Analysis Overview
SHA256
6f1a8ee627ec2ed7e1d818d32a34a163416938eb13a97783a71f9b79843a80a2
Threat Level: Known bad
The file 6f1a8ee627ec2ed7e1d818d32a34a163416938eb13a97783a71f9b79843a80a2 was found to be: Known bad.
Malicious Activity Summary
SmokeLoader
RMS
Executes dropped EXE
Checks computer location settings
Loads dropped DLL
Adds Run key to start application
Enumerates physical storage devices
Suspicious use of SetWindowsHookEx
Kills process with taskkill
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Checks SCSI registry key(s)
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Runs ping.exe
Modifies data under HKEY_USERS
MITRE ATT&CK
Enterprise Matrix V6
Analysis: static1
Detonation Overview
Reported
2022-01-28 20:21
Signatures
Analysis: behavioral1
Detonation Overview
Submitted
2022-01-28 20:21
Reported
2022-01-28 21:40
Platform
win7-en-20211208
Max time kernel
157s
Max time network
145s
Command Line
Signatures
RMS
SmokeLoader
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\exit.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\uninstall.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\veter2005_MAPS_10cr24.exe | N/A |
| N/A | N/A | C:\ProgramData\Windows Anytime Upgrade\exit.exe | N/A |
| N/A | N/A | C:\ProgramData\Windows Anytime Upgrade\winserv.exe | N/A |
| N/A | N/A | C:\ProgramData\Windows Anytime Upgrade\winserv.exe | N/A |
Checks computer location settings
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Control Panel\International\Geo\Nation | C:\ProgramData\Windows Anytime Upgrade\winserv.exe | N/A |
Loads dropped DLL
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\6f1a8ee627ec2ed7e1d818d32a34a163416938eb13a97783a71f9b79843a80a2.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\6f1a8ee627ec2ed7e1d818d32a34a163416938eb13a97783a71f9b79843a80a2.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\6f1a8ee627ec2ed7e1d818d32a34a163416938eb13a97783a71f9b79843a80a2.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\6f1a8ee627ec2ed7e1d818d32a34a163416938eb13a97783a71f9b79843a80a2.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\cmd.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\cmd.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\uninstall.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\uninstall.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\uninstall.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\uninstall.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\cmd.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\veter2005_MAPS_10cr24.exe | N/A |
Adds Run key to start application
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Windows\CurrentVersion\Run | C:\Windows\SysWOW64\reg.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Anytime Upgrade = "C:\\ProgramData\\Windows Anytime Upgrade\\winserv.exe" | C:\Windows\SysWOW64\reg.exe | N/A |
Enumerates physical storage devices
Checks SCSI registry key(s)
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI | C:\Users\Admin\AppData\Local\Temp\veter2005_MAPS_10cr24.exe | N/A |
| Key queried | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI | C:\Users\Admin\AppData\Local\Temp\veter2005_MAPS_10cr24.exe | N/A |
| Key enumerated | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI | C:\Users\Admin\AppData\Local\Temp\veter2005_MAPS_10cr24.exe | N/A |
Kills process with taskkill
Runs ping.exe
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\PING.EXE | N/A |
| N/A | N/A | C:\Windows\SysWOW64\PING.EXE | N/A |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\ProgramData\Windows Anytime Upgrade\winserv.exe | N/A |
| N/A | N/A | C:\ProgramData\Windows Anytime Upgrade\winserv.exe | N/A |
| N/A | N/A | C:\ProgramData\Windows Anytime Upgrade\winserv.exe | N/A |
| N/A | N/A | C:\ProgramData\Windows Anytime Upgrade\winserv.exe | N/A |
| N/A | N/A | C:\ProgramData\Windows Anytime Upgrade\winserv.exe | N/A |
| N/A | N/A | C:\ProgramData\Windows Anytime Upgrade\winserv.exe | N/A |
| N/A | N/A | C:\ProgramData\Windows Anytime Upgrade\winserv.exe | N/A |
| N/A | N/A | C:\ProgramData\Windows Anytime Upgrade\winserv.exe | N/A |
| N/A | N/A | C:\ProgramData\Windows Anytime Upgrade\winserv.exe | N/A |
Suspicious behavior: MapViewOfSection
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\veter2005_MAPS_10cr24.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\veter2005_MAPS_10cr24.exe | N/A |
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
| Description | Indicator | Process | Target |
| N/A | N/A | C:\ProgramData\Windows Anytime Upgrade\winserv.exe | N/A |
| N/A | N/A | C:\ProgramData\Windows Anytime Upgrade\winserv.exe | N/A |
| N/A | N/A | C:\ProgramData\Windows Anytime Upgrade\winserv.exe | N/A |
| N/A | N/A | C:\ProgramData\Windows Anytime Upgrade\winserv.exe | N/A |
| N/A | N/A | C:\ProgramData\Windows Anytime Upgrade\winserv.exe | N/A |
| N/A | N/A | C:\ProgramData\Windows Anytime Upgrade\winserv.exe | N/A |
| N/A | N/A | C:\ProgramData\Windows Anytime Upgrade\winserv.exe | N/A |
| N/A | N/A | C:\ProgramData\Windows Anytime Upgrade\winserv.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\6f1a8ee627ec2ed7e1d818d32a34a163416938eb13a97783a71f9b79843a80a2.exe
"C:\Users\Admin\AppData\Local\Temp\6f1a8ee627ec2ed7e1d818d32a34a163416938eb13a97783a71f9b79843a80a2.exe"
C:\Users\Admin\AppData\Local\Temp\exit.exe
"C:\Users\Admin\AppData\Local\Temp\exit.exe"
C:\Windows\SysWOW64\cmd.exe
cmd /c i.cmd
C:\Windows\SysWOW64\PING.EXE
ping www.cloudflare.com -n 3 -w 3000
C:\Windows\SysWOW64\PING.EXE
ping www.cloudflare.com -n 3 -w 1000
C:\Users\Admin\AppData\Local\Temp\uninstall.exe
uninstall.exe x -pQELRatcwbU2EJ5 -y
C:\Users\Admin\AppData\Local\Temp\veter2005_MAPS_10cr24.exe
veter2005_MAPS_10cr24.exe
C:\ProgramData\Windows Anytime Upgrade\exit.exe
"C:\ProgramData\Windows Anytime Upgrade\exit.exe"
C:\Windows\SysWOW64\cmd.exe
cmd /c i.cmd
C:\Windows\SysWOW64\reg.exe
REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Windows Anytime Upgrade" /t REG_SZ /d "C:\ProgramData\Windows Anytime Upgrade\winserv.exe"
C:\ProgramData\Windows Anytime Upgrade\winserv.exe
"C:\ProgramData\Windows Anytime Upgrade\winserv.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\ProgramData\Windows Anytime Upgrade\winserv.exe
"C:\ProgramData\Windows Anytime Upgrade\winserv.exe" -second
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | www.cloudflare.com | udp |
| NL | 217.12.201.159:5655 | tcp | |
| NL | 217.12.201.159:5655 | tcp | |
| NL | 217.12.201.159:5655 | tcp | |
| NL | 217.12.201.159:5655 | tcp | |
| NL | 91.240.118.172:80 | tcp | |
| NL | 217.12.201.159:5655 | tcp | |
| NL | 217.12.201.159:5655 | tcp | |
| NL | 217.12.201.159:5655 | tcp | |
| NL | 217.12.201.159:5655 | tcp | |
| NL | 217.12.201.159:5655 | tcp | |
| NL | 217.12.201.159:5655 | tcp | |
| NL | 217.12.201.159:5655 | tcp | |
| NL | 217.12.201.159:5655 | tcp | |
| NL | 217.12.201.159:5655 | tcp | |
| NL | 217.12.201.159:5655 | tcp | |
| NL | 217.12.201.159:5655 | tcp | |
| NL | 217.12.201.159:5655 | tcp | |
| NL | 217.12.201.159:5655 | tcp | |
| NL | 217.12.201.159:5655 | tcp | |
| NL | 217.12.201.159:5655 | tcp | |
| NL | 217.12.201.159:5655 | tcp | |
| NL | 217.12.201.159:5655 | tcp | |
| NL | 217.12.201.159:5655 | tcp | |
| NL | 217.12.201.159:5655 | tcp | |
| NL | 217.12.201.159:5655 | tcp | |
| NL | 217.12.201.159:5655 | tcp | |
| NL | 217.12.201.159:5655 | tcp | |
| NL | 217.12.201.159:5655 | tcp |
Files
memory/1848-54-0x0000000075891000-0x0000000075893000-memory.dmp
\Users\Admin\AppData\Local\Temp\exit.exe
| MD5 | e488decbb44ad1a3430e82b57a70615e |
| SHA1 | df4130c66d988df8154bc1967f650896aa8cd6a1 |
| SHA256 | fd701894e7ec8d8319bc9b32bba5892b11bdf608c3d04c2f18eff83419eb6df0 |
| SHA512 | b0be330248b893a3ff87807ef802a2b27c03d8f66c357304a6ef5b6911ec5ebabdd5279af9bfb1aad1b312bba7cb4304baf5e242b8b7103af7dcef4ee83bd1a1 |
\Users\Admin\AppData\Local\Temp\exit.exe
| MD5 | e488decbb44ad1a3430e82b57a70615e |
| SHA1 | df4130c66d988df8154bc1967f650896aa8cd6a1 |
| SHA256 | fd701894e7ec8d8319bc9b32bba5892b11bdf608c3d04c2f18eff83419eb6df0 |
| SHA512 | b0be330248b893a3ff87807ef802a2b27c03d8f66c357304a6ef5b6911ec5ebabdd5279af9bfb1aad1b312bba7cb4304baf5e242b8b7103af7dcef4ee83bd1a1 |
\Users\Admin\AppData\Local\Temp\exit.exe
| MD5 | e488decbb44ad1a3430e82b57a70615e |
| SHA1 | df4130c66d988df8154bc1967f650896aa8cd6a1 |
| SHA256 | fd701894e7ec8d8319bc9b32bba5892b11bdf608c3d04c2f18eff83419eb6df0 |
| SHA512 | b0be330248b893a3ff87807ef802a2b27c03d8f66c357304a6ef5b6911ec5ebabdd5279af9bfb1aad1b312bba7cb4304baf5e242b8b7103af7dcef4ee83bd1a1 |
\Users\Admin\AppData\Local\Temp\exit.exe
| MD5 | e488decbb44ad1a3430e82b57a70615e |
| SHA1 | df4130c66d988df8154bc1967f650896aa8cd6a1 |
| SHA256 | fd701894e7ec8d8319bc9b32bba5892b11bdf608c3d04c2f18eff83419eb6df0 |
| SHA512 | b0be330248b893a3ff87807ef802a2b27c03d8f66c357304a6ef5b6911ec5ebabdd5279af9bfb1aad1b312bba7cb4304baf5e242b8b7103af7dcef4ee83bd1a1 |
C:\Users\Admin\AppData\Local\Temp\exit.exe
| MD5 | e488decbb44ad1a3430e82b57a70615e |
| SHA1 | df4130c66d988df8154bc1967f650896aa8cd6a1 |
| SHA256 | fd701894e7ec8d8319bc9b32bba5892b11bdf608c3d04c2f18eff83419eb6df0 |
| SHA512 | b0be330248b893a3ff87807ef802a2b27c03d8f66c357304a6ef5b6911ec5ebabdd5279af9bfb1aad1b312bba7cb4304baf5e242b8b7103af7dcef4ee83bd1a1 |
C:\Users\Admin\AppData\Local\Temp\i.cmd
| MD5 | 8aedb7db6d45e3b48941edf4cb4e9cb6 |
| SHA1 | 12c8a6b5c728caf2381db68608318ad64a91b1a5 |
| SHA256 | 137c665abd6c2265cad7830c7a5e7942eef44637358aa2056f3e33177bcf8935 |
| SHA512 | 7af4eea32316d4f2e5daffc05777bb860b56c3990fa42db086e582a6b4b98c0b0875e7445607c15ab6b3009f6cc97dd5f59eb5d0ca42d8ef97ae0d1786c05bf2 |
C:\Users\Admin\AppData\Local\Temp\kernel.dll
| MD5 | 9f63ef6993f98ddd56e1e2cdf2d67b27 |
| SHA1 | 2ec6e958c6e8d0ba8a1682657f57c0c66056ec7e |
| SHA256 | 5310c2397ba4c783f7ee9724711a6da9b5c603b5c9781fff3407b46725e338b3 |
| SHA512 | ba509a33694b6ef7e5837ea86735ee82c353613c1c7a134a9492fede3b81bedaaf41458c1fbbce77cb1b06b7624f890396df17ff53a57030c1de4b5a585803b4 |
\Users\Admin\AppData\Local\Temp\uninstall.exe
| MD5 | 9f63ef6993f98ddd56e1e2cdf2d67b27 |
| SHA1 | 2ec6e958c6e8d0ba8a1682657f57c0c66056ec7e |
| SHA256 | 5310c2397ba4c783f7ee9724711a6da9b5c603b5c9781fff3407b46725e338b3 |
| SHA512 | ba509a33694b6ef7e5837ea86735ee82c353613c1c7a134a9492fede3b81bedaaf41458c1fbbce77cb1b06b7624f890396df17ff53a57030c1de4b5a585803b4 |
C:\Users\Admin\AppData\Local\Temp\veter2005_MAPS_10cr24.exe
| MD5 | a8c805792a954ca0664221acde199f48 |
| SHA1 | 248a4be7db6485f85920b15a5cf21df68b800159 |
| SHA256 | 2b5eefc4bc2d34cbe5093332c47b5405cf5c32e8156767fc8bc9ddd9cdcf3018 |
| SHA512 | 9b54be9fb046cde9c3a6107bd2100268e179e8ae15756cfb0c134e3d3a37735121445c348192562a23148a57ded6f4e32a141161dc78fc711fd28e5a619e69ab |
\Users\Admin\AppData\Local\Temp\veter2005_MAPS_10cr24.exe
| MD5 | a8c805792a954ca0664221acde199f48 |
| SHA1 | 248a4be7db6485f85920b15a5cf21df68b800159 |
| SHA256 | 2b5eefc4bc2d34cbe5093332c47b5405cf5c32e8156767fc8bc9ddd9cdcf3018 |
| SHA512 | 9b54be9fb046cde9c3a6107bd2100268e179e8ae15756cfb0c134e3d3a37735121445c348192562a23148a57ded6f4e32a141161dc78fc711fd28e5a619e69ab |
C:\Users\Admin\AppData\Local\Temp\uninstall.exe
| MD5 | 9f63ef6993f98ddd56e1e2cdf2d67b27 |
| SHA1 | 2ec6e958c6e8d0ba8a1682657f57c0c66056ec7e |
| SHA256 | 5310c2397ba4c783f7ee9724711a6da9b5c603b5c9781fff3407b46725e338b3 |
| SHA512 | ba509a33694b6ef7e5837ea86735ee82c353613c1c7a134a9492fede3b81bedaaf41458c1fbbce77cb1b06b7624f890396df17ff53a57030c1de4b5a585803b4 |
C:\Users\Admin\AppData\Local\Temp\veter2005_MAPS_10cr24.exe
| MD5 | a8c805792a954ca0664221acde199f48 |
| SHA1 | 248a4be7db6485f85920b15a5cf21df68b800159 |
| SHA256 | 2b5eefc4bc2d34cbe5093332c47b5405cf5c32e8156767fc8bc9ddd9cdcf3018 |
| SHA512 | 9b54be9fb046cde9c3a6107bd2100268e179e8ae15756cfb0c134e3d3a37735121445c348192562a23148a57ded6f4e32a141161dc78fc711fd28e5a619e69ab |
\ProgramData\Windows Anytime Upgrade\exit.exe
| MD5 | e488decbb44ad1a3430e82b57a70615e |
| SHA1 | df4130c66d988df8154bc1967f650896aa8cd6a1 |
| SHA256 | fd701894e7ec8d8319bc9b32bba5892b11bdf608c3d04c2f18eff83419eb6df0 |
| SHA512 | b0be330248b893a3ff87807ef802a2b27c03d8f66c357304a6ef5b6911ec5ebabdd5279af9bfb1aad1b312bba7cb4304baf5e242b8b7103af7dcef4ee83bd1a1 |
\ProgramData\Windows Anytime Upgrade\exit.exe
| MD5 | e488decbb44ad1a3430e82b57a70615e |
| SHA1 | df4130c66d988df8154bc1967f650896aa8cd6a1 |
| SHA256 | fd701894e7ec8d8319bc9b32bba5892b11bdf608c3d04c2f18eff83419eb6df0 |
| SHA512 | b0be330248b893a3ff87807ef802a2b27c03d8f66c357304a6ef5b6911ec5ebabdd5279af9bfb1aad1b312bba7cb4304baf5e242b8b7103af7dcef4ee83bd1a1 |
\ProgramData\Windows Anytime Upgrade\exit.exe
| MD5 | e488decbb44ad1a3430e82b57a70615e |
| SHA1 | df4130c66d988df8154bc1967f650896aa8cd6a1 |
| SHA256 | fd701894e7ec8d8319bc9b32bba5892b11bdf608c3d04c2f18eff83419eb6df0 |
| SHA512 | b0be330248b893a3ff87807ef802a2b27c03d8f66c357304a6ef5b6911ec5ebabdd5279af9bfb1aad1b312bba7cb4304baf5e242b8b7103af7dcef4ee83bd1a1 |
\ProgramData\Windows Anytime Upgrade\exit.exe
| MD5 | e488decbb44ad1a3430e82b57a70615e |
| SHA1 | df4130c66d988df8154bc1967f650896aa8cd6a1 |
| SHA256 | fd701894e7ec8d8319bc9b32bba5892b11bdf608c3d04c2f18eff83419eb6df0 |
| SHA512 | b0be330248b893a3ff87807ef802a2b27c03d8f66c357304a6ef5b6911ec5ebabdd5279af9bfb1aad1b312bba7cb4304baf5e242b8b7103af7dcef4ee83bd1a1 |
C:\ProgramData\Windows Anytime Upgrade\exit.exe
| MD5 | e488decbb44ad1a3430e82b57a70615e |
| SHA1 | df4130c66d988df8154bc1967f650896aa8cd6a1 |
| SHA256 | fd701894e7ec8d8319bc9b32bba5892b11bdf608c3d04c2f18eff83419eb6df0 |
| SHA512 | b0be330248b893a3ff87807ef802a2b27c03d8f66c357304a6ef5b6911ec5ebabdd5279af9bfb1aad1b312bba7cb4304baf5e242b8b7103af7dcef4ee83bd1a1 |
C:\ProgramData\Windows Anytime Upgrade\i.cmd
| MD5 | 4957715bbd77615b43f5a409d4687033 |
| SHA1 | a8c9a15879c4c23b0710cb39ba902548c2fc4d10 |
| SHA256 | 4a113391615785f0c4e358938eea2061040941dcd3cb09658d174a60ab683cf1 |
| SHA512 | c1b570adf7cd262755051a38437af165a3bfea6a6f50bfc4ca1ac2c72e6b4301133d244f3bc7350ac00cbb89291e4547bcb2194a28d3c25457739be2b69c98be |
C:\ProgramData\Windows Anytime Upgrade\winserv.exe
| MD5 | cf2ab077a46219b6ce4a53517dd489ea |
| SHA1 | 651b8d1377910e4728e85dcd231e269313ab9e1d |
| SHA256 | 609b0a416f9b16a6df9b967dc32cd739402af31566e019a8fb8abdf3cb573e30 |
| SHA512 | 53fb1ac822467168ea8e7abdd72c78cdd90070b10773ce8c700c6784ab4cc3a03eb53887d158ce3a27779a5fbcf3300d2ccbedab79a34bfd42ddc91f68dbdad7 |
\ProgramData\Windows Anytime Upgrade\winserv.exe
| MD5 | cf2ab077a46219b6ce4a53517dd489ea |
| SHA1 | 651b8d1377910e4728e85dcd231e269313ab9e1d |
| SHA256 | 609b0a416f9b16a6df9b967dc32cd739402af31566e019a8fb8abdf3cb573e30 |
| SHA512 | 53fb1ac822467168ea8e7abdd72c78cdd90070b10773ce8c700c6784ab4cc3a03eb53887d158ce3a27779a5fbcf3300d2ccbedab79a34bfd42ddc91f68dbdad7 |
C:\ProgramData\Windows Anytime Upgrade\winserv.exe
| MD5 | cf2ab077a46219b6ce4a53517dd489ea |
| SHA1 | 651b8d1377910e4728e85dcd231e269313ab9e1d |
| SHA256 | 609b0a416f9b16a6df9b967dc32cd739402af31566e019a8fb8abdf3cb573e30 |
| SHA512 | 53fb1ac822467168ea8e7abdd72c78cdd90070b10773ce8c700c6784ab4cc3a03eb53887d158ce3a27779a5fbcf3300d2ccbedab79a34bfd42ddc91f68dbdad7 |
C:\ProgramData\Windows Anytime Upgrade\winserv.exe
| MD5 | cf2ab077a46219b6ce4a53517dd489ea |
| SHA1 | 651b8d1377910e4728e85dcd231e269313ab9e1d |
| SHA256 | 609b0a416f9b16a6df9b967dc32cd739402af31566e019a8fb8abdf3cb573e30 |
| SHA512 | 53fb1ac822467168ea8e7abdd72c78cdd90070b10773ce8c700c6784ab4cc3a03eb53887d158ce3a27779a5fbcf3300d2ccbedab79a34bfd42ddc91f68dbdad7 |
C:\ProgramData\Windows Anytime Upgrade\settings.dat
| MD5 | 46ff979a07cd2721dc14da7edf386ad7 |
| SHA1 | 228973c6b1eca31bd453d770abec3302a3ee43fa |
| SHA256 | 210bb55664d291d82b94b9cea6fcf41029eded9eca6e7fe7b7d58715407a0703 |
| SHA512 | a901adca59f721b83cc1b3345417b6c28b01bd01e5b0c830179f281f9bcf3dcfb2ee7ae40afdcee6f903b7a8d19100af5fc72e402971e83e9d22f5bcb2f4f68f |
memory/1572-88-0x0000000004340000-0x0000000004341000-memory.dmp
memory/1572-87-0x0000000004330000-0x0000000004331000-memory.dmp
memory/1572-89-0x0000000004360000-0x0000000004361000-memory.dmp
memory/1572-86-0x0000000004310000-0x0000000004311000-memory.dmp
memory/1572-85-0x0000000004350000-0x0000000004351000-memory.dmp
memory/1572-84-0x00000000042F0000-0x00000000042F1000-memory.dmp
memory/1572-83-0x0000000000330000-0x0000000000331000-memory.dmp
memory/1572-90-0x0000000005520000-0x0000000005521000-memory.dmp
memory/1572-94-0x00000000059B0000-0x00000000059B1000-memory.dmp
memory/1572-93-0x0000000005640000-0x0000000005641000-memory.dmp
memory/1572-92-0x0000000005630000-0x0000000005631000-memory.dmp
memory/1572-91-0x0000000004D50000-0x00000000050A0000-memory.dmp
memory/1572-95-0x0000000005B70000-0x0000000005B71000-memory.dmp
memory/1572-96-0x0000000005B80000-0x0000000005B81000-memory.dmp
memory/1572-97-0x0000000005D30000-0x0000000005D31000-memory.dmp
memory/1188-98-0x0000000000400000-0x0000000000474000-memory.dmp
memory/1188-99-0x0000000001D90000-0x0000000001DBD000-memory.dmp
\Users\Admin\AppData\Local\Temp\1D86.tmp
| MD5 | d124f55b9393c976963407dff51ffa79 |
| SHA1 | 2c7bbedd79791bfb866898c85b504186db610b5d |
| SHA256 | ea1e16247c848c8c171c4cd1fa17bc5a018a1fcb0c0dac25009066b6667b8eef |
| SHA512 | 278fe3a4b1fbbe700e4f4483b610133e975e36e101455661d5197bd892a68839b9d555499040d200c92aefa9e3819380e395c0cd85d5fc845c6364d128a8cf06 |
memory/1416-101-0x00000000026F0000-0x00000000026F1000-memory.dmp
memory/1416-102-0x00000000026D0000-0x00000000026E6000-memory.dmp
Analysis: behavioral2
Detonation Overview
Submitted
2022-01-28 20:21
Reported
2022-01-28 21:45
Platform
win10-en-20211208
Max time kernel
181s
Max time network
170s
Command Line
Signatures
RMS
SmokeLoader
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\exit.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\uninstall.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\veter2005_MAPS_10cr24.exe | N/A |
| N/A | N/A | C:\ProgramData\Windows Anytime Upgrade\exit.exe | N/A |
| N/A | N/A | C:\ProgramData\Windows Anytime Upgrade\winserv.exe | N/A |
| N/A | N/A | C:\ProgramData\Windows Anytime Upgrade\winserv.exe | N/A |
Checks computer location settings
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Control Panel\International\Geo\Nation | C:\ProgramData\Windows Anytime Upgrade\winserv.exe | N/A |
Loads dropped DLL
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\veter2005_MAPS_10cr24.exe | N/A |
Adds Run key to start application
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Windows\CurrentVersion\Run | C:\Windows\SysWOW64\reg.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Anytime Upgrade = "C:\\ProgramData\\Windows Anytime Upgrade\\winserv.exe" | C:\Windows\SysWOW64\reg.exe | N/A |
Enumerates physical storage devices
Checks SCSI registry key(s)
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI | C:\Users\Admin\AppData\Local\Temp\veter2005_MAPS_10cr24.exe | N/A |
| Key queried | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI | C:\Users\Admin\AppData\Local\Temp\veter2005_MAPS_10cr24.exe | N/A |
| Key enumerated | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI | C:\Users\Admin\AppData\Local\Temp\veter2005_MAPS_10cr24.exe | N/A |
Kills process with taskkill
Modifies data under HKEY_USERS
| Description | Indicator | Process | Target |
| Set value (data) | \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 | C:\ProgramData\Windows Anytime Upgrade\winserv.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@C:\Windows\SysWOW64\FirewallControlPanel.dll,-12122 = "Windows Firewall" | C:\ProgramData\Windows Anytime Upgrade\winserv.exe | N/A |
Runs ping.exe
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\PING.EXE | N/A |
| N/A | N/A | C:\Windows\SysWOW64\PING.EXE | N/A |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\ProgramData\Windows Anytime Upgrade\winserv.exe | N/A |
| N/A | N/A | C:\ProgramData\Windows Anytime Upgrade\winserv.exe | N/A |
| N/A | N/A | C:\ProgramData\Windows Anytime Upgrade\winserv.exe | N/A |
| N/A | N/A | C:\ProgramData\Windows Anytime Upgrade\winserv.exe | N/A |
| N/A | N/A | C:\ProgramData\Windows Anytime Upgrade\winserv.exe | N/A |
| N/A | N/A | C:\ProgramData\Windows Anytime Upgrade\winserv.exe | N/A |
| N/A | N/A | C:\ProgramData\Windows Anytime Upgrade\winserv.exe | N/A |
| N/A | N/A | C:\ProgramData\Windows Anytime Upgrade\winserv.exe | N/A |
| N/A | N/A | C:\ProgramData\Windows Anytime Upgrade\winserv.exe | N/A |
| N/A | N/A | C:\ProgramData\Windows Anytime Upgrade\winserv.exe | N/A |
Suspicious behavior: MapViewOfSection
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\veter2005_MAPS_10cr24.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\veter2005_MAPS_10cr24.exe | N/A |
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
| Description | Indicator | Process | Target |
| N/A | N/A | C:\ProgramData\Windows Anytime Upgrade\winserv.exe | N/A |
| N/A | N/A | C:\ProgramData\Windows Anytime Upgrade\winserv.exe | N/A |
| N/A | N/A | C:\ProgramData\Windows Anytime Upgrade\winserv.exe | N/A |
| N/A | N/A | C:\ProgramData\Windows Anytime Upgrade\winserv.exe | N/A |
| N/A | N/A | C:\ProgramData\Windows Anytime Upgrade\winserv.exe | N/A |
| N/A | N/A | C:\ProgramData\Windows Anytime Upgrade\winserv.exe | N/A |
| N/A | N/A | C:\ProgramData\Windows Anytime Upgrade\winserv.exe | N/A |
| N/A | N/A | C:\ProgramData\Windows Anytime Upgrade\winserv.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\6f1a8ee627ec2ed7e1d818d32a34a163416938eb13a97783a71f9b79843a80a2.exe
"C:\Users\Admin\AppData\Local\Temp\6f1a8ee627ec2ed7e1d818d32a34a163416938eb13a97783a71f9b79843a80a2.exe"
C:\Users\Admin\AppData\Local\Temp\exit.exe
"C:\Users\Admin\AppData\Local\Temp\exit.exe"
C:\Windows\SysWOW64\cmd.exe
cmd /c i.cmd
C:\Windows\SysWOW64\PING.EXE
ping www.cloudflare.com -n 3 -w 3000
C:\Windows\SysWOW64\PING.EXE
ping www.cloudflare.com -n 3 -w 1000
C:\Users\Admin\AppData\Local\Temp\uninstall.exe
uninstall.exe x -pQELRatcwbU2EJ5 -y
C:\Users\Admin\AppData\Local\Temp\veter2005_MAPS_10cr24.exe
veter2005_MAPS_10cr24.exe
C:\ProgramData\Windows Anytime Upgrade\exit.exe
"C:\ProgramData\Windows Anytime Upgrade\exit.exe"
C:\Windows\SysWOW64\cmd.exe
cmd /c i.cmd
C:\Windows\SysWOW64\reg.exe
REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Windows Anytime Upgrade" /t REG_SZ /d "C:\ProgramData\Windows Anytime Upgrade\winserv.exe"
C:\ProgramData\Windows Anytime Upgrade\winserv.exe
"C:\ProgramData\Windows Anytime Upgrade\winserv.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\ProgramData\Windows Anytime Upgrade\winserv.exe
"C:\ProgramData\Windows Anytime Upgrade\winserv.exe" -second
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
Network
| Country | Destination | Domain | Proto |
| GB | 23.43.75.27:80 | tcp | |
| US | 8.8.8.8:53 | www.cloudflare.com | udp |
| NL | 217.12.201.159:5655 | tcp | |
| NL | 217.12.201.159:5655 | tcp | |
| NL | 217.12.201.159:5655 | tcp | |
| NL | 217.12.201.159:5655 | tcp | |
| NL | 217.12.201.159:5655 | tcp | |
| NL | 217.12.201.159:5655 | tcp | |
| NL | 217.12.201.159:5655 | tcp | |
| NL | 217.12.201.159:5655 | tcp | |
| NL | 217.12.201.159:5655 | tcp | |
| NL | 217.12.201.159:5655 | tcp | |
| NL | 217.12.201.159:5655 | tcp | |
| NL | 217.12.201.159:5655 | tcp | |
| NL | 217.12.201.159:5655 | tcp | |
| NL | 217.12.201.159:5655 | tcp | |
| NL | 217.12.201.159:5655 | tcp | |
| NL | 217.12.201.159:5655 | tcp | |
| NL | 217.12.201.159:5655 | tcp | |
| NL | 217.12.201.159:5655 | tcp |
Files
C:\Users\Admin\AppData\Local\Temp\exit.exe
| MD5 | e488decbb44ad1a3430e82b57a70615e |
| SHA1 | df4130c66d988df8154bc1967f650896aa8cd6a1 |
| SHA256 | fd701894e7ec8d8319bc9b32bba5892b11bdf608c3d04c2f18eff83419eb6df0 |
| SHA512 | b0be330248b893a3ff87807ef802a2b27c03d8f66c357304a6ef5b6911ec5ebabdd5279af9bfb1aad1b312bba7cb4304baf5e242b8b7103af7dcef4ee83bd1a1 |
C:\Users\Admin\AppData\Local\Temp\exit.exe
| MD5 | e488decbb44ad1a3430e82b57a70615e |
| SHA1 | df4130c66d988df8154bc1967f650896aa8cd6a1 |
| SHA256 | fd701894e7ec8d8319bc9b32bba5892b11bdf608c3d04c2f18eff83419eb6df0 |
| SHA512 | b0be330248b893a3ff87807ef802a2b27c03d8f66c357304a6ef5b6911ec5ebabdd5279af9bfb1aad1b312bba7cb4304baf5e242b8b7103af7dcef4ee83bd1a1 |
C:\Users\Admin\AppData\Local\Temp\i.cmd
| MD5 | 8aedb7db6d45e3b48941edf4cb4e9cb6 |
| SHA1 | 12c8a6b5c728caf2381db68608318ad64a91b1a5 |
| SHA256 | 137c665abd6c2265cad7830c7a5e7942eef44637358aa2056f3e33177bcf8935 |
| SHA512 | 7af4eea32316d4f2e5daffc05777bb860b56c3990fa42db086e582a6b4b98c0b0875e7445607c15ab6b3009f6cc97dd5f59eb5d0ca42d8ef97ae0d1786c05bf2 |
C:\Users\Admin\AppData\Local\Temp\kernel.dll
| MD5 | 9f63ef6993f98ddd56e1e2cdf2d67b27 |
| SHA1 | 2ec6e958c6e8d0ba8a1682657f57c0c66056ec7e |
| SHA256 | 5310c2397ba4c783f7ee9724711a6da9b5c603b5c9781fff3407b46725e338b3 |
| SHA512 | ba509a33694b6ef7e5837ea86735ee82c353613c1c7a134a9492fede3b81bedaaf41458c1fbbce77cb1b06b7624f890396df17ff53a57030c1de4b5a585803b4 |
C:\Users\Admin\AppData\Local\Temp\uninstall.exe
| MD5 | 9f63ef6993f98ddd56e1e2cdf2d67b27 |
| SHA1 | 2ec6e958c6e8d0ba8a1682657f57c0c66056ec7e |
| SHA256 | 5310c2397ba4c783f7ee9724711a6da9b5c603b5c9781fff3407b46725e338b3 |
| SHA512 | ba509a33694b6ef7e5837ea86735ee82c353613c1c7a134a9492fede3b81bedaaf41458c1fbbce77cb1b06b7624f890396df17ff53a57030c1de4b5a585803b4 |
C:\Users\Admin\AppData\Local\Temp\veter2005_MAPS_10cr24.exe
| MD5 | a8c805792a954ca0664221acde199f48 |
| SHA1 | 248a4be7db6485f85920b15a5cf21df68b800159 |
| SHA256 | 2b5eefc4bc2d34cbe5093332c47b5405cf5c32e8156767fc8bc9ddd9cdcf3018 |
| SHA512 | 9b54be9fb046cde9c3a6107bd2100268e179e8ae15756cfb0c134e3d3a37735121445c348192562a23148a57ded6f4e32a141161dc78fc711fd28e5a619e69ab |
C:\Users\Admin\AppData\Local\Temp\veter2005_MAPS_10cr24.exe
| MD5 | a8c805792a954ca0664221acde199f48 |
| SHA1 | 248a4be7db6485f85920b15a5cf21df68b800159 |
| SHA256 | 2b5eefc4bc2d34cbe5093332c47b5405cf5c32e8156767fc8bc9ddd9cdcf3018 |
| SHA512 | 9b54be9fb046cde9c3a6107bd2100268e179e8ae15756cfb0c134e3d3a37735121445c348192562a23148a57ded6f4e32a141161dc78fc711fd28e5a619e69ab |
C:\ProgramData\Windows Anytime Upgrade\exit.exe
| MD5 | e488decbb44ad1a3430e82b57a70615e |
| SHA1 | df4130c66d988df8154bc1967f650896aa8cd6a1 |
| SHA256 | fd701894e7ec8d8319bc9b32bba5892b11bdf608c3d04c2f18eff83419eb6df0 |
| SHA512 | b0be330248b893a3ff87807ef802a2b27c03d8f66c357304a6ef5b6911ec5ebabdd5279af9bfb1aad1b312bba7cb4304baf5e242b8b7103af7dcef4ee83bd1a1 |
C:\ProgramData\Windows Anytime Upgrade\exit.exe
| MD5 | e488decbb44ad1a3430e82b57a70615e |
| SHA1 | df4130c66d988df8154bc1967f650896aa8cd6a1 |
| SHA256 | fd701894e7ec8d8319bc9b32bba5892b11bdf608c3d04c2f18eff83419eb6df0 |
| SHA512 | b0be330248b893a3ff87807ef802a2b27c03d8f66c357304a6ef5b6911ec5ebabdd5279af9bfb1aad1b312bba7cb4304baf5e242b8b7103af7dcef4ee83bd1a1 |
C:\ProgramData\Windows Anytime Upgrade\i.cmd
| MD5 | 4957715bbd77615b43f5a409d4687033 |
| SHA1 | a8c9a15879c4c23b0710cb39ba902548c2fc4d10 |
| SHA256 | 4a113391615785f0c4e358938eea2061040941dcd3cb09658d174a60ab683cf1 |
| SHA512 | c1b570adf7cd262755051a38437af165a3bfea6a6f50bfc4ca1ac2c72e6b4301133d244f3bc7350ac00cbb89291e4547bcb2194a28d3c25457739be2b69c98be |
C:\ProgramData\Windows Anytime Upgrade\winserv.exe
| MD5 | cf2ab077a46219b6ce4a53517dd489ea |
| SHA1 | 651b8d1377910e4728e85dcd231e269313ab9e1d |
| SHA256 | 609b0a416f9b16a6df9b967dc32cd739402af31566e019a8fb8abdf3cb573e30 |
| SHA512 | 53fb1ac822467168ea8e7abdd72c78cdd90070b10773ce8c700c6784ab4cc3a03eb53887d158ce3a27779a5fbcf3300d2ccbedab79a34bfd42ddc91f68dbdad7 |
C:\ProgramData\Windows Anytime Upgrade\winserv.exe
| MD5 | cf2ab077a46219b6ce4a53517dd489ea |
| SHA1 | 651b8d1377910e4728e85dcd231e269313ab9e1d |
| SHA256 | 609b0a416f9b16a6df9b967dc32cd739402af31566e019a8fb8abdf3cb573e30 |
| SHA512 | 53fb1ac822467168ea8e7abdd72c78cdd90070b10773ce8c700c6784ab4cc3a03eb53887d158ce3a27779a5fbcf3300d2ccbedab79a34bfd42ddc91f68dbdad7 |
memory/712-316-0x00000000046D0000-0x00000000046D1000-memory.dmp
memory/712-315-0x0000000002D00000-0x0000000002D01000-memory.dmp
C:\ProgramData\Windows Anytime Upgrade\winserv.exe
| MD5 | cf2ab077a46219b6ce4a53517dd489ea |
| SHA1 | 651b8d1377910e4728e85dcd231e269313ab9e1d |
| SHA256 | 609b0a416f9b16a6df9b967dc32cd739402af31566e019a8fb8abdf3cb573e30 |
| SHA512 | 53fb1ac822467168ea8e7abdd72c78cdd90070b10773ce8c700c6784ab4cc3a03eb53887d158ce3a27779a5fbcf3300d2ccbedab79a34bfd42ddc91f68dbdad7 |
memory/1616-323-0x0000000002B40000-0x0000000002B41000-memory.dmp
memory/2124-334-0x0000000000400000-0x0000000000474000-memory.dmp
\Users\Admin\AppData\Local\Temp\1D86.tmp
| MD5 | 50741b3f2d7debf5d2bed63d88404029 |
| SHA1 | 56210388a627b926162b36967045be06ffb1aad3 |
| SHA256 | f2f8732ae464738372ff274b7e481366cecdd2337210d4a3cbcd089c958a730c |
| SHA512 | fac6bfe35b1ee08b3d42d330516a260d9cdb4a90bbb0491411a583029b92a59d20af3552372ea8fb3f59442b3945bf524ef284127f397ae7179467080be8e9b3 |
memory/2124-341-0x00000000006E0000-0x0000000002353000-memory.dmp
memory/3036-342-0x00000000010D0000-0x00000000010D1000-memory.dmp
memory/3036-343-0x0000000001120000-0x0000000001136000-memory.dmp
C:\ProgramData\Windows Anytime Upgrade\settings.dat
| MD5 | 46ff979a07cd2721dc14da7edf386ad7 |
| SHA1 | 228973c6b1eca31bd453d770abec3302a3ee43fa |
| SHA256 | 210bb55664d291d82b94b9cea6fcf41029eded9eca6e7fe7b7d58715407a0703 |
| SHA512 | a901adca59f721b83cc1b3345417b6c28b01bd01e5b0c830179f281f9bcf3dcfb2ee7ae40afdcee6f903b7a8d19100af5fc72e402971e83e9d22f5bcb2f4f68f |
memory/1616-346-0x0000000004640000-0x0000000004641000-memory.dmp
memory/1616-344-0x00000000045F0000-0x00000000045F1000-memory.dmp
memory/1616-347-0x0000000004600000-0x0000000004601000-memory.dmp
memory/1616-348-0x0000000004650000-0x0000000004651000-memory.dmp
memory/1616-349-0x0000000004660000-0x0000000004661000-memory.dmp
memory/1616-361-0x0000000005030000-0x0000000005031000-memory.dmp
memory/1616-360-0x0000000005020000-0x0000000005021000-memory.dmp
memory/1616-362-0x0000000005640000-0x0000000005641000-memory.dmp
memory/1616-363-0x0000000005790000-0x0000000005791000-memory.dmp
memory/1616-370-0x0000000007110000-0x0000000007111000-memory.dmp
memory/1616-371-0x0000000007120000-0x0000000007121000-memory.dmp
memory/1616-369-0x0000000006F10000-0x0000000006F11000-memory.dmp
memory/1616-372-0x00000000073B0000-0x0000000007481000-memory.dmp