Malware Analysis Report

2024-11-30 19:49

Sample ID 220128-vzc3pahbfm
Target f74bedcb4ac33f7343fbbabec0f636b887d92c06e156ac765f345732cf6cbce8
SHA256 f74bedcb4ac33f7343fbbabec0f636b887d92c06e156ac765f345732cf6cbce8
Tags
rms persistence rat trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

f74bedcb4ac33f7343fbbabec0f636b887d92c06e156ac765f345732cf6cbce8

Threat Level: Known bad

The file f74bedcb4ac33f7343fbbabec0f636b887d92c06e156ac765f345732cf6cbce8 was found to be: Known bad.

Malicious Activity Summary

rms persistence rat trojan

RMS

Executes dropped EXE

Loads dropped DLL

Checks computer location settings

Adds Run key to start application

Enumerates physical storage devices

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Modifies data under HKEY_USERS

Runs ping.exe

Suspicious behavior: EnumeratesProcesses

Suspicious use of SetWindowsHookEx

Kills process with taskkill

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2022-01-28 17:25

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2022-01-28 17:25

Reported

2022-01-28 17:30

Platform

win7-en-20211208

Max time kernel

153s

Max time network

153s

Command Line

"C:\Users\Admin\AppData\Local\Temp\f74bedcb4ac33f7343fbbabec0f636b887d92c06e156ac765f345732cf6cbce8.exe"

Signatures

RMS

trojan rat rms

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Control Panel\International\Geo\Nation C:\ProgramData\LemonTrack Installer\winserv.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Windows\CurrentVersion\Run C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Windows\CurrentVersion\Run\LemonTrack = "C:\\ProgramData\\LemonTrack Installer\\winserv.exe" C:\Windows\SysWOW64\reg.exe N/A

Enumerates physical storage devices

Kills process with taskkill

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A N/A N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A N/A N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A N/A N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A

Runs ping.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\ProgramData\LemonTrack Installer\winserv.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\ProgramData\LemonTrack Installer\winserv.exe N/A
Token: SeTcbPrivilege N/A C:\ProgramData\LemonTrack Installer\winserv.exe N/A
Token: SeTcbPrivilege N/A C:\ProgramData\LemonTrack Installer\winserv.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 964 wrote to memory of 1892 N/A C:\Users\Admin\AppData\Local\Temp\f74bedcb4ac33f7343fbbabec0f636b887d92c06e156ac765f345732cf6cbce8.exe C:\Users\Admin\AppData\Local\Temp\exit.exe
PID 964 wrote to memory of 1892 N/A C:\Users\Admin\AppData\Local\Temp\f74bedcb4ac33f7343fbbabec0f636b887d92c06e156ac765f345732cf6cbce8.exe C:\Users\Admin\AppData\Local\Temp\exit.exe
PID 964 wrote to memory of 1892 N/A C:\Users\Admin\AppData\Local\Temp\f74bedcb4ac33f7343fbbabec0f636b887d92c06e156ac765f345732cf6cbce8.exe C:\Users\Admin\AppData\Local\Temp\exit.exe
PID 964 wrote to memory of 1892 N/A C:\Users\Admin\AppData\Local\Temp\f74bedcb4ac33f7343fbbabec0f636b887d92c06e156ac765f345732cf6cbce8.exe C:\Users\Admin\AppData\Local\Temp\exit.exe
PID 964 wrote to memory of 1892 N/A C:\Users\Admin\AppData\Local\Temp\f74bedcb4ac33f7343fbbabec0f636b887d92c06e156ac765f345732cf6cbce8.exe C:\Users\Admin\AppData\Local\Temp\exit.exe
PID 964 wrote to memory of 1892 N/A C:\Users\Admin\AppData\Local\Temp\f74bedcb4ac33f7343fbbabec0f636b887d92c06e156ac765f345732cf6cbce8.exe C:\Users\Admin\AppData\Local\Temp\exit.exe
PID 964 wrote to memory of 1892 N/A C:\Users\Admin\AppData\Local\Temp\f74bedcb4ac33f7343fbbabec0f636b887d92c06e156ac765f345732cf6cbce8.exe C:\Users\Admin\AppData\Local\Temp\exit.exe
PID 1892 wrote to memory of 1272 N/A C:\Users\Admin\AppData\Local\Temp\exit.exe C:\Windows\SysWOW64\cmd.exe
PID 1892 wrote to memory of 1272 N/A C:\Users\Admin\AppData\Local\Temp\exit.exe C:\Windows\SysWOW64\cmd.exe
PID 1892 wrote to memory of 1272 N/A C:\Users\Admin\AppData\Local\Temp\exit.exe C:\Windows\SysWOW64\cmd.exe
PID 1892 wrote to memory of 1272 N/A C:\Users\Admin\AppData\Local\Temp\exit.exe C:\Windows\SysWOW64\cmd.exe
PID 1892 wrote to memory of 1272 N/A C:\Users\Admin\AppData\Local\Temp\exit.exe C:\Windows\SysWOW64\cmd.exe
PID 1892 wrote to memory of 1272 N/A C:\Users\Admin\AppData\Local\Temp\exit.exe C:\Windows\SysWOW64\cmd.exe
PID 1892 wrote to memory of 1272 N/A C:\Users\Admin\AppData\Local\Temp\exit.exe C:\Windows\SysWOW64\cmd.exe
PID 1272 wrote to memory of 1584 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 1272 wrote to memory of 1584 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 1272 wrote to memory of 1584 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 1272 wrote to memory of 1584 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 1272 wrote to memory of 1584 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 1272 wrote to memory of 1584 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 1272 wrote to memory of 1584 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 1272 wrote to memory of 1108 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 1272 wrote to memory of 1108 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 1272 wrote to memory of 1108 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 1272 wrote to memory of 1108 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 1272 wrote to memory of 1108 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 1272 wrote to memory of 1108 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 1272 wrote to memory of 1108 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 1272 wrote to memory of 1932 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\uninstall.exe
PID 1272 wrote to memory of 1932 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\uninstall.exe
PID 1272 wrote to memory of 1932 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\uninstall.exe
PID 1272 wrote to memory of 1932 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\uninstall.exe
PID 1272 wrote to memory of 1932 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\uninstall.exe
PID 1272 wrote to memory of 1932 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\uninstall.exe
PID 1272 wrote to memory of 1932 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\uninstall.exe
PID 1932 wrote to memory of 1100 N/A C:\Users\Admin\AppData\Local\Temp\uninstall.exe C:\ProgramData\LemonTrack Installer\exit.exe
PID 1932 wrote to memory of 1100 N/A C:\Users\Admin\AppData\Local\Temp\uninstall.exe C:\ProgramData\LemonTrack Installer\exit.exe
PID 1932 wrote to memory of 1100 N/A C:\Users\Admin\AppData\Local\Temp\uninstall.exe C:\ProgramData\LemonTrack Installer\exit.exe
PID 1932 wrote to memory of 1100 N/A C:\Users\Admin\AppData\Local\Temp\uninstall.exe C:\ProgramData\LemonTrack Installer\exit.exe
PID 1932 wrote to memory of 1100 N/A C:\Users\Admin\AppData\Local\Temp\uninstall.exe C:\ProgramData\LemonTrack Installer\exit.exe
PID 1932 wrote to memory of 1100 N/A C:\Users\Admin\AppData\Local\Temp\uninstall.exe C:\ProgramData\LemonTrack Installer\exit.exe
PID 1932 wrote to memory of 1100 N/A C:\Users\Admin\AppData\Local\Temp\uninstall.exe C:\ProgramData\LemonTrack Installer\exit.exe
PID 1100 wrote to memory of 1208 N/A C:\ProgramData\LemonTrack Installer\exit.exe C:\Windows\SysWOW64\cmd.exe
PID 1100 wrote to memory of 1208 N/A C:\ProgramData\LemonTrack Installer\exit.exe C:\Windows\SysWOW64\cmd.exe
PID 1100 wrote to memory of 1208 N/A C:\ProgramData\LemonTrack Installer\exit.exe C:\Windows\SysWOW64\cmd.exe
PID 1100 wrote to memory of 1208 N/A C:\ProgramData\LemonTrack Installer\exit.exe C:\Windows\SysWOW64\cmd.exe
PID 1100 wrote to memory of 1208 N/A C:\ProgramData\LemonTrack Installer\exit.exe C:\Windows\SysWOW64\cmd.exe
PID 1100 wrote to memory of 1208 N/A C:\ProgramData\LemonTrack Installer\exit.exe C:\Windows\SysWOW64\cmd.exe
PID 1100 wrote to memory of 1208 N/A C:\ProgramData\LemonTrack Installer\exit.exe C:\Windows\SysWOW64\cmd.exe
PID 1208 wrote to memory of 1288 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1208 wrote to memory of 1288 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1208 wrote to memory of 1288 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1208 wrote to memory of 1288 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1208 wrote to memory of 1288 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1208 wrote to memory of 1288 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1208 wrote to memory of 1288 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1208 wrote to memory of 304 N/A C:\Windows\SysWOW64\cmd.exe C:\ProgramData\LemonTrack Installer\winserv.exe
PID 1208 wrote to memory of 304 N/A C:\Windows\SysWOW64\cmd.exe C:\ProgramData\LemonTrack Installer\winserv.exe
PID 1208 wrote to memory of 304 N/A C:\Windows\SysWOW64\cmd.exe C:\ProgramData\LemonTrack Installer\winserv.exe
PID 1208 wrote to memory of 304 N/A C:\Windows\SysWOW64\cmd.exe C:\ProgramData\LemonTrack Installer\winserv.exe
PID 1208 wrote to memory of 304 N/A C:\Windows\SysWOW64\cmd.exe C:\ProgramData\LemonTrack Installer\winserv.exe
PID 1208 wrote to memory of 304 N/A C:\Windows\SysWOW64\cmd.exe C:\ProgramData\LemonTrack Installer\winserv.exe
PID 1208 wrote to memory of 304 N/A C:\Windows\SysWOW64\cmd.exe C:\ProgramData\LemonTrack Installer\winserv.exe
PID 1208 wrote to memory of 1972 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe

Processes

C:\Users\Admin\AppData\Local\Temp\f74bedcb4ac33f7343fbbabec0f636b887d92c06e156ac765f345732cf6cbce8.exe

"C:\Users\Admin\AppData\Local\Temp\f74bedcb4ac33f7343fbbabec0f636b887d92c06e156ac765f345732cf6cbce8.exe"

C:\Users\Admin\AppData\Local\Temp\exit.exe

"C:\Users\Admin\AppData\Local\Temp\exit.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c i.cmd

C:\Windows\SysWOW64\PING.EXE

ping www.cloudflare.com -n 3 -w 3000

C:\Windows\SysWOW64\PING.EXE

ping www.cloudflare.com -n 3 -w 1000

C:\Users\Admin\AppData\Local\Temp\uninstall.exe

uninstall.exe x -p3KPnoNJ3ReME4bEU5W9APkKS5ErkR3tNRT -y

C:\ProgramData\LemonTrack Installer\exit.exe

"C:\ProgramData\LemonTrack Installer\exit.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c i.cmd

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "LemonTrack" /t REG_SZ /d "C:\ProgramData\LemonTrack Installer\winserv.exe"

C:\ProgramData\LemonTrack Installer\winserv.exe

"C:\ProgramData\LemonTrack Installer\winserv.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\ProgramData\LemonTrack Installer\winserv.exe

"C:\ProgramData\LemonTrack Installer\winserv.exe" -second

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 www.cloudflare.com udp
DE 159.69.48.50:5655 tcp
DE 159.69.48.50:5655 tcp
DE 159.69.48.50:5655 tcp
DE 159.69.48.50:5655 tcp
DE 159.69.48.50:5655 tcp
DE 159.69.48.50:5655 tcp
DE 159.69.48.50:5655 tcp
DE 159.69.48.50:5655 tcp
DE 159.69.48.50:5655 tcp
DE 159.69.48.50:5655 tcp
DE 159.69.48.50:5655 tcp
DE 159.69.48.50:5655 tcp
DE 159.69.48.50:5655 tcp
DE 159.69.48.50:5655 tcp
DE 159.69.48.50:5655 tcp
DE 159.69.48.50:5655 tcp
DE 159.69.48.50:5655 tcp

Files

memory/964-54-0x0000000075D61000-0x0000000075D63000-memory.dmp

\Users\Admin\AppData\Local\Temp\exit.exe

MD5 d2f314f78d0ac5a5c5dbd119a41bad5a
SHA1 49415ae9a0f85699349f13c95cb4fd3ce0eaf932
SHA256 cc81dd1eba5b887d09b0eecb8443916dea82dc58e1cf847f1653413fb804210c
SHA512 42cdb86ebd0e1ef75d9527ee946d43e87abda73f3480e04ef90efb8fbcc7db0b2d29b366fb8715b1cb19896a35dc0dae1a05a23b91032923fbd52ce193c72c5b

\Users\Admin\AppData\Local\Temp\exit.exe

MD5 d2f314f78d0ac5a5c5dbd119a41bad5a
SHA1 49415ae9a0f85699349f13c95cb4fd3ce0eaf932
SHA256 cc81dd1eba5b887d09b0eecb8443916dea82dc58e1cf847f1653413fb804210c
SHA512 42cdb86ebd0e1ef75d9527ee946d43e87abda73f3480e04ef90efb8fbcc7db0b2d29b366fb8715b1cb19896a35dc0dae1a05a23b91032923fbd52ce193c72c5b

\Users\Admin\AppData\Local\Temp\exit.exe

MD5 d2f314f78d0ac5a5c5dbd119a41bad5a
SHA1 49415ae9a0f85699349f13c95cb4fd3ce0eaf932
SHA256 cc81dd1eba5b887d09b0eecb8443916dea82dc58e1cf847f1653413fb804210c
SHA512 42cdb86ebd0e1ef75d9527ee946d43e87abda73f3480e04ef90efb8fbcc7db0b2d29b366fb8715b1cb19896a35dc0dae1a05a23b91032923fbd52ce193c72c5b

\Users\Admin\AppData\Local\Temp\exit.exe

MD5 d2f314f78d0ac5a5c5dbd119a41bad5a
SHA1 49415ae9a0f85699349f13c95cb4fd3ce0eaf932
SHA256 cc81dd1eba5b887d09b0eecb8443916dea82dc58e1cf847f1653413fb804210c
SHA512 42cdb86ebd0e1ef75d9527ee946d43e87abda73f3480e04ef90efb8fbcc7db0b2d29b366fb8715b1cb19896a35dc0dae1a05a23b91032923fbd52ce193c72c5b

C:\Users\Admin\AppData\Local\Temp\exit.exe

MD5 d2f314f78d0ac5a5c5dbd119a41bad5a
SHA1 49415ae9a0f85699349f13c95cb4fd3ce0eaf932
SHA256 cc81dd1eba5b887d09b0eecb8443916dea82dc58e1cf847f1653413fb804210c
SHA512 42cdb86ebd0e1ef75d9527ee946d43e87abda73f3480e04ef90efb8fbcc7db0b2d29b366fb8715b1cb19896a35dc0dae1a05a23b91032923fbd52ce193c72c5b

C:\Users\Admin\AppData\Local\Temp\i.cmd

MD5 fa86bc267e82d0e76651a617cdde2462
SHA1 3d3b1d6c458d2b605b1e3c8996c882ff1eeaf969
SHA256 59d825f5965b4cfecdc67f6afec973d41b5fb2ee3f2c2fe5575b5cca4eddbf1d
SHA512 373b81863e1b31382841755f5cdf5670219d0b6e3868d29e4233ef4e468262a78ba12a7132a33bebccb934eac136f149bfd851470f0e208d57aba5d7b2523e5d

C:\Users\Admin\AppData\Local\Temp\kernel.dll

MD5 573a2619af8c3de0c3f376d8b100db69
SHA1 073dc2aa93fcd1902fb2d823e673b64cac6fd8de
SHA256 17b20aa770ccf250b5aded470fbbaa329856543022ba21f993d5fa02ebb670c7
SHA512 c7cbcd95398a2ce1ee77106d76079101a7af05ddaefed1076db76b64a38488d32cef0e0b2eb1c8cc63b9fb75d24a0756c1af8ae7ec8ce57e21d03da42305cb53

\Users\Admin\AppData\Local\Temp\uninstall.exe

MD5 573a2619af8c3de0c3f376d8b100db69
SHA1 073dc2aa93fcd1902fb2d823e673b64cac6fd8de
SHA256 17b20aa770ccf250b5aded470fbbaa329856543022ba21f993d5fa02ebb670c7
SHA512 c7cbcd95398a2ce1ee77106d76079101a7af05ddaefed1076db76b64a38488d32cef0e0b2eb1c8cc63b9fb75d24a0756c1af8ae7ec8ce57e21d03da42305cb53

C:\Users\Admin\AppData\Local\Temp\uninstall.exe

MD5 573a2619af8c3de0c3f376d8b100db69
SHA1 073dc2aa93fcd1902fb2d823e673b64cac6fd8de
SHA256 17b20aa770ccf250b5aded470fbbaa329856543022ba21f993d5fa02ebb670c7
SHA512 c7cbcd95398a2ce1ee77106d76079101a7af05ddaefed1076db76b64a38488d32cef0e0b2eb1c8cc63b9fb75d24a0756c1af8ae7ec8ce57e21d03da42305cb53

\ProgramData\LemonTrack Installer\exit.exe

MD5 d2f314f78d0ac5a5c5dbd119a41bad5a
SHA1 49415ae9a0f85699349f13c95cb4fd3ce0eaf932
SHA256 cc81dd1eba5b887d09b0eecb8443916dea82dc58e1cf847f1653413fb804210c
SHA512 42cdb86ebd0e1ef75d9527ee946d43e87abda73f3480e04ef90efb8fbcc7db0b2d29b366fb8715b1cb19896a35dc0dae1a05a23b91032923fbd52ce193c72c5b

\ProgramData\LemonTrack Installer\exit.exe

MD5 d2f314f78d0ac5a5c5dbd119a41bad5a
SHA1 49415ae9a0f85699349f13c95cb4fd3ce0eaf932
SHA256 cc81dd1eba5b887d09b0eecb8443916dea82dc58e1cf847f1653413fb804210c
SHA512 42cdb86ebd0e1ef75d9527ee946d43e87abda73f3480e04ef90efb8fbcc7db0b2d29b366fb8715b1cb19896a35dc0dae1a05a23b91032923fbd52ce193c72c5b

\ProgramData\LemonTrack Installer\exit.exe

MD5 d2f314f78d0ac5a5c5dbd119a41bad5a
SHA1 49415ae9a0f85699349f13c95cb4fd3ce0eaf932
SHA256 cc81dd1eba5b887d09b0eecb8443916dea82dc58e1cf847f1653413fb804210c
SHA512 42cdb86ebd0e1ef75d9527ee946d43e87abda73f3480e04ef90efb8fbcc7db0b2d29b366fb8715b1cb19896a35dc0dae1a05a23b91032923fbd52ce193c72c5b

C:\ProgramData\LemonTrack Installer\exit.exe

MD5 d2f314f78d0ac5a5c5dbd119a41bad5a
SHA1 49415ae9a0f85699349f13c95cb4fd3ce0eaf932
SHA256 cc81dd1eba5b887d09b0eecb8443916dea82dc58e1cf847f1653413fb804210c
SHA512 42cdb86ebd0e1ef75d9527ee946d43e87abda73f3480e04ef90efb8fbcc7db0b2d29b366fb8715b1cb19896a35dc0dae1a05a23b91032923fbd52ce193c72c5b

\ProgramData\LemonTrack Installer\exit.exe

MD5 d2f314f78d0ac5a5c5dbd119a41bad5a
SHA1 49415ae9a0f85699349f13c95cb4fd3ce0eaf932
SHA256 cc81dd1eba5b887d09b0eecb8443916dea82dc58e1cf847f1653413fb804210c
SHA512 42cdb86ebd0e1ef75d9527ee946d43e87abda73f3480e04ef90efb8fbcc7db0b2d29b366fb8715b1cb19896a35dc0dae1a05a23b91032923fbd52ce193c72c5b

C:\ProgramData\LemonTrack Installer\i.cmd

MD5 fc3190637744ffbc13dd3a43c49f2acb
SHA1 cb8f1f1036839ea85086d7d9849a98587bdc33e2
SHA256 ea9a0f4ec69452e85dad7d18396d5471e8edc4109e5ce2e4602a6fa097c466f2
SHA512 ed1bd58ac2d4252e0d78376eb31b066819b6efdd2a91b3ff0fa6c4e86f2b5858de3108b40d810c1163116f5866c6ae2c6d27998717d82a636b4587c802763dd0

\ProgramData\LemonTrack Installer\winserv.exe

MD5 cf2ab077a46219b6ce4a53517dd489ea
SHA1 651b8d1377910e4728e85dcd231e269313ab9e1d
SHA256 609b0a416f9b16a6df9b967dc32cd739402af31566e019a8fb8abdf3cb573e30
SHA512 53fb1ac822467168ea8e7abdd72c78cdd90070b10773ce8c700c6784ab4cc3a03eb53887d158ce3a27779a5fbcf3300d2ccbedab79a34bfd42ddc91f68dbdad7

C:\ProgramData\LemonTrack Installer\winserv.exe

MD5 cf2ab077a46219b6ce4a53517dd489ea
SHA1 651b8d1377910e4728e85dcd231e269313ab9e1d
SHA256 609b0a416f9b16a6df9b967dc32cd739402af31566e019a8fb8abdf3cb573e30
SHA512 53fb1ac822467168ea8e7abdd72c78cdd90070b10773ce8c700c6784ab4cc3a03eb53887d158ce3a27779a5fbcf3300d2ccbedab79a34bfd42ddc91f68dbdad7

C:\ProgramData\LemonTrack Installer\winserv.exe

MD5 cf2ab077a46219b6ce4a53517dd489ea
SHA1 651b8d1377910e4728e85dcd231e269313ab9e1d
SHA256 609b0a416f9b16a6df9b967dc32cd739402af31566e019a8fb8abdf3cb573e30
SHA512 53fb1ac822467168ea8e7abdd72c78cdd90070b10773ce8c700c6784ab4cc3a03eb53887d158ce3a27779a5fbcf3300d2ccbedab79a34bfd42ddc91f68dbdad7

memory/304-85-0x0000000000400000-0x0000000000E2B000-memory.dmp

C:\ProgramData\LemonTrack Installer\winserv.exe

MD5 cf2ab077a46219b6ce4a53517dd489ea
SHA1 651b8d1377910e4728e85dcd231e269313ab9e1d
SHA256 609b0a416f9b16a6df9b967dc32cd739402af31566e019a8fb8abdf3cb573e30
SHA512 53fb1ac822467168ea8e7abdd72c78cdd90070b10773ce8c700c6784ab4cc3a03eb53887d158ce3a27779a5fbcf3300d2ccbedab79a34bfd42ddc91f68dbdad7

memory/1684-95-0x0000000000E70000-0x0000000000E71000-memory.dmp

C:\ProgramData\LemonTrack Installer\settings.dat

MD5 a5716c3550a2e7d88cc7973657ad4216
SHA1 ecb98f8414278710642c408966816a8df4375631
SHA256 f4cd8c0da6b2da44c43ec5c9a35155f0b47a2636954cb0329c8c14d66f4ecd5e
SHA512 65c433cd50fa8287dcd49cc49283fc5bf849f94cffbe67e78193eef9127b1899f2cff2d68a950d077e998b2a6f02f910efe7fa38f9a2eacffe4fa6f48b72a41b

memory/1684-105-0x0000000004240000-0x0000000004241000-memory.dmp

memory/1684-104-0x0000000004230000-0x0000000004231000-memory.dmp

memory/1684-108-0x0000000004EF0000-0x0000000004EF1000-memory.dmp

memory/1684-106-0x0000000004D40000-0x0000000004D41000-memory.dmp

memory/1684-109-0x0000000004F00000-0x0000000004F01000-memory.dmp

memory/1684-110-0x0000000004F10000-0x0000000004F11000-memory.dmp

memory/1684-111-0x00000000051D0000-0x00000000051D1000-memory.dmp

memory/1684-112-0x0000000005220000-0x0000000005221000-memory.dmp

memory/1684-114-0x00000000055F0000-0x00000000055F1000-memory.dmp

memory/1684-113-0x0000000005640000-0x0000000005641000-memory.dmp

memory/1684-115-0x0000000005930000-0x0000000005931000-memory.dmp

memory/1684-116-0x0000000005A70000-0x0000000005A71000-memory.dmp

memory/1684-117-0x00000000065A0000-0x00000000066FC000-memory.dmp

memory/1684-118-0x00000000065A0000-0x00000000066FC000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2022-01-28 17:25

Reported

2022-01-28 17:30

Platform

win10-en-20211208

Max time kernel

154s

Max time network

162s

Command Line

"C:\Users\Admin\AppData\Local\Temp\f74bedcb4ac33f7343fbbabec0f636b887d92c06e156ac765f345732cf6cbce8.exe"

Signatures

RMS

trojan rat rms

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Control Panel\International\Geo\Nation C:\ProgramData\LemonTrack Installer\winserv.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Windows\CurrentVersion\Run C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Windows\CurrentVersion\Run\LemonTrack = "C:\\ProgramData\\LemonTrack Installer\\winserv.exe" C:\Windows\SysWOW64\reg.exe N/A

Enumerates physical storage devices

Kills process with taskkill

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A N/A N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A N/A N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A N/A N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A N/A N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A N/A N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 C:\ProgramData\LemonTrack Installer\winserv.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@C:\Windows\SysWOW64\FirewallControlPanel.dll,-12122 = "Windows Firewall" C:\ProgramData\LemonTrack Installer\winserv.exe N/A

Runs ping.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\ProgramData\LemonTrack Installer\winserv.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\ProgramData\LemonTrack Installer\winserv.exe N/A
Token: SeTcbPrivilege N/A C:\ProgramData\LemonTrack Installer\winserv.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeTcbPrivilege N/A C:\ProgramData\LemonTrack Installer\winserv.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2692 wrote to memory of 3668 N/A C:\Users\Admin\AppData\Local\Temp\f74bedcb4ac33f7343fbbabec0f636b887d92c06e156ac765f345732cf6cbce8.exe C:\Users\Admin\AppData\Local\Temp\exit.exe
PID 2692 wrote to memory of 3668 N/A C:\Users\Admin\AppData\Local\Temp\f74bedcb4ac33f7343fbbabec0f636b887d92c06e156ac765f345732cf6cbce8.exe C:\Users\Admin\AppData\Local\Temp\exit.exe
PID 2692 wrote to memory of 3668 N/A C:\Users\Admin\AppData\Local\Temp\f74bedcb4ac33f7343fbbabec0f636b887d92c06e156ac765f345732cf6cbce8.exe C:\Users\Admin\AppData\Local\Temp\exit.exe
PID 3668 wrote to memory of 408 N/A C:\Users\Admin\AppData\Local\Temp\exit.exe C:\Windows\SysWOW64\cmd.exe
PID 3668 wrote to memory of 408 N/A C:\Users\Admin\AppData\Local\Temp\exit.exe C:\Windows\SysWOW64\cmd.exe
PID 3668 wrote to memory of 408 N/A C:\Users\Admin\AppData\Local\Temp\exit.exe C:\Windows\SysWOW64\cmd.exe
PID 408 wrote to memory of 1152 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 408 wrote to memory of 1152 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 408 wrote to memory of 1152 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 408 wrote to memory of 868 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 408 wrote to memory of 868 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 408 wrote to memory of 868 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 408 wrote to memory of 2360 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\uninstall.exe
PID 408 wrote to memory of 2360 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\uninstall.exe
PID 408 wrote to memory of 2360 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\uninstall.exe
PID 2360 wrote to memory of 3084 N/A C:\Users\Admin\AppData\Local\Temp\uninstall.exe C:\ProgramData\LemonTrack Installer\exit.exe
PID 2360 wrote to memory of 3084 N/A C:\Users\Admin\AppData\Local\Temp\uninstall.exe C:\ProgramData\LemonTrack Installer\exit.exe
PID 2360 wrote to memory of 3084 N/A C:\Users\Admin\AppData\Local\Temp\uninstall.exe C:\ProgramData\LemonTrack Installer\exit.exe
PID 3084 wrote to memory of 3064 N/A C:\ProgramData\LemonTrack Installer\exit.exe C:\Windows\SysWOW64\cmd.exe
PID 3084 wrote to memory of 3064 N/A C:\ProgramData\LemonTrack Installer\exit.exe C:\Windows\SysWOW64\cmd.exe
PID 3084 wrote to memory of 3064 N/A C:\ProgramData\LemonTrack Installer\exit.exe C:\Windows\SysWOW64\cmd.exe
PID 3064 wrote to memory of 3784 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 3064 wrote to memory of 3784 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 3064 wrote to memory of 3784 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 3064 wrote to memory of 3496 N/A C:\Windows\SysWOW64\cmd.exe C:\ProgramData\LemonTrack Installer\winserv.exe
PID 3064 wrote to memory of 3496 N/A C:\Windows\SysWOW64\cmd.exe C:\ProgramData\LemonTrack Installer\winserv.exe
PID 3064 wrote to memory of 3496 N/A C:\Windows\SysWOW64\cmd.exe C:\ProgramData\LemonTrack Installer\winserv.exe
PID 3064 wrote to memory of 3204 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 3064 wrote to memory of 3204 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 3064 wrote to memory of 3204 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 3064 wrote to memory of 2440 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 3064 wrote to memory of 2440 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 3064 wrote to memory of 2440 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 3064 wrote to memory of 524 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 3064 wrote to memory of 524 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 3064 wrote to memory of 524 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 3064 wrote to memory of 3576 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 3064 wrote to memory of 3576 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 3064 wrote to memory of 3576 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 3064 wrote to memory of 648 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 3064 wrote to memory of 648 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 3064 wrote to memory of 648 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 3064 wrote to memory of 2032 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 3064 wrote to memory of 2032 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 3064 wrote to memory of 2032 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 3064 wrote to memory of 3692 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 3064 wrote to memory of 3692 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 3064 wrote to memory of 3692 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 3064 wrote to memory of 2692 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 3064 wrote to memory of 2692 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 3064 wrote to memory of 2692 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 3064 wrote to memory of 3696 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 3064 wrote to memory of 3696 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 3064 wrote to memory of 3696 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 3064 wrote to memory of 924 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 3064 wrote to memory of 924 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 3064 wrote to memory of 924 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 3064 wrote to memory of 1076 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 3064 wrote to memory of 1076 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 3064 wrote to memory of 1076 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 3064 wrote to memory of 1976 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 3064 wrote to memory of 1976 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 3064 wrote to memory of 1976 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 3064 wrote to memory of 4040 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe

Processes

C:\Users\Admin\AppData\Local\Temp\f74bedcb4ac33f7343fbbabec0f636b887d92c06e156ac765f345732cf6cbce8.exe

"C:\Users\Admin\AppData\Local\Temp\f74bedcb4ac33f7343fbbabec0f636b887d92c06e156ac765f345732cf6cbce8.exe"

C:\Users\Admin\AppData\Local\Temp\exit.exe

"C:\Users\Admin\AppData\Local\Temp\exit.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c i.cmd

C:\Windows\SysWOW64\PING.EXE

ping www.cloudflare.com -n 3 -w 3000

C:\Windows\SysWOW64\PING.EXE

ping www.cloudflare.com -n 3 -w 1000

C:\Users\Admin\AppData\Local\Temp\uninstall.exe

uninstall.exe x -p3KPnoNJ3ReME4bEU5W9APkKS5ErkR3tNRT -y

C:\ProgramData\LemonTrack Installer\exit.exe

"C:\ProgramData\LemonTrack Installer\exit.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c i.cmd

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "LemonTrack" /t REG_SZ /d "C:\ProgramData\LemonTrack Installer\winserv.exe"

C:\ProgramData\LemonTrack Installer\winserv.exe

"C:\ProgramData\LemonTrack Installer\winserv.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\ProgramData\LemonTrack Installer\winserv.exe

"C:\ProgramData\LemonTrack Installer\winserv.exe" -second

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 www.cloudflare.com udp
DE 159.69.48.50:5655 tcp
DE 159.69.48.50:5655 tcp
DE 159.69.48.50:5655 tcp
DE 159.69.48.50:5655 tcp
DE 159.69.48.50:5655 tcp
DE 159.69.48.50:5655 tcp
DE 159.69.48.50:5655 tcp
DE 159.69.48.50:5655 tcp
DE 159.69.48.50:5655 tcp
DE 159.69.48.50:5655 tcp
DE 159.69.48.50:5655 tcp
DE 159.69.48.50:5655 tcp
DE 159.69.48.50:5655 tcp
DE 159.69.48.50:5655 tcp
DE 159.69.48.50:5655 tcp
DE 159.69.48.50:5655 tcp

Files

C:\Users\Admin\AppData\Local\Temp\exit.exe

MD5 d2f314f78d0ac5a5c5dbd119a41bad5a
SHA1 49415ae9a0f85699349f13c95cb4fd3ce0eaf932
SHA256 cc81dd1eba5b887d09b0eecb8443916dea82dc58e1cf847f1653413fb804210c
SHA512 42cdb86ebd0e1ef75d9527ee946d43e87abda73f3480e04ef90efb8fbcc7db0b2d29b366fb8715b1cb19896a35dc0dae1a05a23b91032923fbd52ce193c72c5b

C:\Users\Admin\AppData\Local\Temp\exit.exe

MD5 d2f314f78d0ac5a5c5dbd119a41bad5a
SHA1 49415ae9a0f85699349f13c95cb4fd3ce0eaf932
SHA256 cc81dd1eba5b887d09b0eecb8443916dea82dc58e1cf847f1653413fb804210c
SHA512 42cdb86ebd0e1ef75d9527ee946d43e87abda73f3480e04ef90efb8fbcc7db0b2d29b366fb8715b1cb19896a35dc0dae1a05a23b91032923fbd52ce193c72c5b

C:\Users\Admin\AppData\Local\Temp\i.cmd

MD5 fa86bc267e82d0e76651a617cdde2462
SHA1 3d3b1d6c458d2b605b1e3c8996c882ff1eeaf969
SHA256 59d825f5965b4cfecdc67f6afec973d41b5fb2ee3f2c2fe5575b5cca4eddbf1d
SHA512 373b81863e1b31382841755f5cdf5670219d0b6e3868d29e4233ef4e468262a78ba12a7132a33bebccb934eac136f149bfd851470f0e208d57aba5d7b2523e5d

C:\Users\Admin\AppData\Local\Temp\kernel.dll

MD5 573a2619af8c3de0c3f376d8b100db69
SHA1 073dc2aa93fcd1902fb2d823e673b64cac6fd8de
SHA256 17b20aa770ccf250b5aded470fbbaa329856543022ba21f993d5fa02ebb670c7
SHA512 c7cbcd95398a2ce1ee77106d76079101a7af05ddaefed1076db76b64a38488d32cef0e0b2eb1c8cc63b9fb75d24a0756c1af8ae7ec8ce57e21d03da42305cb53

C:\Users\Admin\AppData\Local\Temp\uninstall.exe

MD5 573a2619af8c3de0c3f376d8b100db69
SHA1 073dc2aa93fcd1902fb2d823e673b64cac6fd8de
SHA256 17b20aa770ccf250b5aded470fbbaa329856543022ba21f993d5fa02ebb670c7
SHA512 c7cbcd95398a2ce1ee77106d76079101a7af05ddaefed1076db76b64a38488d32cef0e0b2eb1c8cc63b9fb75d24a0756c1af8ae7ec8ce57e21d03da42305cb53

C:\ProgramData\LemonTrack Installer\exit.exe

MD5 d2f314f78d0ac5a5c5dbd119a41bad5a
SHA1 49415ae9a0f85699349f13c95cb4fd3ce0eaf932
SHA256 cc81dd1eba5b887d09b0eecb8443916dea82dc58e1cf847f1653413fb804210c
SHA512 42cdb86ebd0e1ef75d9527ee946d43e87abda73f3480e04ef90efb8fbcc7db0b2d29b366fb8715b1cb19896a35dc0dae1a05a23b91032923fbd52ce193c72c5b

C:\ProgramData\LemonTrack Installer\exit.exe

MD5 d2f314f78d0ac5a5c5dbd119a41bad5a
SHA1 49415ae9a0f85699349f13c95cb4fd3ce0eaf932
SHA256 cc81dd1eba5b887d09b0eecb8443916dea82dc58e1cf847f1653413fb804210c
SHA512 42cdb86ebd0e1ef75d9527ee946d43e87abda73f3480e04ef90efb8fbcc7db0b2d29b366fb8715b1cb19896a35dc0dae1a05a23b91032923fbd52ce193c72c5b

C:\ProgramData\LemonTrack Installer\i.cmd

MD5 fc3190637744ffbc13dd3a43c49f2acb
SHA1 cb8f1f1036839ea85086d7d9849a98587bdc33e2
SHA256 ea9a0f4ec69452e85dad7d18396d5471e8edc4109e5ce2e4602a6fa097c466f2
SHA512 ed1bd58ac2d4252e0d78376eb31b066819b6efdd2a91b3ff0fa6c4e86f2b5858de3108b40d810c1163116f5866c6ae2c6d27998717d82a636b4587c802763dd0

C:\ProgramData\LemonTrack Installer\winserv.exe

MD5 cf2ab077a46219b6ce4a53517dd489ea
SHA1 651b8d1377910e4728e85dcd231e269313ab9e1d
SHA256 609b0a416f9b16a6df9b967dc32cd739402af31566e019a8fb8abdf3cb573e30
SHA512 53fb1ac822467168ea8e7abdd72c78cdd90070b10773ce8c700c6784ab4cc3a03eb53887d158ce3a27779a5fbcf3300d2ccbedab79a34bfd42ddc91f68dbdad7

C:\ProgramData\LemonTrack Installer\winserv.exe

MD5 cf2ab077a46219b6ce4a53517dd489ea
SHA1 651b8d1377910e4728e85dcd231e269313ab9e1d
SHA256 609b0a416f9b16a6df9b967dc32cd739402af31566e019a8fb8abdf3cb573e30
SHA512 53fb1ac822467168ea8e7abdd72c78cdd90070b10773ce8c700c6784ab4cc3a03eb53887d158ce3a27779a5fbcf3300d2ccbedab79a34bfd42ddc91f68dbdad7

C:\ProgramData\LemonTrack Installer\winserv.exe

MD5 cf2ab077a46219b6ce4a53517dd489ea
SHA1 651b8d1377910e4728e85dcd231e269313ab9e1d
SHA256 609b0a416f9b16a6df9b967dc32cd739402af31566e019a8fb8abdf3cb573e30
SHA512 53fb1ac822467168ea8e7abdd72c78cdd90070b10773ce8c700c6784ab4cc3a03eb53887d158ce3a27779a5fbcf3300d2ccbedab79a34bfd42ddc91f68dbdad7

memory/3596-311-0x0000000001130000-0x0000000001131000-memory.dmp

C:\ProgramData\LemonTrack Installer\settings.dat

MD5 a5716c3550a2e7d88cc7973657ad4216
SHA1 ecb98f8414278710642c408966816a8df4375631
SHA256 f4cd8c0da6b2da44c43ec5c9a35155f0b47a2636954cb0329c8c14d66f4ecd5e
SHA512 65c433cd50fa8287dcd49cc49283fc5bf849f94cffbe67e78193eef9127b1899f2cff2d68a950d077e998b2a6f02f910efe7fa38f9a2eacffe4fa6f48b72a41b

memory/3596-314-0x0000000004600000-0x0000000004601000-memory.dmp

memory/3596-313-0x00000000045F0000-0x00000000045F1000-memory.dmp

memory/3596-315-0x0000000004860000-0x0000000004861000-memory.dmp

memory/3596-316-0x0000000004EC0000-0x0000000004EC1000-memory.dmp

memory/3596-317-0x0000000005010000-0x0000000005011000-memory.dmp

memory/3596-318-0x0000000005160000-0x0000000005161000-memory.dmp

memory/3596-319-0x0000000004FE0000-0x0000000004FE1000-memory.dmp

memory/3596-321-0x0000000005000000-0x0000000005001000-memory.dmp

memory/3596-320-0x0000000004FF0000-0x0000000004FF1000-memory.dmp

memory/3596-322-0x00000000053F0000-0x00000000053F1000-memory.dmp

memory/3596-323-0x0000000006F00000-0x0000000006F01000-memory.dmp

memory/3596-324-0x0000000007100000-0x0000000007101000-memory.dmp

memory/3596-325-0x0000000007390000-0x000000000741F000-memory.dmp

memory/3596-326-0x00000000074E0000-0x00000000074E1000-memory.dmp