rms | 107de953b02fb0dd7e31a0b618c3748f2c285070577ef1abaabeb30ab3153424

Analysis

max time kernel
151s
max time network
155s
platform
windows7_x64
resource
win7-20220414-en
submitted
04-06-2022 12:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

107de953b02fb0dd7e31a0b618c3748f2c285070577ef1abaabeb30ab3153424.exe
Size

3.0MB
MD5

9fde87763e721ea2ebdae8aa4c3f6b53
SHA1

4423a6b64b8c483b802065a0d14cb21bbfcd3e2d
SHA256

107de953b02fb0dd7e31a0b618c3748f2c285070577ef1abaabeb30ab3153424
SHA512

de66e9b9c913ac43bd9e42198562d731f57b5ad21abcb679924386ea93030be69864c513aa0b43a2565c785c703f4348273798a4fb1b18e181b884a2f29b9c11

Score

10^/10

rms persistence rat trojan

Malware Config

Signatures

RMS
Remote Manipulator System (RMS) is a remote access tool developed by Russian organization TektonIT.
trojan rat rms

Executes dropped EXE 5 IoCs

pid	Process
1772	exit.exe
1348	uninstall.exe
1776	exit.exe
880	winserv.exe
1740	winserv.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Control Panel\International\Geo\Nation	winserv.exe

Loads dropped DLL 10 IoCs

pid	Process
1976	107de953b02fb0dd7e31a0b618c3748f2c285070577ef1abaabeb30ab3153424.exe
1976	107de953b02fb0dd7e31a0b618c3748f2c285070577ef1abaabeb30ab3153424.exe
1976	107de953b02fb0dd7e31a0b618c3748f2c285070577ef1abaabeb30ab3153424.exe
1976	107de953b02fb0dd7e31a0b618c3748f2c285070577ef1abaabeb30ab3153424.exe
760	cmd.exe
1348	uninstall.exe
1348	uninstall.exe
1348	uninstall.exe
1348	uninstall.exe
856	cmd.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows\CurrentVersion\Run	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Anytime Upgrade = "C:\\ProgramData\\Windows Anytime Upgrade\\winserv.exe"	reg.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Kills process with taskkill 64 IoCs

evasion

pid	Process
1708	taskkill.exe
1456	taskkill.exe
1544	Process not Found
1132	taskkill.exe
576	Process not Found
1012	Process not Found
676	Process not Found
1052	taskkill.exe
1700	Process not Found
1440	taskkill.exe
2032	Process not Found
1340	Process not Found
1336	taskkill.exe
1516	Process not Found
880	taskkill.exe
1960	taskkill.exe
1960	taskkill.exe
844	Process not Found
908	taskkill.exe
1236	taskkill.exe
908	Process not Found
300	taskkill.exe
1164	Process not Found
936	Process not Found
1672	taskkill.exe
1088	taskkill.exe
1880	taskkill.exe
1048	Process not Found
1940	Process not Found
1484	taskkill.exe
964	Process not Found
1684	Process not Found
1708	Process not Found
1156	Process not Found
1948	Process not Found
1336	taskkill.exe
1692	taskkill.exe
812	taskkill.exe
1340	Process not Found
1176	taskkill.exe
1772	taskkill.exe
1264	taskkill.exe
812	taskkill.exe
1700	Process not Found
1872	taskkill.exe
964	Process not Found
1576	taskkill.exe
988	taskkill.exe
1180	Process not Found
1624	taskkill.exe
768	Process not Found
1668	taskkill.exe
884	taskkill.exe
940	taskkill.exe
1872	taskkill.exe
676	taskkill.exe
1500	taskkill.exe
1492	taskkill.exe
1400	taskkill.exe
1668	Process not Found
2024	Process not Found
936	taskkill.exe
1176	taskkill.exe
1916	Process not Found

Runs ping.exe 1 TTPs 2 IoCs

Remote System Discovery

T1018

pid	Process
2012	PING.EXE
1336	PING.EXE

Suspicious behavior: EnumeratesProcesses 9 IoCs

pid	Process
880	winserv.exe
880	winserv.exe
880	taskkill.exe
880	taskkill.exe
880	taskkill.exe
1740	winserv.exe
1740	winserv.exe
1740	winserv.exe
1740	winserv.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1212	taskkill.exe
Token: SeDebugPrivilege	1836	taskkill.exe
Token: SeDebugPrivilege	1160	taskkill.exe
Token: SeDebugPrivilege	880	taskkill.exe
Token: SeDebugPrivilege	1620	taskkill.exe
Token: SeDebugPrivilege	1236	taskkill.exe
Token: SeDebugPrivilege	1528	taskkill.exe
Token: SeDebugPrivilege	988	taskkill.exe
Token: SeDebugPrivilege	1948	taskkill.exe
Token: SeDebugPrivilege	1340	taskkill.exe
Token: SeDebugPrivilege	300	taskkill.exe
Token: SeDebugPrivilege	576	taskkill.exe
Token: SeDebugPrivilege	788	taskkill.exe
Token: SeDebugPrivilege	1052	taskkill.exe
Token: SeTakeOwnershipPrivilege	1740	winserv.exe
Token: SeTcbPrivilege	1740	winserv.exe
Token: SeTcbPrivilege	1740	winserv.exe
Token: SeDebugPrivilege	1628	taskkill.exe
Token: SeDebugPrivilege	1672	taskkill.exe
Token: SeDebugPrivilege	1264	taskkill.exe
Token: SeDebugPrivilege	1492	taskkill.exe
Token: SeDebugPrivilege	1088	taskkill.exe
Token: SeDebugPrivilege	1956	taskkill.exe
Token: SeDebugPrivilege	1872	taskkill.exe
Token: SeDebugPrivilege	880	taskkill.exe
Token: SeDebugPrivilege	1676	taskkill.exe
Token: SeDebugPrivilege	1696	taskkill.exe
Token: SeDebugPrivilege	1180	taskkill.exe
Token: SeDebugPrivilege	1932	taskkill.exe
Token: SeDebugPrivilege	1716	taskkill.exe
Token: SeDebugPrivilege	1916	taskkill.exe
Token: SeDebugPrivilege	1528	taskkill.exe
Token: SeDebugPrivilege	544	taskkill.exe
Token: SeDebugPrivilege	1308	taskkill.exe
Token: SeDebugPrivilege	1724	taskkill.exe
Token: SeDebugPrivilege	1060	taskkill.exe
Token: SeDebugPrivilege	1484	taskkill.exe
Token: SeDebugPrivilege	1200	taskkill.exe
Token: SeDebugPrivilege	828	taskkill.exe
Token: SeDebugPrivilege	2020	taskkill.exe
Token: SeDebugPrivilege	432	taskkill.exe
Token: SeDebugPrivilege	1628	taskkill.exe
Token: SeDebugPrivilege	1276	taskkill.exe
Token: SeDebugPrivilege	748	taskkill.exe
Token: SeDebugPrivilege	1436	taskkill.exe
Token: SeDebugPrivilege	1340	taskkill.exe
Token: SeDebugPrivilege	1548	taskkill.exe
Token: SeDebugPrivilege	1964	taskkill.exe
Token: SeDebugPrivilege	880	taskkill.exe
Token: SeDebugPrivilege	1176	taskkill.exe
Token: SeDebugPrivilege	1696	taskkill.exe
Token: SeDebugPrivilege	1712	taskkill.exe
Token: SeDebugPrivilege	1052	taskkill.exe
Token: SeDebugPrivilege	1616	taskkill.exe
Token: SeDebugPrivilege	1916	taskkill.exe
Token: SeDebugPrivilege	1948	taskkill.exe
Token: SeDebugPrivilege	1924	taskkill.exe
Token: SeDebugPrivilege	940	taskkill.exe
Token: SeDebugPrivilege	1280	taskkill.exe
Token: SeDebugPrivilege	560	taskkill.exe
Token: SeDebugPrivilege	788	taskkill.exe
Token: SeDebugPrivilege	1776	taskkill.exe
Token: SeDebugPrivilege	1176	taskkill.exe
Token: SeDebugPrivilege	936	taskkill.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
880	winserv.exe
880	winserv.exe
880	taskkill.exe
880	taskkill.exe
1740	winserv.exe
1740	winserv.exe
1740	winserv.exe
1740	winserv.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1976 wrote to memory of 1772	1976	107de953b02fb0dd7e31a0b618c3748f2c285070577ef1abaabeb30ab3153424.exe	28
PID 1976 wrote to memory of 1772	1976	107de953b02fb0dd7e31a0b618c3748f2c285070577ef1abaabeb30ab3153424.exe	28
PID 1976 wrote to memory of 1772	1976	107de953b02fb0dd7e31a0b618c3748f2c285070577ef1abaabeb30ab3153424.exe	28
PID 1976 wrote to memory of 1772	1976	107de953b02fb0dd7e31a0b618c3748f2c285070577ef1abaabeb30ab3153424.exe	28
PID 1772 wrote to memory of 760	1772	exit.exe	29
PID 1772 wrote to memory of 760	1772	exit.exe	29
PID 1772 wrote to memory of 760	1772	exit.exe	29
PID 1772 wrote to memory of 760	1772	exit.exe	29
PID 760 wrote to memory of 2012	760	cmd.exe	31
PID 760 wrote to memory of 2012	760	cmd.exe	31
PID 760 wrote to memory of 2012	760	cmd.exe	31
PID 760 wrote to memory of 2012	760	cmd.exe	31
PID 760 wrote to memory of 1336	760	cmd.exe	32
PID 760 wrote to memory of 1336	760	cmd.exe	32
PID 760 wrote to memory of 1336	760	cmd.exe	32
PID 760 wrote to memory of 1336	760	cmd.exe	32
PID 760 wrote to memory of 1348	760	cmd.exe	33
PID 760 wrote to memory of 1348	760	cmd.exe	33
PID 760 wrote to memory of 1348	760	cmd.exe	33
PID 760 wrote to memory of 1348	760	cmd.exe	33
PID 760 wrote to memory of 1348	760	cmd.exe	33
PID 760 wrote to memory of 1348	760	cmd.exe	33
PID 760 wrote to memory of 1348	760	cmd.exe	33
PID 1348 wrote to memory of 1776	1348	uninstall.exe	34
PID 1348 wrote to memory of 1776	1348	uninstall.exe	34
PID 1348 wrote to memory of 1776	1348	uninstall.exe	34
PID 1348 wrote to memory of 1776	1348	uninstall.exe	34
PID 1776 wrote to memory of 856	1776	exit.exe	35
PID 1776 wrote to memory of 856	1776	exit.exe	35
PID 1776 wrote to memory of 856	1776	exit.exe	35
PID 1776 wrote to memory of 856	1776	exit.exe	35
PID 856 wrote to memory of 1152	856	cmd.exe	37
PID 856 wrote to memory of 1152	856	cmd.exe	37
PID 856 wrote to memory of 1152	856	cmd.exe	37
PID 856 wrote to memory of 1152	856	cmd.exe	37
PID 856 wrote to memory of 880	856	cmd.exe	38
PID 856 wrote to memory of 880	856	cmd.exe	38
PID 856 wrote to memory of 880	856	cmd.exe	38
PID 856 wrote to memory of 880	856	cmd.exe	38
PID 856 wrote to memory of 1212	856	cmd.exe	39
PID 856 wrote to memory of 1212	856	cmd.exe	39
PID 856 wrote to memory of 1212	856	cmd.exe	39
PID 856 wrote to memory of 1212	856	cmd.exe	39
PID 856 wrote to memory of 1836	856	cmd.exe	41
PID 856 wrote to memory of 1836	856	cmd.exe	41
PID 856 wrote to memory of 1836	856	cmd.exe	41
PID 856 wrote to memory of 1836	856	cmd.exe	41
PID 856 wrote to memory of 1160	856	cmd.exe	42
PID 856 wrote to memory of 1160	856	cmd.exe	42
PID 856 wrote to memory of 1160	856	cmd.exe	42
PID 856 wrote to memory of 1160	856	cmd.exe	42
PID 856 wrote to memory of 1620	856	cmd.exe	43
PID 856 wrote to memory of 1620	856	cmd.exe	43
PID 856 wrote to memory of 1620	856	cmd.exe	43
PID 856 wrote to memory of 1620	856	cmd.exe	43
PID 856 wrote to memory of 1236	856	cmd.exe	44
PID 856 wrote to memory of 1236	856	cmd.exe	44
PID 856 wrote to memory of 1236	856	cmd.exe	44
PID 856 wrote to memory of 1236	856	cmd.exe	44
PID 856 wrote to memory of 1528	856	cmd.exe	68
PID 856 wrote to memory of 1528	856	cmd.exe	68
PID 856 wrote to memory of 1528	856	cmd.exe	68
PID 856 wrote to memory of 1528	856	cmd.exe	68
PID 856 wrote to memory of 988	856	cmd.exe	46

C:\Users\Admin\AppData\Local\Temp\107de953b02fb0dd7e31a0b618c3748f2c285070577ef1abaabeb30ab3153424.exe
"C:\Users\Admin\AppData\Local\Temp\107de953b02fb0dd7e31a0b618c3748f2c285070577ef1abaabeb30ab3153424.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1976
- C:\Users\Admin\AppData\Local\Temp\exit.exe
  "C:\Users\Admin\AppData\Local\Temp\exit.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1772
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c i.cmd
    3⤵
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:760
  - - C:\Windows\SysWOW64\PING.EXE
      ping www.cloudflare.com -n 3 -w 3000
      4⤵
      Runs ping.exe
      PID:2012
  - - C:\Windows\SysWOW64\PING.EXE
      ping www.cloudflare.com -n 3 -w 1000
      4⤵
      Runs ping.exe
      PID:1336
  - - C:\Users\Admin\AppData\Local\Temp\uninstall.exe
      uninstall.exe x -pQELRatcwbU2EJ5 -y
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of WriteProcessMemory
      PID:1348
    - - C:\ProgramData\Windows Anytime Upgrade\exit.exe
        
        "C:\ProgramData\Windows Anytime Upgrade\exit.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1776
      - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c i.cmd
        6⤵
        Loads dropped DLL
        Suspicious use of WriteProcessMemory
        
        PID:856
        
        C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Windows Anytime Upgrade" /t REG_SZ /d "C:\ProgramData\Windows Anytime Upgrade\winserv.exe"
        7⤵
        Adds Run key to start application
        
        PID:1152
        
        C:\ProgramData\Windows Anytime Upgrade\winserv.exe
        
        "C:\ProgramData\Windows Anytime Upgrade\winserv.exe"
        7⤵
        Executes dropped EXE
        Checks computer location settings
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:880
        
        C:\ProgramData\Windows Anytime Upgrade\winserv.exe
        
        "C:\ProgramData\Windows Anytime Upgrade\winserv.exe" -second
        8⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:1740
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1212
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1836
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1160
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1620
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1236
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1528
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:988
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1948
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1340
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:300
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:576
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:788
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1052
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1628
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1672
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1264
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1492
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1088
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1956
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:1872
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:880
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1676
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1696
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1180
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1932
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1716
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1916
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1528
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:544
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1308
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1724
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1060
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:1484
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1200
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:828
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2020
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:432
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1628
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1276
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:748
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1436
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1340
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1548
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1964
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:880
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1176
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1696
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1712
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1052
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1616
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1916
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1948
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1924
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:940
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1280
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:560
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:788
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1776
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:1176
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:936
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1420
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:432
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1628
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1660
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1456
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1044
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1924
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1736
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1572
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1872
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1484
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1200
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:908
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1684
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1212
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1052
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1716
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1164
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1264
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1088
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        Kills process with taskkill
        
        PID:1500
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1012
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1964
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1668
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1676
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:872
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1336
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:936
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1420
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:432
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1628
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1660
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1456
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1044
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1924
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1736
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1572
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1872
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1484
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:2020
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        Kills process with taskkill
        
        PID:908
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1684
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1180
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1052
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1672
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1632
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1264
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1088
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1308
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:940
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1964
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1668
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        Kills process with taskkill
        
        PID:1960
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:2024
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:988
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1276
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1156
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:748
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1436
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1948
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1548
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1536
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:880
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:788
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1060
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1708
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1692
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        Kills process with taskkill
        
        PID:1624
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1336
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:936
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1420
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:432
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1628
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:760
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1340
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1088
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1500
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:940
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1572
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        Kills process with taskkill
        
        PID:1668
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1960
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:812
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:988
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1940
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1492
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:748
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1436
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1660
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        Kills process with taskkill
        
        PID:884
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:300
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:880
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1108
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1592
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1400
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:872
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1624
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1276
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:936
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1420
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:432
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1628
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1164
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:560
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1308
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1576
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1200
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1908
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:2000
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1748
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1684
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1488
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1940
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1212
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1456
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1044
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1948
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1548
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1092
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        Kills process with taskkill
        
        PID:940
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:788
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:816
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        Kills process with taskkill
        
        PID:1708
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:896
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1156
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        Kills process with taskkill
        
        PID:1672
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1552
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1980
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:432
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1264
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1164
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1500
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1308
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1576
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1200
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1916
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:2000
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:988
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1684
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1772
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1280
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1724
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1340
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1044
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:760
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:544
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1092
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:940
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:576
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:816
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1708
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1956
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:2020
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1940
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:936
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1632
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1088
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1264
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1872
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1676
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1696
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1908
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1712
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1592
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:916
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1692
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1624
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1048
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1420
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1492
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1456
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1044
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:760
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1736
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1536
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:880
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1108
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:828
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1708
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1960
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1228
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1940
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:936
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:560
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:676
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1572
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1628
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1880
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1180
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:812
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1712
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1592
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1336
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1692
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1924
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1488
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1528
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        Kills process with taskkill
        
        PID:1492
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1948
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1044
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1576
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1736
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        Kills process with taskkill
        
        PID:1236
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:880
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1108
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:828
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1772
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1960
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1228
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1980
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:936
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1176
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1872
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1716
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:788
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1500
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:576
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1668
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:896
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:872
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1684
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:748
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:2020
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1280
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1964
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:884
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1676
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:300
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1576
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1616
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1236
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:916
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1108
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:828
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1772
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1960
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1420
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1980
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1484
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:560
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1696
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1716
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:788
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1916
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1060
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1552
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1624
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1132
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1684
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:748
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:2020
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1536
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1964
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1872
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1932
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:300
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        Kills process with taskkill
        
        PID:1576
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:880
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:576
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1276
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1108
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:828
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:988
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1960
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1548
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1980
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1528
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1012
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1088
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:544
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1628
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1748
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1236
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:812
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1712
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1672
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1772
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1692
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:2020
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1224
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1484
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1736
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1948
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1616
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1660
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:896
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1180
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1632
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:2000
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1156
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1336
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:748
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1228
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1940
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1696
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1620
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1500
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1708
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1060
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1748
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1552
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1592
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1684
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1672
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1772
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1536
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1908
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1224
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1484
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1492
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1088
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:916
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1660
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:896
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1236
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1264
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1700
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1132
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1692
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:748
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1872
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1012
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:936
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1736
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1616
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1708
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:616
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1880
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1180
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1276
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1684
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1796
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1336
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1956
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1548
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1048
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1696
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1620
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1932
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        Kills process with taskkill
        
        PID:300
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1916
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1748
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1236
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1264
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1964
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:940
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1960
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1940
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        Kills process with taskkill
        
        PID:1872
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1012
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1500
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1736
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1616
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1708
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:616
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1280
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1164
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1400
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1772
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1796
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        Kills process with taskkill
        
        PID:1336
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1956
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1484
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1048
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1724
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1620
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1436
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:300
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1916
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1748
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:884
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1176
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1964
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:828
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1960
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:2020
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1908
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1980
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1500
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:560
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1616
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1044
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1308
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:908
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1164
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1276
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:988
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1200
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:432
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:788
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1668
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1628
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1724
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:916
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1660
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1180
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1496
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1684
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1156
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1340
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1052
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1548
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1776
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:872
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1060
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:812
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1576
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:880
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:2024
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1044
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1420
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1536
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1716
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1212
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1228
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1796
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1336
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:2020
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1484
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1980
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1572
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:560
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1616
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1708
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:616
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1280
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1132
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:544
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1964
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1960
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:788
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1932
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1628
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1592
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:2000
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1236
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1308
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1692
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1700
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:816
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1340
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:828
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1228
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1796
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1336
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1712
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1060
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:916
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1576
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:560
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:2024
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1708
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:616
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1488
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1132
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1400
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1772
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:940
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1224
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1956
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1908
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1048
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1572
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1736
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1616
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1632
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1916
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:760
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1108
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1264
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1456
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:432
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1932
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1484
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1628
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:2000
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1724
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        Kills process with taskkill
        
        PID:880
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1276
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:988
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1164
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1924
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1624
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1400
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:2020
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:940
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:2012
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1672
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1908
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1620
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1572
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1692
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1280
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1632
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1176
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:2008
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1132
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:544
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:936
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1548
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1776
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:872
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1060
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:812
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1576
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:560
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1436
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1044
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1916
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1536
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1716
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        Kills process with taskkill
        
        PID:1400
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        Kills process with taskkill
        
        PID:1052
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1500
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1224
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1712
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1676
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1048
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:748
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1692
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1700
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1212
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1696
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1876
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:676
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1264
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1456
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1880
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1932
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:872
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1060
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:2000
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1724
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1684
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:2024
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:988
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:616
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1924
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1716
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1400
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:2020
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1796
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:788
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1956
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1908
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1012
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1572
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1736
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1280
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:300
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1176
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:760
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1340
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:828
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        Kills process with taskkill
        
        PID:1772
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1548
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1776
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1484
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1668
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:916
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1948
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:560
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1436
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1044
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:816
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1536
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1108
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1528
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        Kills process with taskkill
        
        PID:1088
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1500
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1224
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1660
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1592
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1048
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:748
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1692
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:896
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1212
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1164
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1876
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:676
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1264
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        Kills process with taskkill
        
        PID:936
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1548
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1932
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1940
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1668
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:2000
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1948
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:880
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1436
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1044
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:616
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1536
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1716
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1872
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1088
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:432
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1224
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1660
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1592
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1048
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:748
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1736
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1280
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1212
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1164
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1488
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:676
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1264
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1772
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1548
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1932
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1940
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1668
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1496
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1308
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:560
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1276
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1708
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1176
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:2008
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1064
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:676
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:544
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1228
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1880
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1980
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1672
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1180
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1012
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1572
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1616
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:2024
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1632
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1916
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:760
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1716
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1504
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        Kills process with taskkill
        
        PID:1264
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1772
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1548
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1932
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1940
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1668
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1684
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1692
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:988
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1276
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1924
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1176
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:2008
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1340
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1544
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1052
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:936
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:788
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1980
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1676
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:884
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1012
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1948
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:880
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:2024
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1632
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:616
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1748
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1624
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1200
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1264
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        Kills process with taskkill
        
        PID:1960
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:2012
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1956
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1940
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1048
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:748
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1736
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1280
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:816
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1108
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1440
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1528
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1064
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        Kills process with taskkill
        
        PID:676
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:544
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1228
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1880
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1592
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1676
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:884
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1012
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1948
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:880
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1964
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1632
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:616
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1748
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1776
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1200
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1264
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1960
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:2012
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1156
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:560
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:300
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1436
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1488
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1536
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1276
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1164
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:616
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1748
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1776
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1200
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1264
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1960
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:2012
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1156
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:560
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:300
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1436
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1488
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1872
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:2020
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1440
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1528
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1484
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:676
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        Kills process with taskkill
        
        PID:812
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1228
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:2000
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1592
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1676
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1668
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1684
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        Kills process with taskkill
        
        PID:1692
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:828
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1536
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1964
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1164
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1088
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1748
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1776
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1200
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1908
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1672
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:2012
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1156
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1708
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        Kills process with taskkill
        
        PID:1132
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1436
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1488
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1872
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:2020
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1176
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1660
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1340
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:872
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:812
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1228
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:2000
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1980
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1676
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1696
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1012
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1280
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1516
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1924
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1916
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1164
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1088
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1748
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1336
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1200
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:936
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:788
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1592
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1236
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:560
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1736
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:2024
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:964
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1400
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1456
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1716
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1528
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1060
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:872
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:812
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1960
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1880
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1940
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1708
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1132
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1692
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:828
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1964
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:940
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1440
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1712
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1628
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1472
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1576
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1200
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:2012
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1212
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1592
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1236
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1436
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:988
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:2024
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:2020
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1400
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1456
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1484
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1528
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1336
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:872
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:812
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1960
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1880
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1940
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1420
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:332
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1276
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:964
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1964
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1624
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1440
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1712
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1908
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1672
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1684
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:788
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:2012
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1212
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:560
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1724
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:748
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1012
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:760
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1516
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1400
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1052
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1484
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1472
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1576
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1264
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1492
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1876
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1880
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1940
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:880
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        Kills process with taskkill
        
        PID:988
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        Kills process with taskkill
        
        PID:1176
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:940
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1964
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        Kills process with taskkill
        
        PID:1456
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        Kills process with taskkill
        
        PID:1440
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1228
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        Kills process with taskkill
        
        PID:1336
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:872
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:812
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:300
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1708
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:296
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        Kills process with taskkill
        
        PID:1880
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1940
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:880
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:988
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1176
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:940
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1964
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1456
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1440
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1228
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1336
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:872
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:812
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:300
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1708
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:296
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1880
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1940
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:880
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:988
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1176
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:940
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1964
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1456
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1440
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1228
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1336
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:872
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:812
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:300
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1708
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:296
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1880
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1940
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:880
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:988
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1176
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:940
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1964
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1456
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1440
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1684
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1924
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:872
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:812
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:300
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1708
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:296
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1880
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1940
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:880
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:988
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1176
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:940
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1964
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1456
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1440
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1684
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1924
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:872
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:812
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:300
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1708
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:296
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1880
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1940
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:880
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:988
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1176
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:940
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1964
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1456
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1440
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1684
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1924
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:872
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        Kills process with taskkill
        
        PID:812
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:300
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1708
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:296
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1880
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1940
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:880
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:988
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1176
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:940
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:676
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "rundll32.exe"
        7⤵
        
        PID:1456

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Windows Anytime Upgrade\exit.exe

Filesize
1KB

MD5
e488decbb44ad1a3430e82b57a70615e

SHA1
df4130c66d988df8154bc1967f650896aa8cd6a1

SHA256
fd701894e7ec8d8319bc9b32bba5892b11bdf608c3d04c2f18eff83419eb6df0

SHA512
b0be330248b893a3ff87807ef802a2b27c03d8f66c357304a6ef5b6911ec5ebabdd5279af9bfb1aad1b312bba7cb4304baf5e242b8b7103af7dcef4ee83bd1a1

Download Submit
C:\ProgramData\Windows Anytime Upgrade\i.cmd

Filesize
312B

MD5
4957715bbd77615b43f5a409d4687033

SHA1
a8c9a15879c4c23b0710cb39ba902548c2fc4d10

SHA256
4a113391615785f0c4e358938eea2061040941dcd3cb09658d174a60ab683cf1

SHA512
c1b570adf7cd262755051a38437af165a3bfea6a6f50bfc4ca1ac2c72e6b4301133d244f3bc7350ac00cbb89291e4547bcb2194a28d3c25457739be2b69c98be

Download Submit
C:\ProgramData\Windows Anytime Upgrade\settings.dat

Filesize
2KB

MD5
46ff979a07cd2721dc14da7edf386ad7

SHA1
228973c6b1eca31bd453d770abec3302a3ee43fa

SHA256
210bb55664d291d82b94b9cea6fcf41029eded9eca6e7fe7b7d58715407a0703

SHA512
a901adca59f721b83cc1b3345417b6c28b01bd01e5b0c830179f281f9bcf3dcfb2ee7ae40afdcee6f903b7a8d19100af5fc72e402971e83e9d22f5bcb2f4f68f

Download Submit
C:\ProgramData\Windows Anytime Upgrade\winserv.exe

Filesize
2.7MB

MD5
cf2ab077a46219b6ce4a53517dd489ea

SHA1
651b8d1377910e4728e85dcd231e269313ab9e1d

SHA256
609b0a416f9b16a6df9b967dc32cd739402af31566e019a8fb8abdf3cb573e30

SHA512
53fb1ac822467168ea8e7abdd72c78cdd90070b10773ce8c700c6784ab4cc3a03eb53887d158ce3a27779a5fbcf3300d2ccbedab79a34bfd42ddc91f68dbdad7

Download Submit
C:\ProgramData\Windows Anytime Upgrade\winserv.exe

Filesize
2.7MB

MD5
cf2ab077a46219b6ce4a53517dd489ea

SHA1
651b8d1377910e4728e85dcd231e269313ab9e1d

SHA256
609b0a416f9b16a6df9b967dc32cd739402af31566e019a8fb8abdf3cb573e30

SHA512
53fb1ac822467168ea8e7abdd72c78cdd90070b10773ce8c700c6784ab4cc3a03eb53887d158ce3a27779a5fbcf3300d2ccbedab79a34bfd42ddc91f68dbdad7

Download Submit
C:\ProgramData\Windows Anytime Upgrade\winserv.exe

Filesize
2.7MB

MD5
cf2ab077a46219b6ce4a53517dd489ea

SHA1
651b8d1377910e4728e85dcd231e269313ab9e1d

SHA256
609b0a416f9b16a6df9b967dc32cd739402af31566e019a8fb8abdf3cb573e30

SHA512
53fb1ac822467168ea8e7abdd72c78cdd90070b10773ce8c700c6784ab4cc3a03eb53887d158ce3a27779a5fbcf3300d2ccbedab79a34bfd42ddc91f68dbdad7

Download Submit
C:\Users\Admin\AppData\Local\Temp\exit.exe

Filesize
1KB

MD5
e488decbb44ad1a3430e82b57a70615e

SHA1
df4130c66d988df8154bc1967f650896aa8cd6a1

SHA256
fd701894e7ec8d8319bc9b32bba5892b11bdf608c3d04c2f18eff83419eb6df0

SHA512
b0be330248b893a3ff87807ef802a2b27c03d8f66c357304a6ef5b6911ec5ebabdd5279af9bfb1aad1b312bba7cb4304baf5e242b8b7103af7dcef4ee83bd1a1

Download Submit
C:\Users\Admin\AppData\Local\Temp\i.cmd

Filesize
235B

MD5
21a7a58e20a4e24bea27bac7444d5e6c

SHA1
7f03b816cb19ec84514986395f6062a1448fbefc

SHA256
af7e0cec39be8ef5ec6c17ccd4b01d4263eee66305dbc215cf0bdda008e3bf9f

SHA512
817c551ca54adae9609d24ec089e5e74885dde149703f6ab54018b6985ceb57a97f6c5788d8e2b109b8f478bed25d530c6c10497d40571326e95073c1da87691

Download Submit
C:\Users\Admin\AppData\Local\Temp\kernel.dll

Filesize
2.9MB

MD5
9f63ef6993f98ddd56e1e2cdf2d67b27

SHA1
2ec6e958c6e8d0ba8a1682657f57c0c66056ec7e

SHA256
5310c2397ba4c783f7ee9724711a6da9b5c603b5c9781fff3407b46725e338b3

SHA512
ba509a33694b6ef7e5837ea86735ee82c353613c1c7a134a9492fede3b81bedaaf41458c1fbbce77cb1b06b7624f890396df17ff53a57030c1de4b5a585803b4

Download Submit
C:\Users\Admin\AppData\Local\Temp\uninstall.exe

Filesize
2.9MB

MD5
9f63ef6993f98ddd56e1e2cdf2d67b27

SHA1
2ec6e958c6e8d0ba8a1682657f57c0c66056ec7e

SHA256
5310c2397ba4c783f7ee9724711a6da9b5c603b5c9781fff3407b46725e338b3

SHA512
ba509a33694b6ef7e5837ea86735ee82c353613c1c7a134a9492fede3b81bedaaf41458c1fbbce77cb1b06b7624f890396df17ff53a57030c1de4b5a585803b4

Download Submit
\ProgramData\Windows Anytime Upgrade\exit.exe

Filesize
1KB

MD5
e488decbb44ad1a3430e82b57a70615e

SHA1
df4130c66d988df8154bc1967f650896aa8cd6a1

SHA256
fd701894e7ec8d8319bc9b32bba5892b11bdf608c3d04c2f18eff83419eb6df0

SHA512
b0be330248b893a3ff87807ef802a2b27c03d8f66c357304a6ef5b6911ec5ebabdd5279af9bfb1aad1b312bba7cb4304baf5e242b8b7103af7dcef4ee83bd1a1

Download Submit
\ProgramData\Windows Anytime Upgrade\exit.exe

Filesize
1KB

MD5
e488decbb44ad1a3430e82b57a70615e

SHA1
df4130c66d988df8154bc1967f650896aa8cd6a1

SHA256
fd701894e7ec8d8319bc9b32bba5892b11bdf608c3d04c2f18eff83419eb6df0

SHA512
b0be330248b893a3ff87807ef802a2b27c03d8f66c357304a6ef5b6911ec5ebabdd5279af9bfb1aad1b312bba7cb4304baf5e242b8b7103af7dcef4ee83bd1a1

Download Submit
\ProgramData\Windows Anytime Upgrade\exit.exe

Filesize
1KB

MD5
e488decbb44ad1a3430e82b57a70615e

SHA1
df4130c66d988df8154bc1967f650896aa8cd6a1

SHA256
fd701894e7ec8d8319bc9b32bba5892b11bdf608c3d04c2f18eff83419eb6df0

SHA512
b0be330248b893a3ff87807ef802a2b27c03d8f66c357304a6ef5b6911ec5ebabdd5279af9bfb1aad1b312bba7cb4304baf5e242b8b7103af7dcef4ee83bd1a1

Download Submit
\ProgramData\Windows Anytime Upgrade\exit.exe

Filesize
1KB

MD5
e488decbb44ad1a3430e82b57a70615e

SHA1
df4130c66d988df8154bc1967f650896aa8cd6a1

SHA256
fd701894e7ec8d8319bc9b32bba5892b11bdf608c3d04c2f18eff83419eb6df0

SHA512
b0be330248b893a3ff87807ef802a2b27c03d8f66c357304a6ef5b6911ec5ebabdd5279af9bfb1aad1b312bba7cb4304baf5e242b8b7103af7dcef4ee83bd1a1

Download Submit
\ProgramData\Windows Anytime Upgrade\winserv.exe

Filesize
2.7MB

MD5
cf2ab077a46219b6ce4a53517dd489ea

SHA1
651b8d1377910e4728e85dcd231e269313ab9e1d

SHA256
609b0a416f9b16a6df9b967dc32cd739402af31566e019a8fb8abdf3cb573e30

SHA512
53fb1ac822467168ea8e7abdd72c78cdd90070b10773ce8c700c6784ab4cc3a03eb53887d158ce3a27779a5fbcf3300d2ccbedab79a34bfd42ddc91f68dbdad7

Download Submit
\Users\Admin\AppData\Local\Temp\exit.exe

Filesize
1KB

MD5
e488decbb44ad1a3430e82b57a70615e

SHA1
df4130c66d988df8154bc1967f650896aa8cd6a1

SHA256
fd701894e7ec8d8319bc9b32bba5892b11bdf608c3d04c2f18eff83419eb6df0

SHA512
b0be330248b893a3ff87807ef802a2b27c03d8f66c357304a6ef5b6911ec5ebabdd5279af9bfb1aad1b312bba7cb4304baf5e242b8b7103af7dcef4ee83bd1a1

Download Submit
\Users\Admin\AppData\Local\Temp\exit.exe

Filesize
1KB

MD5
e488decbb44ad1a3430e82b57a70615e

SHA1
df4130c66d988df8154bc1967f650896aa8cd6a1

SHA256
fd701894e7ec8d8319bc9b32bba5892b11bdf608c3d04c2f18eff83419eb6df0

SHA512
b0be330248b893a3ff87807ef802a2b27c03d8f66c357304a6ef5b6911ec5ebabdd5279af9bfb1aad1b312bba7cb4304baf5e242b8b7103af7dcef4ee83bd1a1

Download Submit
\Users\Admin\AppData\Local\Temp\exit.exe

Filesize
1KB

MD5
e488decbb44ad1a3430e82b57a70615e

SHA1
df4130c66d988df8154bc1967f650896aa8cd6a1

SHA256
fd701894e7ec8d8319bc9b32bba5892b11bdf608c3d04c2f18eff83419eb6df0

SHA512
b0be330248b893a3ff87807ef802a2b27c03d8f66c357304a6ef5b6911ec5ebabdd5279af9bfb1aad1b312bba7cb4304baf5e242b8b7103af7dcef4ee83bd1a1

Download Submit
\Users\Admin\AppData\Local\Temp\exit.exe

Filesize
1KB

MD5
e488decbb44ad1a3430e82b57a70615e

SHA1
df4130c66d988df8154bc1967f650896aa8cd6a1

SHA256
fd701894e7ec8d8319bc9b32bba5892b11bdf608c3d04c2f18eff83419eb6df0

SHA512
b0be330248b893a3ff87807ef802a2b27c03d8f66c357304a6ef5b6911ec5ebabdd5279af9bfb1aad1b312bba7cb4304baf5e242b8b7103af7dcef4ee83bd1a1

Download Submit
\Users\Admin\AppData\Local\Temp\uninstall.exe

Filesize
2.9MB

MD5
9f63ef6993f98ddd56e1e2cdf2d67b27

SHA1
2ec6e958c6e8d0ba8a1682657f57c0c66056ec7e

SHA256
5310c2397ba4c783f7ee9724711a6da9b5c603b5c9781fff3407b46725e338b3

SHA512
ba509a33694b6ef7e5837ea86735ee82c353613c1c7a134a9492fede3b81bedaaf41458c1fbbce77cb1b06b7624f890396df17ff53a57030c1de4b5a585803b4

Download Submit
memory/856-146-0x0000000002010000-0x0000000002A3B000-memory.dmp

Filesize
10.2MB

Download
memory/856-85-0x0000000002010000-0x0000000002A3B000-memory.dmp

Filesize
10.2MB

Download
memory/880-87-0x0000000000400000-0x0000000000E2B000-memory.dmp

Filesize
10.2MB

Download
memory/880-98-0x0000000000400000-0x0000000000E2B000-memory.dmp

Filesize
10.2MB

Download
memory/1740-147-0x0000000000400000-0x0000000000E2B000-memory.dmp

Filesize
10.2MB

Download
memory/1740-99-0x0000000000400000-0x0000000000E2B000-memory.dmp

Filesize
10.2MB

Download
memory/1976-54-0x00000000750C1000-0x00000000750C3000-memory.dmp

Filesize
8KB

Download