6f48ee57a66e9beac78c2ee53b9adb57abb0bc42231877a5d73c8a039e35e287

General

Target

1554ba4da5ebb3f1a3569f76fbcf8fcf_JaffaCakes118.exe
Size

47KB
MD5

1554ba4da5ebb3f1a3569f76fbcf8fcf
SHA1

f41f1adc228d717686f802da4c3cf8e5d7979f64
SHA256

6f48ee57a66e9beac78c2ee53b9adb57abb0bc42231877a5d73c8a039e35e287
SHA512

ae0abb5dfbbd667dcb11d5c975ebc1f9ec0987e5eacf6036b45e3f6f1ff76ad95e0a877f46242838719b2b91c49049011cc8185c10b4de3877ea9ddc6c7d3041
SSDEEP

768:23nOcThRrURtoEc2vQ3qJJqMUJBtM2W+NA1RGbI8zWzgmQPhlISITA5JBFN09dLf:2eUCwXSJJABeENnbp6z5SQkHi

Score

8^/10

defense_evasion discovery exploit persistence upx

Malware Config

Signatures

Possible privilege escalation attempt 2 IoCs
exploit

Processes:

takeown.exeicacls.exe

pid process

2360 takeown.exe
2768 icacls.exe
Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

2784 cmd.exe
Executes dropped EXE 1 IoCs

Processes:

wlock.exe

pid process

2804 wlock.exe
Loads dropped DLL 2 IoCs

Processes:

1554ba4da5ebb3f1a3569f76fbcf8fcf_JaffaCakes118.exe

pid process

2140 1554ba4da5ebb3f1a3569f76fbcf8fcf_JaffaCakes118.exe
2140 1554ba4da5ebb3f1a3569f76fbcf8fcf_JaffaCakes118.exe
Modifies file permissions 1 TTPs 2 IoCs
discovery

File and Directory Permissions Modification
T1222

Processes:

takeown.exeicacls.exe

pid process

2360 takeown.exe
2768 icacls.exe
UPX packed file 1 IoCs
Detects executables packed with UPX/modified UPX open source packer.
upx

Processes:

resource yara_rule

behavioral1/memory/2140-0-0x0000000000400000-0x000000000041D000-memory.dmp upx
Adds Run key to start application 2 TTPs 1 IoCs
persistence

Registry Run Keys / Startup Folder
T1547.001

Modify Registry
T1112

Processes:

reg.exe

description ioc process

Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\wlock = "C:\\Users\\Admin\\wlock\\wlock.exe" reg.exe
File and Directory Permissions Modification: Windows File and Directory Permissions Modification 1 TTPs
defense_evasion

Windows File and Directory Permissions Modification
T1222.001
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
2360	takeown.exe
2768	icacls.exe

pid	process
2784	cmd.exe

pid	process
2804	wlock.exe

pid	process
2140	1554ba4da5ebb3f1a3569f76fbcf8fcf_JaffaCakes118.exe
2140	1554ba4da5ebb3f1a3569f76fbcf8fcf_JaffaCakes118.exe

pid	process
2360	takeown.exe
2768	icacls.exe

resource	yara_rule
behavioral1/memory/2140-0-0x0000000000400000-0x000000000041D000-memory.dmp	upx

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\wlock = "C:\\Users\\Admin\\wlock\\wlock.exe"	reg.exe

Kills process with taskkill 64 IoCs

evasion

Processes:

taskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exe

pid	process
2556	taskkill.exe
2532	taskkill.exe
1492	taskkill.exe
1612	taskkill.exe
1716	taskkill.exe
764	taskkill.exe
1172	taskkill.exe
1548	taskkill.exe
1552	taskkill.exe
2024	taskkill.exe
1928	taskkill.exe
1512	taskkill.exe
1964	taskkill.exe
2512	taskkill.exe
1240	taskkill.exe
1464	taskkill.exe
1004	taskkill.exe
2152	taskkill.exe
2788	taskkill.exe
1440	taskkill.exe
2832	taskkill.exe
2304	taskkill.exe
1252	taskkill.exe
1496	taskkill.exe
1724	taskkill.exe
1204	taskkill.exe
2396	taskkill.exe
2768	taskkill.exe
2032	taskkill.exe
1884	taskkill.exe
604	taskkill.exe
1668	taskkill.exe
2924	taskkill.exe
3032	taskkill.exe
1904	taskkill.exe
2148	taskkill.exe
1928	taskkill.exe
2452	taskkill.exe
2464	taskkill.exe
3032	taskkill.exe
2780	taskkill.exe
2524	taskkill.exe
400	taskkill.exe
1876	taskkill.exe
2820	taskkill.exe
2072	taskkill.exe
1964	taskkill.exe
2748	taskkill.exe
300	taskkill.exe
2016	taskkill.exe
1604	taskkill.exe
2892	taskkill.exe
1540	taskkill.exe
1488	taskkill.exe
1512	taskkill.exe
2152	taskkill.exe
2272	taskkill.exe
2652	taskkill.exe
2488	taskkill.exe
2912	taskkill.exe
2036	taskkill.exe
1020	taskkill.exe
2484	taskkill.exe
324	taskkill.exe

Modifies Control Panel 1 IoCs
evasion

Processes:

wlock.exe

description ioc process

Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Control Panel\Desktop\ScreenSaveActive = "0" wlock.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Control Panel\Desktop\ScreenSaveActive = "0"	wlock.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

takeown.exe1554ba4da5ebb3f1a3569f76fbcf8fcf_JaffaCakes118.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exe

description	pid	process
Token: SeTakeOwnershipPrivilege	2360	takeown.exe
Token: SeIncBasePriorityPrivilege	2140	1554ba4da5ebb3f1a3569f76fbcf8fcf_JaffaCakes118.exe
Token: SeDebugPrivilege	2672	taskkill.exe
Token: SeDebugPrivilege	2032	taskkill.exe
Token: SeDebugPrivilege	2008	taskkill.exe
Token: SeDebugPrivilege	2900	taskkill.exe
Token: SeDebugPrivilege	1728	taskkill.exe
Token: SeDebugPrivilege	1548	taskkill.exe
Token: SeDebugPrivilege	908	taskkill.exe
Token: SeDebugPrivilege	1040	taskkill.exe
Token: SeDebugPrivilege	1740	taskkill.exe
Token: SeDebugPrivilege	3056	taskkill.exe
Token: SeDebugPrivilege	1584	taskkill.exe
Token: SeDebugPrivilege	872	taskkill.exe
Token: SeDebugPrivilege	1172	taskkill.exe
Token: SeDebugPrivilege	848	taskkill.exe
Token: SeDebugPrivilege	2152	taskkill.exe
Token: SeDebugPrivilege	300	taskkill.exe
Token: SeDebugPrivilege	2864	taskkill.exe
Token: SeDebugPrivilege	884	taskkill.exe
Token: SeDebugPrivilege	1468	taskkill.exe
Token: SeDebugPrivilege	2360	taskkill.exe
Token: SeDebugPrivilege	3032	taskkill.exe
Token: SeDebugPrivilege	2584	taskkill.exe
Token: SeDebugPrivilege	1872	taskkill.exe
Token: SeDebugPrivilege	2520	taskkill.exe
Token: SeDebugPrivilege	2464	taskkill.exe
Token: SeDebugPrivilege	2256	taskkill.exe
Token: SeDebugPrivilege	624	taskkill.exe
Token: SeDebugPrivilege	2492	taskkill.exe
Token: SeDebugPrivilege	2068	taskkill.exe
Token: SeDebugPrivilege	1212	taskkill.exe
Token: SeDebugPrivilege	1004	taskkill.exe
Token: SeDebugPrivilege	1572	taskkill.exe
Token: SeDebugPrivilege	2460	taskkill.exe
Token: SeDebugPrivilege	1496	taskkill.exe
Token: SeDebugPrivilege	2776	taskkill.exe
Token: SeDebugPrivilege	2240	taskkill.exe
Token: SeDebugPrivilege	2900	taskkill.exe
Token: SeDebugPrivilege	1728	taskkill.exe
Token: SeDebugPrivilege	2232	taskkill.exe
Token: SeDebugPrivilege	908	taskkill.exe
Token: SeDebugPrivilege	1040	taskkill.exe
Token: SeDebugPrivilege	892	taskkill.exe
Token: SeDebugPrivilege	2224	taskkill.exe
Token: SeDebugPrivilege	2756	taskkill.exe
Token: SeDebugPrivilege	324	taskkill.exe
Token: SeDebugPrivilege	328	taskkill.exe
Token: SeDebugPrivilege	3020	taskkill.exe
Token: SeDebugPrivilege	2152	taskkill.exe
Token: SeDebugPrivilege	1148	taskkill.exe
Token: SeDebugPrivilege	2104	taskkill.exe
Token: SeDebugPrivilege	2324	taskkill.exe
Token: SeDebugPrivilege	2132	taskkill.exe
Token: SeDebugPrivilege	1928	taskkill.exe
Token: SeDebugPrivilege	2644	taskkill.exe
Token: SeDebugPrivilege	1960	taskkill.exe
Token: SeDebugPrivilege	2140	taskkill.exe
Token: SeDebugPrivilege	2448	taskkill.exe
Token: SeDebugPrivilege	2892	taskkill.exe
Token: SeDebugPrivilege	1400	taskkill.exe
Token: SeDebugPrivilege	400	taskkill.exe
Token: SeDebugPrivilege	2736	taskkill.exe
Token: SeDebugPrivilege	2764	taskkill.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

wlock.exe

pid process

2804 wlock.exe
2804 wlock.exe

pid	process
2804	wlock.exe
2804	wlock.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

1554ba4da5ebb3f1a3569f76fbcf8fcf_JaffaCakes118.execmd.exewlock.exe

description	pid	process	target process
PID 2140 wrote to memory of 2360	2140	1554ba4da5ebb3f1a3569f76fbcf8fcf_JaffaCakes118.exe	takeown.exe
PID 2140 wrote to memory of 2360	2140	1554ba4da5ebb3f1a3569f76fbcf8fcf_JaffaCakes118.exe	takeown.exe
PID 2140 wrote to memory of 2360	2140	1554ba4da5ebb3f1a3569f76fbcf8fcf_JaffaCakes118.exe	takeown.exe
PID 2140 wrote to memory of 2360	2140	1554ba4da5ebb3f1a3569f76fbcf8fcf_JaffaCakes118.exe	takeown.exe
PID 2140 wrote to memory of 2768	2140	1554ba4da5ebb3f1a3569f76fbcf8fcf_JaffaCakes118.exe	icacls.exe
PID 2140 wrote to memory of 2768	2140	1554ba4da5ebb3f1a3569f76fbcf8fcf_JaffaCakes118.exe	icacls.exe
PID 2140 wrote to memory of 2768	2140	1554ba4da5ebb3f1a3569f76fbcf8fcf_JaffaCakes118.exe	icacls.exe
PID 2140 wrote to memory of 2768	2140	1554ba4da5ebb3f1a3569f76fbcf8fcf_JaffaCakes118.exe	icacls.exe
PID 2140 wrote to memory of 3016	2140	1554ba4da5ebb3f1a3569f76fbcf8fcf_JaffaCakes118.exe	cmd.exe
PID 2140 wrote to memory of 3016	2140	1554ba4da5ebb3f1a3569f76fbcf8fcf_JaffaCakes118.exe	cmd.exe
PID 2140 wrote to memory of 3016	2140	1554ba4da5ebb3f1a3569f76fbcf8fcf_JaffaCakes118.exe	cmd.exe
PID 2140 wrote to memory of 3016	2140	1554ba4da5ebb3f1a3569f76fbcf8fcf_JaffaCakes118.exe	cmd.exe
PID 2140 wrote to memory of 2560	2140	1554ba4da5ebb3f1a3569f76fbcf8fcf_JaffaCakes118.exe	cmd.exe
PID 2140 wrote to memory of 2560	2140	1554ba4da5ebb3f1a3569f76fbcf8fcf_JaffaCakes118.exe	cmd.exe
PID 2140 wrote to memory of 2560	2140	1554ba4da5ebb3f1a3569f76fbcf8fcf_JaffaCakes118.exe	cmd.exe
PID 2140 wrote to memory of 2560	2140	1554ba4da5ebb3f1a3569f76fbcf8fcf_JaffaCakes118.exe	cmd.exe
PID 2560 wrote to memory of 2584	2560	cmd.exe	reg.exe
PID 2560 wrote to memory of 2584	2560	cmd.exe	reg.exe
PID 2560 wrote to memory of 2584	2560	cmd.exe	reg.exe
PID 2560 wrote to memory of 2584	2560	cmd.exe	reg.exe
PID 2140 wrote to memory of 2804	2140	1554ba4da5ebb3f1a3569f76fbcf8fcf_JaffaCakes118.exe	wlock.exe
PID 2140 wrote to memory of 2804	2140	1554ba4da5ebb3f1a3569f76fbcf8fcf_JaffaCakes118.exe	wlock.exe
PID 2140 wrote to memory of 2804	2140	1554ba4da5ebb3f1a3569f76fbcf8fcf_JaffaCakes118.exe	wlock.exe
PID 2140 wrote to memory of 2804	2140	1554ba4da5ebb3f1a3569f76fbcf8fcf_JaffaCakes118.exe	wlock.exe
PID 2140 wrote to memory of 2784	2140	1554ba4da5ebb3f1a3569f76fbcf8fcf_JaffaCakes118.exe	cmd.exe
PID 2140 wrote to memory of 2784	2140	1554ba4da5ebb3f1a3569f76fbcf8fcf_JaffaCakes118.exe	cmd.exe
PID 2140 wrote to memory of 2784	2140	1554ba4da5ebb3f1a3569f76fbcf8fcf_JaffaCakes118.exe	cmd.exe
PID 2140 wrote to memory of 2784	2140	1554ba4da5ebb3f1a3569f76fbcf8fcf_JaffaCakes118.exe	cmd.exe
PID 2804 wrote to memory of 2672	2804	wlock.exe	taskkill.exe
PID 2804 wrote to memory of 2672	2804	wlock.exe	taskkill.exe
PID 2804 wrote to memory of 2672	2804	wlock.exe	taskkill.exe
PID 2804 wrote to memory of 2672	2804	wlock.exe	taskkill.exe
PID 2804 wrote to memory of 2032	2804	wlock.exe	taskkill.exe
PID 2804 wrote to memory of 2032	2804	wlock.exe	taskkill.exe
PID 2804 wrote to memory of 2032	2804	wlock.exe	taskkill.exe
PID 2804 wrote to memory of 2032	2804	wlock.exe	taskkill.exe
PID 2804 wrote to memory of 2008	2804	wlock.exe	taskkill.exe
PID 2804 wrote to memory of 2008	2804	wlock.exe	taskkill.exe
PID 2804 wrote to memory of 2008	2804	wlock.exe	taskkill.exe
PID 2804 wrote to memory of 2008	2804	wlock.exe	taskkill.exe
PID 2804 wrote to memory of 2900	2804	wlock.exe	taskkill.exe
PID 2804 wrote to memory of 2900	2804	wlock.exe	taskkill.exe
PID 2804 wrote to memory of 2900	2804	wlock.exe	taskkill.exe
PID 2804 wrote to memory of 2900	2804	wlock.exe	taskkill.exe
PID 2804 wrote to memory of 1728	2804	wlock.exe	taskkill.exe
PID 2804 wrote to memory of 1728	2804	wlock.exe	taskkill.exe
PID 2804 wrote to memory of 1728	2804	wlock.exe	taskkill.exe
PID 2804 wrote to memory of 1728	2804	wlock.exe	taskkill.exe
PID 2804 wrote to memory of 1548	2804	wlock.exe	taskkill.exe
PID 2804 wrote to memory of 1548	2804	wlock.exe	taskkill.exe
PID 2804 wrote to memory of 1548	2804	wlock.exe	taskkill.exe
PID 2804 wrote to memory of 1548	2804	wlock.exe	taskkill.exe
PID 2804 wrote to memory of 908	2804	wlock.exe	taskkill.exe
PID 2804 wrote to memory of 908	2804	wlock.exe	taskkill.exe
PID 2804 wrote to memory of 908	2804	wlock.exe	taskkill.exe
PID 2804 wrote to memory of 908	2804	wlock.exe	taskkill.exe
PID 2804 wrote to memory of 1040	2804	wlock.exe	taskkill.exe
PID 2804 wrote to memory of 1040	2804	wlock.exe	taskkill.exe
PID 2804 wrote to memory of 1040	2804	wlock.exe	taskkill.exe
PID 2804 wrote to memory of 1040	2804	wlock.exe	taskkill.exe
PID 2804 wrote to memory of 1740	2804	wlock.exe	taskkill.exe
PID 2804 wrote to memory of 1740	2804	wlock.exe	taskkill.exe
PID 2804 wrote to memory of 1740	2804	wlock.exe	taskkill.exe
PID 2804 wrote to memory of 1740	2804	wlock.exe	taskkill.exe

C:\Users\Admin\AppData\Local\Temp\1554ba4da5ebb3f1a3569f76fbcf8fcf_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\1554ba4da5ebb3f1a3569f76fbcf8fcf_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2140

C:\Windows\SysWOW64\takeown.exe
"C:\Windows\System32\takeown.exe" /f "C:\Windows\System32\rstrui.exe"
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:2360

C:\Windows\SysWOW64\icacls.exe
"C:\Windows\System32\icacls.exe" "C:\Windows\System32\rstrui.exe" /grant Admin:F
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:2768

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /q "C:\Windows\System32\rstrui.exe"
2⤵
PID:3016

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c REG ADD HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v wlock /t REG_SZ /d "C:\Users\Admin\wlock\wlock.exe" /f
2⤵
- Suspicious use of WriteProcessMemory
PID:2560

C:\Windows\SysWOW64\reg.exe
REG ADD HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v wlock /t REG_SZ /d "C:\Users\Admin\wlock\wlock.exe" /f
3⤵
- Adds Run key to start application
PID:2584

C:\Users\Admin\wlock\wlock.exe
"C:\Users\Admin\wlock\wlock.exe" f
2⤵
- Executes dropped EXE
- Modifies Control Panel
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2804

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2672

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2032

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2008

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2900

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1728

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1548

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:908

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1040

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1740

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:3056

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1584

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:872

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1172

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:848

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2152

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:300

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2864

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:884

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1468

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2360

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:3032

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2584

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1872

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2520

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2464

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2256

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:624

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2492

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2068

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1212

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1004

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1572

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2460

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1496

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2776

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2240

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2900

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1728

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2232

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:908

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1040

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:892

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2224

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2756

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:324

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:328

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:3020

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2152

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1148

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2104

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2324

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2132

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1928

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2644

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1960

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2140

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2448

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2892

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1400

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:400

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2736

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2764

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:1464

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:1448

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:1232

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:1500

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2672

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:1200

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2876

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:1848

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:764

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:580

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:1780

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:1688

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:3056

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
- Kills process with taskkill
PID:2832

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:1412

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:956

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:680

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2984

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:1916

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:1672

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2824

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2064

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:1440

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2360

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2992

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2564

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:1872

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2568

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2496

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:1792

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:832

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2720

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
- Kills process with taskkill
PID:1540

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:1212

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:1908

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:1332

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2460

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2996

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2212

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:1352

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:388

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:1632

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:1636

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
- Kills process with taskkill
PID:2396

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2384

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:1084

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
- Kills process with taskkill
PID:1252

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:112

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:3068

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:1976

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:1108

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:1940

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2164

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:1744

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2204

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2572

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:3016

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2632

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
- Kills process with taskkill
PID:2652

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2700

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2340

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:1504

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2408

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2420

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2160

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:1508

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:1600

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
- Kills process with taskkill
PID:2072

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:1528

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:1516

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2672

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:1948

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2188

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:320

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2232

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:824

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2532

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:864

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:1740

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2260

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:1288

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:1276

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:1696

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2920

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2944

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:1384

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:884

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:1892

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:300

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2540

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:1668

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2476

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
- Kills process with taskkill
PID:2488

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2600

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2112

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2492

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:1204

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2720

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2764

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:1492

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:1560

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:1572

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:1496

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
- Kills process with taskkill
PID:2024

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2196

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2240

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
- Kills process with taskkill
PID:1904

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:1632

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2404

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:1732

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:1712

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2900

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:1076

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2932

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:3068

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2124

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2936

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:1444

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:1748

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:3008

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:880

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2560

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2640

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
- Kills process with taskkill
PID:3032

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2652

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2940

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2552

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2276

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:840

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2760

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2068

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:352

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:1908

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
- Kills process with taskkill
PID:1020

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2460

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2032

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:1844

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2216

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:1548

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:1988

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:1112

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:1680

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2060

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:1716

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:1912

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
- Kills process with taskkill
PID:1488

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:1064

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:3048

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2984

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:1940

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:1216

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2348

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2204

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2284

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2524

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2880

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:1668

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2972

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:1192

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2596

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2908

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
- Kills process with taskkill
PID:400

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:832

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2328

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:752

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:1576

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:1500

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2792

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2004

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2196

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
- Kills process with taskkill
PID:2016

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:1904

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:1112

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:1680

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2060

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:1724

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2224

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:1488

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:1064

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:3048

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2984

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:1940

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:1148

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2120

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2204

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:1596

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2524

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2880

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2692

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2592

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2700

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2596

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:1504

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:400

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:832

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:1768

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
- Kills process with taskkill
PID:2912

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:1212

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:1500

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2996

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2004

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:1012

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:764

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:1676

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:1944

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2608

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2060

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:1724

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2224

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:1484

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:1696

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:3020

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2984

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:3060

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:1148

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2120

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2768

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:3016

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
- Kills process with taskkill
PID:2524

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2540

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2692

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2592

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2552

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:612

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:756

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:400

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:832

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2696

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2912

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:1464

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2792

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:1516

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2188

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2196

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:904

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:1676

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2384

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:864

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2904

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:1724

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:1876

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:1484

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:1696

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:1276

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:1940

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:3060

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:1552

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:768

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2768

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
- Kills process with taskkill
PID:2556

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2648

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2480

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2340

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2508

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2888

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2908

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2732

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:352

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2700

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2696

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:1500

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:1332

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:1496

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2208

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2232

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2432

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:536

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:824

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2384

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2264

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:1740

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:1408

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:1288

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:112

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:1900

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2832

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:296

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:1672

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
- Kills process with taskkill
PID:1552

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2536

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2132

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2752

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:1668

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2476

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2340

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2336

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:1248

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2148

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2728

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:1540

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:316

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:1512

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2460

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:1332

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:1496

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2208

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2232

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:1988

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
- Kills process with taskkill
PID:2532

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2884

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:1688

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
- Kills process with taskkill
PID:1884

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:980

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2184

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:3004

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:748

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:1900

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2144

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:348

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2964

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2572

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2968

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2284

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:3012

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:1588

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2896

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2596

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:612

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:1656

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2148

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:1192

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:1396

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2912

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:1528

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2528

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2012

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2236

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:1640

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2008

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:668

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2820

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:1716

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:1144

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:1260

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2080

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:1644

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2184

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:848

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:1276

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:1940

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:1148

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2088

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:1596

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:556

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2536

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2140

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2924

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:1588

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2276

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
- Kills process with taskkill
PID:2464

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2908

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2732

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:1348

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2764

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:1396

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2912

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
- Kills process with taskkill
PID:1512

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2860

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:1516

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2784

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2208

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:1780

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2788

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2404

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:1084

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2900

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:1724

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
- Kills process with taskkill
PID:1876

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:1964

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2184

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:1216

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
- Kills process with taskkill
PID:604

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2864

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2064

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2576

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2360

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2960

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2132

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2972

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2892

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2584

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2552

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:1248

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2760

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:1656

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:1540

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2072

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:928

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:1628

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
- Kills process with taskkill
PID:1512

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:1548

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
- Kills process with taskkill
PID:1496

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:1012

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:1776

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:1648

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
- Kills process with taskkill
PID:2788

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2828

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2288

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:484

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2512

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:324

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:1544

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2388

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2348

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:296

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:1476

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2164

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2088

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2680

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2624

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2536

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2676

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2372

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:1400

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2276

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2340

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:1508

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2160

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
- Kills process with taskkill
PID:2148

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:1524

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:1004

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2268

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:632

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:1516

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:1972

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2188

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:764

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:824

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:668

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2828

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2516

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2900

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
- Kills process with taskkill
PID:1724

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:1408

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
- Kills process with taskkill
PID:1964

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2388

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:884

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:296

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:1476

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2136

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2576

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2272

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2624

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:1440

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2676

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:1588

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2476

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2620

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2492

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
- Kills process with taskkill
PID:2484

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2020

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2408

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2544

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:1304

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:1728

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
- Kills process with taskkill
PID:2036

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:1868

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:692

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:536

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:892

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:448

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
- Kills process with taskkill
PID:1716

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:1488

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2772

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:1556

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:1644

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:1944

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:680

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2144

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2104

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2560

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:1744

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:1552

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:1596

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2808

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2556

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:768

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2652

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2336

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:1792

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
- Kills process with taskkill
PID:1668

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:1264

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2704

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:1656

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2148

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:3064

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2444

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2220

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:1512

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:580

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:1776

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2188

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:764

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2608

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:668

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:1260

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
- Kills process with taskkill
PID:2512

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:1484

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2080

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2200

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:1544

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:1940

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2120

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:880

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
- Kills process with taskkill
PID:2768

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
- Kills process with taskkill
PID:1928

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2640

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2592

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2716

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2600

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
- Kills process with taskkill
PID:2304

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2584

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:1240

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:612

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:840

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
- Kills process with taskkill
PID:1492

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:352

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:836

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:1572

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2268

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:592

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:1516

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:1012

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:908

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:1732

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2884

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2816

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:864

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:980

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:484

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:1556

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2124

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:748

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:1936

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2904

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:1584

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:296

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2612

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:1552

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2640

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2448

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2556

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:3060

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2676

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
- Kills process with taskkill
PID:2924

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2596

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2736

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:1908

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:1784

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2364

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2148

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2792

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2444

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:1332

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2004

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:1496

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:1920

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:1732

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
- Kills process with taskkill
PID:764

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2384

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2932

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:1832

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
- Kills process with taskkill
PID:1604

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:324

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2184

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2824

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:3004

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2172

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:1892

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:1748

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:556

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:1612

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:1552

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2640

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2592

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2520

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
- Kills process with taskkill
PID:1440

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2380

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2336

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
- Kills process with taskkill
PID:1240

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2340

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:1908

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:400

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2552

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
- Kills process with taskkill
PID:2780

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:1904

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2444

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:1924

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2292

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:1776

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:908

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:1680

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:764

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2384

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:1664

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:1260

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:1876

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2944

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:956

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:1408

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2988

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2172

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2100

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:1468

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:3052

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:1672

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2284

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2640

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
- Kills process with taskkill
PID:2892

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:3012

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
- Kills process with taskkill
PID:2452

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:1792

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2572

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:612

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2728

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:1908

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
- Kills process with taskkill
PID:1464

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:1524

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2016

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:1572

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:1516

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:1924

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:1972

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:1776

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:908

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:1712

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:1740

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2260

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:936

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:1260

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:1876

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2944

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2936

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
- Kills process with taskkill
PID:1964

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:884

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2056

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2256

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:1748

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:1900

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:1612

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2808

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2960

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2716

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:3012

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:1472

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2596

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2748

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:1480

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:840

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:1908

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2072

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2552

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
- Kills process with taskkill
PID:1548

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:1968

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2236

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:1924

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2912

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2436

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:908

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
- Kills process with taskkill
PID:2820

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:1488

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2516

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:1832

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:324

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:1944

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2816

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:1936

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:1964

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:1108

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:1476

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:3020

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:3052

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:3008

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
- Kills process with taskkill
PID:1612

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2592

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2888

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:1768

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2676

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2924

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:1240

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
- Kills process with taskkill
PID:2748

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:1784

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:352

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:820

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:1428

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2780

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:632

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:1968

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:1848

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:1640

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2616

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2060

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:824

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:864

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:1172

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2260

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:936

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:1484

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2224

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:1976

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2988

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:1736

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2324

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2656

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2648

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
- Kills process with taskkill
PID:2272

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2448

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:992

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2808

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2500

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:1248

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2908

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:1020

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
- Kills process with taskkill
PID:1204

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2000

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:1784

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:3064

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
- Kills process with taskkill
PID:1004

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:1428

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:1332

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:1868

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:572

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2008

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:892

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2616

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:1252

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2384

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:1740

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:1040

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2260

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:1832

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:324

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2388

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:1940

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:1836

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:1892

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:680

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2088

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
- Kills process with taskkill
PID:3032

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:1672

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2992

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2372

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2504

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:1768

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2068

C:\Windows\SysWOW64\taskkill.exe
taskkill /im taskmgr.exe /f
3⤵
PID:2908

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /C DEL C:\Users\Admin\AppData\Local\Temp\1554BA~1.EXE
2⤵
- Deletes itself
PID:2784

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\wlock\wlock.exe
Filesize
74KB

MD5
c9b7915921c107fbe94cc2e93116de9c

SHA1
71fead17a27e6bde48154554fd3be23e423e9f32

SHA256
4fc53ad0b883367a7d4817f48f4315509f1f9ed16f9b7c8fdbf09b1b47b39daf

SHA512
03fdc64ba3a8b9160e6b9e08d1e854a70ee85fe04fa4dd19979b19193406c2daafab6f8f5db2b7563ad78c3a7a4ceaa90a50398830b27affbd461d7faa1dba30

Download Submit
memory/2140-0-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/2140-11-0x0000000000280000-0x0000000000281000-memory.dmp

Filesize
4KB

Download
memory/2140-10-0x0000000000280000-0x0000000000281000-memory.dmp

Filesize
4KB

Download
memory/2140-9-0x0000000000280000-0x0000000000281000-memory.dmp

Filesize
4KB

Download
memory/2804-17-0x0000000000090000-0x0000000000091000-memory.dmp

Filesize
4KB

Download
memory/2804-18-0x0000000000090000-0x0000000000091000-memory.dmp

Filesize
4KB

Download
memory/2804-16-0x0000000000080000-0x0000000000081000-memory.dmp

Filesize
4KB

Download
memory/2804-15-0x0000000000080000-0x0000000000081000-memory.dmp

Filesize
4KB

Download
memory/2804-14-0x0000000000080000-0x0000000000081000-memory.dmp

Filesize
4KB

Download
memory/2804-24-0x00000000000A0000-0x00000000000A1000-memory.dmp

Filesize
4KB

Download
memory/2804-23-0x00000000000A0000-0x00000000000A1000-memory.dmp

Filesize
4KB

Download
memory/2804-22-0x00000000000A0000-0x00000000000A1000-memory.dmp

Filesize
4KB

Download
memory/2804-21-0x00000000000A0000-0x00000000000A1000-memory.dmp

Filesize
4KB

Download
memory/2804-20-0x0000000000080000-0x0000000000081000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads