rms | 5a0746efe225da2d41bd802670ef63d55a598fcdf12275283532144df6b7a1bb

Analysis

max time kernel
162s
max time network
165s
platform
windows10-2004_x64
resource
win10v2004-20220721-en
resource tags

arch:x64arch:x86image:win10v2004-20220721-enlocale:en-usos:windows10-2004-x64system
submitted
24-07-2022 02:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5a0746efe225da2d41bd802670ef63d55a598fcdf12275283532144df6b7a1bb.exe
Size

3.9MB
MD5

147e30ac09fe0df9eb498dd832b55243
SHA1

f23823d52b5e50583b05da54f9e49b9786b0377c
SHA256

5a0746efe225da2d41bd802670ef63d55a598fcdf12275283532144df6b7a1bb
SHA512

96c6bc27e3dce82c6de712501a3116a846f08acc6d0ffe0a0a7ec2c219b715d717038e736e4c7c66e0ae37358590b6e8604881c6e3076e1a087aaf673109bbcd

Score

10^/10

rms persistence rat trojan

Malware Config

Signatures

RMS
Remote Manipulator System (RMS) is a remote access tool developed by Russian organization TektonIT.
trojan rat rms
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

Processes:

svchost.exe

description pid process target process

PID 744 created 4188 744 svchost.exe winserv.exe
Executes dropped EXE 5 IoCs

Processes:

exit.exemail-bird.exeexit.exewinserv.exewinserv.exe

pid process

4860 exit.exe
4524 mail-bird.exe
4516 exit.exe
4188 winserv.exe
2868 winserv.exe

description	pid	process	target process
PID 744 created 4188	744	svchost.exe	winserv.exe

pid	process
4860	exit.exe
4524	mail-bird.exe
4516	exit.exe
4188	winserv.exe
2868	winserv.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

winserv.exe5a0746efe225da2d41bd802670ef63d55a598fcdf12275283532144df6b7a1bb.exemail-bird.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000\Control Panel\International\Geo\Nation	winserv.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000\Control Panel\International\Geo\Nation	5a0746efe225da2d41bd802670ef63d55a598fcdf12275283532144df6b7a1bb.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000\Control Panel\International\Geo\Nation	mail-bird.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

reg.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000\Software\Microsoft\Windows\CurrentVersion\Run	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Mail-Bird Tool = "C:\\ProgramData\\Mail-Bird Tool\\winserv.exe"	reg.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Kills process with taskkill 64 IoCs

evasion

Processes:

taskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exe

pid	process
4376	taskkill.exe
1404	taskkill.exe
4792	taskkill.exe
4376	taskkill.exe
4064	taskkill.exe
1148	taskkill.exe
3436	taskkill.exe
4916	taskkill.exe
4648
5112	taskkill.exe
1392	taskkill.exe
4732	taskkill.exe
3888	taskkill.exe
4156	taskkill.exe
2804	taskkill.exe
4212	taskkill.exe
5028	taskkill.exe
4908	taskkill.exe
3520	taskkill.exe
4168	taskkill.exe
876	taskkill.exe
3340	taskkill.exe
4544
216	taskkill.exe
2100	taskkill.exe
4764	taskkill.exe
2712	taskkill.exe
1436	taskkill.exe
4668	taskkill.exe
1436	taskkill.exe
4372	taskkill.exe
3220	taskkill.exe
1000
1636	taskkill.exe
4476	taskkill.exe
1280	taskkill.exe
1276	taskkill.exe
5056	taskkill.exe
1824	taskkill.exe
2148	taskkill.exe
1152	taskkill.exe
4348	taskkill.exe
1580	taskkill.exe
3560	taskkill.exe
220	taskkill.exe
4660	taskkill.exe
3836
4896
4672	taskkill.exe
4792	taskkill.exe
4716	taskkill.exe
2116	taskkill.exe
4428	taskkill.exe
2524
4116	taskkill.exe
1328	taskkill.exe
1252	taskkill.exe
4148	taskkill.exe
4176	taskkill.exe
4068	taskkill.exe
4788	taskkill.exe
2364	taskkill.exe
2884	taskkill.exe
1324	taskkill.exe

Runs ping.exe 1 TTPs 2 IoCs

Remote System Discovery
T1018

Processes:

PING.EXEPING.EXE

pid process

4256 PING.EXE
4840 PING.EXE

pid	process
4256	PING.EXE
4840	PING.EXE

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

winserv.exewinserv.exe

pid	process
4188	winserv.exe
4188	winserv.exe
4188	winserv.exe
4188	winserv.exe
4188	winserv.exe
4188	winserv.exe
2868	winserv.exe
2868	winserv.exe
2868	winserv.exe
2868	winserv.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

taskkill.exetaskkill.exetaskkill.exewinserv.exetaskkill.exesvchost.exetaskkill.exetaskkill.exewinserv.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exe

description	pid	process
Token: SeDebugPrivilege	4180	taskkill.exe
Token: SeDebugPrivilege	2348	taskkill.exe
Token: SeDebugPrivilege	3396	taskkill.exe
Token: SeDebugPrivilege	4188	winserv.exe
Token: SeDebugPrivilege	1276	taskkill.exe
Token: SeTcbPrivilege	744	svchost.exe
Token: SeTcbPrivilege	744	svchost.exe
Token: SeDebugPrivilege	3600	taskkill.exe
Token: SeDebugPrivilege	4776	taskkill.exe
Token: SeTakeOwnershipPrivilege	2868	winserv.exe
Token: SeTcbPrivilege	2868	winserv.exe
Token: SeTcbPrivilege	2868	winserv.exe
Token: SeDebugPrivilege	216	taskkill.exe
Token: SeDebugPrivilege	4788	taskkill.exe
Token: SeDebugPrivilege	3824	taskkill.exe
Token: SeDebugPrivilege	4416	taskkill.exe
Token: SeDebugPrivilege	4644	taskkill.exe
Token: SeDebugPrivilege	4212	taskkill.exe
Token: SeDebugPrivilege	4028	taskkill.exe
Token: SeDebugPrivilege	1392	taskkill.exe
Token: SeDebugPrivilege	2572	taskkill.exe
Token: SeDebugPrivilege	2760	taskkill.exe
Token: SeDebugPrivilege	624	taskkill.exe
Token: SeDebugPrivilege	616	taskkill.exe
Token: SeDebugPrivilege	3852	taskkill.exe
Token: SeDebugPrivilege	4960	taskkill.exe
Token: SeDebugPrivilege	5028	taskkill.exe
Token: SeDebugPrivilege	396	taskkill.exe
Token: SeDebugPrivilege	1180	taskkill.exe
Token: SeDebugPrivilege	3648	taskkill.exe
Token: SeDebugPrivilege	864	taskkill.exe
Token: SeDebugPrivilege	1268	taskkill.exe
Token: SeDebugPrivilege	4184	taskkill.exe
Token: SeDebugPrivilege	4172	taskkill.exe
Token: SeDebugPrivilege	3532	taskkill.exe
Token: SeDebugPrivilege	2100	taskkill.exe
Token: SeDebugPrivilege	3092	taskkill.exe
Token: SeDebugPrivilege	2544	taskkill.exe
Token: SeDebugPrivilege	2524	taskkill.exe
Token: SeDebugPrivilege	548	taskkill.exe
Token: SeDebugPrivilege	3340	taskkill.exe
Token: SeDebugPrivilege	4340	taskkill.exe
Token: SeDebugPrivilege	5024	taskkill.exe
Token: SeDebugPrivilege	1640	taskkill.exe
Token: SeDebugPrivilege	2884	taskkill.exe
Token: SeDebugPrivilege	2580	taskkill.exe
Token: SeDebugPrivilege	5020	taskkill.exe
Token: SeDebugPrivilege	2888	taskkill.exe
Token: SeDebugPrivilege	3236	taskkill.exe
Token: SeDebugPrivilege	3848	taskkill.exe
Token: SeDebugPrivilege	1252	taskkill.exe
Token: SeDebugPrivilege	4872	taskkill.exe
Token: SeDebugPrivilege	4660	taskkill.exe
Token: SeDebugPrivilege	4256	taskkill.exe
Token: SeDebugPrivilege	4520	taskkill.exe
Token: SeDebugPrivilege	1452	taskkill.exe
Token: SeDebugPrivilege	2148	taskkill.exe
Token: SeDebugPrivilege	4476	taskkill.exe
Token: SeDebugPrivilege	1512	taskkill.exe
Token: SeDebugPrivilege	4368	taskkill.exe
Token: SeDebugPrivilege	4180	taskkill.exe
Token: SeDebugPrivilege	3660	taskkill.exe
Token: SeDebugPrivilege	1324	taskkill.exe
Token: SeDebugPrivilege	1960	taskkill.exe

Suspicious use of SetWindowsHookEx 8 IoCs

Processes:

winserv.exewinserv.exe

pid process

4188 winserv.exe
4188 winserv.exe
4188 winserv.exe
4188 winserv.exe
2868 winserv.exe
2868 winserv.exe
2868 winserv.exe
2868 winserv.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

5a0746efe225da2d41bd802670ef63d55a598fcdf12275283532144df6b7a1bb.exeexit.execmd.exemail-bird.exeexit.execmd.exesvchost.exe

description	pid	process	target process
PID 4596 wrote to memory of 4860	4596	5a0746efe225da2d41bd802670ef63d55a598fcdf12275283532144df6b7a1bb.exe	exit.exe
PID 4596 wrote to memory of 4860	4596	5a0746efe225da2d41bd802670ef63d55a598fcdf12275283532144df6b7a1bb.exe	exit.exe
PID 4596 wrote to memory of 4860	4596	5a0746efe225da2d41bd802670ef63d55a598fcdf12275283532144df6b7a1bb.exe	exit.exe
PID 4860 wrote to memory of 4428	4860	exit.exe	cmd.exe
PID 4860 wrote to memory of 4428	4860	exit.exe	cmd.exe
PID 4860 wrote to memory of 4428	4860	exit.exe	cmd.exe
PID 4428 wrote to memory of 4256	4428	cmd.exe	PING.EXE
PID 4428 wrote to memory of 4256	4428	cmd.exe	PING.EXE
PID 4428 wrote to memory of 4256	4428	cmd.exe	PING.EXE
PID 4428 wrote to memory of 4840	4428	cmd.exe	PING.EXE
PID 4428 wrote to memory of 4840	4428	cmd.exe	PING.EXE
PID 4428 wrote to memory of 4840	4428	cmd.exe	PING.EXE
PID 4428 wrote to memory of 4524	4428	cmd.exe	mail-bird.exe
PID 4428 wrote to memory of 4524	4428	cmd.exe	mail-bird.exe
PID 4428 wrote to memory of 4524	4428	cmd.exe	mail-bird.exe
PID 4524 wrote to memory of 4516	4524	mail-bird.exe	exit.exe
PID 4524 wrote to memory of 4516	4524	mail-bird.exe	exit.exe
PID 4524 wrote to memory of 4516	4524	mail-bird.exe	exit.exe
PID 4516 wrote to memory of 3452	4516	exit.exe	cmd.exe
PID 4516 wrote to memory of 3452	4516	exit.exe	cmd.exe
PID 4516 wrote to memory of 3452	4516	exit.exe	cmd.exe
PID 3452 wrote to memory of 4648	3452	cmd.exe	reg.exe
PID 3452 wrote to memory of 4648	3452	cmd.exe	reg.exe
PID 3452 wrote to memory of 4648	3452	cmd.exe	reg.exe
PID 3452 wrote to memory of 4188	3452	cmd.exe	winserv.exe
PID 3452 wrote to memory of 4188	3452	cmd.exe	winserv.exe
PID 3452 wrote to memory of 4188	3452	cmd.exe	winserv.exe
PID 3452 wrote to memory of 4180	3452	cmd.exe	taskkill.exe
PID 3452 wrote to memory of 4180	3452	cmd.exe	taskkill.exe
PID 3452 wrote to memory of 4180	3452	cmd.exe	taskkill.exe
PID 3452 wrote to memory of 2348	3452	cmd.exe	taskkill.exe
PID 3452 wrote to memory of 2348	3452	cmd.exe	taskkill.exe
PID 3452 wrote to memory of 2348	3452	cmd.exe	taskkill.exe
PID 3452 wrote to memory of 3396	3452	cmd.exe	taskkill.exe
PID 3452 wrote to memory of 3396	3452	cmd.exe	taskkill.exe
PID 3452 wrote to memory of 3396	3452	cmd.exe	taskkill.exe
PID 3452 wrote to memory of 1276	3452	cmd.exe	taskkill.exe
PID 3452 wrote to memory of 1276	3452	cmd.exe	taskkill.exe
PID 3452 wrote to memory of 1276	3452	cmd.exe	taskkill.exe
PID 744 wrote to memory of 2868	744	svchost.exe	winserv.exe
PID 744 wrote to memory of 2868	744	svchost.exe	winserv.exe
PID 744 wrote to memory of 2868	744	svchost.exe	winserv.exe
PID 3452 wrote to memory of 3600	3452	cmd.exe	taskkill.exe
PID 3452 wrote to memory of 3600	3452	cmd.exe	taskkill.exe
PID 3452 wrote to memory of 3600	3452	cmd.exe	taskkill.exe
PID 3452 wrote to memory of 4776	3452	cmd.exe	taskkill.exe
PID 3452 wrote to memory of 4776	3452	cmd.exe	taskkill.exe
PID 3452 wrote to memory of 4776	3452	cmd.exe	taskkill.exe
PID 3452 wrote to memory of 216	3452	cmd.exe	taskkill.exe
PID 3452 wrote to memory of 216	3452	cmd.exe	taskkill.exe
PID 3452 wrote to memory of 216	3452	cmd.exe	taskkill.exe
PID 3452 wrote to memory of 4788	3452	cmd.exe	taskkill.exe
PID 3452 wrote to memory of 4788	3452	cmd.exe	taskkill.exe
PID 3452 wrote to memory of 4788	3452	cmd.exe	taskkill.exe
PID 3452 wrote to memory of 3824	3452	cmd.exe	taskkill.exe
PID 3452 wrote to memory of 3824	3452	cmd.exe	taskkill.exe
PID 3452 wrote to memory of 3824	3452	cmd.exe	taskkill.exe
PID 3452 wrote to memory of 4416	3452	cmd.exe	taskkill.exe
PID 3452 wrote to memory of 4416	3452	cmd.exe	taskkill.exe
PID 3452 wrote to memory of 4416	3452	cmd.exe	taskkill.exe
PID 3452 wrote to memory of 4644	3452	cmd.exe	taskkill.exe
PID 3452 wrote to memory of 4644	3452	cmd.exe	taskkill.exe
PID 3452 wrote to memory of 4644	3452	cmd.exe	taskkill.exe
PID 3452 wrote to memory of 4212	3452	cmd.exe	taskkill.exe

C:\Users\Admin\AppData\Local\Temp\5a0746efe225da2d41bd802670ef63d55a598fcdf12275283532144df6b7a1bb.exe
"C:\Users\Admin\AppData\Local\Temp\5a0746efe225da2d41bd802670ef63d55a598fcdf12275283532144df6b7a1bb.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4596

C:\Users\Admin\AppData\Local\Temp\exit.exe
"C:\Users\Admin\AppData\Local\Temp\exit.exe"
2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4860

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c i.cmd
3⤵
- Suspicious use of WriteProcessMemory
PID:4428

C:\Windows\SysWOW64\PING.EXE
ping cloudflare.com -n 3 -w 3000
4⤵
- Runs ping.exe
PID:4256

C:\Windows\SysWOW64\PING.EXE
ping cloudflare.com -n 3 -w 1000
4⤵
- Runs ping.exe
PID:4840

C:\Users\Admin\AppData\Local\Temp\mail-bird.exe
mail-bird.exe x -p3KPnoNJ3ReME4bEU5W9APkKS5ErkR3tNRT -y
4⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4524

C:\ProgramData\Mail-Bird Tool\exit.exe
"C:\ProgramData\Mail-Bird Tool\exit.exe"
5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4516

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c i.cmd
6⤵
- Suspicious use of WriteProcessMemory
PID:3452

C:\Windows\SysWOW64\reg.exe
REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Mail-Bird Tool" /t REG_SZ /d "C:\ProgramData\Mail-Bird Tool\winserv.exe"
7⤵
- Adds Run key to start application
PID:4648

C:\ProgramData\Mail-Bird Tool\winserv.exe
"C:\ProgramData\Mail-Bird Tool\winserv.exe"
7⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4188

C:\ProgramData\Mail-Bird Tool\winserv.exe
"C:\ProgramData\Mail-Bird Tool\winserv.exe" -second
8⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2868

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
- Suspicious use of AdjustPrivilegeToken
PID:4180

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
- Suspicious use of AdjustPrivilegeToken
PID:2348

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
- Suspicious use of AdjustPrivilegeToken
PID:3396

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
- Suspicious use of AdjustPrivilegeToken
PID:1276

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
- Suspicious use of AdjustPrivilegeToken
PID:3600

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
- Suspicious use of AdjustPrivilegeToken
PID:4776

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:216

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
- Suspicious use of AdjustPrivilegeToken
PID:4788

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
- Suspicious use of AdjustPrivilegeToken
PID:3824

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
- Suspicious use of AdjustPrivilegeToken
PID:4416

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
- Suspicious use of AdjustPrivilegeToken
PID:4644

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
- Suspicious use of AdjustPrivilegeToken
PID:4212

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
- Suspicious use of AdjustPrivilegeToken
PID:4028

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
- Suspicious use of AdjustPrivilegeToken
PID:1392

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
- Suspicious use of AdjustPrivilegeToken
PID:2572

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
- Suspicious use of AdjustPrivilegeToken
PID:2760

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
- Suspicious use of AdjustPrivilegeToken
PID:624

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
- Suspicious use of AdjustPrivilegeToken
PID:616

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
- Suspicious use of AdjustPrivilegeToken
PID:3852

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
- Suspicious use of AdjustPrivilegeToken
PID:4960

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:5028

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
- Suspicious use of AdjustPrivilegeToken
PID:396

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
- Suspicious use of AdjustPrivilegeToken
PID:1180

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
- Suspicious use of AdjustPrivilegeToken
PID:3648

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
- Suspicious use of AdjustPrivilegeToken
PID:864

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
- Suspicious use of AdjustPrivilegeToken
PID:1268

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
- Suspicious use of AdjustPrivilegeToken
PID:4184

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
- Suspicious use of AdjustPrivilegeToken
PID:4172

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
- Suspicious use of AdjustPrivilegeToken
PID:3532

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2100

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
- Suspicious use of AdjustPrivilegeToken
PID:3092

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
- Suspicious use of AdjustPrivilegeToken
PID:2544

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
- Suspicious use of AdjustPrivilegeToken
PID:2524

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
- Suspicious use of AdjustPrivilegeToken
PID:548

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
- Suspicious use of AdjustPrivilegeToken
PID:3340

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
- Suspicious use of AdjustPrivilegeToken
PID:4340

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
- Suspicious use of AdjustPrivilegeToken
PID:5024

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
- Suspicious use of AdjustPrivilegeToken
PID:1640

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2884

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
- Suspicious use of AdjustPrivilegeToken
PID:2580

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
- Suspicious use of AdjustPrivilegeToken
PID:5020

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
- Suspicious use of AdjustPrivilegeToken
PID:2888

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
- Suspicious use of AdjustPrivilegeToken
PID:3236

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
- Suspicious use of AdjustPrivilegeToken
PID:3848

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
- Suspicious use of AdjustPrivilegeToken
PID:1252

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
- Suspicious use of AdjustPrivilegeToken
PID:4872

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
- Suspicious use of AdjustPrivilegeToken
PID:4660

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
- Suspicious use of AdjustPrivilegeToken
PID:4256

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
- Suspicious use of AdjustPrivilegeToken
PID:4520

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
- Suspicious use of AdjustPrivilegeToken
PID:1452

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
- Suspicious use of AdjustPrivilegeToken
PID:2148

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
- Suspicious use of AdjustPrivilegeToken
PID:4476

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
- Suspicious use of AdjustPrivilegeToken
PID:1512

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
- Suspicious use of AdjustPrivilegeToken
PID:4368

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
- Suspicious use of AdjustPrivilegeToken
PID:4180

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
- Suspicious use of AdjustPrivilegeToken
PID:3660

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1324

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
- Suspicious use of AdjustPrivilegeToken
PID:1960

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:5008

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:3056

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:3200

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4444

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:212

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:216

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4084

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
- Kills process with taskkill
PID:4668

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4760

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
- Kills process with taskkill
PID:4764

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:2232

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4644

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4212

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1404

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4216

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:3552

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:2816

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1936

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4836

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1328

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:3852

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4912

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4680

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:2356

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:876

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:3748

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:3596

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1636

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:2076

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:2248

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4172

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:3464

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:3228

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:3448

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4784

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:3296

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:2708

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4012

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:3340

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:3140

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:860

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1080

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4632

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1272

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:2772

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:5020

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:3216

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1700

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:3848

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:2584

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4676

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4564

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4916

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4108

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1444

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1452

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4348

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4432

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:3484

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1516

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:3496

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:3580

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4924

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:2712

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1596

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4704

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:3600

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:2468

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1828

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:60

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4744

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
- Kills process with taskkill
PID:1148

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1340

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4480

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4124

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1820

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:3556

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4260

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:2756

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:2224

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4076

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:3828

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
- Kills process with taskkill
PID:1436

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:2592

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1764

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:3852

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4912

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4680

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:2356

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:876

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:3748

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4196

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:3012

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:3388

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:3888

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1164

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:3240

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1580

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:3992

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:2640

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:3256

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4928

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1068

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:2632

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:5024

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
- Kills process with taskkill
PID:3436

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:3360

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:764

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1272

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:2772

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:3168

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4024

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:868

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:3848

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:2584

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4676

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4564

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
- Kills process with taskkill
PID:4916

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4312

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:3236

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1452

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
- Kills process with taskkill
PID:4348

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4432

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:3484

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1516

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
- Kills process with taskkill
PID:4116

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1480

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1188

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:544

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
- Kills process with taskkill
PID:4376

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:2244

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4776

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:228

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:2120

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4052

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:348

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:2284

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:8

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4100

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1344

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1476

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:3944

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:2620

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
- Kills process with taskkill
PID:4168

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:2760

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:808

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:2176

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4836

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
- Kills process with taskkill
PID:1328

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1768

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:852

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:3304

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:2180

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:2356

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
- Kills process with taskkill
PID:876

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:2212

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:2988

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:3008

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1980

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4328

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:388

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1848

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1968

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:2692

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:548

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1748

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:5012

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4672

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4140

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4876

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:2884

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:5004

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:3784

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:2028

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4016

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:3572

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4472

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4596

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4224

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4660

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:5112

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:2464

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4652

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4500

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4448

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4476

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4160

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4992

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:5000

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:3660

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1324

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1960

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1844

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:3056

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:276

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:204

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:116

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:3128

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:3392

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4356

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4048

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4740

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:2208

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4956

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
- Kills process with taskkill
PID:4372

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4028

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:3816

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:3104

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4996

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1604

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4064

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:3080

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:2592

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1396

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:696

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1156

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1356

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4112

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4968

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1532

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
- Kills process with taskkill
PID:1636

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4768

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:2256

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:2784

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:3464

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:3228

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:2544

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4132

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:2172

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1192

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:644

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4576

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1644

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1640

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4120

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:2192

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:2580

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1668

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1484

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:5020

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4024

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:868

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:3848

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4596

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4224

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4660

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:5112

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1488

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4400

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4504

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
- Kills process with taskkill
PID:4148

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1876

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:3524

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:3484

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:2348

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4116

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:3660

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:3972

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1964

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:544

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4376

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4704

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4444

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:3576

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4788

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4088

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:3824

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1776

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4740

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:2208

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1280

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:832

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4344

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
- Kills process with taskkill
PID:1404

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:3856

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:2816

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1604

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4064

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:3080

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:2592

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1396

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:696

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1156

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1356

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4112

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4968

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1532

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1636

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4768

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:2256

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:2784

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:3464

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:3228

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:2544

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4132

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:2172

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1192

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:644

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4576

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1644

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1640

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1080

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:3360

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:3276

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:2320

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:412

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4020

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:3216

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:868

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:3848

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4596

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4224

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4660

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:5112

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1488

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4400

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4504

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4144

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4368

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4164

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4040

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:2972

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1544

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4692

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:988

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:2712

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:3056

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4752

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:220

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:940

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4728

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1100

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1036

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4480

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1776

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4740

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:2208

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1280

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:832

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4344

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1404

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:2364

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4092

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:3412

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
- Kills process with taskkill
PID:4908

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4960

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:5100

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1824

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:3108

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:3648

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:3596

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1884

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4184

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
- Kills process with taskkill
PID:4176

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:3220

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:420

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1164

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:3240

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1580

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:3992

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:2640

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:3256

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4928

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1068

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:2632

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:5024

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:5044

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:2704

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:764

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1272

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4032

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:3168

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4604

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:660

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
- Kills process with taskkill
PID:1252

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
- Kills process with taskkill
PID:2116

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4544

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4288

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:2824

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4228

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4152

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4508

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
- Kills process with taskkill
PID:3520

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4432

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:3344

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4468

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:5000

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:3396

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1480

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1544

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4692

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:988

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
- Kills process with taskkill
PID:2712

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:3056

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4752

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:220

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1760

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:2624

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1340

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:2232

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4100

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1344

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1540

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4264

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:2104

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:3816

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4816

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1404

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:2364

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1600

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4836

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:648

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:5028

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1496

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:328

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:2180

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:2356

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:632

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4988

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:876

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:2448

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1636

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4768

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1980

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:5104

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1164

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:3240

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
- Kills process with taskkill
PID:1580

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:2544

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:3000

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:548

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1292

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1152

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
- Kills process with taskkill
PID:4672

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1888

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:2788

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1080

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:3360

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:3276

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:2076

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4016

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:3572

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4472

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:2144

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:3808

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4540

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:2852

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4864

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
- Kills process with taskkill
PID:5112

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4500

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4420

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:2088

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
- Kills process with taskkill
PID:4476

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
- Kills process with taskkill
PID:3560

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1916

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4300

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4180

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
- Kills process with taskkill
PID:2804

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:2612

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1324

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
- Kills process with taskkill
PID:1276

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:2888

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:3840

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:2468

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1828

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:60

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1760

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1148

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4764

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:2232

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1492

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:2208

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1280

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1284

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:2104

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4392

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:2412

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:2816

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1604

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1244

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1328

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:828

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:852

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:2860

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:2196

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:3788

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1356

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:2944

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:3680

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4200

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:3012

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1788

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1092

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:2256

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:3532

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:3092

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1784

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
- Kills process with taskkill
PID:4792

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
- Kills process with taskkill
PID:5056

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:2640

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:3256

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4928

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1068

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:2632

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:3672

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1888

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:5060

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:2604

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:3148

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:2772

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:2076

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4016

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4848

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4232

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:868

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4676

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:2560

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
- Kills process with taskkill
PID:4428

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4860

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4484

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4152

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4348

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4504

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4144

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:3524

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:3484

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:2348

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4116

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:3660

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:3972

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1844

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:544

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
- Kills process with taskkill
PID:4068

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4704

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:204

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:2120

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4788

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:3392

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:3824

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4416

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4636

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:3556

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1492

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:2208

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
- Kills process with taskkill
PID:1280

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1284

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:2104

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4392

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:2412

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:2816

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1604

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1244

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1328

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:828

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:852

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:2860

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:3732

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:3648

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1268

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4812

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:3680

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4200

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:3012

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1788

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1092

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:2256

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:3532

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:3092

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1784

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
- Kills process with taskkill
PID:4792

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:5056

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:2640

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:3256

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4928

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1068

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:2632

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:3672

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:2884

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:2564

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4568

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1968

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:2772

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:5068

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4016

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4848

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4232

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:868

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4676

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:2560

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4428

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4860

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4484

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4420

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:2088

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4476

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4056

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:3344

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4468

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:5000

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1552

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4896

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1964

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4692

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:2888

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:3840

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:2468

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4052

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:60

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1760

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1160

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:2052

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4124

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:3488

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:2000

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1392

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4028

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4352

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4076

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4996

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:3096

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:3608

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4128

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:688

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:648

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:5028

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1688

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4912

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4680

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1356

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:3748

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4196

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1532

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4252

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1636

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:3008

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
- Kills process with taskkill
PID:3888

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:3120

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:2100

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4684

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4784

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:3296

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:2708

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4012

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
- Kills process with taskkill
PID:3340

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:3140

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:5016

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:5024

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4120

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:5060

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:2604

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:3360

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:3276

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:5020

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:3572

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4944

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:2144

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:3848

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4916

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:3288

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:2464

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:5112

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4400

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4348

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1876

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4144

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:3524

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:3176

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4592

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:3896

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1188

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1360

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:3200

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:544

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
- Kills process with taskkill
PID:4376

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:276

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4444

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:2120

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
- Kills process with taskkill
PID:4788

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1100

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:8

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
- Kills process with taskkill
PID:4212

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1976

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4956

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4372

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4264

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4028

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4352

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4076

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:2520

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
- Kills process with taskkill
PID:2364

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1600

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4836

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:3080

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:2592

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:3836

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:5040

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:2860

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1240

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:632

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:3916

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:2212

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:2988

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4200

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4328

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4268

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:5104

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1164

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:3240

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
- Kills process with taskkill
PID:4716

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:2692

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4132

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:2172

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1192

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:644

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
- Kills process with taskkill
PID:1824

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1068

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:2632

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:3672

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:2884

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:2564

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4568

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1968

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:5068

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4016

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4848

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4232

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:868

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4676

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:2560

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4292

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4508

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:3520

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4432

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1512

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4368

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1888

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:3344

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4468

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:5000

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1552

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4896

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4620

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:3200

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:544

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4376

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:276

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:204

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1828

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
- Kills process with taskkill
PID:220

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:348

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1036

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:912

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4740

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1344

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4168

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:2344

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4404

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:2224

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:3612

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
- Kills process with taskkill
PID:4064

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4732

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:3608

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4128

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:688

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:396

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:852

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:3108

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:856

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4968

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1884

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4184

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:2600

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4176

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:2240

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:3012

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1788

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:2568

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:2340

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:464

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:2524

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1772

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1000

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:3720

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
- Kills process with taskkill
PID:4156

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4140

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:2068

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:5044

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:3968

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4364

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:408

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:3704

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:412

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:660

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4472

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4840

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4452

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4536

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:2824

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4228

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4664

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
- Kills process with taskkill
PID:2148

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:3280

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4448

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4504

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:3564

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4476

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4056

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4164

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4468

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:5000

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1552

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4896

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4620

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:3200

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:544

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4376

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:276

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:204

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1828

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:220

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:3744

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1776

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:3488

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:2756

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1088

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
- Kills process with taskkill
PID:1392

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1284

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:2104

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
- Kills process with taskkill
PID:1436

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4996

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:3128

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
- Kills process with taskkill
PID:4732

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:3608

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4128

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:688

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:928

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:3304

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:2940

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:856

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4968

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1884

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4184

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
- Kills process with taskkill
PID:3220

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4200

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4328

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4268

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:3120

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1164

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:3240

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4716

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:3992

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:5056

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:2640

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:3256

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4672

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1644

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4408

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:2788

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1080

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:3148

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1272

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4060

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4872

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4000

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:3808

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4596

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4224

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4312

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4240

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:2464

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:3236

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4400

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1700

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4460

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1728

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:3136

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4476

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4056

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4040

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4608

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:3972

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:5008

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:208

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:212

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4776

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:3780

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:3056

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4052

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:60

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1760

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:348

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1036

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:912

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1492

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:3944

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4372

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:2572

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4640

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:3104

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1404

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:2244

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:3128

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4960

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:696

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:5100

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1496

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:328

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4680

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:2940

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:856

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4968

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1884

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:2828

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:3220

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:808

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4328

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1848

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:3120

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4244

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4832

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:2692

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4132

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:2172

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1192

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
- Kills process with taskkill
PID:1152

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:860

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:3436

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1640

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:5004

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:3784

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1668

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4032

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4004

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:2584

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4256

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4520

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4564

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4108

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4540

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:2852

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
- Kills process with taskkill
PID:4660

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4500

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:3584

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:3620

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1880

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:392

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4368

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1516

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:3204

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4164

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:4468

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:1324

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:5036

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "rundll32.exe"
7⤵
PID:2952

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s seclogon
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:744

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Remote System Discovery

T1018

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Mail-Bird Tool\exit.exe
Filesize
1.3MB

MD5
d2f314f78d0ac5a5c5dbd119a41bad5a

SHA1
49415ae9a0f85699349f13c95cb4fd3ce0eaf932

SHA256
cc81dd1eba5b887d09b0eecb8443916dea82dc58e1cf847f1653413fb804210c

SHA512
42cdb86ebd0e1ef75d9527ee946d43e87abda73f3480e04ef90efb8fbcc7db0b2d29b366fb8715b1cb19896a35dc0dae1a05a23b91032923fbd52ce193c72c5b

Download Submit
C:\ProgramData\Mail-Bird Tool\exit.exe
Filesize
1.3MB

MD5
d2f314f78d0ac5a5c5dbd119a41bad5a

SHA1
49415ae9a0f85699349f13c95cb4fd3ce0eaf932

SHA256
cc81dd1eba5b887d09b0eecb8443916dea82dc58e1cf847f1653413fb804210c

SHA512
42cdb86ebd0e1ef75d9527ee946d43e87abda73f3480e04ef90efb8fbcc7db0b2d29b366fb8715b1cb19896a35dc0dae1a05a23b91032923fbd52ce193c72c5b

Download Submit
C:\ProgramData\Mail-Bird Tool\i.cmd
Filesize
285B

MD5
ed673083a78bedb904abf3a9248aba2f

SHA1
891ff26ef43b2cf7d64c694e4c3eecbd7ae78631

SHA256
2472cd98c357eef3aa88534c8b1f12727341aef35f4d0b5d900891192c496fa9

SHA512
8bd0c81d59715c3f3a9148375c3da0b478e2c69d21e9d9eb5f6f0560cdbb5af4c5ed58a9eaa715551be6d1c76b323bd8861b597d00f10d4a4be9fc2615f8b683

Download Submit
C:\ProgramData\Mail-Bird Tool\settings.dat
Filesize
2KB

MD5
a66681ae26a6c9bde38fb13e4bff0469

SHA1
0af7a6de7ea59687b9751207c62fcc8c004c602c

SHA256
4bb75803531fa7307bb0943b3ac49510a51ae65b915c276a210bdb7865bdecd5

SHA512
cca492781dcd02e685219550fda75e04473e6037ff5698394900c212000ddaa1ff896145eb99fa5835f792f616ccc0c69acce156c6eec37f44954afdb08daa5f

Download Submit
C:\ProgramData\Mail-Bird Tool\winserv.exe
Filesize
2.7MB

MD5
cf2ab077a46219b6ce4a53517dd489ea

SHA1
651b8d1377910e4728e85dcd231e269313ab9e1d

SHA256
609b0a416f9b16a6df9b967dc32cd739402af31566e019a8fb8abdf3cb573e30

SHA512
53fb1ac822467168ea8e7abdd72c78cdd90070b10773ce8c700c6784ab4cc3a03eb53887d158ce3a27779a5fbcf3300d2ccbedab79a34bfd42ddc91f68dbdad7

Download Submit
C:\ProgramData\Mail-Bird Tool\winserv.exe
Filesize
2.7MB

MD5
cf2ab077a46219b6ce4a53517dd489ea

SHA1
651b8d1377910e4728e85dcd231e269313ab9e1d

SHA256
609b0a416f9b16a6df9b967dc32cd739402af31566e019a8fb8abdf3cb573e30

SHA512
53fb1ac822467168ea8e7abdd72c78cdd90070b10773ce8c700c6784ab4cc3a03eb53887d158ce3a27779a5fbcf3300d2ccbedab79a34bfd42ddc91f68dbdad7

Download Submit
C:\ProgramData\Mail-Bird Tool\winserv.exe
Filesize
2.7MB

MD5
cf2ab077a46219b6ce4a53517dd489ea

SHA1
651b8d1377910e4728e85dcd231e269313ab9e1d

SHA256
609b0a416f9b16a6df9b967dc32cd739402af31566e019a8fb8abdf3cb573e30

SHA512
53fb1ac822467168ea8e7abdd72c78cdd90070b10773ce8c700c6784ab4cc3a03eb53887d158ce3a27779a5fbcf3300d2ccbedab79a34bfd42ddc91f68dbdad7

Download Submit
C:\Users\Admin\AppData\Local\Temp\exit.exe
Filesize
1.3MB

MD5
d2f314f78d0ac5a5c5dbd119a41bad5a

SHA1
49415ae9a0f85699349f13c95cb4fd3ce0eaf932

SHA256
cc81dd1eba5b887d09b0eecb8443916dea82dc58e1cf847f1653413fb804210c

SHA512
42cdb86ebd0e1ef75d9527ee946d43e87abda73f3480e04ef90efb8fbcc7db0b2d29b366fb8715b1cb19896a35dc0dae1a05a23b91032923fbd52ce193c72c5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\exit.exe
Filesize
1.3MB

MD5
d2f314f78d0ac5a5c5dbd119a41bad5a

SHA1
49415ae9a0f85699349f13c95cb4fd3ce0eaf932

SHA256
cc81dd1eba5b887d09b0eecb8443916dea82dc58e1cf847f1653413fb804210c

SHA512
42cdb86ebd0e1ef75d9527ee946d43e87abda73f3480e04ef90efb8fbcc7db0b2d29b366fb8715b1cb19896a35dc0dae1a05a23b91032923fbd52ce193c72c5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\i.cmd
Filesize
243B

MD5
fc649536672519e77ef0797995695945

SHA1
91efdc98ff70a3f0723ae9b4e8ed150701c845bb

SHA256
9bda632ea503cb771672c709b2427e3d44df28c0b2c2e4ff0a5b01d143fc8eaa

SHA512
b201693875d42850b81ceee2f4f344ed939067f5315eb36305d4a166f085b7c133fe9f93bf7a7e889d93616a2d8acc8cf72cd9c2ad26049dd31bebd236dbb6bb

Download Submit
C:\Users\Admin\AppData\Local\Temp\mail-bird.exe
Filesize
3.3MB

MD5
1a3fea120e3954dcd0c78c489f465f8e

SHA1
aa8eaf849858926334d3101acb139c82310cacb7

SHA256
2a5c9571dd3524a78827c7d2c50f79b84e8036f737f1ea62c5169706cf924354

SHA512
3f40c2ce4d2c52ad30ea1cf086886386f23c05ba57e4fc6e6f1778f3eb5d18040c5eaa13519a28b665cabe0ab5facaa0375c1be7f97be3b49845cd05851c584b

Download Submit
C:\Users\Admin\AppData\Local\Temp\syst.dll
Filesize
3.3MB

MD5
1a3fea120e3954dcd0c78c489f465f8e

SHA1
aa8eaf849858926334d3101acb139c82310cacb7

SHA256
2a5c9571dd3524a78827c7d2c50f79b84e8036f737f1ea62c5169706cf924354

SHA512
3f40c2ce4d2c52ad30ea1cf086886386f23c05ba57e4fc6e6f1778f3eb5d18040c5eaa13519a28b665cabe0ab5facaa0375c1be7f97be3b49845cd05851c584b

Download Submit
memory/216-159-0x0000000000000000-mapping.dmp

Download
memory/396-176-0x0000000000000000-mapping.dmp

Download
memory/548-188-0x0000000000000000-mapping.dmp

Download
memory/616-172-0x0000000000000000-mapping.dmp

Download
memory/624-171-0x0000000000000000-mapping.dmp

Download
memory/864-179-0x0000000000000000-mapping.dmp

Download
memory/1180-177-0x0000000000000000-mapping.dmp

Download
memory/1252-199-0x0000000000000000-mapping.dmp

Download
memory/1268-180-0x0000000000000000-mapping.dmp

Download
memory/1276-153-0x0000000000000000-mapping.dmp

Download
memory/1392-168-0x0000000000000000-mapping.dmp

Download
memory/1452-204-0x0000000000000000-mapping.dmp

Download
memory/1512-207-0x0000000000000000-mapping.dmp

Download
memory/1640-192-0x0000000000000000-mapping.dmp

Download
memory/2100-184-0x0000000000000000-mapping.dmp

Download
memory/2148-205-0x0000000000000000-mapping.dmp

Download
memory/2348-151-0x0000000000000000-mapping.dmp

Download
memory/2524-187-0x0000000000000000-mapping.dmp

Download
memory/2544-186-0x0000000000000000-mapping.dmp

Download
memory/2572-169-0x0000000000000000-mapping.dmp

Download
memory/2580-194-0x0000000000000000-mapping.dmp

Download
memory/2760-170-0x0000000000000000-mapping.dmp

Download
memory/2868-154-0x0000000000000000-mapping.dmp

Download
memory/2868-162-0x0000000000400000-0x0000000000E2B000-memory.dmp

Filesize
10.2MB

Download
memory/2868-209-0x0000000000400000-0x0000000000E2B000-memory.dmp

Filesize
10.2MB

Download
memory/2884-193-0x0000000000000000-mapping.dmp

Download
memory/2888-196-0x0000000000000000-mapping.dmp

Download
memory/3092-185-0x0000000000000000-mapping.dmp

Download
memory/3236-197-0x0000000000000000-mapping.dmp

Download
memory/3340-189-0x0000000000000000-mapping.dmp

Download
memory/3396-152-0x0000000000000000-mapping.dmp

Download
memory/3452-143-0x0000000000000000-mapping.dmp

Download
memory/3532-183-0x0000000000000000-mapping.dmp

Download
memory/3600-157-0x0000000000000000-mapping.dmp

Download
memory/3648-178-0x0000000000000000-mapping.dmp

Download
memory/3824-163-0x0000000000000000-mapping.dmp

Download
memory/3848-198-0x0000000000000000-mapping.dmp

Download
memory/3852-173-0x0000000000000000-mapping.dmp

Download
memory/4028-167-0x0000000000000000-mapping.dmp

Download
memory/4172-182-0x0000000000000000-mapping.dmp

Download
memory/4180-149-0x0000000000000000-mapping.dmp

Download
memory/4184-181-0x0000000000000000-mapping.dmp

Download
memory/4188-150-0x0000000000400000-0x0000000000E2B000-memory.dmp

Filesize
10.2MB

Download
memory/4188-146-0x0000000000000000-mapping.dmp

Download
memory/4188-156-0x0000000000400000-0x0000000000E2B000-memory.dmp

Filesize
10.2MB

Download
memory/4212-166-0x0000000000000000-mapping.dmp

Download
memory/4256-135-0x0000000000000000-mapping.dmp

Download
memory/4256-202-0x0000000000000000-mapping.dmp

Download
memory/4340-190-0x0000000000000000-mapping.dmp

Download
memory/4368-208-0x0000000000000000-mapping.dmp

Download
memory/4416-164-0x0000000000000000-mapping.dmp

Download
memory/4428-133-0x0000000000000000-mapping.dmp

Download
memory/4476-206-0x0000000000000000-mapping.dmp

Download
memory/4516-140-0x0000000000000000-mapping.dmp

Download
memory/4520-203-0x0000000000000000-mapping.dmp

Download
memory/4524-138-0x0000000000000000-mapping.dmp

Download
memory/4644-165-0x0000000000000000-mapping.dmp

Download
memory/4648-145-0x0000000000000000-mapping.dmp

Download
memory/4660-201-0x0000000000000000-mapping.dmp

Download
memory/4776-158-0x0000000000000000-mapping.dmp

Download
memory/4788-161-0x0000000000000000-mapping.dmp

Download
memory/4840-137-0x0000000000000000-mapping.dmp

Download
memory/4860-130-0x0000000000000000-mapping.dmp

Download
memory/4872-200-0x0000000000000000-mapping.dmp

Download
memory/4960-174-0x0000000000000000-mapping.dmp

Download
memory/5020-195-0x0000000000000000-mapping.dmp

Download
memory/5024-191-0x0000000000000000-mapping.dmp

Download
memory/5028-175-0x0000000000000000-mapping.dmp

Download