tr "'C:\bridgeServercomponentFontDriver\audiodg.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 6 /tr "'C:\Windows\Resources\Ease of Access Themes\dllhost.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 5 /tr "'C:\bridgeServercomponentFontDriver\audiodg.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "wscriptw" /sc MINUTE /mo 10 /tr "'C:\Windows\Prefetch\ReadyBoot\wscript.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Windows\Resources\Ease of Access Themes\dllhost.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "audiodg" /sc ONLOGON /tr "'C:\bridgeServercomponentFontDriver\audiodg.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "audiodg" /sc ONLOGON /tr "'C:\bridgeServercomponentFontDriver\audiodg.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 6 /tr "'C:\Windows\Resources\Ease of Access Themes\dllhost.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 11 /tr "'C:\bridgeServercomponentFontDriver\audiodg.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 5 /tr "'C:\bridgeServercomponentFontDriver\audiodg.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 11 /tr "'C:\bridgeServercomponentFontDriver\audiodg.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "audiodg" /sc ONLOGON /tr "'C:\bridgeServercomponentFontDriver\audiodg.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Google\CrashReports\spoolsv.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 10 /tr "'C:\Users\Public\Favorites\conhost.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 14 /tr "'C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\spoolsv.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Program Files (x86)\Google\CrashReports\spoolsv.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 11 /tr "'C:\bridgeServercomponentFontDriver\audiodg.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Google\CrashReports\spoolsv.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\spoolsv.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Users\Public\Favorites\conhost.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Google\CrashReports\spoolsv.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 11 /tr "'C:\Users\Public\Favorites\conhost.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "wscriptw" /sc MINUTE /mo 12 /tr "'C:\Users\Admin\wscript.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 14 /tr "'C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\spoolsv.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Program Files (x86)\Google\CrashReports\spoolsv.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "wscript" /sc ONLOGON /tr "'C:\Users\Admin\wscript.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "servicess" /sc MINUTE /mo 13 /tr "'C:\Windows\Fonts\services.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Windows\Fonts\services.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "explorere" /sc MINUTE /mo 13 /tr "'C:\Users\All Users\Package Cache\explorer.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "wscriptw" /sc MINUTE /mo 9 /tr "'C:\Users\Admin\wscript.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Google\CrashReports\spoolsv.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "servicess" /sc MINUTE /mo 10 /tr "'C:\Windows\Fonts\services.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Users\All Users\Package Cache\explorer.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "wscriptw" /sc MINUTE /mo 12 /tr "'C:\Users\Admin\wscript.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "explorere" /sc MINUTE /mo 12 /tr "'C:\Users\All Users\Package Cache\explorer.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "íóòèïàõóéí" /sc MINUTE /mo 10 /tr "'C:\Users\Admin\AppData\Roaming\Mozilla\íóòèïàõóé.exe'" /f

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "íóòèïàõóé" /sc ONLOGON /tr "'C:\Users\Admin\AppData\Roaming\Mozilla\íóòèïàõóé.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "wscriptw" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\wscript.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "wscript" /sc ONLOGON /tr "'C:\Users\Admin\wscript.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "wscriptw" /sc MINUTE /mo 13 /tr "'C:\bridgeServercomponentFontDriver\wscript.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "íóòèïàõóéí" /sc MINUTE /mo 6 /tr "'C:\Users\Admin\AppData\Roaming\Mozilla\íóòèïàõóé.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "wscript" /sc ONLOGON /tr "'C:\bridgeServercomponentFontDriver\wscript.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "wscript" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\wscript.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "wscriptw" /sc MINUTE /mo 9 /tr "'C:\Users\Admin\wscript.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "wscriptw" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\wscript.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "wscriptw" /sc MINUTE /mo 9 /tr "'C:\bridgeServercomponentFontDriver\wscript.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "íóòèïàõóéí" /sc MINUTE /mo 10 /tr "'C:\Users\Admin\AppData\Roaming\Mozilla\íóòèïàõóé.exe'" /f

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "íóòèïàõóé" /sc ONLOGON /tr "'C:\Users\Admin\AppData\Roaming\Mozilla\íóòèïàõóé.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "MsHostsvcM" /sc MINUTE /mo 10 /tr "'C:\Windows\Prefetch\MsHostsvc.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "íóòèïàõóéí" /sc MINUTE /mo 6 /tr "'C:\Users\Admin\AppData\Roaming\Mozilla\íóòèïàõóé.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "MsHostsvc" /sc ONLOGON /tr "'C:\Windows\Prefetch\MsHostsvc.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "MsHostsvcM" /sc MINUTE /mo 11 /tr "'C:\Windows\Prefetch\MsHostsvc.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "MsHostsvcM" /sc MINUTE /mo 14 /tr "'C:\MSOCache\All Users\MsHostsvc.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "MsHostsvc" /sc ONLOGON /tr "'C:\MSOCache\All Users\MsHostsvc.exe'" /rl HIGHEST /f

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\w1YW8UP1NG.bat"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "MsHostsvcM" /sc MINUTE /mo 11 /tr "'C:\MSOCache\All Users\MsHostsvc.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "íóòèïàõóéí" /sc MINUTE /mo 8 /tr "'C:\Users\All Users\íóòèïàõóé.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "íóòèïàõóé" /sc ONLOGON /tr "'C:\Users\All Users\íóòèïàõóé.exe'" /rl HIGHEST /f

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\w1YW8UP1NG.bat"

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\RxbbScEcUc.bat"

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "íóòèïàõóéí" /sc MINUTE /mo 14 /tr "'C:\Users\All Users\íóòèïàõóé.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "wscriptw" /sc MINUTE /mo 5 /tr "'C:\Windows\de-DE\wscript.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "wscript" /sc ONLOGON /tr "'C:\Windows\de-DE\wscript.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "wscriptw" /sc MINUTE /mo 5 /tr "'C:\Windows\de-DE\wscript.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "MsHostsvcM" /sc MINUTE /mo 14 /tr "'C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\MsHostsvc.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "MsHostsvc" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\MsHostsvc.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "MsHostsvcM" /sc MINUTE /mo 11 /tr "'C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\MsHostsvc.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "wscriptw" /sc MINUTE /mo 7 /tr "'C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\wscript.exe'" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "wscript" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\wscript.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "wscriptw" /sc MINUTE /mo 13 /tr "'C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\wscript.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "wscriptw" /sc MINUTE /mo 7 /tr "'C:\Program Files\Windows Media Player\wscript.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "wscript" /sc ONLOGON /tr "'C:\Program Files\Windows Media Player\wscript.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "wscriptw" /sc MINUTE /mo 12 /tr "'C:\Program Files\Windows Media Player\wscript.exe'" /rl HIGHEST /f

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "wscriptw" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Windows Photo Viewer\ja-JP\wscript.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "wscript" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Photo Viewer\ja-JP\wscript.exe'" /rl HIGHEST /f

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "wscriptw" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Windows Photo Viewer\ja-JP\wscript.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "íóòèïàõóéí" /sc MINUTE /mo 9 /tr "'C:\Windows\Vss\íóòèïàõóé.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "íóòèïàõóé" /sc ONLOGON /tr "'C:\Windows\Vss\íóòèïàõóé.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "íóòèïàõóéí" /sc MINUTE /mo 10 /tr "'C:\Windows\Vss\íóòèïàõóé.exe'" /rl HIGHEST /f

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\mOiugIQtKn.bat"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\Windows\system32\conhost.exe

\??\C:\Windows\system32\conhost.exe "-1142516889-4690471361222705812-18757333271667287967-237753794294121187-1412489812"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\Windows\system32\conhost.exe

\??\C:\Windows\system32\conhost.exe "-572897688-1071271033-168917881316392521781239830340-390831473948204373-1964191024"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\Windows\system32\w32tm.exe

w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2

C:\Windows\system32\w32tm.exe

w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Windows\system32\w32tm.exe

w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\Windows\system32\w32tm.exe

w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\Program Files\Microsoft Office\Office14\1033\sppsvc.exe

"C:\Program Files\Microsoft Office\Office14\1033\sppsvc.exe"

C:\Windows\Prefetch\ReadyBoot\wscript.exe

"C:\Windows\Prefetch\ReadyBoot\wscript.exe"

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\bridgeServercomponentFontDriver\wscript.exe

"C:\bridgeServercomponentFontDriver\wscript.exe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Windows\system32\conhost.exe

\??\C:\Windows\system32\conhost.exe "497489938-1461290047-1891970711-1032562435-9697706291842343234-19844001-552648072"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\Windows\system32\conhost.exe

\??\C:\Windows\system32\conhost.exe "414115021-1923028840491310152-1587525959-15645555018948081842052716838-76495650"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\Windows\system32\conhost.exe

\??\C:\Windows\system32\conhost.exe "-138422705663857730620591649711994786305105619622687570802614321056971776928510"

C:\Windows\system32\conhost.exe

\??\C:\Windows\system32\conhost.exe "-1285564722-1860237338108957085968942292112363574383436053291365576883-1600061446"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\Windows\system32\conhost.exe

\??\C:\Windows\system32\conhost.exe "-442380647849326856-1755530379-936527608-762403082-1266296312-635894013-149828967"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\Windows\system32\conhost.exe

\??\C:\Windows\system32\conhost.exe "-6968059461097054000460173210-1904713231377802209-5586905491194759017-381335977"

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\Windows\system32\conhost.exe

\??\C:\Windows\system32\conhost.exe "-1310653881283198903-983933257522030141008531444-14334360221782380143548955205"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\Windows\system32\conhost.exe

\??\C:\Windows\system32\conhost.exe "-192131022030971942-103495664-1156371492-1012496872-506901048906825322-1573131904"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\Windows\system32\conhost.exe

\??\C:\Windows\system32\conhost.exe "7721241971606183369-2096304830-1654201870-236349218-19953398541036344808556868235"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\Windows\system32\conhost.exe

\??\C:\Windows\system32\conhost.exe "503706140-1331947396-1545589151-1826362846398347815146414232689840724-358294815"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\Windows\system32\conhost.exe

\??\C:\Windows\system32\conhost.exe "-1368237520165161589211191345261587715195-1406454482-1572778550-943053540-828759153"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\Windows\system32\conhost.exe

\??\C:\Windows\system32\conhost.exe "3978109381257476753541041822036745317-2062635881858335141-127587100269620535"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\Windows\system32\conhost.exe

\??\C:\Windows\system32\conhost.exe "1985770815652791157774667564-1083366134-16199549841677755081659504197239584203"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\Windows\system32\conhost.exe

\??\C:\Windows\system32\conhost.exe "-1728616438-2020640340-1202005438-218184906-1348006815-8127174881401662778509394934"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\Windows\system32\conhost.exe

\??\C:\Windows\system32\conhost.exe "1760427014-1940987363-193795435396934168419381880321580743074-14699678791975632068"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\Windows\system32\conhost.exe

\??\C:\Windows\system32\conhost.exe "-1637803711830249203932336967-1683292097-5856692281046381095269273932-1818295147"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\Windows\system32\conhost.exe

\??\C:\Windows\system32\conhost.exe "-90959115520466666942090180328-1391094524-122233796-1884287227602961391305401481"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\Windows\system32\conhost.exe

\??\C:\Windows\system32\conhost.exe "-1122172680-1814863459922464068-1420927875-6447622492136726135-604973791193266530"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\Windows\system32\conhost.exe

\??\C:\Windows\system32\conhost.exe "3997369701751415101641191663-1061173061805988634-406769599-2114106580-266777106"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\Windows\system32\conhost.exe

\??\C:\Windows\system32\conhost.exe "-797831565372769279507599311247188007702536472-624177960634905152-325554025"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

Network

N/A

Files

\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

MD5 90094c2066f9e53cb9217876c833c269
SHA1 da9086b65e114257168e634cc921e1ab1c069144
SHA256 371427ad07be3f9c39773c3c0c4b95c86f63dc2e427835565b159f3686818bd0
SHA512 ef4a15be7efa9ac59c991c64c5afa5fb9e8015334f69e1c64315f788345c456fec5caf58605ccf08afaf16f1a2f7cc2fda1ffd85850d6c2ea268c63efc261aa8

\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

MD5 d80301cde99009a601e22c0f9cb3433a
SHA1 d82a05a75f31ec11ced2f6c5e0b945510dbfcd5a
SHA256 334e48543f8c2d0203135f7820116b676467ae1c1a3d6eabd8b17f96308e5574
SHA512 02b744e15834b654b1d4772d8f2ddc26ca773a9139d9d12fec12c2749e09e69c904014c8464762a7bd97aa8413971193a8c386bb2bfecc14fc8aabd78383888b

C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe

MD5 bd091f4d8a1df91d73b0c65a4ba02330
SHA1 bef757dc154e1d4a0fc91f8ce1e4072c4c12d6df
SHA256 7eeb92d6b5e2faca9ea5763051aac81b7851f4aefe76680ccb25a3aec7e05be2
SHA512 0559ece912e8d3f061e615dd55ced1ddb75c743014b99f4589421c192a4aadf58c41c5b8d72cb96ac3b40f4326e7a7c5791691d557036fb3df2df8f78ff2a98c

memory/1636-76-0x0000000000C20000-0x0000000000EE2000-memory.dmp

memory/2608-77-0x0000000000430000-0x000000000043E000-memory.dmp

memory/1636-78-0x00000000003D0000-0x00000000003EC000-memory.dmp

memory/2608-81-0x00000000004A0000-0x00000000004A8000-memory.dmp

memory/2608-80-0x0000000000480000-0x0000000000496000-memory.dmp

memory/2608-79-0x0000000000470000-0x0000000000478000-memory.dmp

memory/2608-83-0x00000000004D0000-0x00000000004DA000-memory.dmp

memory/2608-82-0x00000000004C0000-0x00000000004D0000-memory.dmp

memory/2608-84-0x0000000000AC0000-0x0000000000B16000-memory.dmp

memory/2568-85-0x0000000000BD0000-0x0000000000C26000-memory.dmp

memory/2608-86-0x00000000004B0000-0x00000000004BC000-memory.dmp

memory/2608-87-0x00000000004E0000-0x00000000004E8000-memory.dmp

memory/1636-90-0x0000000000B40000-0x0000000000B52000-memory.dmp

memory/2608-89-0x0000000000500000-0x0000000000512000-memory.dmp

memory/2608-88-0x00000000004F0000-0x00000000004FC000-memory.dmp

memory/2568-91-0x0000000002320000-0x0000000002332000-memory.dmp

memory/1636-94-0x00000000005A0000-0x00000000005AC000-memory.dmp

memory/1636-93-0x0000000000590000-0x0000000000598000-memory.dmp

memory/1636-92-0x0000000000580000-0x000000000058C000-memory.dmp

memory/2608-96-0x0000000000B70000-0x0000000000B7C000-memory.dmp

memory/2608-95-0x0000000000B60000-0x0000000000B6E000-memory.dmp

C:\Program Files\Microsoft Office\Office14\1033\sppsvc.exe

MD5 a7a6c9f410573c8fbd408170eab6aa33
SHA1 99354c9e2c7fc978abd47e8d2ec1a403bcc5dfd6
SHA256 9d5aaaf2551239a60ec1a383a3512be976cfaa866573e86687c59412ae167974
SHA512 f3dbb349ed88f1d9b7c6d1e0ffc2fa12b3d2f68209eaf97ff8bf4344c5a87e39ba3588584df4b656acdcf1b1526415b0a06e921f405bc836792c9b55a794d6b5

memory/2176-185-0x0000000003650000-0x000000000429A000-memory.dmp

memory/2176-184-0x00000000771D0000-0x00000000772CA000-memory.dmp

memory/2176-183-0x00000000770B0000-0x00000000771CF000-memory.dmp

memory/4848-186-0x0000000000A70000-0x0000000000D32000-memory.dmp

memory/4944-187-0x00000000011D0000-0x0000000001492000-memory.dmp

memory/5080-188-0x0000000000A60000-0x0000000000D22000-memory.dmp

memory/2176-189-0x00000000770B0000-0x00000000771CF000-memory.dmp

memory/2176-191-0x00000000033F0000-0x000000000403A000-memory.dmp

memory/2176-194-0x00000000009A0000-0x0000000000A40000-memory.dmp

memory/2176-193-0x00000000771D0000-0x00000000772CA000-memory.dmp

memory/2176-192-0x00000000770B0000-0x00000000771CF000-memory.dmp

memory/2176-198-0x00000000770B0000-0x00000000771CF000-memory.dmp

memory/2176-199-0x00000000771D0000-0x00000000772CA000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-07-20 17:07

Reported

2024-07-20 17:09

Platform

win10v2004-20240704-en

Max time kernel

4s

Max time network

97s

Command Line

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

Signatures

DcRat

rat infostealer dcrat

Process spawned unexpected child process

Description Indicator Process Target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe

DCRat payload

rat
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe N/A

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000_Classes\Local Settings C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000_Classes\Local Settings C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000_Classes\Local Settings C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000_Classes\Local Settings C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000_Classes\Local Settings C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000_Classes\Local Settings C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000_Classes\Local Settings C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000_Classes\Local Settings C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000_Classes\Local Settings C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000_Classes\Local Settings C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000_Classes\Local Settings C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe N/A

Scheduled Task/Job: Scheduled Task

persistence execution
Description Indicator Process Target
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2936 wrote to memory of 3948 N/A C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe
PID 2936 wrote to memory of 3948 N/A C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe
PID 2936 wrote to memory of 3948 N/A C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe
PID 2936 wrote to memory of 2044 N/A C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe
PID 2936 wrote to memory of 2044 N/A C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe
PID 2936 wrote to memory of 2044 N/A C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe
PID 3948 wrote to memory of 2924 N/A C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe
PID 3948 wrote to memory of 2924 N/A C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe
PID 3948 wrote to memory of 2924 N/A C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe
PID 3948 wrote to memory of 2848 N/A C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe
PID 3948 wrote to memory of 2848 N/A C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe
PID 3948 wrote to memory of 2848 N/A C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe
PID 2924 wrote to memory of 3780 N/A C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe
PID 2924 wrote to memory of 3780 N/A C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe
PID 2924 wrote to memory of 3780 N/A C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe
PID 2044 wrote to memory of 2228 N/A C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe C:\Windows\SysWOW64\WScript.exe
PID 2044 wrote to memory of 2228 N/A C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe C:\Windows\SysWOW64\WScript.exe
PID 2044 wrote to memory of 2228 N/A C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe C:\Windows\SysWOW64\WScript.exe
PID 2924 wrote to memory of 1208 N/A C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe C:\Windows\SysWOW64\WScript.exe
PID 2924 wrote to memory of 1208 N/A C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe C:\Windows\SysWOW64\WScript.exe
PID 2924 wrote to memory of 1208 N/A C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe C:\Windows\SysWOW64\WScript.exe
PID 2848 wrote to memory of 2712 N/A C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe C:\Windows\System32\Conhost.exe
PID 2848 wrote to memory of 2712 N/A C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe C:\Windows\System32\Conhost.exe
PID 2848 wrote to memory of 2712 N/A C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe C:\Windows\System32\Conhost.exe
PID 3780 wrote to memory of 5072 N/A C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe
PID 3780 wrote to memory of 5072 N/A C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe
PID 3780 wrote to memory of 5072 N/A C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe
PID 3780 wrote to memory of 4216 N/A C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe C:\Windows\System32\Conhost.exe
PID 3780 wrote to memory of 4216 N/A C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe C:\Windows\System32\Conhost.exe
PID 3780 wrote to memory of 4216 N/A C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe C:\Windows\System32\Conhost.exe
PID 1208 wrote to memory of 2784 N/A C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe
PID 1208 wrote to memory of 2784 N/A C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe
PID 1208 wrote to memory of 2784 N/A C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe
PID 5072 wrote to memory of 3952 N/A C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe
PID 5072 wrote to memory of 3952 N/A C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe
PID 5072 wrote to memory of 3952 N/A C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe
PID 5072 wrote to memory of 4644 N/A C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe C:\Windows\SysWOW64\WScript.exe
PID 5072 wrote to memory of 4644 N/A C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe C:\Windows\SysWOW64\WScript.exe
PID 5072 wrote to memory of 4644 N/A C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe C:\Windows\SysWOW64\WScript.exe
PID 4216 wrote to memory of 2628 N/A C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe C:\Windows\SysWOW64\WScript.exe
PID 4216 wrote to memory of 2628 N/A C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe C:\Windows\SysWOW64\WScript.exe
PID 4216 wrote to memory of 2628 N/A C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe C:\Windows\SysWOW64\WScript.exe
PID 4644 wrote to memory of 1312 N/A C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe
PID 4644 wrote to memory of 1312 N/A C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe
PID 4644 wrote to memory of 1312 N/A C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe
PID 3952 wrote to memory of 4284 N/A C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe
PID 3952 wrote to memory of 4284 N/A C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe
PID 3952 wrote to memory of 4284 N/A C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe
PID 3952 wrote to memory of 2976 N/A C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe C:\Windows\SysWOW64\cmd.exe
PID 3952 wrote to memory of 2976 N/A C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe C:\Windows\SysWOW64\cmd.exe
PID 3952 wrote to memory of 2976 N/A C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe C:\Windows\SysWOW64\cmd.exe
PID 4284 wrote to memory of 4604 N/A C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe
PID 4284 wrote to memory of 4604 N/A C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe
PID 4284 wrote to memory of 4604 N/A C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe
PID 2976 wrote to memory of 1668 N/A C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe C:\Windows\SysWOW64\WScript.exe
PID 2976 wrote to memory of 1668 N/A C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe C:\Windows\SysWOW64\WScript.exe
PID 2976 wrote to memory of 1668 N/A C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe C:\Windows\SysWOW64\WScript.exe
PID 4284 wrote to memory of 4012 N/A C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe
PID 4284 wrote to memory of 4012 N/A C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe
PID 4284 wrote to memory of 4012 N/A C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe
PID 4604 wrote to memory of 1708 N/A C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe
PID 4604 wrote to memory of 1708 N/A C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe
PID 4604 wrote to memory of 1708 N/A C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe
PID 4604 wrote to memory of 2916 N/A C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

Processes

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\Windows\System32\Conhost.exe

\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "TrustedInstallerT" /sc MINUTE /mo 6 /tr "'C:\Users\All Users\TrustedInstaller.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "TrustedInstaller" /sc ONLOGON /tr "'C:\Users\All Users\TrustedInstaller.exe'" /rl HIGHEST /f

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "TrustedInstallerT" /sc MINUTE /mo 12 /tr "'C:\Users\All Users\TrustedInstaller.exe'" /rl HIGHEST /f

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "smsss" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Windows Photo Viewer\ja-JP\smss.exe'" /f

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Photo Viewer\ja-JP\smss.exe'" /rl HIGHEST /f

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "smsss" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Windows Photo Viewer\ja-JP\smss.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "wscriptw" /sc MINUTE /mo 9 /tr "'C:\Users\All Users\regid.1991-06.com.microsoft\wscript.exe'" /f

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "wscript" /sc ONLOGON /tr "'C:\Users\All Users\regid.1991-06.com.microsoft\wscript.exe'" /rl HIGHEST /f

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "wscriptw" /sc MINUTE /mo 11 /tr "'C:\Users\All Users\regid.1991-06.com.microsoft\wscript.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "wscriptw" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Windows Photo Viewer\it-IT\wscript.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "wscript" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Photo Viewer\it-IT\wscript.exe'" /rl HIGHEST /f

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "wscriptw" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Windows Photo Viewer\it-IT\wscript.exe'" /rl HIGHEST /f

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "TrustedInstallerT" /sc MINUTE /mo 5 /tr "'C:\Program Files\Windows Security\BrowserCore\en-US\TrustedInstaller.exe'" /f

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "TrustedInstaller" /sc ONLOGON /tr "'C:\Program Files\Windows Security\BrowserCore\en-US\TrustedInstaller.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "TrustedInstallerT" /sc MINUTE /mo 14 /tr "'C:\Program Files\Windows Security\BrowserCore\en-US\TrustedInstaller.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 7 /tr "'C:\Program Files\Windows Photo Viewer\ja-JP\conhost.exe'" /f

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Program Files\Windows Photo Viewer\ja-JP\conhost.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 11 /tr "'C:\Program Files\Windows Photo Viewer\ja-JP\conhost.exe'" /rl HIGHEST /f

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "wscriptw" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Windows Mail\wscript.exe'" /f

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "wscript" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Mail\wscript.exe'" /rl HIGHEST /f

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "wscriptw" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Windows Mail\wscript.exe'" /rl HIGHEST /f

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /f

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\Windows\System32\Conhost.exe

\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "wscriptw" /sc MINUTE /mo 12 /tr "'C:\Windows\ShellComponents\wscript.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "wscript" /sc ONLOGON /tr "'C:\Windows\ShellComponents\wscript.exe'" /rl HIGHEST /f

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "wscriptw" /sc MINUTE /mo 13 /tr "'C:\Windows\ShellComponents\wscript.exe'" /rl HIGHEST /f

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\cmd.exe'" /f

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\cmd.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\cmd.exe'" /rl HIGHEST /f

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "wscriptw" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\wscript.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "wscript" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\wscript.exe'" /rl HIGHEST /f

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "wscriptw" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\wscript.exe'" /rl HIGHEST /f

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "wscriptw" /sc MINUTE /mo 8 /tr "'C:\bridgeServercomponentFontDriver\wscript.exe'" /f

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "wscript" /sc ONLOGON /tr "'C:\bridgeServercomponentFontDriver\wscript.exe'" /rl HIGHEST /f

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "wscriptw" /sc MINUTE /mo 9 /tr "'C:\bridgeServercomponentFontDriver\wscript.exe'" /rl HIGHEST /f

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Recovery\WindowsRE\RuntimeBroker.exe

"C:\Recovery\WindowsRE\RuntimeBroker.exe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Windows\System32\Conhost.exe

\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe"

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"

C:\bridgeServercomponentFontDriver\MsHostsvc.exe

"C:\bridgeServercomponentFontDriver\MsHostsvc.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\bridgeServercomponentFontDriver\9qhNErD.bat" "

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

"C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp
US 8.8.8.8:53 0.204.248.87.in-addr.arpa udp
US 8.8.8.8:53 138.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
US 8.8.8.8:53 149.220.183.52.in-addr.arpa udp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
US 8.8.8.8:53 147.142.123.92.in-addr.arpa udp
US 8.8.8.8:53 81.144.22.2.in-addr.arpa udp
US 8.8.8.8:53 73.144.22.2.in-addr.arpa udp
US 8.8.8.8:53 43.229.111.52.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe

MD5 90094c2066f9e53cb9217876c833c269
SHA1 da9086b65e114257168e634cc921e1ab1c069144
SHA256 371427ad07be3f9c39773c3c0c4b95c86f63dc2e427835565b159f3686818bd0
SHA512 ef4a15be7efa9ac59c991c64c5afa5fb9e8015334f69e1c64315f788345c456fec5caf58605ccf08afaf16f1a2f7cc2fda1ffd85850d6c2ea268c63efc261aa8

C:\Users\Admin\AppData\Local\Temp\íóòèïàõóé.exe

MD5 d80301cde99009a601e22c0f9cb3433a
SHA1 d82a05a75f31ec11ced2f6c5e0b945510dbfcd5a
SHA256 334e48543f8c2d0203135f7820116b676467ae1c1a3d6eabd8b17f96308e5574
SHA512 02b744e15834b654b1d4772d8f2ddc26ca773a9139d9d12fec12c2749e09e69c904014c8464762a7bd97aa8413971193a8c386bb2bfecc14fc8aabd78383888b

C:\bridgeServercomponentFontDriver\SND7XTuGR2g.vbe

MD5 bd091f4d8a1df91d73b0c65a4ba02330
SHA1 bef757dc154e1d4a0fc91f8ce1e4072c4c12d6df
SHA256 7eeb92d6b5e2faca9ea5763051aac81b7851f4aefe76680ccb25a3aec7e05be2
SHA512 0559ece912e8d3f061e615dd55ced1ddb75c743014b99f4589421c192a4aadf58c41c5b8d72cb96ac3b40f4326e7a7c5791691d557036fb3df2df8f78ff2a98c

memory/4208-79-0x0000000000470000-0x0000000000732000-memory.dmp

memory/4208-80-0x0000000000EF0000-0x0000000000EFE000-memory.dmp

memory/4208-81-0x0000000002750000-0x000000000276C000-memory.dmp

memory/4208-82-0x000000001B2F0000-0x000000001B340000-memory.dmp

memory/4208-85-0x00000000027A0000-0x00000000027A8000-memory.dmp

memory/4208-86-0x000000001B2A0000-0x000000001B2B0000-memory.dmp

memory/4208-87-0x000000001B2B0000-0x000000001B2BA000-memory.dmp

memory/4208-88-0x000000001BAB0000-0x000000001BB06000-memory.dmp

memory/4208-84-0x0000000002780000-0x0000000002796000-memory.dmp

memory/4208-83-0x0000000002770000-0x0000000002778000-memory.dmp

memory/4208-89-0x000000001B2C0000-0x000000001B2CC000-memory.dmp

memory/4208-90-0x000000001B2D0000-0x000000001B2D8000-memory.dmp

memory/4208-91-0x000000001B2E0000-0x000000001B2EC000-memory.dmp

memory/4208-92-0x000000001B340000-0x000000001B352000-memory.dmp

memory/4208-93-0x000000001C030000-0x000000001C558000-memory.dmp

memory/4208-94-0x000000001B480000-0x000000001B48C000-memory.dmp

memory/4208-97-0x000000001BD10000-0x000000001BD1E000-memory.dmp

memory/4208-98-0x000000001BD20000-0x000000001BD2C000-memory.dmp

memory/4208-96-0x000000001BB00000-0x000000001BB0C000-memory.dmp

memory/4208-95-0x000000001B490000-0x000000001B498000-memory.dmp

C:\Program Files (x86)\Windows Photo Viewer\ja-JP\smss.exe

MD5 a7a6c9f410573c8fbd408170eab6aa33
SHA1 99354c9e2c7fc978abd47e8d2ec1a403bcc5dfd6
SHA256 9d5aaaf2551239a60ec1a383a3512be976cfaa866573e86687c59412ae167974
SHA512 f3dbb349ed88f1d9b7c6d1e0ffc2fa12b3d2f68209eaf97ff8bf4344c5a87e39ba3588584df4b656acdcf1b1526415b0a06e921f405bc836792c9b55a794d6b5