njrat | 8e9b72f5c85f33855d55ba43828a9eb6747a20c269fd2f0a3e8e79927adcc644

Resubmissions

31/03/2025, 01:21

250331-bqtvaszyhx 10

31/03/2025, 01:18

250331-bn4xgszydt 10

31/03/2025, 01:17

250331-bnwwwasqv7 10

29/03/2025, 14:30

250329-rveh6swqw4 10

Analysis

max time kernel
175s
max time network
897s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20250314-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20250314-enlocale:en-usos:windows10-ltsc_2021-x64system
submitted
31/03/2025, 01:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

jjexploer.exe
Size

25KB
MD5

48f18e8a6a3f9b0f948b0e11e736f9e5
SHA1

643cec64499163563d018edbece54075c13e7cc3
SHA256

8e9b72f5c85f33855d55ba43828a9eb6747a20c269fd2f0a3e8e79927adcc644
SHA512

110a9e9bae0e4d527c6f8e5c9958aff8a13db398f0b18a727e28d69fa30d0bd759033f8efcbb59b11c2c1816b2cb17c43b7453244a198c217aa48cced0088d7b
SSDEEP

768:svpoyEEfxcQ4UBPq9lzcdaxfvM/r7yPV6U6m:QoyhuLUIjzgCfvM/r7yH6m

Score

10^/10

njrat svhost.exe persistence trojan

Malware Config

Extracted

Family

njrat

Version

Njrat 0.7 Golden By Hassan Amiri

Botnet

svhost.exe

animal-premium.gl.at.ply.gg:16843

Mutex

Update

Attributes

reg_key
Update
splitter
|Hassan|

Signatures

Njrat family
njrat
njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-780313508-644878201-565826771-1000\Control Panel\International\Geo\Nation	jjexploer.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Update.exe	Dllhost.exe

Executes dropped EXE 64 IoCs

pid	Process
380	Dllhost.exe
4768	Dllhost.exe
5040	Dllhost.exe
460	Dllhost.exe
6052	Dllhost.exe
4588	Dllhost.exe
6104	Dllhost.exe
3560	Dllhost.exe
3596	Dllhost.exe
3356	Dllhost.exe
6036	Dllhost.exe
5872	Dllhost.exe
2964	Dllhost.exe
1676	Dllhost.exe
2532	Dllhost.exe
220	Dllhost.exe
984	Dllhost.exe
1744	Dllhost.exe
324	Dllhost.exe
4268	Dllhost.exe
5728	Server.exe
4676	Dllhost.exe
2836	Dllhost.exe
4576	Dllhost.exe
1504	Dllhost.exe
3724	Dllhost.exe
3112	Dllhost.exe
6396	Dllhost.exe
6552	Dllhost.exe
6720	Dllhost.exe
7148	Dllhost.exe
7156	Dllhost.exe
4908	Dllhost.exe
4720	Dllhost.exe
2844	Dllhost.exe
5096	Dllhost.exe
1744	Dllhost.exe
3420	Dllhost.exe
4156	Dllhost.exe
2996	Dllhost.exe
2948	Dllhost.exe
6192	Dllhost.exe
4432	Dllhost.exe
7180	Dllhost.exe
7304	Dllhost.exe
7236	Dllhost.exe
7336	Dllhost.exe
7500	Dllhost.exe
7556	Dllhost.exe
7720	Dllhost.exe
7796	Dllhost.exe
7772	Dllhost.exe
7980	Dllhost.exe
7972	Dllhost.exe
8036	Dllhost.exe
8028	Dllhost.exe
7644	Dllhost.exe
7620	Dllhost.exe
6808	Dllhost.exe
780	Dllhost.exe
2496	Dllhost.exe
6660	Dllhost.exe
6552	Dllhost.exe
1916	Dllhost.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-780313508-644878201-565826771-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update = "\"C:\\Users\\Admin\\AppData\\Roaming\\Dllhost.exe\" .."	Dllhost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update = "\"C:\\Users\\Admin\\AppData\\Roaming\\Dllhost.exe\" .."	Dllhost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4576	schtasks.exe

Suspicious behavior: GetForegroundWindowSpam 64 IoCs

pid	Process
3996	jjexploer.exe
380	Dllhost.exe
4768	Dllhost.exe
5040	Dllhost.exe
460	Dllhost.exe
6052	Dllhost.exe
4588	Dllhost.exe
6104	Dllhost.exe
3560	Dllhost.exe
3596	Dllhost.exe
3356	Dllhost.exe
5872	Dllhost.exe
6036	Dllhost.exe
2964	Dllhost.exe
1676	Dllhost.exe
2532	Dllhost.exe
220	Dllhost.exe
984	Dllhost.exe
1744	Dllhost.exe
324	Dllhost.exe
1504	Dllhost.exe
2836	Dllhost.exe
4268	Dllhost.exe
4676	Dllhost.exe
4576	Dllhost.exe
3724	Dllhost.exe
3112	Dllhost.exe
6396	Dllhost.exe
6720	Dllhost.exe
7156	Dllhost.exe
4908	Dllhost.exe
6552	Dllhost.exe
4720	Dllhost.exe
7148	Dllhost.exe
5096	Dllhost.exe
2844	Dllhost.exe
1744	Dllhost.exe
3420	Dllhost.exe
4156	Dllhost.exe
2948	Dllhost.exe
6192	Dllhost.exe
7236	Dllhost.exe
7180	Dllhost.exe
7556	Dllhost.exe
7336	Dllhost.exe
4432	Dllhost.exe
2996	Dllhost.exe
7304	Dllhost.exe
7772	Dllhost.exe
7796	Dllhost.exe
7980	Dllhost.exe
7500	Dllhost.exe
7720	Dllhost.exe
7972	Dllhost.exe
8036	Dllhost.exe
8028	Dllhost.exe
7644	Dllhost.exe
6808	Dllhost.exe
6660	Dllhost.exe
780	Dllhost.exe
2496	Dllhost.exe
7620	Dllhost.exe
6552	Dllhost.exe
1916	Dllhost.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	380	Dllhost.exe
Token: 33	380	Dllhost.exe
Token: SeIncBasePriorityPrivilege	380	Dllhost.exe
Token: 33	380	Dllhost.exe
Token: SeIncBasePriorityPrivilege	380	Dllhost.exe
Token: 33	380	Dllhost.exe
Token: SeIncBasePriorityPrivilege	380	Dllhost.exe
Token: 33	380	Dllhost.exe
Token: SeIncBasePriorityPrivilege	380	Dllhost.exe
Token: 33	380	Dllhost.exe
Token: SeIncBasePriorityPrivilege	380	Dllhost.exe
Token: 33	380	Dllhost.exe
Token: SeIncBasePriorityPrivilege	380	Dllhost.exe
Token: 33	380	Dllhost.exe
Token: SeIncBasePriorityPrivilege	380	Dllhost.exe
Token: 33	380	Dllhost.exe
Token: SeIncBasePriorityPrivilege	380	Dllhost.exe
Token: 33	380	Dllhost.exe
Token: SeIncBasePriorityPrivilege	380	Dllhost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3996 wrote to memory of 380	3996	jjexploer.exe	82
PID 3996 wrote to memory of 380	3996	jjexploer.exe	82
PID 380 wrote to memory of 4576	380	Dllhost.exe	87
PID 380 wrote to memory of 4576	380	Dllhost.exe	87
PID 4040 wrote to memory of 4768	4040	cmd.exe	91
PID 4040 wrote to memory of 4768	4040	cmd.exe	91
PID 4824 wrote to memory of 5040	4824	cmd.exe	92
PID 4824 wrote to memory of 5040	4824	cmd.exe	92
PID 4984 wrote to memory of 460	4984	cmd.exe	101
PID 4984 wrote to memory of 460	4984	cmd.exe	101
PID 4920 wrote to memory of 6052	4920	cmd.exe	106
PID 4920 wrote to memory of 6052	4920	cmd.exe	106
PID 5000 wrote to memory of 4588	5000	cmd.exe	111
PID 5000 wrote to memory of 4588	5000	cmd.exe	111
PID 4992 wrote to memory of 6104	4992	cmd.exe	116
PID 4992 wrote to memory of 6104	4992	cmd.exe	116
PID 3912 wrote to memory of 3560	3912	cmd.exe	123
PID 3912 wrote to memory of 3560	3912	cmd.exe	123
PID 5908 wrote to memory of 3596	5908	cmd.exe	132
PID 5908 wrote to memory of 3596	5908	cmd.exe	132
PID 2632 wrote to memory of 3356	2632	cmd.exe	141
PID 2632 wrote to memory of 3356	2632	cmd.exe	141
PID 5668 wrote to memory of 6036	5668	cmd.exe	146
PID 5668 wrote to memory of 6036	5668	cmd.exe	146
PID 4792 wrote to memory of 5872	4792	cmd.exe	147
PID 4792 wrote to memory of 5872	4792	cmd.exe	147
PID 3636 wrote to memory of 2964	3636	cmd.exe	540
PID 3636 wrote to memory of 2964	3636	cmd.exe	540
PID 1068 wrote to memory of 1676	1068	cmd.exe	167
PID 1068 wrote to memory of 1676	1068	cmd.exe	167
PID 1796 wrote to memory of 2532	1796	cmd.exe	273
PID 1796 wrote to memory of 2532	1796	cmd.exe	273
PID 1700 wrote to memory of 220	1700	cmd.exe	174
PID 1700 wrote to memory of 220	1700	cmd.exe	174
PID 1144 wrote to memory of 984	1144	cmd.exe	179
PID 1144 wrote to memory of 984	1144	cmd.exe	179
PID 4332 wrote to memory of 1744	4332	cmd.exe	277
PID 4332 wrote to memory of 1744	4332	cmd.exe	277
PID 3992 wrote to memory of 324	3992	cmd.exe	821
PID 3992 wrote to memory of 324	3992	cmd.exe	821
PID 2736 wrote to memory of 4676	2736	cmd.exe	196
PID 2736 wrote to memory of 4676	2736	cmd.exe	196
PID 3620 wrote to memory of 4268	3620	cmd.exe	198
PID 3620 wrote to memory of 4268	3620	cmd.exe	198
PID 1276 wrote to memory of 2836	1276	cmd.exe	402
PID 1276 wrote to memory of 2836	1276	cmd.exe	402
PID 6064 wrote to memory of 3724	6064	cmd.exe	710
PID 6064 wrote to memory of 3724	6064	cmd.exe	710
PID 3832 wrote to memory of 4576	3832	cmd.exe	1000
PID 3832 wrote to memory of 4576	3832	cmd.exe	1000
PID 2084 wrote to memory of 1504	2084	cmd.exe	208
PID 2084 wrote to memory of 1504	2084	cmd.exe	208
PID 2224 wrote to memory of 3112	2224	cmd.exe	213
PID 2224 wrote to memory of 3112	2224	cmd.exe	213
PID 1888 wrote to memory of 6396	1888	cmd.exe	222
PID 1888 wrote to memory of 6396	1888	cmd.exe	222
PID 3752 wrote to memory of 6552	3752	cmd.exe	1322
PID 3752 wrote to memory of 6552	3752	cmd.exe	1322
PID 5976 wrote to memory of 6720	5976	cmd.exe	232
PID 5976 wrote to memory of 6720	5976	cmd.exe	232
PID 1604 wrote to memory of 7148	1604	cmd.exe	246
PID 1604 wrote to memory of 7148	1604	cmd.exe	246
PID 3216 wrote to memory of 7156	3216	cmd.exe	1384
PID 3216 wrote to memory of 7156	3216	cmd.exe	1384

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\jjexploer.exe
"C:\Users\Admin\AppData\Local\Temp\jjexploer.exe"
1⤵
- Checks computer location settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:3996
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  "C:\Users\Admin\AppData\Roaming\Dllhost.exe"
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:380
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn Server /tr C:\Users\Admin\AppData\Local\Temp/Server.exe
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4576

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
- Suspicious use of WriteProcessMemory
PID:4824
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: GetForegroundWindowSpam
  PID:5040

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
- Suspicious use of WriteProcessMemory
PID:4040
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: GetForegroundWindowSpam
  PID:4768

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
- Suspicious use of WriteProcessMemory
PID:4984
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: GetForegroundWindowSpam
  PID:460

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
- Suspicious use of WriteProcessMemory
PID:4920
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: GetForegroundWindowSpam
  PID:6052

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
- Suspicious use of WriteProcessMemory
PID:4992
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: GetForegroundWindowSpam
  PID:6104

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
- Suspicious use of WriteProcessMemory
PID:5000
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: GetForegroundWindowSpam
  PID:4588

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
- Suspicious use of WriteProcessMemory
PID:5908
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: GetForegroundWindowSpam
  PID:3596

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
- Suspicious use of WriteProcessMemory
PID:3912
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: GetForegroundWindowSpam
  PID:3560

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
- Suspicious use of WriteProcessMemory
PID:5668
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: GetForegroundWindowSpam
  PID:6036

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
- Suspicious use of WriteProcessMemory
PID:4792
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: GetForegroundWindowSpam
  PID:5872

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
- Suspicious use of WriteProcessMemory
PID:2632
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: GetForegroundWindowSpam
  PID:3356

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
- Suspicious use of WriteProcessMemory
PID:3636
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: GetForegroundWindowSpam
  PID:2964

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
- Suspicious use of WriteProcessMemory
PID:1700
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: GetForegroundWindowSpam
  PID:220

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
- Suspicious use of WriteProcessMemory
PID:1068
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: GetForegroundWindowSpam
  PID:1676

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
- Suspicious use of WriteProcessMemory
PID:1796
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: GetForegroundWindowSpam
  PID:2532

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
- Suspicious use of WriteProcessMemory
PID:1144
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: GetForegroundWindowSpam
  PID:984

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
- Suspicious use of WriteProcessMemory
PID:4332
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: GetForegroundWindowSpam
  PID:1744

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
- Suspicious use of WriteProcessMemory
PID:3620
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: GetForegroundWindowSpam
  PID:4268

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
- Suspicious use of WriteProcessMemory
PID:2736
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: GetForegroundWindowSpam
  PID:4676

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
- Suspicious use of WriteProcessMemory
PID:3992
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: GetForegroundWindowSpam
  PID:324

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
- Suspicious use of WriteProcessMemory
PID:1276
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: GetForegroundWindowSpam
  PID:2836

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
- Suspicious use of WriteProcessMemory
PID:3832
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: GetForegroundWindowSpam
  PID:4576

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
- Suspicious use of WriteProcessMemory
PID:2224
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: GetForegroundWindowSpam
  PID:3112

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
- Suspicious use of WriteProcessMemory
PID:2084
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: GetForegroundWindowSpam
  PID:1504

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
- Suspicious use of WriteProcessMemory
PID:3752
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: GetForegroundWindowSpam
  PID:6552

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
- Suspicious use of WriteProcessMemory
PID:6064
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: GetForegroundWindowSpam
  PID:3724

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
- Suspicious use of WriteProcessMemory
PID:1888
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: GetForegroundWindowSpam
  PID:6396

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
- Suspicious use of WriteProcessMemory
PID:5976
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: GetForegroundWindowSpam
  PID:6720

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
- Suspicious use of WriteProcessMemory
PID:3216
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: GetForegroundWindowSpam
  PID:7156

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:2880
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: GetForegroundWindowSpam
  PID:4720

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
- Suspicious use of WriteProcessMemory
PID:1604
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: GetForegroundWindowSpam
  PID:7148

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:2724
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: GetForegroundWindowSpam
  PID:2996

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:1664
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: GetForegroundWindowSpam
  PID:7336

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:4448
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: GetForegroundWindowSpam
  PID:4908

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:1928
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: GetForegroundWindowSpam
  PID:2844

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:5792
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: GetForegroundWindowSpam
  PID:4156

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:4088
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: GetForegroundWindowSpam
  PID:5096

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:6108
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: GetForegroundWindowSpam
  PID:7180

C:\Users\Admin\AppData\Local\Temp\Server.exe
"C:\Users\Admin\AppData\Local\Temp/Server.exe"
1⤵
- Executes dropped EXE
PID:5728

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:6004
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: GetForegroundWindowSpam
  PID:4432

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:3952
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: GetForegroundWindowSpam
  PID:7500

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:4632
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: GetForegroundWindowSpam
  PID:6192

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:5636
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: GetForegroundWindowSpam
  PID:1744

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:5844
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: GetForegroundWindowSpam
  PID:7236

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:5600
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: GetForegroundWindowSpam
  PID:7304

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:944
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: GetForegroundWindowSpam
  PID:7556

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:4808
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: GetForegroundWindowSpam
  PID:2948

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:2056
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: GetForegroundWindowSpam
  PID:7720

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:2976
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: GetForegroundWindowSpam
  PID:7772

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:3400
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: GetForegroundWindowSpam
  PID:3420

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:5064
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: GetForegroundWindowSpam
  PID:7980

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:2592
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: GetForegroundWindowSpam
  PID:7972

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:3932
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: GetForegroundWindowSpam
  PID:7796

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:6304
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: GetForegroundWindowSpam
  PID:8028

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:6348
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: GetForegroundWindowSpam
  PID:8036

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:6520
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: GetForegroundWindowSpam
  PID:7644

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:6544
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: GetForegroundWindowSpam
  PID:6808

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:6684
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: GetForegroundWindowSpam
  PID:7620

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:6696
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: GetForegroundWindowSpam
  PID:780

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:6872
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: GetForegroundWindowSpam
  PID:2496

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:6868
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: GetForegroundWindowSpam
  PID:6660

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:7040
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:5220

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:7048
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:188

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:7128
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:7152

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:7136
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: GetForegroundWindowSpam
  PID:6552

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:5496
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:1392

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:6464
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: GetForegroundWindowSpam
  PID:1916

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:6312
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:8804

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:6412
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:5020

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:4928
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:8708

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:6772
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:9148

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:3960
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:8404

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:3452
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:8880

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:5892
- C:\Windows\System32\Conhost.exe
  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
  2⤵
  PID:2532
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:2680

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:4636
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:8852

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:5836
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:9140

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:3780
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:9084

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:3688
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:1508

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:1028
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:1200

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:6092
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:5880

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:3592
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:9156

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:7292
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:8616

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:7284
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:9212

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:7576
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:1068

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:7584
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:6404

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:7904
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:768

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:7912
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:4988

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:8124
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:7556

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:8132
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:7396

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:4048
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:5624

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:7192
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:6424

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:5092
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:7268

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:5520
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:2248

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:1404
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:5024

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:6476
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:4732

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:2736
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:820

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:544
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:6612

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:400
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:2748

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:5488
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:8736

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:6892
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:4192

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:4836
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:2876

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:1988
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:4772

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:64
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:6068

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:6924
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:2224

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:7476
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:6532

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:4584
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:8400

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:2336
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:2844

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:8548
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:3476

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:8564
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:6024

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:8792
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:6432

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:8868
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:7940

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:9004
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:6940

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:9020
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:9056

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:9188
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:4212

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:9196
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:7356

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:7432
- C:\Windows\System32\Conhost.exe
  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
  2⤵
  PID:2836
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:2012

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:7608
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:7188

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:7524
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:4152

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:8624
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:4352

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:2332
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:5572

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:7848
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:6544

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:2464
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:5292

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:1284
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:3520

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:1148
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:2964

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:6200
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:1492

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:7504
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:4960

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:9172
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:4380

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:6568
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:9060

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:6508
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:4708

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:4444
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:2932

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:7872
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:3160

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:6784
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:8224

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:6740
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:7952

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:6920
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:3208

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:6936
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:7348

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:3188
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:8456

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:7768
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:7188

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:4948
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:8296

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:4672
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:9072

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:2468
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:3620

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:5344
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:2264

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:4408
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:2280

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:3004
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:464

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:5112
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:4824

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:4776
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:6532

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:3028
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:7820

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:2060
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:636

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:7720
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:5764

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:8260
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:6612

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:8708
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:2080

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:6308
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:1788

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:6880
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:5660

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:7528
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:8004

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:7592
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:8908

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:6488
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:6964

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:980
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:9180

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:6052
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:5584

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:6616
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:5952

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:2704
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:7328

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:8472
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:6800

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:8476
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:8504

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:3716
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:6372

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:5724
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:9176

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:2788
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:6892

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:7512
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:6088

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:5948
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:1584

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:3960
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:7608

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:8068
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:8244

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:2756
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:7128

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:5448
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:100

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:3892
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:5836

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:4636
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:8392

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:7688
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:7376

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:4752
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:9060

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:5208
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:3524

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:4184
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:6944

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:5232
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:3724

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:6468
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:6836

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:7812
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:7772

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:7420
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:3656

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:5516
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:6068

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:7028
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:8356

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:7700
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:6408

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:8716
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:9072

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:4016
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:6844

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:2492
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:8728

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:4788
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:7932

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:6928
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:6796

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:852
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:9100

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:8440
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:9104

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:8452
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:8368

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:2064
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:3508

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:7204
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:6760

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:8736
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:6828

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:2480
- C:\Windows\System32\Conhost.exe
  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
  2⤵
  PID:9156
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:2632

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:8800
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:6280

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:5432
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:3756

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:7748
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:4544

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:2376
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:7612

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:2220
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:6708

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:3972
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:7784

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:3124
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:1396

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:6608
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:7704

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:6632
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:236

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:6744
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:8820

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:9024
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:7660

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:1984
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:4628

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:8692
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:324

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:5140
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:5476

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:4848
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:3700

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:3964
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:6664

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:240
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:6732

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:1748
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:7388

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:8964
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:6032

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:8520
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:6580

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:4924
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:8112

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:5376
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:7220

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:5000
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:7596

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:7616
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:8760

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:5488
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:8232

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:6288
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:7468

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:3452
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:1088

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:5348
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:2756

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:964
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:8208

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:4648
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:4816

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:1616
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:4848

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:116
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:6428

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:1644
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:6948

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:1492
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:5116

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:6952
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:7176

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:8220
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:8124

C:\Users\Admin\AppData\Local\Temp\Server.exe
"C:\Users\Admin\AppData\Local\Temp/Server.exe"
1⤵
PID:5872

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:464
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:2292

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:3208
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:8972

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:5064
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:7104

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:6120
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:2384

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:6180
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:8916

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:1784
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:5108

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:8060
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:5484

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:7400
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:5868

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:2280
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:4828

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:8224
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:3392

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:7180
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:3756

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:8080
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:2352

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:4044
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:5960

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:5328
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:2236

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:8092
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:8528

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:6036
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:8328

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:8952
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:8500

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:6304
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:4444

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:1844
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:7748

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:8168
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:1928

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:8708
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:8748

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:8276
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:5464

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:4440
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:1744

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:4416
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:8448

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:1972
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:3744

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:7452
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:8296

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:8564
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:8308

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:7240
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:8824

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:5784
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:1624

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:8024
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:8112

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:4588
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:7972

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:8256
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:4904

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:2712
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:5088

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:7952
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:4192

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:6784
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:6260

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:6308
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:6968

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:1584
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:2748

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:3976
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:6444

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:7732
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:2288

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:6068
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:7924

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:6380
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:2332

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:8588
- C:\Windows\System32\Conhost.exe
  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
  2⤵
  PID:7980
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:2248

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:1276
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:5064

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:2392
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:9068

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:4928
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:1820

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:6772
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:1976

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:8072
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:116

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:3308
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:5472

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:8280
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:3076

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:8352
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:7588

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:7280
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:7216

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:6808
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:672

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:3936
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:6224

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:8740
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:7632

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:2324
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:3176

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:8148
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:7328

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:768
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:2844

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:7544
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:3540

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:9072
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:6216

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:5020
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:8224

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:3728
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:6312

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:232
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:9008

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:2428
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:1912

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:8728
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:8176

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:6112
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:1392

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:8044
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:8220

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:8036
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:7308

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:6516
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:8604

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:8660
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:8508

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:5136
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:5636

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:4208
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:7528

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:5132
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:8580

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:5304
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:7388

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:7364
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:4632

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:3592
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:1916

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:3656
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:4556

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:7164
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:9016

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:3508
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:4480

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:3620
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:4584

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:6016
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:6044

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:4276
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:6012

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:6988
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:7524

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:8832
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:6008

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:6744
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:4236

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:1848
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:8920

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:7320
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:5612

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:9168
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:9012

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:3392
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:7804

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:5224
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:2964

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:4576
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:5512

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:1956
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:1736

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:1968
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:2680

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:2756
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:2532

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:3472
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:5544

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:7352
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:7144

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:5376
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:8856

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:8872
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:8720

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:6668
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:708

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:7840
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:5048

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:5500
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:8452

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:2760
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:5728

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:7936
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:6660

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:8052
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:7004

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:7084
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:8644

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:4444
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:7288

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:9132
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:8484

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:3504
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:8496

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:6288
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:700

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:1612
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:7852

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:7516
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:3104

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:5488
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:1132

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:4756
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:2808

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:7124
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:6168

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:6024
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:7932

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:564
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:5288

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:5592
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:4040

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:8880
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:8160

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:8000
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:1720

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:4944
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:4860

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:6884
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:7632

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:2184
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:5360

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:7784
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:7340

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:8612
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:5908

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:8816
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:2592

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:1196
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:4560

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:2980
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:7976

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:4416
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:5404

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:7252
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:4340

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:6444
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:5448

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:5056
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:4984

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:8616
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:6660

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:4504
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:8852

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:8840
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:6204

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:5936
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:4588

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:5968
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:7044

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:4612
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:4400

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:348
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:4192

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:1820
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:5792

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:7608
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:3692

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:8264
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:6700

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:3212
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:8172

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:7956
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:4940

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:7328
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:3976

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:8392
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:4048

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:8468
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:6656

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:8492
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:2024

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:8904
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:7768

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:5472
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:2964

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:1028
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:6092

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:6652
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:8712

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:1944
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:1508

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:2548
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:8644

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:3088
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:6128

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:7308
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:4312

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:1180
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:1956

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:7120
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:4624

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:5040
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:7036

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:3936
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:4628

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:8744
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:5648

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:8688
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:3736

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:8800
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:2832

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:5368
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:6096

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:4236
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:7192

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:7312
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:8048

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:4004
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:8864

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:6228
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:5152

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:6036
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:3988

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:1800
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:8404

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:7396
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:5900

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:6940
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:4852

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:4016
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:1616

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:1528
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:4788

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:7204
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:8536

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:3248
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:8452

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:4696
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:2876

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:8728
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:7032

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:9100
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:6996

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:964
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:6544

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:780
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:8268

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:5140
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:3108

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:5536
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:2996

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:7844
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:4352

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:6400
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:3228

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:1736
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:5952

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:4880
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:5812

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:1044
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:8612

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:6464
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:8848

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:7808
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:4312

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:5156
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:8032

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:2340
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:5404

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:1664
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:2976

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:6432
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:636

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:1908
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:2036

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:3600
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:2648

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:7616
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:564

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:6552
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:8616

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:4536
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:7744

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:8084
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:4852

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:5680
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:7224

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:720
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:5860

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:2476
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:8348

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:1088
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:4660

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:5576
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:5664

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:8884
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:4156

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:6320
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:3392

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:3028
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:2364

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:1708
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:9096

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:7124
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:7036

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:4900
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:4248

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:4040
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:4388

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:400
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:6908

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:2868
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:7620

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:8228
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:1576

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:2496
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:6800

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:4528
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:7796

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:7156
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:7680

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:7468
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:8044

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:6924
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:7316

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:8992
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:5364

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:4620
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:8800

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:7640
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:2608

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:5432
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:8368

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:396
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:8536

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:8756
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:6456

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:5596
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:9204

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:4192
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:2928

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:6752
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:9140

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:2708
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:5888

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:2796
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:6872

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:4328
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:6576

C:\Users\Admin\AppData\Local\Temp\Server.exe
"C:\Users\Admin\AppData\Local\Temp/Server.exe"
1⤵
PID:420

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:2160
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:8820

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:5048
- C:\Windows\System32\Conhost.exe
  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
  2⤵
  PID:7644
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:7108

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:9168
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:6372

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:6252
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:8088

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:2120
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:4264

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:1360
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:5300

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:2356
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:3800

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:6164
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:1148

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:6732
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:6568

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:6708
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:3952

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:7376
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:2728

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:7444
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:2948

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:1028
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:7752

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:5980

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:4356
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:5020

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:7432
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:7008

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:5792

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:8900
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:6756

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:2068
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:1568

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:7688
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:984

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:1364

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:4404
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:8888

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:6640

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:8500
- C:\Users\Admin\AppData\Roaming\Dllhost.exe
  C:\Users\Admin\AppData\Roaming\Dllhost.exe ..
  2⤵
  PID:7712

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:8808

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:5648

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:8048

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:5900

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:1820

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:4036

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:6272

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:8120

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:2712

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:8208

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:6776

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:8744

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:5884

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:8532

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:824

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:7792

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:6124

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:7172

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:1888

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:2656

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:7420

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:7092

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:2744
- C:\Windows\System32\Conhost.exe
  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
  2⤵
  PID:5096

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:3592

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:8848

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:8016

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:2080

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:4768

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:5952

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:5064

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:240

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:4208

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:3588

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:8712

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:4660

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:1388

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:6760

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:896

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:3452

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:9060

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:6404

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:6624

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:3540

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:964

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:7464

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:7624

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:1784

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Dllhost.exe" ..
1⤵
PID:6540

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Dllhost.exe.log

Filesize
1KB

MD5
4f6b05ffda31f521f50ab51bdc5d012c

SHA1
97a007d2796eadbf97c9f4a5c1b221b19c265a45

SHA256
2264d6027143e95b6e04d1c6a2305555bad4639c38ba90002be6f07fac4be1a9

SHA512
24e0352fa6c2cedc98ee9b2f080af3931aed5ae20363787f49b911f8e3e842569db0248f5e8bccc58ed941af0ff4942fb104d9ea1ea4700e7deebf1012bbd7a9

Download Submit
C:\Users\Admin\AppData\Roaming\Dllhost.exe

Filesize
25KB

MD5
48f18e8a6a3f9b0f948b0e11e736f9e5

SHA1
643cec64499163563d018edbece54075c13e7cc3

SHA256
8e9b72f5c85f33855d55ba43828a9eb6747a20c269fd2f0a3e8e79927adcc644

SHA512
110a9e9bae0e4d527c6f8e5c9958aff8a13db398f0b18a727e28d69fa30d0bd759033f8efcbb59b11c2c1816b2cb17c43b7453244a198c217aa48cced0088d7b

Download Submit
memory/324-48-0x0000000001550000-0x0000000001562000-memory.dmp

Filesize
72KB

Download
memory/380-21-0x00007FFED4210000-0x00007FFED4CD2000-memory.dmp

Filesize
10.8MB

Download
memory/380-22-0x00007FFED4210000-0x00007FFED4CD2000-memory.dmp

Filesize
10.8MB

Download
memory/380-19-0x00007FFED4210000-0x00007FFED4CD2000-memory.dmp

Filesize
10.8MB

Download
memory/380-20-0x00007FFED4210000-0x00007FFED4CD2000-memory.dmp

Filesize
10.8MB

Download
memory/564-160-0x0000000002760000-0x0000000002772000-memory.dmp

Filesize
72KB

Download
memory/636-152-0x0000000000CD0000-0x0000000000CE2000-memory.dmp

Filesize
72KB

Download
memory/1392-103-0x0000000000D40000-0x0000000000D52000-memory.dmp

Filesize
72KB

Download
memory/1676-44-0x00000000005D0000-0x00000000005E2000-memory.dmp

Filesize
72KB

Download
memory/1720-140-0x0000000000BA0000-0x0000000000BB2000-memory.dmp

Filesize
72KB

Download
memory/1820-131-0x00000000023E0000-0x00000000023F2000-memory.dmp

Filesize
72KB

Download
memory/1916-102-0x0000000001190000-0x00000000011A2000-memory.dmp

Filesize
72KB

Download
memory/2264-113-0x0000000001150000-0x0000000001162000-memory.dmp

Filesize
72KB

Download
memory/2280-112-0x00000000009E0000-0x00000000009F2000-memory.dmp

Filesize
72KB

Download
memory/2748-107-0x0000000001270000-0x0000000001282000-memory.dmp

Filesize
72KB

Download
memory/2836-57-0x0000000000D50000-0x0000000000D62000-memory.dmp

Filesize
72KB

Download
memory/2948-83-0x0000000002DA0000-0x0000000002DB2000-memory.dmp

Filesize
72KB

Download
memory/2964-135-0x0000000001570000-0x0000000001582000-memory.dmp

Filesize
72KB

Download
memory/2964-40-0x00000000024E0000-0x00000000024F2000-memory.dmp

Filesize
72KB

Download
memory/3392-158-0x0000000001540000-0x0000000001552000-memory.dmp

Filesize
72KB

Download
memory/3508-117-0x0000000002230000-0x0000000002242000-memory.dmp

Filesize
72KB

Download
memory/3540-129-0x0000000000EF0000-0x0000000000F02000-memory.dmp

Filesize
72KB

Download
memory/3692-142-0x0000000002A70000-0x0000000002A82000-memory.dmp

Filesize
72KB

Download
memory/3800-164-0x00000000011B0000-0x00000000011C2000-memory.dmp

Filesize
72KB

Download
memory/3996-2-0x00000000015D0000-0x00000000015E2000-memory.dmp

Filesize
72KB

Download
memory/3996-0-0x00007FFED4213000-0x00007FFED4215000-memory.dmp

Filesize
8KB

Download
memory/3996-18-0x00007FFED4210000-0x00007FFED4CD2000-memory.dmp

Filesize
10.8MB

Download
memory/3996-1-0x0000000000D30000-0x0000000000D38000-memory.dmp

Filesize
32KB

Download
memory/3996-3-0x00007FFED4210000-0x00007FFED4CD2000-memory.dmp

Filesize
10.8MB

Download
memory/3996-4-0x00007FFED4213000-0x00007FFED4215000-memory.dmp

Filesize
8KB

Download
memory/3996-5-0x00007FFED4210000-0x00007FFED4CD2000-memory.dmp

Filesize
10.8MB

Download
memory/4156-157-0x0000000001240000-0x0000000001252000-memory.dmp

Filesize
72KB

Download
memory/4264-163-0x0000000000DA0000-0x0000000000DB2000-memory.dmp

Filesize
72KB

Download
memory/4544-122-0x00000000009C0000-0x00000000009D2000-memory.dmp

Filesize
72KB

Download
memory/4576-58-0x0000000002BD0000-0x0000000002BE2000-memory.dmp

Filesize
72KB

Download
memory/4588-29-0x0000000002100000-0x0000000002112000-memory.dmp

Filesize
72KB

Download
memory/4628-147-0x00000000007F0000-0x0000000000802000-memory.dmp

Filesize
72KB

Download
memory/4632-134-0x0000000000C40000-0x0000000000C52000-memory.dmp

Filesize
72KB

Download
memory/4676-53-0x00000000017B0000-0x00000000017C2000-memory.dmp

Filesize
72KB

Download
memory/4708-110-0x0000000000D40000-0x0000000000D52000-memory.dmp

Filesize
72KB

Download
memory/4772-108-0x00000000016C0000-0x00000000016D2000-memory.dmp

Filesize
72KB

Download
memory/4824-111-0x0000000000A00000-0x0000000000A12000-memory.dmp

Filesize
72KB

Download
memory/4860-167-0x0000000001500000-0x0000000001512000-memory.dmp

Filesize
72KB

Download
memory/5464-126-0x00000000014B0000-0x00000000014C2000-memory.dmp

Filesize
72KB

Download
memory/5584-171-0x0000000000A20000-0x0000000000A32000-memory.dmp

Filesize
72KB

Download
memory/5792-145-0x0000000000B60000-0x0000000000B72000-memory.dmp

Filesize
72KB

Download
memory/5872-39-0x0000000002F00000-0x0000000002F12000-memory.dmp

Filesize
72KB

Download
memory/5880-105-0x0000000001180000-0x0000000001192000-memory.dmp

Filesize
72KB

Download
memory/6096-146-0x0000000001320000-0x0000000001332000-memory.dmp

Filesize
72KB

Download
memory/6108-169-0x0000000001890000-0x00000000018A2000-memory.dmp

Filesize
72KB

Download
memory/6372-170-0x00000000007E0000-0x00000000007F2000-memory.dmp

Filesize
72KB

Download
memory/6456-162-0x0000000000E80000-0x0000000000E92000-memory.dmp

Filesize
72KB

Download
memory/6532-114-0x0000000001650000-0x0000000001662000-memory.dmp

Filesize
72KB

Download
memory/6552-66-0x0000000001210000-0x0000000001222000-memory.dmp

Filesize
72KB

Download
memory/6580-123-0x00000000010C0000-0x00000000010D2000-memory.dmp

Filesize
72KB

Download
memory/6660-136-0x0000000001120000-0x0000000001132000-memory.dmp

Filesize
72KB

Download
memory/6796-166-0x00000000010A0000-0x00000000010B2000-memory.dmp

Filesize
72KB

Download
memory/6796-120-0x0000000000880000-0x0000000000892000-memory.dmp

Filesize
72KB

Download
memory/6800-161-0x0000000000E80000-0x0000000000E92000-memory.dmp

Filesize
72KB

Download
memory/6940-109-0x00000000012D0000-0x00000000012E2000-memory.dmp

Filesize
72KB

Download
memory/6964-116-0x0000000000ED0000-0x0000000000EE2000-memory.dmp

Filesize
72KB

Download
memory/6968-128-0x0000000001020000-0x0000000001032000-memory.dmp

Filesize
72KB

Download
memory/7008-165-0x0000000001690000-0x00000000016A2000-memory.dmp

Filesize
72KB

Download
memory/7036-155-0x0000000001710000-0x0000000001722000-memory.dmp

Filesize
72KB

Download
memory/7148-68-0x0000000001590000-0x00000000015A2000-memory.dmp

Filesize
72KB

Download
memory/7220-124-0x0000000001020000-0x0000000001032000-memory.dmp

Filesize
72KB

Download
memory/7224-156-0x0000000000E40000-0x0000000000E52000-memory.dmp

Filesize
72KB

Download
memory/7236-85-0x0000000002C30000-0x0000000002C42000-memory.dmp

Filesize
72KB

Download
memory/7348-115-0x0000000000E80000-0x0000000000E92000-memory.dmp

Filesize
72KB

Download
memory/7500-96-0x00000000006D0000-0x00000000006E2000-memory.dmp

Filesize
72KB

Download
memory/7556-88-0x0000000001040000-0x0000000001052000-memory.dmp

Filesize
72KB

Download
memory/7632-130-0x0000000002E80000-0x0000000002E92000-memory.dmp

Filesize
72KB

Download
memory/7744-154-0x0000000000CE0000-0x0000000000CF2000-memory.dmp

Filesize
72KB

Download
memory/7772-119-0x00000000023F0000-0x0000000002402000-memory.dmp

Filesize
72KB

Download
memory/7932-139-0x0000000000CB0000-0x0000000000CC2000-memory.dmp

Filesize
72KB

Download
memory/7976-141-0x0000000001080000-0x0000000001092000-memory.dmp

Filesize
72KB

Download
memory/7980-95-0x0000000001680000-0x0000000001692000-memory.dmp

Filesize
72KB

Download
memory/8048-148-0x0000000002AD0000-0x0000000002AE2000-memory.dmp

Filesize
72KB

Download
memory/8160-138-0x0000000001580000-0x0000000001592000-memory.dmp

Filesize
72KB

Download
memory/8172-144-0x0000000000A60000-0x0000000000A72000-memory.dmp

Filesize
72KB

Download
memory/8260-172-0x0000000000A10000-0x0000000000A22000-memory.dmp

Filesize
72KB

Download
memory/8348-159-0x0000000000C70000-0x0000000000C82000-memory.dmp

Filesize
72KB

Download
memory/8392-118-0x0000000000900000-0x0000000000912000-memory.dmp

Filesize
72KB

Download
memory/8404-149-0x0000000002FA0000-0x0000000002FB2000-memory.dmp

Filesize
72KB

Download
memory/8412-168-0x0000000002C00000-0x0000000002C12000-memory.dmp

Filesize
72KB

Download
memory/8496-137-0x00000000009E0000-0x00000000009F2000-memory.dmp

Filesize
72KB

Download
memory/8580-133-0x0000000000FB0000-0x0000000000FC2000-memory.dmp

Filesize
72KB

Download
memory/8616-104-0x00000000013A0000-0x00000000013B2000-memory.dmp

Filesize
72KB

Download
memory/8616-151-0x0000000000C00000-0x0000000000C12000-memory.dmp

Filesize
72KB

Download
memory/8748-125-0x0000000002300000-0x0000000002312000-memory.dmp

Filesize
72KB

Download
memory/8824-127-0x0000000001560000-0x0000000001572000-memory.dmp

Filesize
72KB

Download
memory/8848-150-0x0000000001650000-0x0000000001662000-memory.dmp

Filesize
72KB

Download
memory/8852-143-0x0000000002EB0000-0x0000000002EC2000-memory.dmp

Filesize
72KB

Download
memory/9068-132-0x0000000001190000-0x00000000011A2000-memory.dmp

Filesize
72KB

Download
memory/9072-121-0x0000000000D10000-0x0000000000D22000-memory.dmp

Filesize
72KB

Download
memory/9096-153-0x0000000001220000-0x0000000001232000-memory.dmp

Filesize
72KB

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads