rms | 5a0746efe225da2d41bd802670ef63d55a598fcdf12275283532144df6b7a1bb

Analysis

max time kernel
162s
max time network
167s
platform
windows7_x64
resource
win7-20220718-en
resource tags

arch:x64arch:x86image:win7-20220718-enlocale:en-usos:windows7-x64system
submitted
24-07-2022 02:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5a0746efe225da2d41bd802670ef63d55a598fcdf12275283532144df6b7a1bb.exe
Size

3.9MB
MD5

147e30ac09fe0df9eb498dd832b55243
SHA1

f23823d52b5e50583b05da54f9e49b9786b0377c
SHA256

5a0746efe225da2d41bd802670ef63d55a598fcdf12275283532144df6b7a1bb
SHA512

96c6bc27e3dce82c6de712501a3116a846f08acc6d0ffe0a0a7ec2c219b715d717038e736e4c7c66e0ae37358590b6e8604881c6e3076e1a087aaf673109bbcd

Score

10^/10

rms persistence rat trojan

Malware Config

Signatures

RMS
Remote Manipulator System (RMS) is a remote access tool developed by Russian organization TektonIT.
trojan rat rms
Executes dropped EXE 5 IoCs

Processes:

exit.exemail-bird.exeexit.exewinserv.exewinserv.exe

pid process

592 exit.exe
596 mail-bird.exe
1960 exit.exe
2044 winserv.exe
860 winserv.exe

pid	process
592	exit.exe
596	mail-bird.exe
1960	exit.exe
2044	winserv.exe
860	winserv.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

winserv.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-4084403625-2215941253-1760665084-1000\Control Panel\International\Geo\Nation	winserv.exe

Loads dropped DLL 10 IoCs

Processes:

5a0746efe225da2d41bd802670ef63d55a598fcdf12275283532144df6b7a1bb.execmd.exemail-bird.execmd.exe

pid	process
888	5a0746efe225da2d41bd802670ef63d55a598fcdf12275283532144df6b7a1bb.exe
888	5a0746efe225da2d41bd802670ef63d55a598fcdf12275283532144df6b7a1bb.exe
888	5a0746efe225da2d41bd802670ef63d55a598fcdf12275283532144df6b7a1bb.exe
888	5a0746efe225da2d41bd802670ef63d55a598fcdf12275283532144df6b7a1bb.exe
608	cmd.exe
596	mail-bird.exe
596	mail-bird.exe
596	mail-bird.exe
596	mail-bird.exe
1256	cmd.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

reg.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-4084403625-2215941253-1760665084-1000\Software\Microsoft\Windows\CurrentVersion\Run	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4084403625-2215941253-1760665084-1000\Software\Microsoft\Windows\CurrentVersion\Run\Mail-Bird Tool = "C:\\ProgramData\\Mail-Bird Tool\\winserv.exe"	reg.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Kills process with taskkill 64 IoCs

evasion

Processes:

taskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exe

pid	process
1516	taskkill.exe
1544	taskkill.exe
1708
1748
544
544
828	taskkill.exe
932	taskkill.exe
1980	taskkill.exe
944	taskkill.exe
1756
1636
1936
1728	taskkill.exe
1928	taskkill.exe
1920
1048
816
1504
2036
828
1108	taskkill.exe
1540	taskkill.exe
1704	taskkill.exe
1516
884
1760	taskkill.exe
1080	taskkill.exe
1516	taskkill.exe
736	taskkill.exe
1896	taskkill.exe
1652	taskkill.exe
920	taskkill.exe
1092	taskkill.exe
2028
1972
1944
1712
556
328	taskkill.exe
944	taskkill.exe
1744
2004	taskkill.exe
1864	taskkill.exe
1904	taskkill.exe
1896	taskkill.exe
812	taskkill.exe
520
844	taskkill.exe
2004
1140
1760	taskkill.exe
1140	taskkill.exe
1108	taskkill.exe
1908	taskkill.exe
828	taskkill.exe
480	taskkill.exe
316	taskkill.exe
1692	taskkill.exe
1004
1620	taskkill.exe
608	taskkill.exe
1744
1092	taskkill.exe

Runs ping.exe 1 TTPs 2 IoCs

Remote System Discovery
T1018

Processes:

PING.EXEPING.EXE

pid process

1760 PING.EXE
1720 PING.EXE
Suspicious behavior: EnumeratesProcesses 9 IoCs

Processes:

winserv.exewinserv.exe

pid process

2044 winserv.exe
2044 winserv.exe
2044 winserv.exe
2044 winserv.exe
2044 winserv.exe
860 winserv.exe
860 winserv.exe
860 winserv.exe
860 winserv.exe

pid	process
1760	PING.EXE
1720	PING.EXE

pid	process
2044	winserv.exe
2044	winserv.exe
2044	winserv.exe
2044	winserv.exe
2044	winserv.exe
860	winserv.exe
860	winserv.exe
860	winserv.exe
860	winserv.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

taskkill.exewinserv.exetaskkill.exetaskkill.exetaskkill.exewinserv.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exe

description	pid	process
Token: SeDebugPrivilege	1724	taskkill.exe
Token: SeDebugPrivilege	2044	winserv.exe
Token: SeDebugPrivilege	1088	taskkill.exe
Token: SeDebugPrivilege	328	taskkill.exe
Token: SeDebugPrivilege	1688	taskkill.exe
Token: SeTakeOwnershipPrivilege	860	winserv.exe
Token: SeTcbPrivilege	860	winserv.exe
Token: SeTcbPrivilege	860	winserv.exe
Token: SeDebugPrivilege	1416	taskkill.exe
Token: SeDebugPrivilege	292	taskkill.exe
Token: SeDebugPrivilege	1140	taskkill.exe
Token: SeDebugPrivilege	1728	taskkill.exe
Token: SeDebugPrivilege	1804	taskkill.exe
Token: SeDebugPrivilege	556	taskkill.exe
Token: SeDebugPrivilege	2004	taskkill.exe
Token: SeDebugPrivilege	1148	taskkill.exe
Token: SeDebugPrivilege	1652	taskkill.exe
Token: SeDebugPrivilege	736	taskkill.exe
Token: SeDebugPrivilege	328	taskkill.exe
Token: SeDebugPrivilege	1516	taskkill.exe
Token: SeDebugPrivilege	988	taskkill.exe
Token: SeDebugPrivilege	1212	taskkill.exe
Token: SeDebugPrivilege	892	taskkill.exe
Token: SeDebugPrivilege	1496	taskkill.exe
Token: SeDebugPrivilege	828	taskkill.exe
Token: SeDebugPrivilege	1532	taskkill.exe
Token: SeDebugPrivilege	480	taskkill.exe
Token: SeDebugPrivilege	2044	taskkill.exe
Token: SeDebugPrivilege	1088	taskkill.exe
Token: SeDebugPrivilege	1664	taskkill.exe
Token: SeDebugPrivilege	884	taskkill.exe
Token: SeDebugPrivilege	1704	taskkill.exe
Token: SeDebugPrivilege	1964	taskkill.exe
Token: SeDebugPrivilege	316	taskkill.exe
Token: SeDebugPrivilege	1048	taskkill.exe
Token: SeDebugPrivilege	268	taskkill.exe
Token: SeDebugPrivilege	1896	taskkill.exe
Token: SeDebugPrivilege	1888	taskkill.exe
Token: SeDebugPrivilege	1612	taskkill.exe
Token: SeDebugPrivilege	1476	taskkill.exe
Token: SeDebugPrivilege	1008	taskkill.exe
Token: SeDebugPrivilege	1676	taskkill.exe
Token: SeDebugPrivilege	844	taskkill.exe
Token: SeDebugPrivilege	1416	taskkill.exe
Token: SeDebugPrivilege	608	taskkill.exe
Token: SeDebugPrivilege	592	taskkill.exe
Token: SeDebugPrivilege	1540	taskkill.exe
Token: SeDebugPrivilege	756	taskkill.exe
Token: SeDebugPrivilege	856	taskkill.exe
Token: SeDebugPrivilege	1724	taskkill.exe
Token: SeDebugPrivilege	920	taskkill.exe
Token: SeDebugPrivilege	664	taskkill.exe
Token: SeDebugPrivilege	1592	taskkill.exe
Token: SeDebugPrivilege	936	taskkill.exe
Token: SeDebugPrivilege	1524	taskkill.exe
Token: SeDebugPrivilege	1400	taskkill.exe
Token: SeDebugPrivilege	1756	taskkill.exe
Token: SeDebugPrivilege	1872	taskkill.exe
Token: SeDebugPrivilege	1996	taskkill.exe
Token: SeDebugPrivilege	2020	taskkill.exe
Token: SeDebugPrivilege	1864	taskkill.exe
Token: SeDebugPrivilege	1560	taskkill.exe
Token: SeDebugPrivilege	1724	taskkill.exe
Token: SeDebugPrivilege	1108	taskkill.exe

Suspicious use of SetWindowsHookEx 8 IoCs

Processes:

winserv.exewinserv.exe

pid process

2044 winserv.exe
2044 winserv.exe
2044 winserv.exe
2044 winserv.exe
860 winserv.exe
860 winserv.exe
860 winserv.exe
860 winserv.exe

pid	process
2044	winserv.exe
2044	winserv.exe
2044	winserv.exe
2044	winserv.exe
860	winserv.exe
860	winserv.exe
860	winserv.exe
860	winserv.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

5a0746efe225da2d41bd802670ef63d55a598fcdf12275283532144df6b7a1bb.exeexit.execmd.exemail-bird.exeexit.execmd.exe

description	pid	process	target process
PID 888 wrote to memory of 592	888	5a0746efe225da2d41bd802670ef63d55a598fcdf12275283532144df6b7a1bb.exe	exit.exe
PID 888 wrote to memory of 592	888	5a0746efe225da2d41bd802670ef63d55a598fcdf12275283532144df6b7a1bb.exe	exit.exe
PID 888 wrote to memory of 592	888	5a0746efe225da2d41bd802670ef63d55a598fcdf12275283532144df6b7a1bb.exe	exit.exe
PID 888 wrote to memory of 592	888	5a0746efe225da2d41bd802670ef63d55a598fcdf12275283532144df6b7a1bb.exe	exit.exe
PID 888 wrote to memory of 592	888	5a0746efe225da2d41bd802670ef63d55a598fcdf12275283532144df6b7a1bb.exe	exit.exe
PID 888 wrote to memory of 592	888	5a0746efe225da2d41bd802670ef63d55a598fcdf12275283532144df6b7a1bb.exe	exit.exe
PID 888 wrote to memory of 592	888	5a0746efe225da2d41bd802670ef63d55a598fcdf12275283532144df6b7a1bb.exe	exit.exe
PID 592 wrote to memory of 608	592	exit.exe	cmd.exe
PID 592 wrote to memory of 608	592	exit.exe	cmd.exe
PID 592 wrote to memory of 608	592	exit.exe	cmd.exe
PID 592 wrote to memory of 608	592	exit.exe	cmd.exe
PID 592 wrote to memory of 608	592	exit.exe	cmd.exe
PID 592 wrote to memory of 608	592	exit.exe	cmd.exe
PID 592 wrote to memory of 608	592	exit.exe	cmd.exe
PID 608 wrote to memory of 1720	608	cmd.exe	PING.EXE
PID 608 wrote to memory of 1720	608	cmd.exe	PING.EXE
PID 608 wrote to memory of 1720	608	cmd.exe	PING.EXE
PID 608 wrote to memory of 1720	608	cmd.exe	PING.EXE
PID 608 wrote to memory of 1720	608	cmd.exe	PING.EXE
PID 608 wrote to memory of 1720	608	cmd.exe	PING.EXE
PID 608 wrote to memory of 1720	608	cmd.exe	PING.EXE
PID 608 wrote to memory of 1760	608	cmd.exe	PING.EXE
PID 608 wrote to memory of 1760	608	cmd.exe	PING.EXE
PID 608 wrote to memory of 1760	608	cmd.exe	PING.EXE
PID 608 wrote to memory of 1760	608	cmd.exe	PING.EXE
PID 608 wrote to memory of 1760	608	cmd.exe	PING.EXE
PID 608 wrote to memory of 1760	608	cmd.exe	PING.EXE
PID 608 wrote to memory of 1760	608	cmd.exe	PING.EXE
PID 608 wrote to memory of 596	608	cmd.exe	mail-bird.exe
PID 608 wrote to memory of 596	608	cmd.exe	mail-bird.exe
PID 608 wrote to memory of 596	608	cmd.exe	mail-bird.exe
PID 608 wrote to memory of 596	608	cmd.exe	mail-bird.exe
PID 608 wrote to memory of 596	608	cmd.exe	mail-bird.exe
PID 608 wrote to memory of 596	608	cmd.exe	mail-bird.exe
PID 608 wrote to memory of 596	608	cmd.exe	mail-bird.exe
PID 596 wrote to memory of 1960	596	mail-bird.exe	exit.exe
PID 596 wrote to memory of 1960	596	mail-bird.exe	exit.exe
PID 596 wrote to memory of 1960	596	mail-bird.exe	exit.exe
PID 596 wrote to memory of 1960	596	mail-bird.exe	exit.exe
PID 596 wrote to memory of 1960	596	mail-bird.exe	exit.exe
PID 596 wrote to memory of 1960	596	mail-bird.exe	exit.exe
PID 596 wrote to memory of 1960	596	mail-bird.exe	exit.exe
PID 1960 wrote to memory of 1256	1960	exit.exe	cmd.exe
PID 1960 wrote to memory of 1256	1960	exit.exe	cmd.exe
PID 1960 wrote to memory of 1256	1960	exit.exe	cmd.exe
PID 1960 wrote to memory of 1256	1960	exit.exe	cmd.exe
PID 1960 wrote to memory of 1256	1960	exit.exe	cmd.exe
PID 1960 wrote to memory of 1256	1960	exit.exe	cmd.exe
PID 1960 wrote to memory of 1256	1960	exit.exe	cmd.exe
PID 1256 wrote to memory of 828	1256	cmd.exe	reg.exe
PID 1256 wrote to memory of 828	1256	cmd.exe	reg.exe
PID 1256 wrote to memory of 828	1256	cmd.exe	reg.exe
PID 1256 wrote to memory of 828	1256	cmd.exe	reg.exe
PID 1256 wrote to memory of 828	1256	cmd.exe	reg.exe
PID 1256 wrote to memory of 828	1256	cmd.exe	reg.exe
PID 1256 wrote to memory of 828	1256	cmd.exe	reg.exe
PID 1256 wrote to memory of 2044	1256	cmd.exe	winserv.exe
PID 1256 wrote to memory of 2044	1256	cmd.exe	winserv.exe
PID 1256 wrote to memory of 2044	1256	cmd.exe	winserv.exe
PID 1256 wrote to memory of 2044	1256	cmd.exe	winserv.exe
PID 1256 wrote to memory of 2044	1256	cmd.exe	winserv.exe
PID 1256 wrote to memory of 2044	1256	cmd.exe	winserv.exe
PID 1256 wrote to memory of 2044	1256	cmd.exe	winserv.exe
PID 1256 wrote to memory of 1724	1256	cmd.exe	taskkill.exe

C:\Users\Admin\AppData\Local\Temp\5a0746efe225da2d41bd802670ef63d55a598fcdf12275283532144df6b7a1bb.exe
"C:\Users\Admin\AppData\Local\Temp\5a0746efe225da2d41bd802670ef63d55a598fcdf12275283532144df6b7a1bb.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:888

C:\Users\Admin\AppData\Local\Temp\exit.exe
"C:\Users\Admin\AppData\Local\Temp\exit.exe"
2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:592

C:\Windows\SysWOW64\cmd.exe
cmd /c i.cmd
3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:608

C:\Windows\SysWOW64\PING.EXE
ping cloudflare.com -n 3 -w 3000
4⤵
- Runs ping.exe
PID:1720

C:\Windows\SysWOW64\PING.EXE
ping cloudflare.com -n 3 -w 1000
4⤵
- Runs ping.exe
PID:1760

C:\Users\Admin\AppData\Local\Temp\mail-bird.exe
mail-bird.exe x -p3KPnoNJ3ReME4bEU5W9APkKS5ErkR3tNRT -y
4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:596

C:\ProgramData\Mail-Bird Tool\exit.exe
"C:\ProgramData\Mail-Bird Tool\exit.exe"
5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1960

C:\Windows\SysWOW64\cmd.exe
cmd /c i.cmd
6⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1256

C:\Windows\SysWOW64\reg.exe
REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Mail-Bird Tool" /t REG_SZ /d "C:\ProgramData\Mail-Bird Tool\winserv.exe"
7⤵
- Adds Run key to start application
PID:828

C:\ProgramData\Mail-Bird Tool\winserv.exe
"C:\ProgramData\Mail-Bird Tool\winserv.exe"
7⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2044

C:\ProgramData\Mail-Bird Tool\winserv.exe
"C:\ProgramData\Mail-Bird Tool\winserv.exe" -second
8⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:860

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
- Suspicious use of AdjustPrivilegeToken
PID:1724

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
- Suspicious use of AdjustPrivilegeToken
PID:1088

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
- Suspicious use of AdjustPrivilegeToken
PID:328

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
- Suspicious use of AdjustPrivilegeToken
PID:1688

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
- Suspicious use of AdjustPrivilegeToken
PID:1416

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
- Suspicious use of AdjustPrivilegeToken
PID:292

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
- Suspicious use of AdjustPrivilegeToken
PID:1140

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
- Suspicious use of AdjustPrivilegeToken
PID:1728

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
- Suspicious use of AdjustPrivilegeToken
PID:1804

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
- Suspicious use of AdjustPrivilegeToken
PID:556

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2004

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
- Suspicious use of AdjustPrivilegeToken
PID:1148

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
- Suspicious use of AdjustPrivilegeToken
PID:1652

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:736

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
- Suspicious use of AdjustPrivilegeToken
PID:328

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
- Suspicious use of AdjustPrivilegeToken
PID:1516

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
- Suspicious use of AdjustPrivilegeToken
PID:988

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
- Suspicious use of AdjustPrivilegeToken
PID:1212

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
- Suspicious use of AdjustPrivilegeToken
PID:892

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
- Suspicious use of AdjustPrivilegeToken
PID:1496

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
- Suspicious use of AdjustPrivilegeToken
PID:828

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
- Suspicious use of AdjustPrivilegeToken
PID:1532

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
- Suspicious use of AdjustPrivilegeToken
PID:480

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
- Suspicious use of AdjustPrivilegeToken
PID:2044

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
- Suspicious use of AdjustPrivilegeToken
PID:1088

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
- Suspicious use of AdjustPrivilegeToken
PID:1664

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
- Suspicious use of AdjustPrivilegeToken
PID:884

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
- Suspicious use of AdjustPrivilegeToken
PID:1704

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
- Suspicious use of AdjustPrivilegeToken
PID:1964

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
- Suspicious use of AdjustPrivilegeToken
PID:316

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
- Suspicious use of AdjustPrivilegeToken
PID:1048

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
- Suspicious use of AdjustPrivilegeToken
PID:268

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1896

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
- Suspicious use of AdjustPrivilegeToken
PID:1888

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
- Suspicious use of AdjustPrivilegeToken
PID:1612

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
- Suspicious use of AdjustPrivilegeToken
PID:1476

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
- Suspicious use of AdjustPrivilegeToken
PID:1008

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
- Suspicious use of AdjustPrivilegeToken
PID:1676

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
- Suspicious use of AdjustPrivilegeToken
PID:844

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
- Suspicious use of AdjustPrivilegeToken
PID:1416

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
- Suspicious use of AdjustPrivilegeToken
PID:608

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
- Suspicious use of AdjustPrivilegeToken
PID:592

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
- Suspicious use of AdjustPrivilegeToken
PID:1540

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
- Suspicious use of AdjustPrivilegeToken
PID:756

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
- Suspicious use of AdjustPrivilegeToken
PID:856

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
- Suspicious use of AdjustPrivilegeToken
PID:1724

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
- Suspicious use of AdjustPrivilegeToken
PID:920

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
- Suspicious use of AdjustPrivilegeToken
PID:664

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
- Suspicious use of AdjustPrivilegeToken
PID:1592

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
- Suspicious use of AdjustPrivilegeToken
PID:936

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
- Suspicious use of AdjustPrivilegeToken
PID:1524

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
- Suspicious use of AdjustPrivilegeToken
PID:1400

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
- Suspicious use of AdjustPrivilegeToken
PID:1756

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
- Suspicious use of AdjustPrivilegeToken
PID:1872

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
- Suspicious use of AdjustPrivilegeToken
PID:1996

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
- Suspicious use of AdjustPrivilegeToken
PID:2020

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
- Suspicious use of AdjustPrivilegeToken
PID:1864

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
- Suspicious use of AdjustPrivilegeToken
PID:1560

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
- Suspicious use of AdjustPrivilegeToken
PID:1724

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1108

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1476

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
- Kills process with taskkill
PID:1652

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1980

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1516

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:988

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1964

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1140

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1872

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1580

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1804

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:556

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1056

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:572

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
- Kills process with taskkill
PID:920

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:2044

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1008

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1060

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1668

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:292

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1760

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:316

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1048

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1580

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:2020

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
- Kills process with taskkill
PID:1864

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1560

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1724

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1108

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1476

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1652

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1980

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1516

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:988

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1964

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1140

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1872

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1092

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1804

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:556

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1056

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:572

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:920

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:2044

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1008

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1060

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1516

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:988

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1964

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1140

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1872

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
- Kills process with taskkill
PID:1092

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1804

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:556

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:680

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1676

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:920

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:2044

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1008

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1060

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1516

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:988

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1964

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1140

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1872

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:480

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1936

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:664

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1592

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1004

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:884

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:816

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1340

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:592

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1244

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:756

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1744

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1080

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1148

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
- Kills process with taskkill
PID:1092

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1804

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:556

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:680

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1676

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:920

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:2044

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1008

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1060

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1516

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:988

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1964

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1140

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1872

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
- Kills process with taskkill
PID:480

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1936

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:556

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:680

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1676

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:920

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:2044

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1008

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1060

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1516

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:988

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1964

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1140

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1872

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:480

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1936

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:556

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:680

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:2032

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
- Kills process with taskkill
PID:1540

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:268

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1896

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1060

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1516

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:988

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1964

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1140

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1872

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:480

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1936

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:556

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:680

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:2032

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1540

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
- Kills process with taskkill
PID:828

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1996

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:2004

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1588

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1968

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:812

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:328

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:944

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1592

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1004

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1408

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1848

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1904

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:292

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:268

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1896

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1060

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1516

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:988

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:812

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:328

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:944

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1980

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1748

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1408

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1848

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
- Kills process with taskkill
PID:1904

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:292

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:268

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1896

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1060

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1516

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1968

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1108

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1344

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1652

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1212

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1728

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
- Kills process with taskkill
PID:1760

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:592

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:856

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:756

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1612

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1864

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1552

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1724

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:988

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:812

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:328

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:944

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1980

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1748

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1408

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1848

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1904

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:756

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:268

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1896

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1060

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1516

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1968

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1108

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1344

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1652

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1212

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1728

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1760

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:592

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:856

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:480

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1612

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1864

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1552

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1724

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:988

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:812

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:328

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:944

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1980

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1748

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1408

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1848

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1904

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:756

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:268

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
- Kills process with taskkill
PID:1896

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1552

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1516

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1968

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1108

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1344

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1652

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1212

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1728

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1760

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:592

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:840

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:480

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1612

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1864

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1500

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1724

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:988

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
- Kills process with taskkill
PID:812

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:328

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:944

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1980

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1748

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1408

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1848

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:840

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:480

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1612

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1864

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1500

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1724

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:988

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:812

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:328

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:944

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1212

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
- Kills process with taskkill
PID:1728

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
- Kills process with taskkill
PID:1760

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:592

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:840

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:480

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1612

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1864

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1500

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1724

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:988

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:700

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1532

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:944

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1212

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1728

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1760

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:592

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1628

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1756

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1200

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1900

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1560

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:760

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1580

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:756

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1080

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:856

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1664

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1140

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1704

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1416

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1672

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1516

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:680

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:316

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1048

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:544

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1948

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:756

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
- Kills process with taskkill
PID:1080

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:856

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1664

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1140

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
- Kills process with taskkill
PID:1704

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1416

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1672

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1516

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:680

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
- Kills process with taskkill
PID:316

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1048

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:544

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1948

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:756

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1080

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:856

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1664

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1140

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1704

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1416

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1672

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
- Kills process with taskkill
PID:1516

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:680

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:316

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1048

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:544

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1948

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:756

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1080

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1804

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:592

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1592

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1756

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1676

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1500

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1008

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1244

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1888

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1368

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1596

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1588

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1964

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1692

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:856

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1664

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
- Kills process with taskkill
PID:1140

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1704

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1416

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1672

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1516

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:680

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:316

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1048

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:544

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1948

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:756

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1080

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1804

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:592

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1592

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1756

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1676

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1500

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1008

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1244

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1888

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1368

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1596

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1588

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1524

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1628

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:556

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:816

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1620

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1108

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:760

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:844

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1476

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1944

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1748

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1408

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:936

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:268

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1668

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:884

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1052

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1044

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1512

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1344

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1420

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1672

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1516

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:680

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:316

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:608

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:544

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1948

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1688

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1692

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:856

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1724

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1404

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:812

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1908

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:2004

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1056

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1092

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1760

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1504

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1744

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1080

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1200

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:592

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1052

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:540

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1704

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:292

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:932

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1148

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1980

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1848

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1928

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:480

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1872

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1964

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1900

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1560

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:556

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1580

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1416

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
- Kills process with taskkill
PID:1108

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1088

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1728

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1708

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:840

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:432

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1936

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1552

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1612

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1540

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:2020

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1044

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1512

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1328

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1420

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1672

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1212

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:572

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1092

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1888

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1368

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1596

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1588

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1524

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1628

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:856

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:816

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1620

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:812

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:760

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:844

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1476

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:840

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1504

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1936

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1552

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1692

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1592

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1676

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1404

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1996

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:944

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1516

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1672

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1848

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:892

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1340

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1968

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:920

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:664

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1668

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:884

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1496

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:700

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1908

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:2004

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1056

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1500

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1920

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1476

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1928

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1688

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1872

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1552

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1612

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1592

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
- Kills process with taskkill
PID:328

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1704

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:292

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:932

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:316

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1980

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1212

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1060

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:480

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1140

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1756

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1724

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1344

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:2044

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:2032

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:988

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1620

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:756

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:608

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1748

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1708

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1864

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:828

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1080

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1532

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1540

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:540

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:856

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:328

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1996

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:292

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:760

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:316

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:572

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1212

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1060

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1664

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1596

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1756

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1668

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1344

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1560

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:556

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1580

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
- Kills process with taskkill
PID:932

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1108

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
- Kills process with taskkill
PID:1980

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1092

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:936

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1760

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1140

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:268

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1724

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1524

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1628

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1704

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1496

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:700

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1328

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1420

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1148

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1476

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:480

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1688

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:664

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1484

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:592

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1940

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:432

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:2032

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:988

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
- Kills process with taskkill
PID:1620

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1088

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1728

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1848

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1968

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1608

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:936

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1760

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1140

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:268

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1724

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1524

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1628

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1704

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:328

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1996

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
- Kills process with taskkill
PID:1908

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:2004

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1056

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1500

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1864

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1888

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1588

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1676

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:2044

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:540

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:680

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1516

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1512

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:292

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:760

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1420

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:572

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1112

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:920

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1972

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1920

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:840

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1928

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1936

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1744

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1200

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1692

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1052

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1416

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1672

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:756

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:608

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1748

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1944

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1664

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1596

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1588

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1676

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:2044

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:540

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:680

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1516

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1512

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:292

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:760

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1420

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:572

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1112

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1708

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1864

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1888

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:840

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1928

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1936

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1744

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1948

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1692

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1052

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1416

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1672

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:756

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
- Kills process with taskkill
PID:608

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1748

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1944

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1664

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1596

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:840

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
- Kills process with taskkill
PID:1928

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1704

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:680

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1996

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1908

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:2004

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1056

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1500

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:920

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1972

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1920

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:268

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1940

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1044

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:2032

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:700

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1200

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
- Kills process with taskkill
PID:1692

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1980

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1416

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:2028

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:756

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:608

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:664

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1540

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:2020

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:268

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1940

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1044

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:2032

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:700

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1200

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1692

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1848

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1416

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:760

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:828

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1900

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1748

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1708

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:520

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1724

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:432

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:544

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1872

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:932

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1108

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1148

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1672

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1968

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:2028

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:756

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:608

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:664

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1540

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:2020

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:268

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1940

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1044

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1872

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:932

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1108

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1148

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:480

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1504

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:2028

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:756

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1900

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1748

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1708

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:520

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1724

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:432

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
- Kills process with taskkill
PID:1516

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1996

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1092

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:844

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1420

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1964

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:920

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:828

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1920

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1652

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1344

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1592

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1496

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1580

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1620

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1088

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1728

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1692

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1848

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1416

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:572

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1612

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1112

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:856

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
- Kills process with taskkill
PID:944

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1936

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1928

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1048

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:316

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1340

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1980

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1212

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1672

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1060

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1368

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1964

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:920

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:828

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1716

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:608

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:664

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1540

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:2020

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:268

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1940

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:544

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:892

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:292

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1004

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1416

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:572

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:920

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:828

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:856

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:944

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1936

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1928

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1048

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:316

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1340

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1980

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1212

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1672

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1060

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1368

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1964

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1920

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1652

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1716

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:608

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:664

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1540

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:2020

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:268

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1940

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:544

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:892

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:292

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1004

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1416

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:572

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:920

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:828

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:856

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:944

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1936

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1928

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1048

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:316

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1340

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1980

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:892

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:292

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1004

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1416

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:572

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:920

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
- Kills process with taskkill
PID:828

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:856

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
- Kills process with taskkill
PID:944

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1936

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1928

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1048

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:316

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1688

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1972

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1484

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1552

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1560

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1524

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1708

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1948

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:2032

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:432

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1008

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:932

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1108

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1148

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
- Kills process with taskkill
PID:1544

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1212

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1944

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1408

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1112

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1748

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:556

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1628

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:680

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1044

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:664

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1996

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:2020

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
- Kills process with taskkill
PID:844

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:936

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1804

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1672

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1060

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1368

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1964

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:540

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1652

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1608

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1512

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1516

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:2004

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:364

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1088

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1728

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1692

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1848

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1940

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:544

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:2028

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1864

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1888

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1524

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1708

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:736

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:812

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:700

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:268

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1680

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:884

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1980

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:892

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1588

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1004

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1532

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1704

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:2036

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:828

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1908

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1476

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1936

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1080

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1108

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:316

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1544

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1212

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:976

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1940

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:544

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1748

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:556

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1052

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:2032

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:432

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:736

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:812

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1636

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1340

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:816

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1668

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1484

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1904

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1744

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1328

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1716

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1216

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1724

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1496

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1008

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1968

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:2004

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1620

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:2020

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1664

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1688

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1972

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1944

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1408

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1112

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:520

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:556

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1052

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:2032

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1708

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:664

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1996

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:700

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1340

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:936

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1552

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:756

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1344

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:920

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1964

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:856

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1676

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1920

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1496

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:932

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1148

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1140

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1244

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:292

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1448

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1980

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:892

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1368

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:608

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1652

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1540

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:2044

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:828

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Remote System Discovery

T1018

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Mail-Bird Tool\exit.exe
Filesize
1.3MB

MD5
d2f314f78d0ac5a5c5dbd119a41bad5a

SHA1
49415ae9a0f85699349f13c95cb4fd3ce0eaf932

SHA256
cc81dd1eba5b887d09b0eecb8443916dea82dc58e1cf847f1653413fb804210c

SHA512
42cdb86ebd0e1ef75d9527ee946d43e87abda73f3480e04ef90efb8fbcc7db0b2d29b366fb8715b1cb19896a35dc0dae1a05a23b91032923fbd52ce193c72c5b

Download Submit
C:\ProgramData\Mail-Bird Tool\i.cmd
Filesize
285B

MD5
ed673083a78bedb904abf3a9248aba2f

SHA1
891ff26ef43b2cf7d64c694e4c3eecbd7ae78631

SHA256
2472cd98c357eef3aa88534c8b1f12727341aef35f4d0b5d900891192c496fa9

SHA512
8bd0c81d59715c3f3a9148375c3da0b478e2c69d21e9d9eb5f6f0560cdbb5af4c5ed58a9eaa715551be6d1c76b323bd8861b597d00f10d4a4be9fc2615f8b683

Download Submit
C:\ProgramData\Mail-Bird Tool\settings.dat
Filesize
2KB

MD5
a66681ae26a6c9bde38fb13e4bff0469

SHA1
0af7a6de7ea59687b9751207c62fcc8c004c602c

SHA256
4bb75803531fa7307bb0943b3ac49510a51ae65b915c276a210bdb7865bdecd5

SHA512
cca492781dcd02e685219550fda75e04473e6037ff5698394900c212000ddaa1ff896145eb99fa5835f792f616ccc0c69acce156c6eec37f44954afdb08daa5f

Download Submit
C:\ProgramData\Mail-Bird Tool\winserv.exe
Filesize
2.7MB

MD5
cf2ab077a46219b6ce4a53517dd489ea

SHA1
651b8d1377910e4728e85dcd231e269313ab9e1d

SHA256
609b0a416f9b16a6df9b967dc32cd739402af31566e019a8fb8abdf3cb573e30

SHA512
53fb1ac822467168ea8e7abdd72c78cdd90070b10773ce8c700c6784ab4cc3a03eb53887d158ce3a27779a5fbcf3300d2ccbedab79a34bfd42ddc91f68dbdad7

Download Submit
C:\ProgramData\Mail-Bird Tool\winserv.exe
Filesize
2.7MB

MD5
cf2ab077a46219b6ce4a53517dd489ea

SHA1
651b8d1377910e4728e85dcd231e269313ab9e1d

SHA256
609b0a416f9b16a6df9b967dc32cd739402af31566e019a8fb8abdf3cb573e30

SHA512
53fb1ac822467168ea8e7abdd72c78cdd90070b10773ce8c700c6784ab4cc3a03eb53887d158ce3a27779a5fbcf3300d2ccbedab79a34bfd42ddc91f68dbdad7

Download Submit
C:\ProgramData\Mail-Bird Tool\winserv.exe
Filesize
2.7MB

MD5
cf2ab077a46219b6ce4a53517dd489ea

SHA1
651b8d1377910e4728e85dcd231e269313ab9e1d

SHA256
609b0a416f9b16a6df9b967dc32cd739402af31566e019a8fb8abdf3cb573e30

SHA512
53fb1ac822467168ea8e7abdd72c78cdd90070b10773ce8c700c6784ab4cc3a03eb53887d158ce3a27779a5fbcf3300d2ccbedab79a34bfd42ddc91f68dbdad7

Download Submit
C:\Users\Admin\AppData\Local\Temp\exit.exe
Filesize
1.3MB

MD5
d2f314f78d0ac5a5c5dbd119a41bad5a

SHA1
49415ae9a0f85699349f13c95cb4fd3ce0eaf932

SHA256
cc81dd1eba5b887d09b0eecb8443916dea82dc58e1cf847f1653413fb804210c

SHA512
42cdb86ebd0e1ef75d9527ee946d43e87abda73f3480e04ef90efb8fbcc7db0b2d29b366fb8715b1cb19896a35dc0dae1a05a23b91032923fbd52ce193c72c5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\i.cmd
Filesize
243B

MD5
fc649536672519e77ef0797995695945

SHA1
91efdc98ff70a3f0723ae9b4e8ed150701c845bb

SHA256
9bda632ea503cb771672c709b2427e3d44df28c0b2c2e4ff0a5b01d143fc8eaa

SHA512
b201693875d42850b81ceee2f4f344ed939067f5315eb36305d4a166f085b7c133fe9f93bf7a7e889d93616a2d8acc8cf72cd9c2ad26049dd31bebd236dbb6bb

Download Submit
C:\Users\Admin\AppData\Local\Temp\mail-bird.exe
Filesize
3.3MB

MD5
1a3fea120e3954dcd0c78c489f465f8e

SHA1
aa8eaf849858926334d3101acb139c82310cacb7

SHA256
2a5c9571dd3524a78827c7d2c50f79b84e8036f737f1ea62c5169706cf924354

SHA512
3f40c2ce4d2c52ad30ea1cf086886386f23c05ba57e4fc6e6f1778f3eb5d18040c5eaa13519a28b665cabe0ab5facaa0375c1be7f97be3b49845cd05851c584b

Download Submit
C:\Users\Admin\AppData\Local\Temp\syst.dll
Filesize
3.3MB

MD5
1a3fea120e3954dcd0c78c489f465f8e

SHA1
aa8eaf849858926334d3101acb139c82310cacb7

SHA256
2a5c9571dd3524a78827c7d2c50f79b84e8036f737f1ea62c5169706cf924354

SHA512
3f40c2ce4d2c52ad30ea1cf086886386f23c05ba57e4fc6e6f1778f3eb5d18040c5eaa13519a28b665cabe0ab5facaa0375c1be7f97be3b49845cd05851c584b

Download Submit
\ProgramData\Mail-Bird Tool\exit.exe
Filesize
1.3MB

MD5
d2f314f78d0ac5a5c5dbd119a41bad5a

SHA1
49415ae9a0f85699349f13c95cb4fd3ce0eaf932

SHA256
cc81dd1eba5b887d09b0eecb8443916dea82dc58e1cf847f1653413fb804210c

SHA512
42cdb86ebd0e1ef75d9527ee946d43e87abda73f3480e04ef90efb8fbcc7db0b2d29b366fb8715b1cb19896a35dc0dae1a05a23b91032923fbd52ce193c72c5b

Download Submit
\ProgramData\Mail-Bird Tool\exit.exe
Filesize
1.3MB

MD5
d2f314f78d0ac5a5c5dbd119a41bad5a

SHA1
49415ae9a0f85699349f13c95cb4fd3ce0eaf932

SHA256
cc81dd1eba5b887d09b0eecb8443916dea82dc58e1cf847f1653413fb804210c

SHA512
42cdb86ebd0e1ef75d9527ee946d43e87abda73f3480e04ef90efb8fbcc7db0b2d29b366fb8715b1cb19896a35dc0dae1a05a23b91032923fbd52ce193c72c5b

Download Submit
\ProgramData\Mail-Bird Tool\exit.exe
Filesize
1.3MB

MD5
d2f314f78d0ac5a5c5dbd119a41bad5a

SHA1
49415ae9a0f85699349f13c95cb4fd3ce0eaf932

SHA256
cc81dd1eba5b887d09b0eecb8443916dea82dc58e1cf847f1653413fb804210c

SHA512
42cdb86ebd0e1ef75d9527ee946d43e87abda73f3480e04ef90efb8fbcc7db0b2d29b366fb8715b1cb19896a35dc0dae1a05a23b91032923fbd52ce193c72c5b

Download Submit
\ProgramData\Mail-Bird Tool\exit.exe
Filesize
1.3MB

MD5
d2f314f78d0ac5a5c5dbd119a41bad5a

SHA1
49415ae9a0f85699349f13c95cb4fd3ce0eaf932

SHA256
cc81dd1eba5b887d09b0eecb8443916dea82dc58e1cf847f1653413fb804210c

SHA512
42cdb86ebd0e1ef75d9527ee946d43e87abda73f3480e04ef90efb8fbcc7db0b2d29b366fb8715b1cb19896a35dc0dae1a05a23b91032923fbd52ce193c72c5b

Download Submit
\ProgramData\Mail-Bird Tool\winserv.exe
Filesize
2.7MB

MD5
cf2ab077a46219b6ce4a53517dd489ea

SHA1
651b8d1377910e4728e85dcd231e269313ab9e1d

SHA256
609b0a416f9b16a6df9b967dc32cd739402af31566e019a8fb8abdf3cb573e30

SHA512
53fb1ac822467168ea8e7abdd72c78cdd90070b10773ce8c700c6784ab4cc3a03eb53887d158ce3a27779a5fbcf3300d2ccbedab79a34bfd42ddc91f68dbdad7

Download Submit
\Users\Admin\AppData\Local\Temp\exit.exe
Filesize
1.3MB

MD5
d2f314f78d0ac5a5c5dbd119a41bad5a

SHA1
49415ae9a0f85699349f13c95cb4fd3ce0eaf932

SHA256
cc81dd1eba5b887d09b0eecb8443916dea82dc58e1cf847f1653413fb804210c

SHA512
42cdb86ebd0e1ef75d9527ee946d43e87abda73f3480e04ef90efb8fbcc7db0b2d29b366fb8715b1cb19896a35dc0dae1a05a23b91032923fbd52ce193c72c5b

Download Submit
\Users\Admin\AppData\Local\Temp\exit.exe
Filesize
1.3MB

MD5
d2f314f78d0ac5a5c5dbd119a41bad5a

SHA1
49415ae9a0f85699349f13c95cb4fd3ce0eaf932

SHA256
cc81dd1eba5b887d09b0eecb8443916dea82dc58e1cf847f1653413fb804210c

SHA512
42cdb86ebd0e1ef75d9527ee946d43e87abda73f3480e04ef90efb8fbcc7db0b2d29b366fb8715b1cb19896a35dc0dae1a05a23b91032923fbd52ce193c72c5b

Download Submit
\Users\Admin\AppData\Local\Temp\exit.exe
Filesize
1.3MB

MD5
d2f314f78d0ac5a5c5dbd119a41bad5a

SHA1
49415ae9a0f85699349f13c95cb4fd3ce0eaf932

SHA256
cc81dd1eba5b887d09b0eecb8443916dea82dc58e1cf847f1653413fb804210c

SHA512
42cdb86ebd0e1ef75d9527ee946d43e87abda73f3480e04ef90efb8fbcc7db0b2d29b366fb8715b1cb19896a35dc0dae1a05a23b91032923fbd52ce193c72c5b

Download Submit
\Users\Admin\AppData\Local\Temp\exit.exe
Filesize
1.3MB

MD5
d2f314f78d0ac5a5c5dbd119a41bad5a

SHA1
49415ae9a0f85699349f13c95cb4fd3ce0eaf932

SHA256
cc81dd1eba5b887d09b0eecb8443916dea82dc58e1cf847f1653413fb804210c

SHA512
42cdb86ebd0e1ef75d9527ee946d43e87abda73f3480e04ef90efb8fbcc7db0b2d29b366fb8715b1cb19896a35dc0dae1a05a23b91032923fbd52ce193c72c5b

Download Submit
\Users\Admin\AppData\Local\Temp\mail-bird.exe
Filesize
3.3MB

MD5
1a3fea120e3954dcd0c78c489f465f8e

SHA1
aa8eaf849858926334d3101acb139c82310cacb7

SHA256
2a5c9571dd3524a78827c7d2c50f79b84e8036f737f1ea62c5169706cf924354

SHA512
3f40c2ce4d2c52ad30ea1cf086886386f23c05ba57e4fc6e6f1778f3eb5d18040c5eaa13519a28b665cabe0ab5facaa0375c1be7f97be3b49845cd05851c584b

Download Submit
memory/268-160-0x0000000000000000-mapping.dmp

Download
memory/292-108-0x0000000000000000-mapping.dmp

Download
memory/316-156-0x0000000000000000-mapping.dmp

Download
memory/328-101-0x0000000000000000-mapping.dmp

Download
memory/328-126-0x0000000000000000-mapping.dmp

Download
memory/480-142-0x0000000000000000-mapping.dmp

Download
memory/556-116-0x0000000000000000-mapping.dmp

Download
memory/592-180-0x0000000000000000-mapping.dmp

Download
memory/592-59-0x0000000000000000-mapping.dmp

Download
memory/596-71-0x0000000000000000-mapping.dmp

Download
memory/608-178-0x0000000000000000-mapping.dmp

Download
memory/608-63-0x0000000000000000-mapping.dmp

Download
memory/664-192-0x0000000000000000-mapping.dmp

Download
memory/736-124-0x0000000000000000-mapping.dmp

Download
memory/756-184-0x0000000000000000-mapping.dmp

Download
memory/828-84-0x0000000000000000-mapping.dmp

Download
memory/828-138-0x0000000000000000-mapping.dmp

Download
memory/844-174-0x0000000000000000-mapping.dmp

Download
memory/856-186-0x0000000000000000-mapping.dmp

Download
memory/860-99-0x0000000000400000-0x0000000000E2B000-memory.dmp

Filesize
10.2MB

Download
memory/860-324-0x0000000000400000-0x0000000000E2B000-memory.dmp

Filesize
10.2MB

Download
memory/884-150-0x0000000000000000-mapping.dmp

Download
memory/888-54-0x0000000075BB1000-0x0000000075BB3000-memory.dmp

Filesize
8KB

Download
memory/892-134-0x0000000000000000-mapping.dmp

Download
memory/920-190-0x0000000000000000-mapping.dmp

Download
memory/936-196-0x0000000000000000-mapping.dmp

Download
memory/988-130-0x0000000000000000-mapping.dmp

Download
memory/1008-170-0x0000000000000000-mapping.dmp

Download
memory/1048-158-0x0000000000000000-mapping.dmp

Download
memory/1088-146-0x0000000000000000-mapping.dmp

Download
memory/1088-97-0x0000000000000000-mapping.dmp

Download
memory/1140-110-0x0000000000000000-mapping.dmp

Download
memory/1148-120-0x0000000000000000-mapping.dmp

Download
memory/1212-132-0x0000000000000000-mapping.dmp

Download
memory/1256-93-0x00000000021A0000-0x0000000002BCB000-memory.dmp

Filesize
10.2MB

Download
memory/1256-82-0x0000000000000000-mapping.dmp

Download
memory/1256-307-0x00000000021A0000-0x0000000002BCB000-memory.dmp

Filesize
10.2MB

Download
memory/1400-200-0x0000000000000000-mapping.dmp

Download
memory/1416-106-0x0000000000000000-mapping.dmp

Download
memory/1416-176-0x0000000000000000-mapping.dmp

Download
memory/1476-168-0x0000000000000000-mapping.dmp

Download
memory/1496-136-0x0000000000000000-mapping.dmp

Download
memory/1516-128-0x0000000000000000-mapping.dmp

Download
memory/1524-198-0x0000000000000000-mapping.dmp

Download
memory/1532-140-0x0000000000000000-mapping.dmp

Download
memory/1540-182-0x0000000000000000-mapping.dmp

Download
memory/1592-194-0x0000000000000000-mapping.dmp

Download
memory/1612-166-0x0000000000000000-mapping.dmp

Download
memory/1652-122-0x0000000000000000-mapping.dmp

Download
memory/1664-148-0x0000000000000000-mapping.dmp

Download
memory/1676-172-0x0000000000000000-mapping.dmp

Download
memory/1688-103-0x0000000000000000-mapping.dmp

Download
memory/1704-152-0x0000000000000000-mapping.dmp

Download
memory/1720-65-0x0000000000000000-mapping.dmp

Download
memory/1724-90-0x0000000000000000-mapping.dmp

Download
memory/1724-188-0x0000000000000000-mapping.dmp

Download
memory/1728-112-0x0000000000000000-mapping.dmp

Download
memory/1756-202-0x0000000000000000-mapping.dmp

Download
memory/1760-68-0x0000000000000000-mapping.dmp

Download
memory/1804-114-0x0000000000000000-mapping.dmp

Download
memory/1872-204-0x0000000000000000-mapping.dmp

Download
memory/1888-164-0x0000000000000000-mapping.dmp

Download
memory/1896-162-0x0000000000000000-mapping.dmp

Download
memory/1960-78-0x0000000000000000-mapping.dmp

Download
memory/1964-154-0x0000000000000000-mapping.dmp

Download
memory/1996-206-0x0000000000000000-mapping.dmp

Download
memory/2004-118-0x0000000000000000-mapping.dmp

Download
memory/2044-94-0x0000000000400000-0x0000000000E2B000-memory.dmp

Filesize
10.2MB

Download
memory/2044-88-0x0000000000000000-mapping.dmp

Download
memory/2044-144-0x0000000000000000-mapping.dmp

Download
memory/2044-98-0x0000000000400000-0x0000000000E2B000-memory.dmp

Filesize
10.2MB

Download