d4b9f1e004a25bba47022b08c0ab200c4361f763ebb84c2932d79af2fafda576

Analysis

max time kernel
150s
max time network
155s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
31/07/2026, 17:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
d4b9f1e004a25bba47022b08c0ab200c4361f763ebb84c2932d79af2fafda576.exe
Size 996KB
Sample260731-vtp53axbkb
SHA256 d4b9f1e004a25bba47022b08c0ab200c4361f763ebb84c2932d79af2fafda576
MD5 1bc54849da58f0b43864ad9f2eab1393
SHA1 36f1937870d72d4bd84f44f8da9ffb6a0865715d
SHA512 5ba045e716791952a4d4089899d75aae72a10fdfb64760c4b22c360924d86f16d00a7170aa1d3459d4bcf3e793acb375b67bb5e65edcaa024ba21a7554b2aed7
SSDEEP 24576:24lxxBpeyv3zTuH57PtiqYBxEV+uYTg/UhAu1wDFQ:24bxBpeyv3zTuH57PtiqYBxEVnYTg/Xe
TLSH
T1AA255B22F221F866E06550F1597ACABA66646E70170054C7F3C8BF3F1BB61E17A3261F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

adware defense_evasion discovery execution persistence privilege_escalation spyware

Malware Config

Signatures

Modifies Windows Firewall 2 TTPs 2 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
2524	netsh.exe
2680	netsh.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4476	cmd.exe
2388	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_HTTP_USERNAME_PASSWORD_DISABLE\explorer.exe = "0"	d4b9f1e004a25bba47022b08c0ab200c4361f763ebb84c2932d79af2fafda576.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_HTTP_USERNAME_PASSWORD_DISABLE\iexplore.exe = "0"	d4b9f1e004a25bba47022b08c0ab200c4361f763ebb84c2932d79af2fafda576.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2020	d4b9f1e004a25bba47022b08c0ab200c4361f763ebb84c2932d79af2fafda576.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2020	d4b9f1e004a25bba47022b08c0ab200c4361f763ebb84c2932d79af2fafda576.exe
2020	d4b9f1e004a25bba47022b08c0ab200c4361f763ebb84c2932d79af2fafda576.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
2020	d4b9f1e004a25bba47022b08c0ab200c4361f763ebb84c2932d79af2fafda576.exe
2020	d4b9f1e004a25bba47022b08c0ab200c4361f763ebb84c2932d79af2fafda576.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
2020	d4b9f1e004a25bba47022b08c0ab200c4361f763ebb84c2932d79af2fafda576.exe
2020	d4b9f1e004a25bba47022b08c0ab200c4361f763ebb84c2932d79af2fafda576.exe
2020	d4b9f1e004a25bba47022b08c0ab200c4361f763ebb84c2932d79af2fafda576.exe
2020	d4b9f1e004a25bba47022b08c0ab200c4361f763ebb84c2932d79af2fafda576.exe
2020	d4b9f1e004a25bba47022b08c0ab200c4361f763ebb84c2932d79af2fafda576.exe
2020	d4b9f1e004a25bba47022b08c0ab200c4361f763ebb84c2932d79af2fafda576.exe
2020	d4b9f1e004a25bba47022b08c0ab200c4361f763ebb84c2932d79af2fafda576.exe
2020	d4b9f1e004a25bba47022b08c0ab200c4361f763ebb84c2932d79af2fafda576.exe
2020	d4b9f1e004a25bba47022b08c0ab200c4361f763ebb84c2932d79af2fafda576.exe
2020	d4b9f1e004a25bba47022b08c0ab200c4361f763ebb84c2932d79af2fafda576.exe
2020	d4b9f1e004a25bba47022b08c0ab200c4361f763ebb84c2932d79af2fafda576.exe
2020	d4b9f1e004a25bba47022b08c0ab200c4361f763ebb84c2932d79af2fafda576.exe
2020	d4b9f1e004a25bba47022b08c0ab200c4361f763ebb84c2932d79af2fafda576.exe
2020	d4b9f1e004a25bba47022b08c0ab200c4361f763ebb84c2932d79af2fafda576.exe
2020	d4b9f1e004a25bba47022b08c0ab200c4361f763ebb84c2932d79af2fafda576.exe
2020	d4b9f1e004a25bba47022b08c0ab200c4361f763ebb84c2932d79af2fafda576.exe
2020	d4b9f1e004a25bba47022b08c0ab200c4361f763ebb84c2932d79af2fafda576.exe
2020	d4b9f1e004a25bba47022b08c0ab200c4361f763ebb84c2932d79af2fafda576.exe
2020	d4b9f1e004a25bba47022b08c0ab200c4361f763ebb84c2932d79af2fafda576.exe
2020	d4b9f1e004a25bba47022b08c0ab200c4361f763ebb84c2932d79af2fafda576.exe
2020	d4b9f1e004a25bba47022b08c0ab200c4361f763ebb84c2932d79af2fafda576.exe
2020	d4b9f1e004a25bba47022b08c0ab200c4361f763ebb84c2932d79af2fafda576.exe
2020	d4b9f1e004a25bba47022b08c0ab200c4361f763ebb84c2932d79af2fafda576.exe
2020	d4b9f1e004a25bba47022b08c0ab200c4361f763ebb84c2932d79af2fafda576.exe
2020	d4b9f1e004a25bba47022b08c0ab200c4361f763ebb84c2932d79af2fafda576.exe
2020	d4b9f1e004a25bba47022b08c0ab200c4361f763ebb84c2932d79af2fafda576.exe
2020	d4b9f1e004a25bba47022b08c0ab200c4361f763ebb84c2932d79af2fafda576.exe
2020	d4b9f1e004a25bba47022b08c0ab200c4361f763ebb84c2932d79af2fafda576.exe
2020	d4b9f1e004a25bba47022b08c0ab200c4361f763ebb84c2932d79af2fafda576.exe
2020	d4b9f1e004a25bba47022b08c0ab200c4361f763ebb84c2932d79af2fafda576.exe
2020	d4b9f1e004a25bba47022b08c0ab200c4361f763ebb84c2932d79af2fafda576.exe
2020	d4b9f1e004a25bba47022b08c0ab200c4361f763ebb84c2932d79af2fafda576.exe
2020	d4b9f1e004a25bba47022b08c0ab200c4361f763ebb84c2932d79af2fafda576.exe
2020	d4b9f1e004a25bba47022b08c0ab200c4361f763ebb84c2932d79af2fafda576.exe
2020	d4b9f1e004a25bba47022b08c0ab200c4361f763ebb84c2932d79af2fafda576.exe
2020	d4b9f1e004a25bba47022b08c0ab200c4361f763ebb84c2932d79af2fafda576.exe
2020	d4b9f1e004a25bba47022b08c0ab200c4361f763ebb84c2932d79af2fafda576.exe
2020	d4b9f1e004a25bba47022b08c0ab200c4361f763ebb84c2932d79af2fafda576.exe
2020	d4b9f1e004a25bba47022b08c0ab200c4361f763ebb84c2932d79af2fafda576.exe
2020	d4b9f1e004a25bba47022b08c0ab200c4361f763ebb84c2932d79af2fafda576.exe
2020	d4b9f1e004a25bba47022b08c0ab200c4361f763ebb84c2932d79af2fafda576.exe
2020	d4b9f1e004a25bba47022b08c0ab200c4361f763ebb84c2932d79af2fafda576.exe
2020	d4b9f1e004a25bba47022b08c0ab200c4361f763ebb84c2932d79af2fafda576.exe
2020	d4b9f1e004a25bba47022b08c0ab200c4361f763ebb84c2932d79af2fafda576.exe
2020	d4b9f1e004a25bba47022b08c0ab200c4361f763ebb84c2932d79af2fafda576.exe
2020	d4b9f1e004a25bba47022b08c0ab200c4361f763ebb84c2932d79af2fafda576.exe
2020	d4b9f1e004a25bba47022b08c0ab200c4361f763ebb84c2932d79af2fafda576.exe
2020	d4b9f1e004a25bba47022b08c0ab200c4361f763ebb84c2932d79af2fafda576.exe
2020	d4b9f1e004a25bba47022b08c0ab200c4361f763ebb84c2932d79af2fafda576.exe
2020	d4b9f1e004a25bba47022b08c0ab200c4361f763ebb84c2932d79af2fafda576.exe
2020	d4b9f1e004a25bba47022b08c0ab200c4361f763ebb84c2932d79af2fafda576.exe
2020	d4b9f1e004a25bba47022b08c0ab200c4361f763ebb84c2932d79af2fafda576.exe
2020	d4b9f1e004a25bba47022b08c0ab200c4361f763ebb84c2932d79af2fafda576.exe
2020	d4b9f1e004a25bba47022b08c0ab200c4361f763ebb84c2932d79af2fafda576.exe
2020	d4b9f1e004a25bba47022b08c0ab200c4361f763ebb84c2932d79af2fafda576.exe
2020	d4b9f1e004a25bba47022b08c0ab200c4361f763ebb84c2932d79af2fafda576.exe
2020	d4b9f1e004a25bba47022b08c0ab200c4361f763ebb84c2932d79af2fafda576.exe
2020	d4b9f1e004a25bba47022b08c0ab200c4361f763ebb84c2932d79af2fafda576.exe
2020	d4b9f1e004a25bba47022b08c0ab200c4361f763ebb84c2932d79af2fafda576.exe
2020	d4b9f1e004a25bba47022b08c0ab200c4361f763ebb84c2932d79af2fafda576.exe
2020	d4b9f1e004a25bba47022b08c0ab200c4361f763ebb84c2932d79af2fafda576.exe
2020	d4b9f1e004a25bba47022b08c0ab200c4361f763ebb84c2932d79af2fafda576.exe
2020	d4b9f1e004a25bba47022b08c0ab200c4361f763ebb84c2932d79af2fafda576.exe
2020	d4b9f1e004a25bba47022b08c0ab200c4361f763ebb84c2932d79af2fafda576.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2020 wrote to memory of 2116	2020	d4b9f1e004a25bba47022b08c0ab200c4361f763ebb84c2932d79af2fafda576.exe	88
PID 2020 wrote to memory of 4476	2020	d4b9f1e004a25bba47022b08c0ab200c4361f763ebb84c2932d79af2fafda576.exe	90
PID 2020 wrote to memory of 2388	2020	d4b9f1e004a25bba47022b08c0ab200c4361f763ebb84c2932d79af2fafda576.exe	92
PID 4476 wrote to memory of 2524	4476	cmd.exe	94
PID 2388 wrote to memory of 2680	2388	cmd.exe	95
PID 2020 wrote to memory of 1396	2020	d4b9f1e004a25bba47022b08c0ab200c4361f763ebb84c2932d79af2fafda576.exe	96
PID 2020 wrote to memory of 4212	2020	d4b9f1e004a25bba47022b08c0ab200c4361f763ebb84c2932d79af2fafda576.exe	97
PID 2020 wrote to memory of 4116	2020	d4b9f1e004a25bba47022b08c0ab200c4361f763ebb84c2932d79af2fafda576.exe	99
PID 2020 wrote to memory of 3200	2020	d4b9f1e004a25bba47022b08c0ab200c4361f763ebb84c2932d79af2fafda576.exe	100
PID 2020 wrote to memory of 4992	2020	d4b9f1e004a25bba47022b08c0ab200c4361f763ebb84c2932d79af2fafda576.exe	104
PID 2020 wrote to memory of 6032	2020	d4b9f1e004a25bba47022b08c0ab200c4361f763ebb84c2932d79af2fafda576.exe	105
PID 2020 wrote to memory of 5668	2020	d4b9f1e004a25bba47022b08c0ab200c4361f763ebb84c2932d79af2fafda576.exe	106
PID 2020 wrote to memory of 1572	2020	d4b9f1e004a25bba47022b08c0ab200c4361f763ebb84c2932d79af2fafda576.exe	110
PID 2020 wrote to memory of 4328	2020	d4b9f1e004a25bba47022b08c0ab200c4361f763ebb84c2932d79af2fafda576.exe	112
PID 2020 wrote to memory of 4880	2020	d4b9f1e004a25bba47022b08c0ab200c4361f763ebb84c2932d79af2fafda576.exe	114
PID 2020 wrote to memory of 4492	2020	d4b9f1e004a25bba47022b08c0ab200c4361f763ebb84c2932d79af2fafda576.exe	115
PID 2020 wrote to memory of 1848	2020	d4b9f1e004a25bba47022b08c0ab200c4361f763ebb84c2932d79af2fafda576.exe	118
PID 2020 wrote to memory of 1432	2020	d4b9f1e004a25bba47022b08c0ab200c4361f763ebb84c2932d79af2fafda576.exe	119
PID 2020 wrote to memory of 6044	2020	d4b9f1e004a25bba47022b08c0ab200c4361f763ebb84c2932d79af2fafda576.exe	122
PID 2020 wrote to memory of 2376	2020	d4b9f1e004a25bba47022b08c0ab200c4361f763ebb84c2932d79af2fafda576.exe	124
PID 2020 wrote to memory of 900	2020	d4b9f1e004a25bba47022b08c0ab200c4361f763ebb84c2932d79af2fafda576.exe	125
PID 2020 wrote to memory of 2396	2020	d4b9f1e004a25bba47022b08c0ab200c4361f763ebb84c2932d79af2fafda576.exe	128
PID 2020 wrote to memory of 2948	2020	d4b9f1e004a25bba47022b08c0ab200c4361f763ebb84c2932d79af2fafda576.exe	130
PID 2020 wrote to memory of 5420	2020	d4b9f1e004a25bba47022b08c0ab200c4361f763ebb84c2932d79af2fafda576.exe	132
PID 2020 wrote to memory of 3760	2020	d4b9f1e004a25bba47022b08c0ab200c4361f763ebb84c2932d79af2fafda576.exe	134
PID 2020 wrote to memory of 4460	2020	d4b9f1e004a25bba47022b08c0ab200c4361f763ebb84c2932d79af2fafda576.exe	136
PID 2020 wrote to memory of 1996	2020	d4b9f1e004a25bba47022b08c0ab200c4361f763ebb84c2932d79af2fafda576.exe	137
PID 2020 wrote to memory of 2172	2020	d4b9f1e004a25bba47022b08c0ab200c4361f763ebb84c2932d79af2fafda576.exe	139
PID 2020 wrote to memory of 2356	2020	d4b9f1e004a25bba47022b08c0ab200c4361f763ebb84c2932d79af2fafda576.exe	142
PID 2020 wrote to memory of 5456	2020	d4b9f1e004a25bba47022b08c0ab200c4361f763ebb84c2932d79af2fafda576.exe	144
PID 2020 wrote to memory of 1960	2020	d4b9f1e004a25bba47022b08c0ab200c4361f763ebb84c2932d79af2fafda576.exe	146
PID 2020 wrote to memory of 4864	2020	d4b9f1e004a25bba47022b08c0ab200c4361f763ebb84c2932d79af2fafda576.exe	148
PID 2020 wrote to memory of 5496	2020	d4b9f1e004a25bba47022b08c0ab200c4361f763ebb84c2932d79af2fafda576.exe	150
PID 2020 wrote to memory of 3800	2020	d4b9f1e004a25bba47022b08c0ab200c4361f763ebb84c2932d79af2fafda576.exe	152
PID 2020 wrote to memory of 4276	2020	d4b9f1e004a25bba47022b08c0ab200c4361f763ebb84c2932d79af2fafda576.exe	154
PID 2020 wrote to memory of 1608	2020	d4b9f1e004a25bba47022b08c0ab200c4361f763ebb84c2932d79af2fafda576.exe	156
PID 2020 wrote to memory of 5484	2020	d4b9f1e004a25bba47022b08c0ab200c4361f763ebb84c2932d79af2fafda576.exe	158
PID 2020 wrote to memory of 2240	2020	d4b9f1e004a25bba47022b08c0ab200c4361f763ebb84c2932d79af2fafda576.exe	160
PID 2020 wrote to memory of 5392	2020	d4b9f1e004a25bba47022b08c0ab200c4361f763ebb84c2932d79af2fafda576.exe	162
PID 2020 wrote to memory of 2888	2020	d4b9f1e004a25bba47022b08c0ab200c4361f763ebb84c2932d79af2fafda576.exe	164
PID 2020 wrote to memory of 4196	2020	d4b9f1e004a25bba47022b08c0ab200c4361f763ebb84c2932d79af2fafda576.exe	166
PID 2020 wrote to memory of 5276	2020	d4b9f1e004a25bba47022b08c0ab200c4361f763ebb84c2932d79af2fafda576.exe	168
PID 2020 wrote to memory of 5752	2020	d4b9f1e004a25bba47022b08c0ab200c4361f763ebb84c2932d79af2fafda576.exe	170
PID 2020 wrote to memory of 2316	2020	d4b9f1e004a25bba47022b08c0ab200c4361f763ebb84c2932d79af2fafda576.exe	172
PID 2020 wrote to memory of 5236	2020	d4b9f1e004a25bba47022b08c0ab200c4361f763ebb84c2932d79af2fafda576.exe	174
PID 2020 wrote to memory of 4632	2020	d4b9f1e004a25bba47022b08c0ab200c4361f763ebb84c2932d79af2fafda576.exe	176
PID 2020 wrote to memory of 5976	2020	d4b9f1e004a25bba47022b08c0ab200c4361f763ebb84c2932d79af2fafda576.exe	178
PID 2020 wrote to memory of 1988	2020	d4b9f1e004a25bba47022b08c0ab200c4361f763ebb84c2932d79af2fafda576.exe	180
PID 2020 wrote to memory of 3484	2020	d4b9f1e004a25bba47022b08c0ab200c4361f763ebb84c2932d79af2fafda576.exe	182
PID 2020 wrote to memory of 4168	2020	d4b9f1e004a25bba47022b08c0ab200c4361f763ebb84c2932d79af2fafda576.exe	184
PID 2020 wrote to memory of 4140	2020	d4b9f1e004a25bba47022b08c0ab200c4361f763ebb84c2932d79af2fafda576.exe	186
PID 2020 wrote to memory of 5932	2020	d4b9f1e004a25bba47022b08c0ab200c4361f763ebb84c2932d79af2fafda576.exe	188
PID 2020 wrote to memory of 5760	2020	d4b9f1e004a25bba47022b08c0ab200c4361f763ebb84c2932d79af2fafda576.exe	190
PID 2020 wrote to memory of 3972	2020	d4b9f1e004a25bba47022b08c0ab200c4361f763ebb84c2932d79af2fafda576.exe	192
PID 2020 wrote to memory of 1404	2020	d4b9f1e004a25bba47022b08c0ab200c4361f763ebb84c2932d79af2fafda576.exe	194
PID 2020 wrote to memory of 4884	2020	d4b9f1e004a25bba47022b08c0ab200c4361f763ebb84c2932d79af2fafda576.exe	196
PID 2020 wrote to memory of 4692	2020	d4b9f1e004a25bba47022b08c0ab200c4361f763ebb84c2932d79af2fafda576.exe	198
PID 2020 wrote to memory of 4372	2020	d4b9f1e004a25bba47022b08c0ab200c4361f763ebb84c2932d79af2fafda576.exe	200
PID 2020 wrote to memory of 204	2020	d4b9f1e004a25bba47022b08c0ab200c4361f763ebb84c2932d79af2fafda576.exe	202
PID 2020 wrote to memory of 4492	2020	d4b9f1e004a25bba47022b08c0ab200c4361f763ebb84c2932d79af2fafda576.exe	204
PID 2020 wrote to memory of 3580	2020	d4b9f1e004a25bba47022b08c0ab200c4361f763ebb84c2932d79af2fafda576.exe	206
PID 2020 wrote to memory of 1180	2020	d4b9f1e004a25bba47022b08c0ab200c4361f763ebb84c2932d79af2fafda576.exe	208
PID 2020 wrote to memory of 4464	2020	d4b9f1e004a25bba47022b08c0ab200c4361f763ebb84c2932d79af2fafda576.exe	210
PID 2020 wrote to memory of 2560	2020	d4b9f1e004a25bba47022b08c0ab200c4361f763ebb84c2932d79af2fafda576.exe	212

C:\Users\Admin\AppData\Local\Temp\d4b9f1e004a25bba47022b08c0ab200c4361f763ebb84c2932d79af2fafda576.exe
"C:\Users\Admin\AppData\Local\Temp\d4b9f1e004a25bba47022b08c0ab200c4361f763ebb84c2932d79af2fafda576.exe"
1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2020
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del c:\ipEdit.ini
  2⤵
  PID:2116
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c netsh advfirewall firewall set rule name="ipedit.exe" dir=in program="C:\Users\Admin\AppData\Local\Temp\d4b9f1e004a25bba47022b08c0ab200c4361f763ebb84c2932d79af2fafda576.exe" new enable=yes profile=private,public action=allow
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4476
- - C:\Windows\SysWOW64\netsh.exe
    netsh advfirewall firewall set rule name="ipedit.exe" dir=in program="C:\Users\Admin\AppData\Local\Temp\d4b9f1e004a25bba47022b08c0ab200c4361f763ebb84c2932d79af2fafda576.exe" new enable=yes profile=private,public action=allow
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    PID:2524
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c netsh advfirewall firewall set rule name="ipEdit with DHCPServer" dir=in program="C:\Users\Admin\AppData\Local\Temp\d4b9f1e004a25bba47022b08c0ab200c4361f763ebb84c2932d79af2fafda576.exe" new enable=yes profile=private,public action=allow
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2388
- - C:\Windows\SysWOW64\netsh.exe
    netsh advfirewall firewall set rule name="ipEdit with DHCPServer" dir=in program="C:\Users\Admin\AppData\Local\Temp\d4b9f1e004a25bba47022b08c0ab200c4361f763ebb84c2932d79af2fafda576.exe" new enable=yes profile=private,public action=allow
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:2680
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del c:\ipEdit.ini
  2⤵
  PID:1396
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del MyUpdate.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4212
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del list.ini
  2⤵
  PID:4116
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del *ipEdit*.rar
  2⤵
  PID:3200
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del MyUpdate.exe
  2⤵
  PID:4992
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del list.ini
  2⤵
  PID:6032
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del *ipEdit*.rar
  2⤵
  PID:5668
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del ipEdit.state
  2⤵
  PID:1572
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del MyUpdate.exe
  2⤵
  PID:4328
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del list.ini
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4880
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del *ipEdit*.rar
  2⤵
  PID:4492
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del MyUpdate.exe
  2⤵
  PID:1848
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del list.ini
  2⤵
  PID:1432
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del *ipEdit*.rar
  2⤵
  PID:6044
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del MyUpdate.exe
  2⤵
  PID:2376
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del list.ini
  2⤵
  PID:900
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del *ipEdit*.rar
  2⤵
  PID:2396
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del MyUpdate.exe
  2⤵
  PID:2948
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del list.ini
  2⤵
  PID:5420
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del *ipEdit*.rar
  2⤵
  PID:3760
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del MyUpdate.exe
  2⤵
  PID:4460
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del list.ini
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1996
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del *ipEdit*.rar
  2⤵
  PID:2172
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del MyUpdate.exe
  2⤵
  PID:2356
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del list.ini
  2⤵
  PID:5456
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del *ipEdit*.rar
  2⤵
  PID:1960
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del MyUpdate.exe
  2⤵
  PID:4864
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del list.ini
  2⤵
  PID:5496
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del *ipEdit*.rar
  2⤵
  PID:3800
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del MyUpdate.exe
  2⤵
  PID:4276
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del list.ini
  2⤵
  PID:1608
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del *ipEdit*.rar
  2⤵
  PID:5484
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del MyUpdate.exe
  2⤵
  PID:2240
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del list.ini
  2⤵
  PID:5392
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del *ipEdit*.rar
  2⤵
  PID:2888
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del MyUpdate.exe
  2⤵
  PID:4196
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del list.ini
  2⤵
  PID:5276
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del *ipEdit*.rar
  2⤵
  PID:5752
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del MyUpdate.exe
  2⤵
  PID:2316
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del list.ini
  2⤵
  PID:5236
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del *ipEdit*.rar
  2⤵
  PID:4632
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del MyUpdate.exe
  2⤵
  PID:5976
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del list.ini
  2⤵
  PID:1988
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del *ipEdit*.rar
  2⤵
  PID:3484
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del MyUpdate.exe
  2⤵
  PID:4168
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del list.ini
  2⤵
  PID:4140
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del *ipEdit*.rar
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5932
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del MyUpdate.exe
  2⤵
  PID:5760
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del list.ini
  2⤵
  PID:3972
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del *ipEdit*.rar
  2⤵
  PID:1404
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del MyUpdate.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4884
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del list.ini
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4692
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del *ipEdit*.rar
  2⤵
  PID:4372
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del MyUpdate.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:204
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del list.ini
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4492
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del *ipEdit*.rar
  2⤵
  PID:3580
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del MyUpdate.exe
  2⤵
  PID:1180
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del list.ini
  2⤵
  PID:4464
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del *ipEdit*.rar
  2⤵
  PID:2560
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del MyUpdate.exe
  2⤵
  PID:4180
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del list.ini
  2⤵
  PID:3716
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del *ipEdit*.rar
  2⤵
  PID:4192
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del MyUpdate.exe
  2⤵
  PID:5848
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del list.ini
  2⤵
  PID:6076
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del *ipEdit*.rar
  2⤵
  PID:1340
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del MyUpdate.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4664
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del list.ini
  2⤵
  PID:5556
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del *ipEdit*.rar
  2⤵
  PID:1996
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del MyUpdate.exe
  2⤵
  PID:1400
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del list.ini
  2⤵
  PID:2700
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del *ipEdit*.rar
  2⤵
  PID:3208
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del MyUpdate.exe
  2⤵
  PID:4864
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del list.ini
  2⤵
  PID:1896
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del *ipEdit*.rar
  2⤵
  PID:2876
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del MyUpdate.exe
  2⤵
  PID:1624
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del list.ini
  2⤵
  PID:936
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del *ipEdit*.rar
  2⤵
  PID:4332
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del MyUpdate.exe
  2⤵
  PID:2240
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del list.ini
  2⤵
  PID:3684
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del *ipEdit*.rar
  2⤵
  PID:3104
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del MyUpdate.exe
  2⤵
  PID:3516
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del list.ini
  2⤵
  PID:2756
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del *ipEdit*.rar
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2728
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del MyUpdate.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2688
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del list.ini
  2⤵
  PID:4632
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del *ipEdit*.rar
  2⤵
  PID:4660
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del MyUpdate.exe
  2⤵
  PID:4268
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del list.ini
  2⤵
  PID:4728
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del *ipEdit*.rar
  2⤵
  PID:4344
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del MyUpdate.exe
  2⤵
  PID:4608
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del list.ini
  2⤵
  PID:3972
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del *ipEdit*.rar
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2488
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del MyUpdate.exe
  2⤵
  PID:5924
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del list.ini
  2⤵
  PID:4884
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del *ipEdit*.rar
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2308
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del MyUpdate.exe
  2⤵
  PID:5240
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del list.ini
  2⤵
  PID:4360
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del *ipEdit*.rar
  2⤵
  PID:3408
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del MyUpdate.exe
  2⤵
  PID:3172
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del list.ini
  2⤵
  PID:4644
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del *ipEdit*.rar
  2⤵
  PID:6044
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del MyUpdate.exe
  2⤵
  PID:3080
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del list.ini
  2⤵
  PID:1108
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del *ipEdit*.rar
  2⤵
  PID:1832
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del MyUpdate.exe
  2⤵
  PID:2564
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del list.ini
  2⤵
  PID:5904
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del *ipEdit*.rar
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2952
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del MyUpdate.exe
  2⤵
  PID:4664
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del list.ini
  2⤵
  PID:5112
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del *ipEdit*.rar
  2⤵
  PID:2748
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del MyUpdate.exe
  2⤵
  PID:5116
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del list.ini
  2⤵
  PID:5716
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del *ipEdit*.rar
  2⤵
  PID:3548
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del MyUpdate.exe
  2⤵
  PID:1388
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del list.ini
  2⤵
  PID:6012
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del *ipEdit*.rar
  2⤵
  PID:2876
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del MyUpdate.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2880
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del list.ini
  2⤵
  PID:3692
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del *ipEdit*.rar
  2⤵
  PID:6108
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del MyUpdate.exe
  2⤵
  PID:4780
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del list.ini
  2⤵
  PID:3704
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del *ipEdit*.rar
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4892
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del MyUpdate.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5428
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del list.ini
  2⤵
  PID:2316
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del *ipEdit*.rar
  2⤵
  PID:4244
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del MyUpdate.exe
  2⤵
  PID:2760
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del list.ini
  2⤵
  PID:5344
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del *ipEdit*.rar
  2⤵
  PID:1988
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del MyUpdate.exe
  2⤵
  PID:5860
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del list.ini
  2⤵
  PID:5408
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del *ipEdit*.rar
  2⤵
  PID:1080
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del MyUpdate.exe
  2⤵
  PID:4432
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del list.ini
  2⤵
  PID:1920
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del *ipEdit*.rar
  2⤵
  PID:4088
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del MyUpdate.exe
  2⤵
  PID:2428
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del list.ini
  2⤵
  PID:2488
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del *ipEdit*.rar
  2⤵
  PID:3364
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del MyUpdate.exe
  2⤵
  PID:2768
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del list.ini
  2⤵
  PID:4328
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del *ipEdit*.rar
  2⤵
  PID:6072
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del MyUpdate.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:204
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del list.ini
  2⤵
  PID:5400
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del *ipEdit*.rar
  2⤵
  PID:4492
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del MyUpdate.exe
  2⤵
  PID:1180
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del list.ini
  2⤵
  PID:3248
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del *ipEdit*.rar
  2⤵
  PID:760
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del MyUpdate.exe
  2⤵
  PID:3156
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del list.ini
  2⤵
  PID:800
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del *ipEdit*.rar
  2⤵
  PID:3964
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del MyUpdate.exe
  2⤵
  PID:3584
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del list.ini
  2⤵
  PID:4592
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del *ipEdit*.rar
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3392
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del MyUpdate.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4664
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del list.ini
  2⤵
  PID:3452
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del *ipEdit*.rar
  2⤵
  PID:4868
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del MyUpdate.exe
  2⤵
  PID:724
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del list.ini
  2⤵
  PID:5320
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del *ipEdit*.rar
  2⤵
  PID:3548
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del MyUpdate.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1388
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del list.ini
  2⤵
  PID:1212
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del *ipEdit*.rar
  2⤵
  PID:4276
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del MyUpdate.exe
  2⤵
  PID:3152
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del list.ini
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4488
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del *ipEdit*.rar
  2⤵
  PID:4228
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del MyUpdate.exe
  2⤵
  PID:2476
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del list.ini
  2⤵
  PID:4304
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del *ipEdit*.rar
  2⤵
  PID:1112
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del MyUpdate.exe
  2⤵
  PID:2904
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del list.ini
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5976
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del *ipEdit*.rar
  2⤵
  PID:4280
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del MyUpdate.exe
  2⤵
  PID:4324
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del list.ini
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5344
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del *ipEdit*.rar
  2⤵
  PID:5304
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del MyUpdate.exe
  2⤵
  PID:5880
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del list.ini
  2⤵
  PID:4300
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del *ipEdit*.rar
  2⤵
  PID:5932
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del MyUpdate.exe
  2⤵
  PID:4148
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del list.ini
  2⤵
  PID:1404
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del *ipEdit*.rar
  2⤵
  PID:2968
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del MyUpdate.exe
  2⤵
  PID:628
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del list.ini
  2⤵
  PID:5924
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del *ipEdit*.rar
  2⤵
  PID:2308
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del MyUpdate.exe
  2⤵
  PID:6028
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del list.ini
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2724
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del *ipEdit*.rar
  2⤵
  PID:2540
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del MyUpdate.exe
  2⤵
  PID:2212
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del list.ini
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4556
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del *ipEdit*.rar
  2⤵
  PID:712
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del MyUpdate.exe
  2⤵
  PID:2468
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del list.ini
  2⤵
  PID:2396
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del *ipEdit*.rar
  2⤵
  PID:1160
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del MyUpdate.exe
  2⤵
  PID:3956
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del list.ini
  2⤵
  PID:6076
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del *ipEdit*.rar
  2⤵
  PID:4592
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del MyUpdate.exe
  2⤵
  PID:3360
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del list.ini
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1828
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del *ipEdit*.rar
  2⤵
  PID:3452
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del MyUpdate.exe
  2⤵
  PID:3140
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del list.ini
  2⤵
  PID:2552
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del *ipEdit*.rar
  2⤵
  PID:1084
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del MyUpdate.exe
  2⤵
  PID:920
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del list.ini
  2⤵
  PID:1712
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del *ipEdit*.rar
  2⤵
  PID:1656
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del MyUpdate.exe
  2⤵
  PID:3692
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del list.ini
  2⤵
  PID:2204
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del *ipEdit*.rar
  2⤵
  PID:5724
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del MyUpdate.exe
  2⤵
  PID:352
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del list.ini
  2⤵
  PID:2756
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del *ipEdit*.rar
  2⤵
  PID:4172
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del MyUpdate.exe
  2⤵
  PID:3264
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del list.ini
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2760
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del *ipEdit*.rar
  2⤵
  PID:5040
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del MyUpdate.exe
  2⤵
  PID:5108
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del list.ini
  2⤵
  PID:1532
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del *ipEdit*.rar
  2⤵
  PID:5488
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del MyUpdate.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4700
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del list.ini
  2⤵
  PID:280
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del *ipEdit*.rar
  2⤵
  PID:4992
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del MyUpdate.exe
  2⤵
  PID:3396
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del list.ini
  2⤵
  PID:3924
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del *ipEdit*.rar
  2⤵
  PID:5748
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del MyUpdate.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4124
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del list.ini
  2⤵
  PID:6016
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del *ipEdit*.rar
  2⤵
  PID:620
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del MyUpdate.exe
  2⤵
  PID:4884
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del list.ini
  2⤵
  PID:4312
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del *ipEdit*.rar
  2⤵
  PID:5224
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del MyUpdate.exe
  2⤵
  PID:3060
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del list.ini
  2⤵
  PID:2520
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del *ipEdit*.rar
  2⤵
  PID:2212
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del MyUpdate.exe
  2⤵
  PID:1092
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del list.ini
  2⤵
  PID:968
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del *ipEdit*.rar
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2396
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del MyUpdate.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5904
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del list.ini
  2⤵
  PID:2288
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del *ipEdit*.rar
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2032
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del MyUpdate.exe
  2⤵
  PID:5844
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del list.ini
  2⤵
  PID:3312
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del *ipEdit*.rar
  2⤵
  PID:5700
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del MyUpdate.exe
  2⤵
  PID:2356
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del list.ini
  2⤵
  PID:2900
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del *ipEdit*.rar
  2⤵
  PID:1508
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del MyUpdate.exe
  2⤵
  PID:4636
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del list.ini
  2⤵
  PID:1952
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del *ipEdit*.rar
  2⤵
  PID:5020
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del MyUpdate.exe
  2⤵
  PID:920
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del list.ini
  2⤵
  PID:1712
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del *ipEdit*.rar
  2⤵
  PID:1336
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del MyUpdate.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4332
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del list.ini
  2⤵
  PID:3684
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del *ipEdit*.rar
  2⤵
  PID:4488
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del MyUpdate.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2432
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del list.ini
  2⤵
  PID:4108
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del *ipEdit*.rar
  2⤵
  PID:3400
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del MyUpdate.exe
  2⤵
  PID:1824
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del list.ini
  2⤵
  PID:3696
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del *ipEdit*.rar
  2⤵
  PID:4172
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del MyUpdate.exe
  2⤵
  PID:5492
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del list.ini
  2⤵
  PID:2244
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del *ipEdit*.rar
  2⤵
  PID:5976
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del MyUpdate.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5408
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del list.ini
  2⤵
  PID:3492
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del *ipEdit*.rar
  2⤵
  PID:5488
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del MyUpdate.exe
  2⤵
  PID:4140
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del list.ini
  2⤵
  PID:4700
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del *ipEdit*.rar
  2⤵
  PID:4512
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del MyUpdate.exe
  2⤵
  PID:3212
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del list.ini
  2⤵
  PID:6032
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del *ipEdit*.rar
  2⤵
  PID:2024
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del MyUpdate.exe
  2⤵
  PID:2852
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del list.ini
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2524
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del *ipEdit*.rar
  2⤵
  PID:4428
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del MyUpdate.exe
  2⤵
  PID:1848
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del list.ini
  2⤵
  PID:5808
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del *ipEdit*.rar
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1632
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del MyUpdate.exe
  2⤵
  PID:2220
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del list.ini
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1928
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del *ipEdit*.rar
  2⤵
  PID:792
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del MyUpdate.exe
  2⤵
  PID:2232
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del list.ini
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5916
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del *ipEdit*.rar
  2⤵
  PID:6056
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del MyUpdate.exe
  2⤵
  PID:2584
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del list.ini
  2⤵
  PID:4984
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del *ipEdit*.rar
  2⤵
  PID:2288
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del MyUpdate.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2656
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del list.ini
  2⤵
  PID:5336
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del *ipEdit*.rar
  2⤵
  PID:5148
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del MyUpdate.exe
  2⤵
  PID:4624
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del list.ini
  2⤵
  PID:4740
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del *ipEdit*.rar
  2⤵
  PID:1368
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del MyUpdate.exe
  2⤵
  PID:5496
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del list.ini
  2⤵
  PID:2552
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del *ipEdit*.rar
  2⤵
  PID:4356
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del MyUpdate.exe
  2⤵
  PID:3800
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del list.ini
  2⤵
  PID:2600
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del *ipEdit*.rar
  2⤵
  PID:2340
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del MyUpdate.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:244
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del list.ini
  2⤵
  PID:208
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del *ipEdit*.rar
  2⤵
  PID:4376
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del MyUpdate.exe
  2⤵
  PID:5032
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del list.ini
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1520
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del *ipEdit*.rar
  2⤵
  PID:4872
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del MyUpdate.exe
  2⤵
  PID:3292
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del list.ini
  2⤵
  PID:5452
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del *ipEdit*.rar
  2⤵
  PID:3188
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del MyUpdate.exe
  2⤵
  PID:3828
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del list.ini
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1912
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del *ipEdit*.rar
  2⤵
  PID:4248
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del MyUpdate.exe
  2⤵
  PID:5388
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del list.ini
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4980
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del *ipEdit*.rar
  2⤵
  PID:5468
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del MyUpdate.exe
  2⤵
  PID:4508
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del list.ini
  2⤵
  PID:5488
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del *ipEdit*.rar
  2⤵
  PID:5792
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del MyUpdate.exe
  2⤵
  PID:5404
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del list.ini
  2⤵
  PID:4700
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del *ipEdit*.rar
  2⤵
  PID:3484
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del MyUpdate.exe
  2⤵
  PID:3924
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del list.ini
  2⤵
  PID:3972
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del *ipEdit*.rar
  2⤵
  PID:6060
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del MyUpdate.exe
  2⤵
  PID:1008
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del list.ini
  2⤵
  PID:4428
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del *ipEdit*.rar
  2⤵
  PID:3020
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del MyUpdate.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4308
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del list.ini
  2⤵
  PID:2892
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del *ipEdit*.rar
  2⤵
  PID:1632
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del MyUpdate.exe
  2⤵
  PID:3472
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del list.ini
  2⤵
  PID:2468
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del *ipEdit*.rar
  2⤵
  PID:1052
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del MyUpdate.exe
  2⤵
  PID:3116
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del list.ini
  2⤵
  PID:5480
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del *ipEdit*.rar
  2⤵
  PID:5556
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del MyUpdate.exe
  2⤵
  PID:4592
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del list.ini
  2⤵
  PID:992
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del *ipEdit*.rar
  2⤵
  PID:5384
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del MyUpdate.exe
  2⤵
  PID:4664
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del list.ini
  2⤵
  PID:5712
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del *ipEdit*.rar
  2⤵
  PID:2356
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del MyUpdate.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1204
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del list.ini
  2⤵
  PID:4996
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del *ipEdit*.rar
  2⤵
  PID:4744
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del MyUpdate.exe
  2⤵
  PID:720
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del list.ini
  2⤵
  PID:2208
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del *ipEdit*.rar
  2⤵
  - System Location Discovery: System Language Discovery
  PID:920
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del MyUpdate.exe
  2⤵
  PID:2600
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del list.ini
  2⤵
  PID:2888
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del *ipEdit*.rar
  2⤵
  PID:2204
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del MyUpdate.exe
  2⤵
  PID:5296
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del list.ini
  2⤵
  PID:5312
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del *ipEdit*.rar
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2416
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del MyUpdate.exe
  2⤵
  PID:2972
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del list.ini
  2⤵
  PID:3516
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del *ipEdit*.rar
  2⤵
  PID:4780
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del MyUpdate.exe
  2⤵
  PID:3084
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del list.ini
  2⤵
  PID:3828
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del *ipEdit*.rar
  2⤵
  PID:4216
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del MyUpdate.exe
  2⤵
  PID:4244
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del list.ini
  2⤵
  PID:5408
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del *ipEdit*.rar
  2⤵
  PID:5468
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del MyUpdate.exe
  2⤵
  PID:2364
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del list.ini
  2⤵
  PID:2640
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del *ipEdit*.rar
  2⤵
  PID:5048
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del MyUpdate.exe
  2⤵
  PID:2968
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del list.ini
  2⤵
  PID:1924
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del *ipEdit*.rar
  2⤵
  PID:4340
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del MyUpdate.exe
  2⤵
  PID:2492
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del list.ini
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4112
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del *ipEdit*.rar
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5924
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del MyUpdate.exe
  2⤵
  PID:5284
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del list.ini
  2⤵
  PID:6028
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del *ipEdit*.rar
  2⤵
  PID:2724
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del MyUpdate.exe
  2⤵
  PID:2520
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del list.ini
  2⤵
  PID:1392
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del *ipEdit*.rar
  2⤵
  PID:5616
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del MyUpdate.exe
  2⤵
  PID:3984
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del list.ini
  2⤵
  PID:1092
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del *ipEdit*.rar
  2⤵
  PID:6008
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del MyUpdate.exe
  2⤵
  PID:1892
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del list.ini
  2⤵
  PID:5464
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del *ipEdit*.rar
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2564
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del MyUpdate.exe
  2⤵
  PID:3312
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del list.ini
  2⤵
  PID:5072
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del *ipEdit*.rar
  2⤵
  PID:4864
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del MyUpdate.exe
  2⤵
  PID:5992
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del list.ini
  2⤵
  PID:2296
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del *ipEdit*.rar
  2⤵
  PID:1084
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del MyUpdate.exe
  2⤵
  PID:1508
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del list.ini
  2⤵
  PID:5824
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del *ipEdit*.rar
  2⤵
  PID:252
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del MyUpdate.exe
  2⤵
  PID:2944
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del list.ini
  2⤵
  PID:2804
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del *ipEdit*.rar
  2⤵
  PID:5984
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del MyUpdate.exe
  2⤵
  PID:3448
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del list.ini
  2⤵
  PID:3944
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del *ipEdit*.rar
  2⤵
  PID:4188
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del MyUpdate.exe
  2⤵
  PID:5724
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del list.ini
  2⤵
  PID:5312
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del *ipEdit*.rar
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1600
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del MyUpdate.exe
  2⤵
  PID:2116
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del list.ini
  2⤵
  PID:4924
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del *ipEdit*.rar
  2⤵
  PID:2604
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del MyUpdate.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5184
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del list.ini
  2⤵
  PID:4660
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del *ipEdit*.rar
  2⤵
  PID:4976
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del MyUpdate.exe
  2⤵
  PID:1964
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del list.ini
  2⤵
  PID:5608
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del *ipEdit*.rar
  2⤵
  PID:4812
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del MyUpdate.exe
  2⤵
  PID:836
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del list.ini
  2⤵
  PID:1920
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del *ipEdit*.rar
  2⤵
  PID:4344
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del MyUpdate.exe
  2⤵
  PID:5404
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del list.ini
  2⤵
  PID:3396
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del *ipEdit*.rar
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1636
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del MyUpdate.exe
  2⤵
  PID:4340
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del list.ini
  2⤵
  PID:1172
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del *ipEdit*.rar
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3952
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del MyUpdate.exe
  2⤵
  PID:1848
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del list.ini
  2⤵
  PID:3248
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del *ipEdit*.rar
  2⤵
  PID:4756
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del MyUpdate.exe
  2⤵
  PID:4928
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del list.ini
  2⤵
  PID:4960
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del *ipEdit*.rar
  2⤵
  PID:3472
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del MyUpdate.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2396
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del list.ini
  2⤵
  PID:3156
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del *ipEdit*.rar
  2⤵
  PID:2868
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del MyUpdate.exe
  2⤵
  PID:3824
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del list.ini
  2⤵
  PID:2716
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del *ipEdit*.rar
  2⤵
  PID:5904
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del MyUpdate.exe
  2⤵
  PID:1176
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del list.ini
  2⤵
  PID:4592
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del *ipEdit*.rar
  2⤵
  PID:5700
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del MyUpdate.exe
  2⤵
  PID:3452
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del list.ini
  2⤵
  PID:364
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del *ipEdit*.rar
  2⤵
  PID:4680
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del MyUpdate.exe
  2⤵
  PID:4580
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del list.ini
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5472
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del *ipEdit*.rar
  2⤵
  PID:5496
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del MyUpdate.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2632
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del list.ini
  2⤵
  PID:4640
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del *ipEdit*.rar
  2⤵
  PID:5484
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del MyUpdate.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:6012
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del list.ini
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3440
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del *ipEdit*.rar
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3684
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del MyUpdate.exe
  2⤵
  PID:1156
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del list.ini
  2⤵
  - System Location Discovery: System Language Discovery
  PID:352
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del *ipEdit*.rar
  2⤵
  PID:2432
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del MyUpdate.exe
  2⤵
  PID:5452
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del list.ini
  2⤵
  PID:1072
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del *ipEdit*.rar
  2⤵
  PID:3704