

"net.exe" wrote 8 bytes to a remote process "C:\Windows\System32\net1.exe" (Handle: 116) "net.exe" wrote 52 bytes to a remote process "C:\Windows\System32\net1.exe" (Handle: 116) "net.exe" wrote 32 bytes to a remote process "C:\Windows\System32\net1.exe" (Handle: 116)

"" wrote 8 bytes to a remote process "C:\CCBoot.exe" (Handle: 544) "" wrote 52 bytes to a remote process "C:\CCBoot.exe" (Handle: 544) "" wrote 32 bytes to a remote process "C:\CCBoot.exe" (Handle: 544) "" wrote 8 bytes to a remote process "C:\Windows\System32\reg.exe" (Handle: 460) "" wrote 52 bytes to a remote process "C:\Windows\System32\reg.exe" (Handle: 460) "" wrote 32 bytes to a remote process "C:\Windows\System32\reg.exe" (Handle: 460) "" wrote 8 bytes to a remote process "C:\Windows\System32\net.exe" (Handle: 460) "" wrote 52 bytes to a remote process "C:\Windows\System32\net.exe" (Handle: 460) "" wrote 32 bytes to a remote process "C:\Windows\System32\net.exe" (Handle: 460) "" wrote 8 bytes to a remote process "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" (Handle: 460)

"" wrote 52 bytes to a remote process "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" (Handle: 460) "" wrote 32 bytes to a remote process "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" (Handle: 460) "" wrote 8 bytes to a remote process "C:\Windows\System32\wbem\WMIC.exe" (Handle: 460) "" wrote 52 bytes to a remote process "C:\Windows\System32\wbem\WMIC.exe" (Handle: 460) "" wrote 32 bytes to a remote process "%WINDIR%\System32\wbem\WMIC.exe" (Handle: 460)
