Malware Analysis Report

2024-11-16 12:57

Sample ID 240806-kq7ktsyepb
Target Melted.exe
SHA256 be408485946a15993195ae06b8553a824bd0ed5feec962b2150829a883dd32df
Tags
aspackv2 discovery exploit persistence
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

be408485946a15993195ae06b8553a824bd0ed5feec962b2150829a883dd32df

Threat Level: Known bad

The file Melted.exe was found to be: Known bad.

Malicious Activity Summary

aspackv2 discovery exploit persistence

Modifies WinLogon for persistence

Possible privilege escalation attempt

Loads dropped DLL

ASPack v2.12-2.42

Modifies file permissions

Executes dropped EXE

Enumerates connected drives

Drops desktop.ini file(s)

Drops file in Windows directory

Unsigned PE

Enumerates physical storage devices

System Location Discovery: System Language Discovery

System Network Configuration Discovery: Internet Connection Discovery

Suspicious use of WriteProcessMemory

Kills process with taskkill

Delays execution with timeout.exe

Enumerates system info in registry

Suspicious use of AdjustPrivilegeToken

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-08-06 08:49

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-08-06 08:49

Reported

2024-08-06 08:54

Platform

win10v2004-20240802-en

Max time kernel

16s

Max time network

203s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Melted.exe"

Signatures

Modifies WinLogon for persistence

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "post.exe" C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe," C:\Windows\SysWOW64\reg.exe N/A

Possible privilege escalation attempt

exploit
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\takeown.exe N/A
N/A N/A C:\Windows\SysWOW64\icacls.exe N/A

ASPack v2.12-2.42

aspackv2
Description Indicator Process Target
N/A N/A N/A N/A

Modifies file permissions

discovery
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\takeown.exe N/A
N/A N/A C:\Windows\SysWOW64\icacls.exe N/A

Drops desktop.ini file(s)

Description Indicator Process Target
File created C:\Users\Admin\AppData\Local\Temp\Melted_801ea88e-1ba0-41cb-a952-22f3380e7c3d\RecycleBin\desktop.ini C:\Users\Admin\AppData\Local\Temp\Melted.exe N/A
File opened for modification C:\Users\Admin\Desktop\10455\desktop.ini C:\Windows\SysWOW64\Robocopy.exe N/A
File created C:\Users\Admin\Desktop\2889\desktop.ini C:\Windows\SysWOW64\Robocopy.exe N/A
File created C:\Users\Admin\Desktop\31233\desktop.ini C:\Windows\SysWOW64\Robocopy.exe N/A
File created C:\Users\Admin\Desktop\28742\desktop.ini C:\Windows\SysWOW64\Robocopy.exe N/A
File opened for modification C:\Users\Admin\Desktop\11270\desktop.ini C:\Windows\SysWOW64\Robocopy.exe N/A
File created C:\Users\Admin\Desktop\27307\desktop.ini C:\Windows\SysWOW64\Robocopy.exe N/A
File opened for modification C:\Users\Admin\Desktop\30132\desktop.ini C:\Windows\SysWOW64\Robocopy.exe N/A
File opened for modification C:\Users\Admin\Desktop\28603\desktop.ini C:\Windows\SysWOW64\Robocopy.exe N/A
File opened for modification C:\Users\Admin\Desktop\3870\desktop.ini C:\Windows\SysWOW64\Robocopy.exe N/A
File created C:\Users\Admin\Desktop\23477\desktop.ini C:\Windows\SysWOW64\Robocopy.exe N/A
File created C:\Users\Admin\Desktop\21155\desktop.ini C:\Windows\SysWOW64\Robocopy.exe N/A
File opened for modification C:\Users\Admin\Desktop\8221\desktop.ini C:\Windows\SysWOW64\Robocopy.exe N/A
File created C:\Users\Admin\Desktop\1540\desktop.ini C:\Windows\SysWOW64\Robocopy.exe N/A
File created C:\Users\Admin\Desktop\31865\desktop.ini C:\Windows\SysWOW64\Robocopy.exe N/A
File created C:\Users\Admin\Desktop\1343\desktop.ini C:\Windows\SysWOW64\Robocopy.exe N/A
File created C:\Users\Admin\Desktop\8844\desktop.ini C:\Windows\SysWOW64\Robocopy.exe N/A
File opened for modification C:\Users\Admin\Desktop\28342\desktop.ini C:\Windows\SysWOW64\Robocopy.exe N/A
File created C:\Users\Admin\Desktop\32165\desktop.ini C:\Windows\SysWOW64\Robocopy.exe N/A
File created C:\Users\Admin\Desktop\25204\desktop.ini C:\Windows\SysWOW64\Robocopy.exe N/A
File opened for modification C:\Users\Admin\Desktop\4579\desktop.ini C:\Windows\SysWOW64\Robocopy.exe N/A
File opened for modification C:\Users\Admin\Desktop\12192\desktop.ini C:\Windows\SysWOW64\Robocopy.exe N/A
File opened for modification C:\Users\Admin\Desktop\27307\desktop.ini C:\Windows\SysWOW64\Robocopy.exe N/A
File created C:\Users\Admin\Desktop\4579\desktop.ini C:\Windows\SysWOW64\Robocopy.exe N/A
File created C:\Users\Admin\Desktop\4982\desktop.ini C:\Windows\SysWOW64\Robocopy.exe N/A
File opened for modification C:\Users\Admin\Desktop\29050\desktop.ini C:\Windows\SysWOW64\Robocopy.exe N/A
File opened for modification C:\Users\Admin\Desktop\7555\desktop.ini C:\Windows\SysWOW64\Robocopy.exe N/A
File opened for modification C:\Users\Admin\Desktop\5774\desktop.ini C:\Windows\SysWOW64\Robocopy.exe N/A
File opened for modification C:\Users\Admin\Desktop\25204\desktop.ini C:\Windows\SysWOW64\Robocopy.exe N/A
File created C:\Users\Admin\Desktop\21509\desktop.ini C:\Windows\SysWOW64\Robocopy.exe N/A
File created C:\Users\Admin\Desktop\2942\desktop.ini C:\Windows\SysWOW64\Robocopy.exe N/A
File opened for modification C:\Users\Admin\Desktop\7209\desktop.ini C:\Windows\SysWOW64\Robocopy.exe N/A
File created C:\Users\Admin\Desktop\9627\desktop.ini C:\Windows\SysWOW64\Robocopy.exe N/A
File opened for modification C:\Users\Admin\Desktop\32408\desktop.ini C:\Windows\SysWOW64\Robocopy.exe N/A
File created C:\Users\Admin\Desktop\1356\desktop.ini C:\Windows\SysWOW64\Robocopy.exe N/A
File created C:\Users\Admin\Desktop\19840\desktop.ini C:\Windows\SysWOW64\Robocopy.exe N/A
File opened for modification C:\Users\Admin\Desktop\32165\desktop.ini C:\Windows\SysWOW64\Robocopy.exe N/A
File created C:\Users\Admin\Desktop\25001\desktop.ini C:\Windows\SysWOW64\Robocopy.exe N/A
File opened for modification C:\Users\Admin\Desktop\21393\desktop.ini C:\Windows\SysWOW64\Robocopy.exe N/A
File opened for modification C:\Users\Admin\Desktop\28742\desktop.ini C:\Windows\SysWOW64\Robocopy.exe N/A
File created C:\Users\Admin\Desktop\12265\desktop.ini C:\Windows\SysWOW64\Robocopy.exe N/A
File created C:\Users\Admin\Desktop\7209\desktop.ini C:\Windows\SysWOW64\Robocopy.exe N/A
File created C:\Users\Admin\Desktop\2129\desktop.ini C:\Windows\SysWOW64\Robocopy.exe N/A
File created C:\Users\Admin\Desktop\14378\desktop.ini C:\Windows\SysWOW64\Robocopy.exe N/A
File opened for modification C:\Users\Admin\Desktop\19481\desktop.ini C:\Windows\SysWOW64\Robocopy.exe N/A
File created C:\Users\Admin\Desktop\28603\desktop.ini C:\Windows\SysWOW64\Robocopy.exe N/A
File created C:\Users\Admin\AppData\Local\Temp\Melted_801ea88e-1ba0-41cb-a952-22f3380e7c3d\RecycleBin\Recycle Bin\desktop.ini C:\Users\Admin\AppData\Local\Temp\Melted.exe N/A
File created C:\Users\Admin\Desktop\14919\desktop.ini C:\Windows\SysWOW64\Robocopy.exe N/A
File created C:\Users\Admin\Desktop\12192\desktop.ini C:\Windows\SysWOW64\Robocopy.exe N/A
File opened for modification C:\Users\Admin\Desktop\31233\desktop.ini C:\Windows\SysWOW64\Robocopy.exe N/A
File created C:\Users\Admin\Desktop\14091\desktop.ini C:\Windows\SysWOW64\Robocopy.exe N/A
File opened for modification C:\Users\Admin\Desktop\30483\desktop.ini C:\Windows\SysWOW64\Robocopy.exe N/A
File created C:\Users\Admin\Desktop\30132\desktop.ini C:\Windows\SysWOW64\Robocopy.exe N/A
File opened for modification C:\Users\Admin\Desktop\27571\desktop.ini C:\Windows\SysWOW64\Robocopy.exe N/A
File created C:\Users\Admin\Desktop\27571\desktop.ini C:\Windows\SysWOW64\Robocopy.exe N/A
File created C:\Users\Admin\Desktop\6637\desktop.ini C:\Windows\SysWOW64\Robocopy.exe N/A
File created C:\Users\Admin\Desktop\21393\desktop.ini C:\Windows\SysWOW64\Robocopy.exe N/A
File opened for modification C:\Users\Admin\Desktop\12265\desktop.ini C:\Windows\SysWOW64\Robocopy.exe N/A
File created C:\Users\Admin\Desktop\26351\desktop.ini C:\Windows\SysWOW64\Robocopy.exe N/A
File opened for modification C:\Users\Admin\Desktop\16916\desktop.ini C:\Windows\SysWOW64\Robocopy.exe N/A
File opened for modification C:\Users\Admin\Desktop\28282\desktop.ini C:\Windows\SysWOW64\Robocopy.exe N/A
File opened for modification C:\Users\Admin\Desktop\14378\desktop.ini C:\Windows\SysWOW64\Robocopy.exe N/A
File created C:\Users\Admin\Desktop\3553\desktop.ini C:\Windows\SysWOW64\Robocopy.exe N/A
File created C:\Users\Admin\Desktop\14737\desktop.ini C:\Windows\SysWOW64\Robocopy.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\E: C:\Windows\SysWOW64\mountvol.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\post.exe C:\Windows\SysWOW64\cmd.exe N/A
File opened for modification C:\Windows\post.exe C:\Windows\SysWOW64\cmd.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\taskkill.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\Robocopy.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\Robocopy.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\Robocopy.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\taskkill.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\Robocopy.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\taskkill.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\Robocopy.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\mountvol.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\taskkill.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\taskkill.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\Robocopy.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\taskkill.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\Robocopy.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\Robocopy.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\Robocopy.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\taskkill.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\taskkill.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\Robocopy.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\Robocopy.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\Robocopy.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\taskkill.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\taskkill.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\taskkill.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\taskkill.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\taskkill.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\Robocopy.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\taskkill.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\Robocopy.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\Robocopy.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\taskkill.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\taskkill.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\timeout.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\taskkill.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\Robocopy.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\Melted.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\taskkill.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\Robocopy.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\taskkill.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\Robocopy.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\Robocopy.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\Robocopy.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\taskkill.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\Robocopy.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\Robocopy.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\taskkill.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\taskkill.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\mountvol.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\Robocopy.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\Robocopy.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\taskkill.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\taskkill.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\taskkill.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\taskkill.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\taskkill.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\taskkill.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\taskkill.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\taskkill.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\taskkill.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\taskkill.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\Robocopy.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\xcopy.exe N/A

System Network Configuration Discovery: Internet Connection Discovery

discovery
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A

Delays execution with timeout.exe

evasion
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Enumerates system info in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier C:\Windows\SysWOW64\xcopy.exe N/A

Kills process with taskkill

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A N/A N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A N/A N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A N/A N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A N/A N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A N/A N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A N/A N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\Robocopy.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\Robocopy.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\Robocopy.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\Robocopy.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\Robocopy.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\Robocopy.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\Robocopy.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\Robocopy.exe N/A
Token: 33 N/A C:\Windows\system32\AUDIODG.EXE N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\system32\AUDIODG.EXE N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\Robocopy.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\Robocopy.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\Robocopy.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\Robocopy.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\Robocopy.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\Robocopy.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\Robocopy.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\Robocopy.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\Robocopy.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\Robocopy.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\Robocopy.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\Robocopy.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\Robocopy.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\Robocopy.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\Robocopy.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\Robocopy.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\Robocopy.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\Robocopy.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\Robocopy.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\Robocopy.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\Robocopy.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\Robocopy.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\Robocopy.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\Robocopy.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\Robocopy.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\Robocopy.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\Robocopy.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\Robocopy.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\Robocopy.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\Robocopy.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\Robocopy.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\Robocopy.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\Robocopy.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\Robocopy.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\Robocopy.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\Robocopy.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\Robocopy.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\Robocopy.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\Robocopy.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\Robocopy.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4832 wrote to memory of 3048 N/A C:\Users\Admin\AppData\Local\Temp\Melted.exe C:\Windows\SysWOW64\cmd.exe
PID 4832 wrote to memory of 3048 N/A C:\Users\Admin\AppData\Local\Temp\Melted.exe C:\Windows\SysWOW64\cmd.exe
PID 4832 wrote to memory of 3048 N/A C:\Users\Admin\AppData\Local\Temp\Melted.exe C:\Windows\SysWOW64\cmd.exe
PID 3048 wrote to memory of 372 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 3048 wrote to memory of 372 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 3048 wrote to memory of 372 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 3048 wrote to memory of 776 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\mountvol.exe
PID 3048 wrote to memory of 776 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\mountvol.exe
PID 3048 wrote to memory of 776 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\mountvol.exe
PID 3048 wrote to memory of 2860 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\mountvol.exe
PID 3048 wrote to memory of 2860 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\mountvol.exe
PID 3048 wrote to memory of 2860 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\mountvol.exe
PID 3048 wrote to memory of 2760 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\mountvol.exe
PID 3048 wrote to memory of 2760 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\mountvol.exe
PID 3048 wrote to memory of 2760 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\mountvol.exe
PID 3048 wrote to memory of 3032 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 3048 wrote to memory of 3032 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 3048 wrote to memory of 3032 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 3048 wrote to memory of 2888 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 3048 wrote to memory of 2888 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 3048 wrote to memory of 2888 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 3048 wrote to memory of 2592 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 3048 wrote to memory of 2592 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 3048 wrote to memory of 2592 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 3048 wrote to memory of 5076 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 3048 wrote to memory of 5076 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 3048 wrote to memory of 5076 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 3048 wrote to memory of 4452 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\Melted_801ea88e-1ba0-41cb-a952-22f3380e7c3d\b.exe
PID 3048 wrote to memory of 4452 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\Melted_801ea88e-1ba0-41cb-a952-22f3380e7c3d\b.exe
PID 3048 wrote to memory of 4452 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\Melted_801ea88e-1ba0-41cb-a952-22f3380e7c3d\b.exe
PID 3048 wrote to memory of 2964 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\xcopy.exe
PID 3048 wrote to memory of 2964 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\xcopy.exe
PID 3048 wrote to memory of 2964 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\xcopy.exe
PID 3048 wrote to memory of 3476 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 3048 wrote to memory of 3476 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 3048 wrote to memory of 3476 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 3048 wrote to memory of 1448 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\Melted_801ea88e-1ba0-41cb-a952-22f3380e7c3d\fb.exe
PID 3048 wrote to memory of 1448 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\Melted_801ea88e-1ba0-41cb-a952-22f3380e7c3d\fb.exe
PID 3048 wrote to memory of 1448 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\Melted_801ea88e-1ba0-41cb-a952-22f3380e7c3d\fb.exe
PID 3048 wrote to memory of 4944 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 3048 wrote to memory of 4944 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 3048 wrote to memory of 4944 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 3048 wrote to memory of 1032 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\Melted_801ea88e-1ba0-41cb-a952-22f3380e7c3d\e.exe
PID 3048 wrote to memory of 1032 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\Melted_801ea88e-1ba0-41cb-a952-22f3380e7c3d\e.exe
PID 3048 wrote to memory of 4608 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 3048 wrote to memory of 4608 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 3048 wrote to memory of 4608 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 3048 wrote to memory of 4524 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\Melted_801ea88e-1ba0-41cb-a952-22f3380e7c3d\flash.exe
PID 3048 wrote to memory of 4524 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\Melted_801ea88e-1ba0-41cb-a952-22f3380e7c3d\flash.exe
PID 3048 wrote to memory of 4524 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\Melted_801ea88e-1ba0-41cb-a952-22f3380e7c3d\flash.exe
PID 3048 wrote to memory of 4900 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 3048 wrote to memory of 4900 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 3048 wrote to memory of 4900 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 3048 wrote to memory of 1556 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 3048 wrote to memory of 1556 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 3048 wrote to memory of 1556 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 3048 wrote to memory of 4788 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\Melted_801ea88e-1ba0-41cb-a952-22f3380e7c3d\i.exe
PID 3048 wrote to memory of 4788 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\Melted_801ea88e-1ba0-41cb-a952-22f3380e7c3d\i.exe
PID 3048 wrote to memory of 3440 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\Robocopy.exe
PID 3048 wrote to memory of 3440 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\Robocopy.exe
PID 3048 wrote to memory of 3440 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\Robocopy.exe
PID 3048 wrote to memory of 5068 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\takeown.exe
PID 3048 wrote to memory of 5068 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\takeown.exe
PID 3048 wrote to memory of 5068 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\takeown.exe

Processes

C:\Users\Admin\AppData\Local\Temp\Melted.exe

"C:\Users\Admin\AppData\Local\Temp\Melted.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Melted_801ea88e-1ba0-41cb-a952-22f3380e7c3d\main.bat" "

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im smartscreen.exe

C:\Windows\SysWOW64\mountvol.exe

mountvol D:\ /d

C:\Windows\SysWOW64\mountvol.exe

mountvol E:\ /d

C:\Windows\SysWOW64\mountvol.exe

mountvol F:\ /d

C:\Windows\SysWOW64\reg.exe

reg import desktop.reg

C:\Windows\SysWOW64\reg.exe

reg import fonts.reg

C:\Windows\SysWOW64\reg.exe

reg import logonui.reg

C:\Windows\SysWOW64\reg.exe

reg import winupdate.reg

C:\Users\Admin\AppData\Local\Temp\Melted_801ea88e-1ba0-41cb-a952-22f3380e7c3d\b.exe

b.exe

C:\Windows\SysWOW64\xcopy.exe

xcopy C:\Windows\* C:\Users\Admin\Desktop\* /J /V /C /I /EXCLUDE:explorer.exe

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /K ping.cmd

C:\Users\Admin\AppData\Local\Temp\Melted_801ea88e-1ba0-41cb-a952-22f3380e7c3d\fb.exe

fb.exe

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Users\Admin\AppData\Local\Temp\Melted_801ea88e-1ba0-41cb-a952-22f3380e7c3d\e.exe

e.exe

C:\Windows\SysWOW64\timeout.exe

timeout 2

C:\Users\Admin\AppData\Local\Temp\Melted_801ea88e-1ba0-41cb-a952-22f3380e7c3d\flash.exe

flash.exe

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im explorer.exe

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /K copypastel.cmd

C:\Users\Admin\AppData\Local\Temp\Melted_801ea88e-1ba0-41cb-a952-22f3380e7c3d\i.exe

i.exe

C:\Users\Admin\AppData\Local\Temp\Melted_801ea88e-1ba0-41cb-a952-22f3380e7c3d\sk.exe

sk.exe

C:\Windows\SysWOW64\takeown.exe

takeown C:\Windows\SystemResources\* Admin

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im e.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\14189" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\timeout.exe

timeout 2

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\4579" /is

C:\Windows\system32\AUDIODG.EXE

C:\Windows\system32\AUDIODG.EXE 0x2ec 0x4e8

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\7209" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\8844" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\9627" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\11270" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\8221" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\32408" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\2129" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\30483" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\30132" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\24072" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\4982" /is

C:\Users\Admin\AppData\Local\Temp\Melted_801ea88e-1ba0-41cb-a952-22f3380e7c3d\e.exe

e.exe /min

C:\Windows\SysWOW64\icacls.exe

icacls C:\Windows\SystemResources\* /Grant:Admin

C:\Users\Admin\AppData\Local\Temp\Melted_801ea88e-1ba0-41cb-a952-22f3380e7c3d\g.exe

g.exe

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\18232" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\7049" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\1356" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\2040" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\1478" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\28282" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\10552" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\14919" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\27571" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\14378" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\29059" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\10455" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\19481" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\19840" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\2889" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\8867" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\28342" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\15654" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\19338" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\32165" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\31338" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\3595" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\25001" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\23903" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\28603" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\3553" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\6637" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\2390" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\13140" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\12192" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\12291" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\21393" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\10369" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\31233" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\12667" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\3870" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\23477" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\1540" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\28742" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\5774" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\15621" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\3435" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\1343" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\25204" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\27307" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\2364" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\25247" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\12265" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\2947" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\24643" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\30343" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\14091" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\14737" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\9614" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\23929" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\29050" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\31865" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\26351" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\9439" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\28889" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\21509" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\2942" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\7555" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\17747" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\21155" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\16916" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\15894" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\29715" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\18405" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\32721" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\5546" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\32203" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\31487" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\3734" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\20023" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\29998" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\30028" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\11148" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\16153" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\9590" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\23753" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\13723" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\3984" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\18655" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\24217" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\27636" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\26943" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\20266" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\10623" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\15496" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\15021" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\13339" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\30823" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\8846" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\2504" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\26107" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\11485" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\5377" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\22109" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\15383" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\31124" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\1311" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\3233" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\32063" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\7393" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\27884" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\1963" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\30279" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\11070" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\28077" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\9207" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\8329" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\27080" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\32365" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\25061" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\22626" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\14528" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\10876" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\6200" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\9137" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\3597" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\24554" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\13976" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\2139" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\32697" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\19984" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\6160" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\29385" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\24176" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\21512" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\26000" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\11368" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\24580" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\32560" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\2156" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\25128" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\23020" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\6572" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\11484" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\15102" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\3008" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\18657" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\21626" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\32355" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\31166" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\15354" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\30919" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\19154" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\22344" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\27238" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\15782" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\23630" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\356" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\25175" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\13279" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\25305" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\2363" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\10053" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\11165" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\26878" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\20122" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\8298" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\5872" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\19016" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\10868" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\5956" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\31820" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\14792" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\10590" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\17942" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\30984" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\22676" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\22034" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\30310" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\21473" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\23618" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\5101" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\12160" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\8053" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\17777" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\2417" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\29938" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\27848" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\9793" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\6851" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\5391" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\3521" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\30934" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\29741" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\1900" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\26542" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\1497" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\9373" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\23398" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\21948" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\23286" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\18469" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\13977" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\7040" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\20831" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\17017" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\25450" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\26482" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\9287" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\2420" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\28543" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\25964" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\5992" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\32660" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\23105" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\24879" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\11646" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\24185" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\21345" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\30942" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\28362" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\12650" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\2384" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\24449" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\16272" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\24528" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\1989" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\12163" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\18074" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\18360" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\9788" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\19764" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\25522" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\26709" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\1649" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\22856" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\13867" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\7292" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\8937" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\13143" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\13145" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\25895" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\28009" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\3163" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\19732" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\17395" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\32124" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\2357" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\10298" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\9634" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\20210" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\29992" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\25386" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\23705" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\4188" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\1116" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\27721" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\11107" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\401" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\9820" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\26753" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\24364" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\25132" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\26777" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\10685" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\31302" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\28683" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\26853" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\13678" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\28328" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\30162" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\22520" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\23305" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\26730" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\26982" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\3055" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\23175" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\10315" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\6770" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\8904" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\6884" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\28203" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\28901" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\13543" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\28832" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\29585" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\15218" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\6036" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\29761" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\30246" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\3599" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\12154" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\26830" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\21047" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\12406" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\21290" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\12886" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\11575" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\7335" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\15766" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\23655" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\12348" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\3429" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\4246" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\12440" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\21117" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\7348" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\26471" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\23807" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\13274" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\29281" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\31015" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\10939" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\1876" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\634" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\19290" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\17516" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\3473" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\23506" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\29800" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\3254" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\8025" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\1663" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\28188" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\1218" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\18459" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\29275" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\30759" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\17085" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\28777" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\30086" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\2715" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\30807" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\6264" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\23266" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\22640" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\2372" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\8865" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\150" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\25091" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\12734" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\11746" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\1675" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\6034" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\15618" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\94" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\3314" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\3009" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\19407" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\473" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\700" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\13848" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\10986" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\17981" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\1057" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\17794" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\14748" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\10263" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\18714" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\720" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\24626" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\29467" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\9191" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\17204" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\5756" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\7836" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\3978" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\27335" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\31311" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\6164" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\20041" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\32515" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\30211" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\7587" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\6192" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\18761" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\30454" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\10375" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\22924" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\2396" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\13319" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\26537" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\369" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\14308" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\1052" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\18960" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\24629" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\22765" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\17564" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\6508" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\5619" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\24165" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\20470" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\9356" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\4362" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\6818" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\1048" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\31208" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\7323" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\17113" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\22776" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\12824" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\32527" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\424" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\1807" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\19035" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\10382" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\6541" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\15833" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\3857" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\29064" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\5996" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\27222" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\5697" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\26928" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\5389" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\3468" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\18965" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\13308" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\2972" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\8963" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\856" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\31271" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\13863" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\5959" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\13311" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\26159" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\1059" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\20074" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\8605" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\13143" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\7144" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\14976" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\12269" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\19494" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\27953" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\545" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\15180" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\30951" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\21405" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\14058" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\828" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\7719" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\18736" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\7163" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\9442" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\2873" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\10450" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\31867" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\9609" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\22709" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\207" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\4624" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\3357" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\22261" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\30037" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\31591" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\4273" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\3223" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\13049" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\17074" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\19706" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\17662" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\28979" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\29733" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\4305" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\11985" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\1246" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\17528" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\14261" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\2682" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\697" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\18281" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\5190" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\26791" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\29160" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\13879" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\27339" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\30925" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\3699" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\17959" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\31661" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\26528" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\7110" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\3843" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\7674" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\19869" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\18223" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\406" /is

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\SysWOW64\Robocopy.exe

robocopy RecycleBin "C:\Users\Admin\Desktop\27108" /is

Network

Country Destination Domain Proto
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
US 8.8.8.8:53 77.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 67.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 23.236.111.52.in-addr.arpa udp

Files

memory/4832-0-0x000000007476E000-0x000000007476F000-memory.dmp

memory/4832-1-0x0000000000AF0000-0x0000000000B7C000-memory.dmp

memory/4832-2-0x0000000001680000-0x00000000016A4000-memory.dmp

memory/4832-3-0x0000000074760000-0x0000000074F10000-memory.dmp

memory/4832-4-0x0000000005CB0000-0x0000000006254000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Melted_801ea88e-1ba0-41cb-a952-22f3380e7c3d\main.bat

MD5 379192a5d3407b6a40cdc0952c7965ba
SHA1 fc3a55670990e1a666a36f5676d87a20b52c496e
SHA256 20c8ee16a2da0fd4433383d9b7339dd81c758c860c59c45d6352dba4d9261c81
SHA512 893205ab22726e0207fbcd53a5df5978f688f74303ddf57f7ecdd2f6b1f74230a491b1cc75b14ebe2553e14c1f5e14ec0260442c5e88af54a3b91bcfdf6ccd5d

C:\Users\Admin\AppData\Local\Temp\Melted_801ea88e-1ba0-41cb-a952-22f3380e7c3d\post.exe

MD5 b617ca8ffc46adea00015b982a2f6dac
SHA1 f31fae3406e4c1f4640310858c279ce9ed3deae6
SHA256 3a4042af640fd28dfd1fdad170af5c01c2df65fdc5bd2766cba8b3340958409a
SHA512 253f709c0e3a08132b51381f622caad791a908aa40d1678fb6e586185d523d5eaeddd68bf095de5a6b7ada65fcae5b763d91c0669ab6ad573ec5b152a80892e4

C:\Users\Admin\AppData\Local\Temp\Melted_801ea88e-1ba0-41cb-a952-22f3380e7c3d\desktop.reg

MD5 6bc57fa8fb4a2814c99ea72bc6c4c2b1
SHA1 c881f1a7965846d3e554ff1709553d2c8ed14043
SHA256 d0f2a2e83bdd0df4820733f8a0708ad647fc1febd3c4eb6936f6e0290fe0be0a
SHA512 dd12e946a0a6f84c49306647453898500017c730af4bb47d51ab39343a275f7d5f117326adc2bd25c98231cbdf3097109fd286da756201e60206fffac6331a70

C:\Users\Admin\AppData\Local\Temp\Melted_801ea88e-1ba0-41cb-a952-22f3380e7c3d\fonts.reg

MD5 37c8a133cc59f9cf21424fa3be153ee4
SHA1 1c7bab80249f7c9b3cc2932fe27f0c1cd32f29d2
SHA256 0455aaa368bd1fcf95c519425f876706144d2822b91730c9255989c80ef34b5a
SHA512 ceffa6c04357a3175dca6f08e69d7ccd2fa4da48a8e9a01907df2a0a0bc5d8caba0042fb1f55436ecf41839601c8a44b1ec6037575e707d8ea2d6356fc6d6d4f

C:\Users\Admin\AppData\Local\Temp\Melted_801ea88e-1ba0-41cb-a952-22f3380e7c3d\logonui.reg

MD5 bac89e8765bd09712ac6bdd698342e4a
SHA1 be1970d5aea9f3956fa9ccea443c88d0893732b1
SHA256 77857c72cff683ed1f3850fd004f739b0de5a8a10a132d7dbe72d07682d96244
SHA512 f71141e4eeaabbe20a3a91577ab6a53d9a823fd5147099755407aec9d6c882e30af90cb55fd02dfa95d72ffd55b6d6259bc6df701e0051255cbd5202d0a2332a

C:\Users\Admin\AppData\Local\Temp\Melted_801ea88e-1ba0-41cb-a952-22f3380e7c3d\winupdate.reg

MD5 9bad97ae7f640e56717304a068504ef6
SHA1 2fd3fffeee98b90597cb650298732391739ed374
SHA256 6ac6ec6b68cdb64086e404df7c109d2dceb8af21965141fb45f428e83ff192f1
SHA512 4ba567e480dc2bca1cf682f212e6ff1fe75a1f108ce72d70aca6f25ed4d5b4a76c928920862d2c4572b11916abaa83886c18e4f1df1e6556890cdaa84c11a478

C:\Users\Admin\AppData\Local\Temp\Melted_801ea88e-1ba0-41cb-a952-22f3380e7c3d\b.exe

MD5 404f9af788af52e74bf0f55edcd92b87
SHA1 17f4becaccaf6868bf5783caf7f88b1b6dc13a32
SHA256 db842ba93967f1637597713b9a0a20c4c98d12bf0556413cba26a3f7379b03e0
SHA512 e108ccbe0bf99478e1b6bd22bd208af8f90378e0e4db2aebe7d5b03dd5e8f679d2eb7e1649779753390a44a204f74a3a1a1f5572f3a77760f5bf62052b2da1ae

C:\Users\Admin\AppData\Local\Temp\Melted_801ea88e-1ba0-41cb-a952-22f3380e7c3d\fb.exe

MD5 fa7cd30068f56e079841e36d16bce5c4
SHA1 49237ab087b28847eb1a01eb699ee99093df6afa
SHA256 c62d2a4ac688ed3972dbb663d2d54c996895d9a3efc4eacc21eb9e2cf02e7cb9
SHA512 a10534f16a2f0b6d0ace630d7b391a37c7fd7d6dd9e98245d5ec6aaf83935046732cadfc21133e0f2b484c1ca0959e16ce8e6f70e15278fd4d39a4950f03611f

C:\Users\Admin\AppData\Local\Temp\Melted_801ea88e-1ba0-41cb-a952-22f3380e7c3d\ping.cmd

MD5 6af387fe39e874c82157ca8aba697458
SHA1 ea9487f8f1c3d19be955a78a909911aac566ef2b
SHA256 fe38147b0ea25ace8e7397075fb827ba0f9e7d17e207800ea3e5f875913aaa9d
SHA512 7b03f3cf898b359c9c4ac5ad86949732627257ce39326332d8702fa99072d2c620d6d82f5d9f81e29adb9cb252d24904839dc470c5c764cfacfdf963e7121799

C:\Users\Admin\AppData\Local\Temp\Melted_801ea88e-1ba0-41cb-a952-22f3380e7c3d\e.exe

MD5 c085484b593c7089907af551de309a05
SHA1 f503ae9f559fd76073578686d2193a6956747fea
SHA256 b78b116d79d8f9613510dbde5aa4a8ca59913ee32df540d06defa214489972d2
SHA512 72b458179362a1bb2888213736e5731d0bafe094feaac11a44e78f7a5ed60a4d6f275aa32bbce41950852a31bc55ce19266f26cd3e66bec9f35dc5aafe97fba1

C:\Users\Admin\AppData\Local\Temp\Melted_801ea88e-1ba0-41cb-a952-22f3380e7c3d\VCRUNTIME140D.dll

MD5 ee7fbf8768a87ea64ad4890540ce48f9
SHA1 bcbc1ebd5a592c2df216d3211f309a79f9cd8a9b
SHA256 03eafdf65d672994e592b8acc8a1276ccae1218a5cb9685b9aa6a5ffe1a855fe
SHA512 0cbf346d46b5c0b09c1f3fb4837c8df662bf0c69de8c4ae292b994ec156c91b78dbaad733226d765b1ca3ee1695566dc90bf85086e438fa15b9eb32058abce80

C:\Users\Admin\AppData\Local\Temp\Melted_801ea88e-1ba0-41cb-a952-22f3380e7c3d\ucrtbased.dll

MD5 c3130cfb00549a5a92da60e7f79f5fc9
SHA1 56c2e8fb1af609525b0f732bb67b806bddab3752
SHA256 eee42eabc546e5aa760f8df7105fcf505abffcb9ec4bf54398436303e407a3f8
SHA512 29bab5b441484bdfac9ec21cd4f0f7454af05bfd7d77f7d4662aeaeaa0d3e25439d52aa341958e7896701546b4a607d3c7a32715386c78b746dfae8529a70748

memory/1032-65-0x00007FF6738D0000-0x00007FF6738F6000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Melted_801ea88e-1ba0-41cb-a952-22f3380e7c3d\flash.exe

MD5 9254ca1da9ff8ad492ca5fa06ca181c6
SHA1 70fa62e6232eae52467d29cf1c1dacb8a7aeab90
SHA256 30676ad5dc94c3fec3d77d87439b2bf0a1aaa7f01900b68002a06f11caee9ce6
SHA512 a84fbbdea4e743f3e41878b9cf6db219778f1479aa478100718af9fc8d7620fc7a3295507e11df39c7863cb896f946514e50368db480796b6603c8de5580685a

C:\Users\Admin\AppData\Local\Temp\Melted_801ea88e-1ba0-41cb-a952-22f3380e7c3d\i.exe

MD5 cea5426da515d43c88132a133f83ce68
SHA1 0c224d0bb777f1e3b186fdf58cc82860d96805cc
SHA256 2be7a0865ded1c0bd1f92d5e09bb7b37a9e36a40487a687e0359c93878611a78
SHA512 4c1f25147222c84dff513bebf00e828719454ad634ef9380cfc7835f0457a718b4b437ecb60c1fa72a7f83fbb67e1ddfcd225194eedda77034c72f8c752c642c

C:\Users\Admin\AppData\Local\Temp\Melted_801ea88e-1ba0-41cb-a952-22f3380e7c3d\sk.exe

MD5 cea26a633f1f3fd621382dad166466d8
SHA1 82d4d90bb6782b0c72deec431a3377e30d34c3e8
SHA256 00e030cb6b6f2fb7b3636f500f60492765363a661e4d7317278c0bbed5689441
SHA512 5244a41121002f8e6c7082d0e4114d74a4fe527b9585adc751bf8d590860057eaf9129bd1dfc070c630f19ef4eac1fb4bcfc25675608fb007b3699c963b0176a

C:\Users\Admin\AppData\Local\Temp\Melted_801ea88e-1ba0-41cb-a952-22f3380e7c3d\copypastel.cmd

MD5 22276a82790d962885ed81f4afaa12e3
SHA1 fbd254c68e04eae009e4bdf718332d01c18087c7
SHA256 8e0bcb5e46f121e9389c5312b4028b7a951e3d695365dc45884a5b756405b61f
SHA512 c089f5388b18753200c7c83a63b7507a5ed608e6e3a8334fe4b92c7d86c20c14adfef950c43c52c1b570a3fe5a8b0583856511543ef1a863bdf0fcafa02222b0

C:\Users\Admin\AppData\Local\Temp\Melted_801ea88e-1ba0-41cb-a952-22f3380e7c3d\RecycleBin\desktop.ini

MD5 0b95bbe6e14257a6af62cf912ac723dc
SHA1 7995e2b5fb5c2c758161e04000bc8af4e1294374
SHA256 3ecbc30bfba5ba7ad0d335aefa251e4efcdc3c7d7919ac55600fd40147b91062
SHA512 1c5ef8250d01d1b9ef41529071610a671f228996e0dec1efd6b1eeb1e5ca02fe684ed9857a9958e32b40470561f042709c7f43b8bae36379131737f39cfb7bd1

memory/1032-83-0x00007FF6738D0000-0x00007FF6738F6000-memory.dmp

memory/3344-110-0x00007FF6738D0000-0x00007FF6738F6000-memory.dmp

memory/2840-116-0x00007FF635530000-0x00007FF635556000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Melted_801ea88e-1ba0-41cb-a952-22f3380e7c3d\g.exe

MD5 ea64d01d756080b86e8e5af63ed6eb50
SHA1 008634fbd4cd348165dbe540ea529f27bd39e5c0
SHA256 35fc36cdd77b1eae66fd02fec2f47cf06841365f6ab66160ed8cf522d71355f7
SHA512 7e7046017eb32e804fb213070997ef228a12426e0f157e959a97a4e27f816eb66b365850cc18ae8573519623db354740d7c008c09734f404d31775e79ead2bb0

memory/4524-230-0x0000000000400000-0x00000000004A4000-memory.dmp

memory/4832-303-0x000000007476E000-0x000000007476F000-memory.dmp

memory/4832-342-0x0000000074760000-0x0000000074F10000-memory.dmp

memory/4524-896-0x0000000000400000-0x00000000004A4000-memory.dmp

memory/1176-1583-0x00007FF6E71B0000-0x00007FF6E71D7000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Melted_801ea88e-1ba0-41cb-a952-22f3380e7c3d\t.exe

MD5 9e0c60453cdea093fa4c6762f9b1fda9
SHA1 02dfa74e42739c4e8a9a0534273f6a89b51f1dd3
SHA256 269c6da90935306778f4f76005d1f00b49703f8819b60e2764cc14a5abc9a781
SHA512 fc499cb6b98529c7a856c9ec7198f2a6d00d0c0d6b16e826913ab8dca2602f6700e3956749d3316484b94e6867f54cf99aa77f23375ea6c5ea75daa88c91aa96

C:\Users\Admin\AppData\Local\Temp\Melted_801ea88e-1ba0-41cb-a952-22f3380e7c3d\boohoo.cmd

MD5 d53097e0265a7589f56bfd43c2ab92d6
SHA1 c5cefc1eed9bd1eff1c32aca735af24135a1bd99
SHA256 28ef22b5677f5523a8852966999f2e1decd7ccf21d14e65dea0d168d460b450c
SHA512 9222dab4590a7d954b8852b3ac22d7bb30c6d4b563ba02003e95d30c16811048961ef757e5ad5ffe5a1c401509c16e99737215a5620702fb47fe217ea0f69445

C:\Users\Admin\AppData\Local\Temp\Melted_801ea88e-1ba0-41cb-a952-22f3380e7c3d\causeErr1.vbs

MD5 781df8e151e1d1bb97b691bc81a2619a
SHA1 cdd28747902e08da1656bb764d4d06f773c0eb2b
SHA256 754bc078439d3b70d46b1a3482d1f359757dd5937d5f1874754f4c8128a6f0da
SHA512 b7368b8c44a826c769d8a79b4ed2c6eab82acbc965ea52c85f60bfdfe125a60285df5e35587700ba22829d26295d11a9b2d9f959ca974d3520274937a3383bd4

C:\Users\Admin\AppData\Local\Temp\Melted_801ea88e-1ba0-41cb-a952-22f3380e7c3d\causeErr2.vbs

MD5 d86806b3929e8deb8ab3af50ff31983a
SHA1 f038800743d28f70962acda6281bbdc5a5f0fca4
SHA256 18ff5d475bb345af4c5390ff5ab5cc0fae2dd1da9e00c7a2d169463c79d9a6ab
SHA512 642d2c2a7c506e4bb8f61d4235fa5b0f411bd43e4cc0c4ab758a292c1fd684533ad1bf89a18b0013383f311095057670fe8ea3b9d0eb5f5a115492041e6d98a5

C:\Users\Admin\AppData\Local\Temp\Melted_801ea88e-1ba0-41cb-a952-22f3380e7c3d\sk2.exe

MD5 4fa84323d9988c8ce77d9f3eee327808
SHA1 5b475529847b707791b18e621337bee880ee9dc6
SHA256 e7dd38f8d0126e13b8d86659f62bda9aa9b50ac6451b1d5c4dab445385757b89
SHA512 4154063d92c06c7789359f416a6754c8edbbd08e58633c487a5826c614411a40038d01c65b94b49189d8a4689e25f0b0595a9be662e953bd8fec434a6f02d2f5

C:\Users\Admin\AppData\Local\Temp\Melted_801ea88e-1ba0-41cb-a952-22f3380e7c3d\sk3.exe

MD5 4dd87b1eb9e6ab5cadafa876917f34aa
SHA1 e46c529797a14acd0dc135ccf0b0144acc53e53b
SHA256 57509b4f3ec7b6aa07c4a42ad140d6d1a754a267d53b6fc539fa73c24da792c3
SHA512 55cc6467b1786d08c12a41db5d205774a489b4522965932a126d1bf1a628f72129a843c380272f01bfe68e861ed829dffa537bd4527d0fdbe2ff8c9188ca9515

memory/7536-1646-0x00007FF6738D0000-0x00007FF6738F6000-memory.dmp

memory/13316-1695-0x00007FF79E320000-0x00007FF79E349000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Melted_801ea88e-1ba0-41cb-a952-22f3380e7c3d\g_.exe

MD5 3cb72c753dd5e198792d1e0be81f7e2b
SHA1 8a55b72a998bf8362a12f68ee8c4801a5a24754c
SHA256 be9d8772b360ca8054929e5f057413b69932ca8e521e6c696e0fb6b371e8cb97
SHA512 008ed2e26fb4f41e9bb245130cc8f285744ccf737adeffc4c78cb11c03261f906cfd50b5b9e78f2c17dc2b8a01d83554e93f4960370064af87e84322cc78ee70

C:\Users\Admin\AppData\Local\Temp\Melted_801ea88e-1ba0-41cb-a952-22f3380e7c3d\ending.vbs

MD5 774cada5baf571a414c25e2ae8931762
SHA1 6ae662e045bff78ec42cc58329288c7578e860d6
SHA256 88d3fb6210f75a39337920ecbccfd0af4e4a5b9e7bf4a3bcd5366346bf7e66b6
SHA512 183e44ac3c9be05e49bd6ddc58a4cc2a5d8517fccc8a1c2615b4b91c288beb410dea03ab79b2dc40a71036955e39afb47431900610905c3d2bb07eb1261c8845

memory/12844-1728-0x00007FF79E320000-0x00007FF79E349000-memory.dmp

C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133674079232399981.txt

MD5 1bfc1a25ebfafe54119bc553e1444f8a
SHA1 3a0763ffe41919bed2586d9602bc8670c4415908
SHA256 6ba58f358c26c0351b1b8c2cc5189502a701b31aec1f8a4fb87190afd802f3e4
SHA512 978a21c2d5f76c87e11f9207d9607bdb329872e31a0590661d3d79c4be3fb268bac9ef50db33600a0716f5d8c24691975e005170d559ffdd7b4b82b4d4e2fa35

memory/13316-1814-0x00007FF79E320000-0x00007FF79E349000-memory.dmp

memory/12844-1822-0x00007FF79E320000-0x00007FF79E349000-memory.dmp