Malware Analysis Report

2024-11-30 19:48

Sample ID 220128-w6z2gaagf6
Target c0fa50e99ca5a647cedd2de2249a5fef57a57d472d9d4c13c2c14fb035ae102c
SHA256 c0fa50e99ca5a647cedd2de2249a5fef57a57d472d9d4c13c2c14fb035ae102c
Tags
rms persistence rat trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

c0fa50e99ca5a647cedd2de2249a5fef57a57d472d9d4c13c2c14fb035ae102c

Threat Level: Known bad

The file c0fa50e99ca5a647cedd2de2249a5fef57a57d472d9d4c13c2c14fb035ae102c was found to be: Known bad.

Malicious Activity Summary

rms persistence rat trojan

RMS

Executes dropped EXE

Checks computer location settings

Loads dropped DLL

Adds Run key to start application

Enumerates physical storage devices

Runs ping.exe

Modifies data under HKEY_USERS

Suspicious use of WriteProcessMemory

Suspicious use of SetWindowsHookEx

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Kills process with taskkill

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2022-01-28 18:32

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2022-01-28 18:32

Reported

2022-01-28 18:47

Platform

win7-en-20211208

Max time kernel

156s

Max time network

148s

Command Line

"C:\Users\Admin\AppData\Local\Temp\c0fa50e99ca5a647cedd2de2249a5fef57a57d472d9d4c13c2c14fb035ae102c.exe"

Signatures

RMS

trojan rat rms

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Control Panel\International\Geo\Nation C:\ProgramData\Windows Anytime Upgrade\winserv.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Windows\CurrentVersion\Run C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Anytime Upgrade = "C:\\ProgramData\\Windows Anytime Upgrade\\winserv.exe" C:\Windows\SysWOW64\reg.exe N/A

Enumerates physical storage devices

Kills process with taskkill

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A N/A N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A N/A N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A N/A N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A

Runs ping.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\ProgramData\Windows Anytime Upgrade\winserv.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\ProgramData\Windows Anytime Upgrade\winserv.exe N/A
Token: SeTcbPrivilege N/A C:\ProgramData\Windows Anytime Upgrade\winserv.exe N/A
Token: SeTcbPrivilege N/A C:\ProgramData\Windows Anytime Upgrade\winserv.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1592 wrote to memory of 1912 N/A C:\Users\Admin\AppData\Local\Temp\c0fa50e99ca5a647cedd2de2249a5fef57a57d472d9d4c13c2c14fb035ae102c.exe C:\Users\Admin\AppData\Local\Temp\exit.exe
PID 1592 wrote to memory of 1912 N/A C:\Users\Admin\AppData\Local\Temp\c0fa50e99ca5a647cedd2de2249a5fef57a57d472d9d4c13c2c14fb035ae102c.exe C:\Users\Admin\AppData\Local\Temp\exit.exe
PID 1592 wrote to memory of 1912 N/A C:\Users\Admin\AppData\Local\Temp\c0fa50e99ca5a647cedd2de2249a5fef57a57d472d9d4c13c2c14fb035ae102c.exe C:\Users\Admin\AppData\Local\Temp\exit.exe
PID 1592 wrote to memory of 1912 N/A C:\Users\Admin\AppData\Local\Temp\c0fa50e99ca5a647cedd2de2249a5fef57a57d472d9d4c13c2c14fb035ae102c.exe C:\Users\Admin\AppData\Local\Temp\exit.exe
PID 1912 wrote to memory of 1792 N/A C:\Users\Admin\AppData\Local\Temp\exit.exe C:\Windows\SysWOW64\cmd.exe
PID 1912 wrote to memory of 1792 N/A C:\Users\Admin\AppData\Local\Temp\exit.exe C:\Windows\SysWOW64\cmd.exe
PID 1912 wrote to memory of 1792 N/A C:\Users\Admin\AppData\Local\Temp\exit.exe C:\Windows\SysWOW64\cmd.exe
PID 1912 wrote to memory of 1792 N/A C:\Users\Admin\AppData\Local\Temp\exit.exe C:\Windows\SysWOW64\cmd.exe
PID 1792 wrote to memory of 856 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 1792 wrote to memory of 856 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 1792 wrote to memory of 856 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 1792 wrote to memory of 856 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 1792 wrote to memory of 1752 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 1792 wrote to memory of 1752 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 1792 wrote to memory of 1752 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 1792 wrote to memory of 1752 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 1792 wrote to memory of 2040 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\uninstall.exe
PID 1792 wrote to memory of 2040 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\uninstall.exe
PID 1792 wrote to memory of 2040 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\uninstall.exe
PID 1792 wrote to memory of 2040 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\uninstall.exe
PID 1792 wrote to memory of 2040 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\uninstall.exe
PID 1792 wrote to memory of 2040 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\uninstall.exe
PID 1792 wrote to memory of 2040 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\uninstall.exe
PID 2040 wrote to memory of 2028 N/A C:\Users\Admin\AppData\Local\Temp\uninstall.exe C:\ProgramData\Windows Anytime Upgrade\exit.exe
PID 2040 wrote to memory of 2028 N/A C:\Users\Admin\AppData\Local\Temp\uninstall.exe C:\ProgramData\Windows Anytime Upgrade\exit.exe
PID 2040 wrote to memory of 2028 N/A C:\Users\Admin\AppData\Local\Temp\uninstall.exe C:\ProgramData\Windows Anytime Upgrade\exit.exe
PID 2040 wrote to memory of 2028 N/A C:\Users\Admin\AppData\Local\Temp\uninstall.exe C:\ProgramData\Windows Anytime Upgrade\exit.exe
PID 2028 wrote to memory of 1464 N/A C:\ProgramData\Windows Anytime Upgrade\exit.exe C:\Windows\SysWOW64\cmd.exe
PID 2028 wrote to memory of 1464 N/A C:\ProgramData\Windows Anytime Upgrade\exit.exe C:\Windows\SysWOW64\cmd.exe
PID 2028 wrote to memory of 1464 N/A C:\ProgramData\Windows Anytime Upgrade\exit.exe C:\Windows\SysWOW64\cmd.exe
PID 2028 wrote to memory of 1464 N/A C:\ProgramData\Windows Anytime Upgrade\exit.exe C:\Windows\SysWOW64\cmd.exe
PID 1464 wrote to memory of 1320 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1464 wrote to memory of 1320 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1464 wrote to memory of 1320 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1464 wrote to memory of 1320 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1464 wrote to memory of 1496 N/A C:\Windows\SysWOW64\cmd.exe C:\ProgramData\Windows Anytime Upgrade\winserv.exe
PID 1464 wrote to memory of 1496 N/A C:\Windows\SysWOW64\cmd.exe C:\ProgramData\Windows Anytime Upgrade\winserv.exe
PID 1464 wrote to memory of 1496 N/A C:\Windows\SysWOW64\cmd.exe C:\ProgramData\Windows Anytime Upgrade\winserv.exe
PID 1464 wrote to memory of 1496 N/A C:\Windows\SysWOW64\cmd.exe C:\ProgramData\Windows Anytime Upgrade\winserv.exe
PID 1464 wrote to memory of 1608 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 1464 wrote to memory of 1608 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 1464 wrote to memory of 1608 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 1464 wrote to memory of 1608 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 1464 wrote to memory of 1768 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 1464 wrote to memory of 1768 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 1464 wrote to memory of 1768 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 1464 wrote to memory of 1768 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 1464 wrote to memory of 1272 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 1464 wrote to memory of 1272 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 1464 wrote to memory of 1272 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 1464 wrote to memory of 1272 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 1464 wrote to memory of 1916 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 1464 wrote to memory of 1916 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 1464 wrote to memory of 1916 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 1464 wrote to memory of 1916 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 1464 wrote to memory of 1508 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 1464 wrote to memory of 1508 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 1464 wrote to memory of 1508 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 1464 wrote to memory of 1508 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 1464 wrote to memory of 1852 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 1464 wrote to memory of 1852 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 1464 wrote to memory of 1852 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 1464 wrote to memory of 1852 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 1464 wrote to memory of 1848 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe

Processes

C:\Users\Admin\AppData\Local\Temp\c0fa50e99ca5a647cedd2de2249a5fef57a57d472d9d4c13c2c14fb035ae102c.exe

"C:\Users\Admin\AppData\Local\Temp\c0fa50e99ca5a647cedd2de2249a5fef57a57d472d9d4c13c2c14fb035ae102c.exe"

C:\Users\Admin\AppData\Local\Temp\exit.exe

"C:\Users\Admin\AppData\Local\Temp\exit.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c i.cmd

C:\Windows\SysWOW64\PING.EXE

ping www.cloudflare.com -n 3 -w 3000

C:\Windows\SysWOW64\PING.EXE

ping www.cloudflare.com -n 3 -w 1000

C:\Users\Admin\AppData\Local\Temp\uninstall.exe

uninstall.exe x -pQELRatcwbU2EJ5 -y

C:\ProgramData\Windows Anytime Upgrade\exit.exe

"C:\ProgramData\Windows Anytime Upgrade\exit.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c i.cmd

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Windows Anytime Upgrade" /t REG_SZ /d "C:\ProgramData\Windows Anytime Upgrade\winserv.exe"

C:\ProgramData\Windows Anytime Upgrade\winserv.exe

"C:\ProgramData\Windows Anytime Upgrade\winserv.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\ProgramData\Windows Anytime Upgrade\winserv.exe

"C:\ProgramData\Windows Anytime Upgrade\winserv.exe" -second

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 www.cloudflare.com udp
US 104.168.237.93:5655 tcp
US 104.168.237.93:5655 tcp
US 104.168.237.93:5655 tcp
US 104.168.237.93:5655 tcp
US 104.168.237.93:5655 tcp
US 104.168.237.93:5655 tcp
US 104.168.237.93:5655 tcp
US 104.168.237.93:5655 tcp
US 104.168.237.93:5655 tcp
US 104.168.237.93:5655 tcp
US 104.168.237.93:5655 tcp
US 104.168.237.93:5655 tcp
US 104.168.237.93:5655 tcp
US 104.168.237.93:5655 tcp
US 104.168.237.93:5655 tcp
US 104.168.237.93:5655 tcp
US 104.168.237.93:5655 tcp
US 104.168.237.93:5655 tcp
US 104.168.237.93:5655 tcp
US 104.168.237.93:5655 tcp
US 104.168.237.93:5655 tcp
US 104.168.237.93:5655 tcp
US 104.168.237.93:5655 tcp
US 104.168.237.93:5655 tcp
US 104.168.237.93:5655 tcp
US 104.168.237.93:5655 tcp
US 104.168.237.93:5655 tcp

Files

memory/1592-54-0x0000000075D51000-0x0000000075D53000-memory.dmp

\Users\Admin\AppData\Local\Temp\exit.exe

MD5 e488decbb44ad1a3430e82b57a70615e
SHA1 df4130c66d988df8154bc1967f650896aa8cd6a1
SHA256 fd701894e7ec8d8319bc9b32bba5892b11bdf608c3d04c2f18eff83419eb6df0
SHA512 b0be330248b893a3ff87807ef802a2b27c03d8f66c357304a6ef5b6911ec5ebabdd5279af9bfb1aad1b312bba7cb4304baf5e242b8b7103af7dcef4ee83bd1a1

\Users\Admin\AppData\Local\Temp\exit.exe

MD5 e488decbb44ad1a3430e82b57a70615e
SHA1 df4130c66d988df8154bc1967f650896aa8cd6a1
SHA256 fd701894e7ec8d8319bc9b32bba5892b11bdf608c3d04c2f18eff83419eb6df0
SHA512 b0be330248b893a3ff87807ef802a2b27c03d8f66c357304a6ef5b6911ec5ebabdd5279af9bfb1aad1b312bba7cb4304baf5e242b8b7103af7dcef4ee83bd1a1

\Users\Admin\AppData\Local\Temp\exit.exe

MD5 e488decbb44ad1a3430e82b57a70615e
SHA1 df4130c66d988df8154bc1967f650896aa8cd6a1
SHA256 fd701894e7ec8d8319bc9b32bba5892b11bdf608c3d04c2f18eff83419eb6df0
SHA512 b0be330248b893a3ff87807ef802a2b27c03d8f66c357304a6ef5b6911ec5ebabdd5279af9bfb1aad1b312bba7cb4304baf5e242b8b7103af7dcef4ee83bd1a1

\Users\Admin\AppData\Local\Temp\exit.exe

MD5 e488decbb44ad1a3430e82b57a70615e
SHA1 df4130c66d988df8154bc1967f650896aa8cd6a1
SHA256 fd701894e7ec8d8319bc9b32bba5892b11bdf608c3d04c2f18eff83419eb6df0
SHA512 b0be330248b893a3ff87807ef802a2b27c03d8f66c357304a6ef5b6911ec5ebabdd5279af9bfb1aad1b312bba7cb4304baf5e242b8b7103af7dcef4ee83bd1a1

C:\Users\Admin\AppData\Local\Temp\exit.exe

MD5 e488decbb44ad1a3430e82b57a70615e
SHA1 df4130c66d988df8154bc1967f650896aa8cd6a1
SHA256 fd701894e7ec8d8319bc9b32bba5892b11bdf608c3d04c2f18eff83419eb6df0
SHA512 b0be330248b893a3ff87807ef802a2b27c03d8f66c357304a6ef5b6911ec5ebabdd5279af9bfb1aad1b312bba7cb4304baf5e242b8b7103af7dcef4ee83bd1a1

C:\Users\Admin\AppData\Local\Temp\i.cmd

MD5 85493a23f5bc37f468d52f9f0aba455e
SHA1 5d66578262f520cc4d2b2bf9172696a526430d00
SHA256 99a87d79ef151cca03a30dea1274afc7b176310a01a706cfcea12ea40ab0b810
SHA512 642d1f1a4992d45818dd5fef0a9d1f969cd6c352ad90a7b6d55b7c063ab9534180c27186da6fac3d3c3c9a8c1c21d526ff4b63dbd085cb5df860bb04bd398f67

C:\Users\Admin\AppData\Local\Temp\kernel.dll

MD5 07680116e1883be684d8b54efcc8e655
SHA1 11f472c43f214cbce6bd8d30990b1bebbd6b9bfa
SHA256 deebd0b0c7b1536e598b4c8680a2f34439bdd68e84e63709e35d083783c58bce
SHA512 4581ed77b6052f648cc15dcea5ad25954580d89c52d4fbffc8055b8feb6796d9eaf2a3108d7003b5f79e95b467a6e921ec101acb5ee328b3a18e3ad3ae9310d1

\Users\Admin\AppData\Local\Temp\uninstall.exe

MD5 07680116e1883be684d8b54efcc8e655
SHA1 11f472c43f214cbce6bd8d30990b1bebbd6b9bfa
SHA256 deebd0b0c7b1536e598b4c8680a2f34439bdd68e84e63709e35d083783c58bce
SHA512 4581ed77b6052f648cc15dcea5ad25954580d89c52d4fbffc8055b8feb6796d9eaf2a3108d7003b5f79e95b467a6e921ec101acb5ee328b3a18e3ad3ae9310d1

C:\Users\Admin\AppData\Local\Temp\uninstall.exe

MD5 07680116e1883be684d8b54efcc8e655
SHA1 11f472c43f214cbce6bd8d30990b1bebbd6b9bfa
SHA256 deebd0b0c7b1536e598b4c8680a2f34439bdd68e84e63709e35d083783c58bce
SHA512 4581ed77b6052f648cc15dcea5ad25954580d89c52d4fbffc8055b8feb6796d9eaf2a3108d7003b5f79e95b467a6e921ec101acb5ee328b3a18e3ad3ae9310d1

\ProgramData\Windows Anytime Upgrade\exit.exe

MD5 e488decbb44ad1a3430e82b57a70615e
SHA1 df4130c66d988df8154bc1967f650896aa8cd6a1
SHA256 fd701894e7ec8d8319bc9b32bba5892b11bdf608c3d04c2f18eff83419eb6df0
SHA512 b0be330248b893a3ff87807ef802a2b27c03d8f66c357304a6ef5b6911ec5ebabdd5279af9bfb1aad1b312bba7cb4304baf5e242b8b7103af7dcef4ee83bd1a1

\ProgramData\Windows Anytime Upgrade\exit.exe

MD5 e488decbb44ad1a3430e82b57a70615e
SHA1 df4130c66d988df8154bc1967f650896aa8cd6a1
SHA256 fd701894e7ec8d8319bc9b32bba5892b11bdf608c3d04c2f18eff83419eb6df0
SHA512 b0be330248b893a3ff87807ef802a2b27c03d8f66c357304a6ef5b6911ec5ebabdd5279af9bfb1aad1b312bba7cb4304baf5e242b8b7103af7dcef4ee83bd1a1

\ProgramData\Windows Anytime Upgrade\exit.exe

MD5 e488decbb44ad1a3430e82b57a70615e
SHA1 df4130c66d988df8154bc1967f650896aa8cd6a1
SHA256 fd701894e7ec8d8319bc9b32bba5892b11bdf608c3d04c2f18eff83419eb6df0
SHA512 b0be330248b893a3ff87807ef802a2b27c03d8f66c357304a6ef5b6911ec5ebabdd5279af9bfb1aad1b312bba7cb4304baf5e242b8b7103af7dcef4ee83bd1a1

\ProgramData\Windows Anytime Upgrade\exit.exe

MD5 e488decbb44ad1a3430e82b57a70615e
SHA1 df4130c66d988df8154bc1967f650896aa8cd6a1
SHA256 fd701894e7ec8d8319bc9b32bba5892b11bdf608c3d04c2f18eff83419eb6df0
SHA512 b0be330248b893a3ff87807ef802a2b27c03d8f66c357304a6ef5b6911ec5ebabdd5279af9bfb1aad1b312bba7cb4304baf5e242b8b7103af7dcef4ee83bd1a1

C:\ProgramData\Windows Anytime Upgrade\exit.exe

MD5 e488decbb44ad1a3430e82b57a70615e
SHA1 df4130c66d988df8154bc1967f650896aa8cd6a1
SHA256 fd701894e7ec8d8319bc9b32bba5892b11bdf608c3d04c2f18eff83419eb6df0
SHA512 b0be330248b893a3ff87807ef802a2b27c03d8f66c357304a6ef5b6911ec5ebabdd5279af9bfb1aad1b312bba7cb4304baf5e242b8b7103af7dcef4ee83bd1a1

C:\ProgramData\Windows Anytime Upgrade\i.cmd

MD5 4957715bbd77615b43f5a409d4687033
SHA1 a8c9a15879c4c23b0710cb39ba902548c2fc4d10
SHA256 4a113391615785f0c4e358938eea2061040941dcd3cb09658d174a60ab683cf1
SHA512 c1b570adf7cd262755051a38437af165a3bfea6a6f50bfc4ca1ac2c72e6b4301133d244f3bc7350ac00cbb89291e4547bcb2194a28d3c25457739be2b69c98be

\ProgramData\Windows Anytime Upgrade\winserv.exe

MD5 cf2ab077a46219b6ce4a53517dd489ea
SHA1 651b8d1377910e4728e85dcd231e269313ab9e1d
SHA256 609b0a416f9b16a6df9b967dc32cd739402af31566e019a8fb8abdf3cb573e30
SHA512 53fb1ac822467168ea8e7abdd72c78cdd90070b10773ce8c700c6784ab4cc3a03eb53887d158ce3a27779a5fbcf3300d2ccbedab79a34bfd42ddc91f68dbdad7

C:\ProgramData\Windows Anytime Upgrade\winserv.exe

MD5 cf2ab077a46219b6ce4a53517dd489ea
SHA1 651b8d1377910e4728e85dcd231e269313ab9e1d
SHA256 609b0a416f9b16a6df9b967dc32cd739402af31566e019a8fb8abdf3cb573e30
SHA512 53fb1ac822467168ea8e7abdd72c78cdd90070b10773ce8c700c6784ab4cc3a03eb53887d158ce3a27779a5fbcf3300d2ccbedab79a34bfd42ddc91f68dbdad7

C:\ProgramData\Windows Anytime Upgrade\winserv.exe

MD5 cf2ab077a46219b6ce4a53517dd489ea
SHA1 651b8d1377910e4728e85dcd231e269313ab9e1d
SHA256 609b0a416f9b16a6df9b967dc32cd739402af31566e019a8fb8abdf3cb573e30
SHA512 53fb1ac822467168ea8e7abdd72c78cdd90070b10773ce8c700c6784ab4cc3a03eb53887d158ce3a27779a5fbcf3300d2ccbedab79a34bfd42ddc91f68dbdad7

memory/1496-75-0x0000000000330000-0x0000000000331000-memory.dmp

C:\ProgramData\Windows Anytime Upgrade\winserv.exe

MD5 cf2ab077a46219b6ce4a53517dd489ea
SHA1 651b8d1377910e4728e85dcd231e269313ab9e1d
SHA256 609b0a416f9b16a6df9b967dc32cd739402af31566e019a8fb8abdf3cb573e30
SHA512 53fb1ac822467168ea8e7abdd72c78cdd90070b10773ce8c700c6784ab4cc3a03eb53887d158ce3a27779a5fbcf3300d2ccbedab79a34bfd42ddc91f68dbdad7

C:\ProgramData\Windows Anytime Upgrade\settings.dat

MD5 6d7446faf515a467da338e42d956db55
SHA1 3bb80da2e5298fd278d5148a3db2814cdc76db28
SHA256 4f553fc6bdc28692b1e80f48b846b2776555116c38667d1cdefa7f2e9e01205c
SHA512 325b6b5cd0fab1d26934658fb1352521dc108466b0f426baa3f642cf100b506b1e1f957b3b2ef52d9f2716ee20254d90fcb43f45e4f794b30f783c637bd40326

memory/1776-79-0x0000000000270000-0x0000000000271000-memory.dmp

memory/1776-80-0x0000000004230000-0x0000000004231000-memory.dmp

memory/1776-81-0x0000000004240000-0x0000000004241000-memory.dmp

memory/1776-82-0x0000000004C90000-0x0000000004FA0000-memory.dmp

memory/1776-83-0x00000000054B0000-0x00000000054B1000-memory.dmp

memory/1776-84-0x0000000005600000-0x0000000005601000-memory.dmp

memory/1776-85-0x0000000005750000-0x0000000005751000-memory.dmp

memory/1776-87-0x00000000055A0000-0x00000000055A1000-memory.dmp

memory/1776-88-0x00000000054F0000-0x00000000054F1000-memory.dmp

memory/1776-90-0x00000000055B0000-0x00000000055B1000-memory.dmp

memory/1776-92-0x0000000005CB0000-0x0000000005CB1000-memory.dmp

memory/1776-91-0x00000000059B0000-0x00000000059B1000-memory.dmp

memory/1776-89-0x0000000005510000-0x0000000005511000-memory.dmp

memory/1776-86-0x0000000005500000-0x0000000005501000-memory.dmp

memory/1776-93-0x0000000005CC0000-0x0000000005CC1000-memory.dmp

memory/1776-94-0x00000000066F0000-0x000000000684C000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2022-01-28 18:32

Reported

2022-01-28 18:48

Platform

win10-en-20211208

Max time kernel

159s

Max time network

153s

Command Line

"C:\Users\Admin\AppData\Local\Temp\c0fa50e99ca5a647cedd2de2249a5fef57a57d472d9d4c13c2c14fb035ae102c.exe"

Signatures

RMS

trojan rat rms

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Control Panel\International\Geo\Nation C:\ProgramData\Windows Anytime Upgrade\winserv.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Windows\CurrentVersion\Run C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Anytime Upgrade = "C:\\ProgramData\\Windows Anytime Upgrade\\winserv.exe" C:\Windows\SysWOW64\reg.exe N/A

Enumerates physical storage devices

Kills process with taskkill

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A N/A N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A N/A N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A N/A N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A N/A N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 C:\ProgramData\Windows Anytime Upgrade\winserv.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@C:\Windows\SysWOW64\FirewallControlPanel.dll,-12122 = "Windows Firewall" C:\ProgramData\Windows Anytime Upgrade\winserv.exe N/A

Runs ping.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\ProgramData\Windows Anytime Upgrade\winserv.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\ProgramData\Windows Anytime Upgrade\winserv.exe N/A
Token: SeTcbPrivilege N/A C:\ProgramData\Windows Anytime Upgrade\winserv.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeTcbPrivilege N/A C:\ProgramData\Windows Anytime Upgrade\winserv.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2712 wrote to memory of 1260 N/A C:\Users\Admin\AppData\Local\Temp\c0fa50e99ca5a647cedd2de2249a5fef57a57d472d9d4c13c2c14fb035ae102c.exe C:\Users\Admin\AppData\Local\Temp\exit.exe
PID 2712 wrote to memory of 1260 N/A C:\Users\Admin\AppData\Local\Temp\c0fa50e99ca5a647cedd2de2249a5fef57a57d472d9d4c13c2c14fb035ae102c.exe C:\Users\Admin\AppData\Local\Temp\exit.exe
PID 2712 wrote to memory of 1260 N/A C:\Users\Admin\AppData\Local\Temp\c0fa50e99ca5a647cedd2de2249a5fef57a57d472d9d4c13c2c14fb035ae102c.exe C:\Users\Admin\AppData\Local\Temp\exit.exe
PID 1260 wrote to memory of 1328 N/A C:\Users\Admin\AppData\Local\Temp\exit.exe C:\Windows\SysWOW64\cmd.exe
PID 1260 wrote to memory of 1328 N/A C:\Users\Admin\AppData\Local\Temp\exit.exe C:\Windows\SysWOW64\cmd.exe
PID 1260 wrote to memory of 1328 N/A C:\Users\Admin\AppData\Local\Temp\exit.exe C:\Windows\SysWOW64\cmd.exe
PID 1328 wrote to memory of 1792 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 1328 wrote to memory of 1792 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 1328 wrote to memory of 1792 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 1328 wrote to memory of 1824 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 1328 wrote to memory of 1824 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 1328 wrote to memory of 1824 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 1328 wrote to memory of 1940 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\uninstall.exe
PID 1328 wrote to memory of 1940 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\uninstall.exe
PID 1328 wrote to memory of 1940 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\uninstall.exe
PID 1940 wrote to memory of 1508 N/A C:\Users\Admin\AppData\Local\Temp\uninstall.exe C:\ProgramData\Windows Anytime Upgrade\exit.exe
PID 1940 wrote to memory of 1508 N/A C:\Users\Admin\AppData\Local\Temp\uninstall.exe C:\ProgramData\Windows Anytime Upgrade\exit.exe
PID 1940 wrote to memory of 1508 N/A C:\Users\Admin\AppData\Local\Temp\uninstall.exe C:\ProgramData\Windows Anytime Upgrade\exit.exe
PID 1508 wrote to memory of 3892 N/A C:\ProgramData\Windows Anytime Upgrade\exit.exe C:\Windows\SysWOW64\cmd.exe
PID 1508 wrote to memory of 3892 N/A C:\ProgramData\Windows Anytime Upgrade\exit.exe C:\Windows\SysWOW64\cmd.exe
PID 1508 wrote to memory of 3892 N/A C:\ProgramData\Windows Anytime Upgrade\exit.exe C:\Windows\SysWOW64\cmd.exe
PID 3892 wrote to memory of 2348 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 3892 wrote to memory of 2348 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 3892 wrote to memory of 2348 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 3892 wrote to memory of 3428 N/A C:\Windows\SysWOW64\cmd.exe C:\ProgramData\Windows Anytime Upgrade\winserv.exe
PID 3892 wrote to memory of 3428 N/A C:\Windows\SysWOW64\cmd.exe C:\ProgramData\Windows Anytime Upgrade\winserv.exe
PID 3892 wrote to memory of 3428 N/A C:\Windows\SysWOW64\cmd.exe C:\ProgramData\Windows Anytime Upgrade\winserv.exe
PID 3892 wrote to memory of 60 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 3892 wrote to memory of 60 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 3892 wrote to memory of 60 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 3892 wrote to memory of 1704 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 3892 wrote to memory of 1704 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 3892 wrote to memory of 1704 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 3892 wrote to memory of 1796 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 3892 wrote to memory of 1796 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 3892 wrote to memory of 1796 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 3892 wrote to memory of 1944 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 3892 wrote to memory of 1944 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 3892 wrote to memory of 1944 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 3892 wrote to memory of 1428 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 3892 wrote to memory of 1428 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 3892 wrote to memory of 1428 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 3892 wrote to memory of 2160 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 3892 wrote to memory of 2160 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 3892 wrote to memory of 2160 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 3892 wrote to memory of 3548 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 3892 wrote to memory of 3548 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 3892 wrote to memory of 3548 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 3892 wrote to memory of 1664 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 3892 wrote to memory of 1664 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 3892 wrote to memory of 1664 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 3892 wrote to memory of 824 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 3892 wrote to memory of 824 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 3892 wrote to memory of 824 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 3892 wrote to memory of 3756 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 3892 wrote to memory of 3756 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 3892 wrote to memory of 3756 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 3892 wrote to memory of 1904 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 3892 wrote to memory of 1904 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 3892 wrote to memory of 1904 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 3892 wrote to memory of 1916 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 3892 wrote to memory of 1916 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 3892 wrote to memory of 1916 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 3892 wrote to memory of 2908 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe

Processes

C:\Users\Admin\AppData\Local\Temp\c0fa50e99ca5a647cedd2de2249a5fef57a57d472d9d4c13c2c14fb035ae102c.exe

"C:\Users\Admin\AppData\Local\Temp\c0fa50e99ca5a647cedd2de2249a5fef57a57d472d9d4c13c2c14fb035ae102c.exe"

C:\Users\Admin\AppData\Local\Temp\exit.exe

"C:\Users\Admin\AppData\Local\Temp\exit.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c i.cmd

C:\Windows\SysWOW64\PING.EXE

ping www.cloudflare.com -n 3 -w 3000

C:\Windows\SysWOW64\PING.EXE

ping www.cloudflare.com -n 3 -w 1000

C:\Users\Admin\AppData\Local\Temp\uninstall.exe

uninstall.exe x -pQELRatcwbU2EJ5 -y

C:\ProgramData\Windows Anytime Upgrade\exit.exe

"C:\ProgramData\Windows Anytime Upgrade\exit.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c i.cmd

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Windows Anytime Upgrade" /t REG_SZ /d "C:\ProgramData\Windows Anytime Upgrade\winserv.exe"

C:\ProgramData\Windows Anytime Upgrade\winserv.exe

"C:\ProgramData\Windows Anytime Upgrade\winserv.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\ProgramData\Windows Anytime Upgrade\winserv.exe

"C:\ProgramData\Windows Anytime Upgrade\winserv.exe" -second

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "rundll32.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 www.cloudflare.com udp
US 104.168.237.93:5655 tcp
US 104.168.237.93:5655 tcp
US 104.168.237.93:5655 tcp
US 104.168.237.93:5655 tcp
US 104.168.237.93:5655 tcp
US 104.168.237.93:5655 tcp
US 104.168.237.93:5655 tcp
US 104.168.237.93:5655 tcp
US 104.168.237.93:5655 tcp
US 104.168.237.93:5655 tcp
US 104.168.237.93:5655 tcp
US 104.168.237.93:5655 tcp
US 104.168.237.93:5655 tcp
US 104.168.237.93:5655 tcp
US 104.168.237.93:5655 tcp
US 104.168.237.93:5655 tcp
US 104.168.237.93:5655 tcp
US 104.168.237.93:5655 tcp
US 104.168.237.93:5655 tcp
US 104.168.237.93:5655 tcp
US 104.168.237.93:5655 tcp
US 104.168.237.93:5655 tcp
US 104.168.237.93:5655 tcp
US 104.168.237.93:5655 tcp
US 104.168.237.93:5655 tcp
US 104.168.237.93:5655 tcp
US 104.168.237.93:5655 tcp

Files

C:\Users\Admin\AppData\Local\Temp\exit.exe

MD5 e488decbb44ad1a3430e82b57a70615e
SHA1 df4130c66d988df8154bc1967f650896aa8cd6a1
SHA256 fd701894e7ec8d8319bc9b32bba5892b11bdf608c3d04c2f18eff83419eb6df0
SHA512 b0be330248b893a3ff87807ef802a2b27c03d8f66c357304a6ef5b6911ec5ebabdd5279af9bfb1aad1b312bba7cb4304baf5e242b8b7103af7dcef4ee83bd1a1

C:\Users\Admin\AppData\Local\Temp\exit.exe

MD5 e488decbb44ad1a3430e82b57a70615e
SHA1 df4130c66d988df8154bc1967f650896aa8cd6a1
SHA256 fd701894e7ec8d8319bc9b32bba5892b11bdf608c3d04c2f18eff83419eb6df0
SHA512 b0be330248b893a3ff87807ef802a2b27c03d8f66c357304a6ef5b6911ec5ebabdd5279af9bfb1aad1b312bba7cb4304baf5e242b8b7103af7dcef4ee83bd1a1

C:\Users\Admin\AppData\Local\Temp\i.cmd

MD5 85493a23f5bc37f468d52f9f0aba455e
SHA1 5d66578262f520cc4d2b2bf9172696a526430d00
SHA256 99a87d79ef151cca03a30dea1274afc7b176310a01a706cfcea12ea40ab0b810
SHA512 642d1f1a4992d45818dd5fef0a9d1f969cd6c352ad90a7b6d55b7c063ab9534180c27186da6fac3d3c3c9a8c1c21d526ff4b63dbd085cb5df860bb04bd398f67

C:\Users\Admin\AppData\Local\Temp\kernel.dll

MD5 07680116e1883be684d8b54efcc8e655
SHA1 11f472c43f214cbce6bd8d30990b1bebbd6b9bfa
SHA256 deebd0b0c7b1536e598b4c8680a2f34439bdd68e84e63709e35d083783c58bce
SHA512 4581ed77b6052f648cc15dcea5ad25954580d89c52d4fbffc8055b8feb6796d9eaf2a3108d7003b5f79e95b467a6e921ec101acb5ee328b3a18e3ad3ae9310d1

C:\Users\Admin\AppData\Local\Temp\uninstall.exe

MD5 07680116e1883be684d8b54efcc8e655
SHA1 11f472c43f214cbce6bd8d30990b1bebbd6b9bfa
SHA256 deebd0b0c7b1536e598b4c8680a2f34439bdd68e84e63709e35d083783c58bce
SHA512 4581ed77b6052f648cc15dcea5ad25954580d89c52d4fbffc8055b8feb6796d9eaf2a3108d7003b5f79e95b467a6e921ec101acb5ee328b3a18e3ad3ae9310d1

C:\ProgramData\Windows Anytime Upgrade\exit.exe

MD5 e488decbb44ad1a3430e82b57a70615e
SHA1 df4130c66d988df8154bc1967f650896aa8cd6a1
SHA256 fd701894e7ec8d8319bc9b32bba5892b11bdf608c3d04c2f18eff83419eb6df0
SHA512 b0be330248b893a3ff87807ef802a2b27c03d8f66c357304a6ef5b6911ec5ebabdd5279af9bfb1aad1b312bba7cb4304baf5e242b8b7103af7dcef4ee83bd1a1

C:\ProgramData\Windows Anytime Upgrade\exit.exe

MD5 e488decbb44ad1a3430e82b57a70615e
SHA1 df4130c66d988df8154bc1967f650896aa8cd6a1
SHA256 fd701894e7ec8d8319bc9b32bba5892b11bdf608c3d04c2f18eff83419eb6df0
SHA512 b0be330248b893a3ff87807ef802a2b27c03d8f66c357304a6ef5b6911ec5ebabdd5279af9bfb1aad1b312bba7cb4304baf5e242b8b7103af7dcef4ee83bd1a1

C:\ProgramData\Windows Anytime Upgrade\i.cmd

MD5 4957715bbd77615b43f5a409d4687033
SHA1 a8c9a15879c4c23b0710cb39ba902548c2fc4d10
SHA256 4a113391615785f0c4e358938eea2061040941dcd3cb09658d174a60ab683cf1
SHA512 c1b570adf7cd262755051a38437af165a3bfea6a6f50bfc4ca1ac2c72e6b4301133d244f3bc7350ac00cbb89291e4547bcb2194a28d3c25457739be2b69c98be

C:\ProgramData\Windows Anytime Upgrade\winserv.exe

MD5 cf2ab077a46219b6ce4a53517dd489ea
SHA1 651b8d1377910e4728e85dcd231e269313ab9e1d
SHA256 609b0a416f9b16a6df9b967dc32cd739402af31566e019a8fb8abdf3cb573e30
SHA512 53fb1ac822467168ea8e7abdd72c78cdd90070b10773ce8c700c6784ab4cc3a03eb53887d158ce3a27779a5fbcf3300d2ccbedab79a34bfd42ddc91f68dbdad7

C:\ProgramData\Windows Anytime Upgrade\winserv.exe

MD5 cf2ab077a46219b6ce4a53517dd489ea
SHA1 651b8d1377910e4728e85dcd231e269313ab9e1d
SHA256 609b0a416f9b16a6df9b967dc32cd739402af31566e019a8fb8abdf3cb573e30
SHA512 53fb1ac822467168ea8e7abdd72c78cdd90070b10773ce8c700c6784ab4cc3a03eb53887d158ce3a27779a5fbcf3300d2ccbedab79a34bfd42ddc91f68dbdad7

memory/3428-367-0x0000000002E21000-0x0000000003000000-memory.dmp

memory/3428-368-0x0000000004820000-0x0000000004821000-memory.dmp

C:\ProgramData\Windows Anytime Upgrade\winserv.exe

MD5 cf2ab077a46219b6ce4a53517dd489ea
SHA1 651b8d1377910e4728e85dcd231e269313ab9e1d
SHA256 609b0a416f9b16a6df9b967dc32cd739402af31566e019a8fb8abdf3cb573e30
SHA512 53fb1ac822467168ea8e7abdd72c78cdd90070b10773ce8c700c6784ab4cc3a03eb53887d158ce3a27779a5fbcf3300d2ccbedab79a34bfd42ddc91f68dbdad7

memory/1592-370-0x00000000029D0000-0x00000000029D1000-memory.dmp

C:\ProgramData\Windows Anytime Upgrade\settings.dat

MD5 6d7446faf515a467da338e42d956db55
SHA1 3bb80da2e5298fd278d5148a3db2814cdc76db28
SHA256 4f553fc6bdc28692b1e80f48b846b2776555116c38667d1cdefa7f2e9e01205c
SHA512 325b6b5cd0fab1d26934658fb1352521dc108466b0f426baa3f642cf100b506b1e1f957b3b2ef52d9f2716ee20254d90fcb43f45e4f794b30f783c637bd40326

memory/1592-372-0x00000000045F0000-0x00000000045F1000-memory.dmp

memory/1592-373-0x0000000004990000-0x0000000004991000-memory.dmp

memory/1592-379-0x0000000004600000-0x0000000004601000-memory.dmp

memory/1592-380-0x0000000004630000-0x0000000004631000-memory.dmp

memory/1592-381-0x0000000005160000-0x0000000005161000-memory.dmp

memory/1592-382-0x0000000004F00000-0x0000000004F01000-memory.dmp

memory/1592-383-0x0000000004F50000-0x0000000004F51000-memory.dmp

memory/1592-384-0x0000000004F60000-0x0000000004F61000-memory.dmp

memory/1592-385-0x0000000004F70000-0x0000000004F71000-memory.dmp

memory/1592-386-0x0000000006F00000-0x0000000006F01000-memory.dmp

memory/1592-387-0x0000000007100000-0x0000000007101000-memory.dmp

memory/1592-388-0x0000000007390000-0x0000000007461000-memory.dmp

memory/1592-389-0x00000000074E0000-0x00000000074E1000-memory.dmp