0adde4246aaa9fb3964d1d6cf3c29b1b13074015b250eb8e5591339f92e1e3ca

Analysis

max time kernel
149s
max time network
119s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
07/03/2024, 19:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0adde4246aaa9fb3964d1d6cf3c29b1b13074015b250eb8e5591339f92e1e3ca.exe
Size

224KB
MD5

8a23347b733420472a1ec0a1eeada597
SHA1

21eae7e488b145fa3618627da99c3234696c0f15
SHA256

0adde4246aaa9fb3964d1d6cf3c29b1b13074015b250eb8e5591339f92e1e3ca
SHA512

f667fe8d23482226241fd7a9cae66327a4bc2317ec01bffddb1243b936a44e0ec7a2a809f75e3e3cb02c3b9415df2401a6b2fe598251079472481114e0ce9b5e
SSDEEP

3072:FnS2A9r4wpzL3syZUmMkZFfAQ2FUAElR8MRC3KevxEwYSidYj6zxe8pxU4iR:ZSFr4EzLvC1kP4Q7XlR8MRCXYZR5c/R

Score

10^/10

ransomware

Malware Config

Extracted

Path

C:\Users\Admin\Documents\Readme.f58A66B51.txt

Ransom Note

!!! DoNex ransomware warning !!! >>>> Your data are stolen and encrypted The data will be published on TOR website if you do not pay the ransom Links for Tor Browser: http://g3h3klsev3eiofxhykmtenmdpi67wzmaixredk5pjuttbx7okcfkftqd.onion >>>> What guarantees that we will not deceive you? We are not a politically motivated group and we do not need anything other than your money. If you pay, we will provide you the programs for decryption and we will delete your data. If we do not give you decrypters, or we do not delete your data after payment, then nobody will pay us in the future. Therefore to us our reputation is very important. We attack the companies worldwide and there is no dissatisfied victim after payment. >>>> You need contact us and decrypt one file for free on these TOR sites with your personal DECRYPTION ID Download and install TOR Browser https://www.torproject.org/ Write to a chat and wait for the answer, we will always answer you. You can install qtox to contanct us online https://tox.chat/download.html Tox ID Contact: 2793D009872AF80ED9B1A461F7B9BD6209744047DC1707A42CB622053716AD4BA624193606C9 Mail (OnionMail) Support: [email protected] >>>> Warning! Do not DELETE or MODIFY any files, it can lead to recovery problems! >>>> Warning! If you do not pay the ransom we will attack your company repeatedly again!

Emails

[email protected]

URLs

http://g3h3klsev3eiofxhykmtenmdpi67wzmaixredk5pjuttbx7okcfkftqd.onion

https://tox.chat/download.html

Signatures

Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1070.004

Inhibit System Recovery
T1490
Renames multiple (131) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\F:	0adde4246aaa9fb3964d1d6cf3c29b1b13074015b250eb8e5591339f92e1e3ca.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2500	1668	WerFault.exe	27

Interacts with shadow copies 2 TTPs 1 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

pid	Process
2732	vssadmin.exe

Kills process with taskkill 64 IoCs

evasion

pid	Process
1028	taskkill.exe
2232	taskkill.exe
2128	taskkill.exe
608	taskkill.exe
2544	taskkill.exe
2296	taskkill.exe
2820	Process not Found
2900	Process not Found
1220	taskkill.exe
2788	taskkill.exe
880	taskkill.exe
108	taskkill.exe
328	taskkill.exe
2580	taskkill.exe
2276	taskkill.exe
2976	taskkill.exe
1652	taskkill.exe
1732	taskkill.exe
1232	taskkill.exe
1600	taskkill.exe
1700	taskkill.exe
1476	Process not Found
2520	taskkill.exe
400	taskkill.exe
1508	taskkill.exe
2088	taskkill.exe
2768	taskkill.exe
1644	taskkill.exe
2752	taskkill.exe
2796	Process not Found
1200	taskkill.exe
1728	taskkill.exe
448	taskkill.exe
3064	taskkill.exe
2560	taskkill.exe
2784	taskkill.exe
1652	taskkill.exe
648	taskkill.exe
2988	taskkill.exe
208	taskkill.exe
1540	Process not Found
2856	taskkill.exe
1460	taskkill.exe
2080	taskkill.exe
1936	taskkill.exe
1264	taskkill.exe
2740	taskkill.exe
2296	taskkill.exe
2056	taskkill.exe
2736	taskkill.exe
2424	taskkill.exe
2796	taskkill.exe
1752	taskkill.exe
2980	Process not Found
1736	taskkill.exe
1684	taskkill.exe
1968	taskkill.exe
380	taskkill.exe
2100	taskkill.exe
2784	taskkill.exe
1972	taskkill.exe
284	taskkill.exe
880	taskkill.exe
3052	taskkill.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\f58A66B51file	0adde4246aaa9fb3964d1d6cf3c29b1b13074015b250eb8e5591339f92e1e3ca.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\f58A66B51file\DefaultIcon\ = "C:\\ProgramData\\icon.ico"	0adde4246aaa9fb3964d1d6cf3c29b1b13074015b250eb8e5591339f92e1e3ca.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.f58A66B51	0adde4246aaa9fb3964d1d6cf3c29b1b13074015b250eb8e5591339f92e1e3ca.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.f58A66B51\ = "f58A66B51file"	0adde4246aaa9fb3964d1d6cf3c29b1b13074015b250eb8e5591339f92e1e3ca.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\f58A66B51file\DefaultIcon	0adde4246aaa9fb3964d1d6cf3c29b1b13074015b250eb8e5591339f92e1e3ca.exe

Runs ping.exe 1 TTPs 64 IoCs

Remote System Discovery

T1018

pid	Process
1760	PING.EXE
1212	Process not Found
2592	PING.EXE
1156	PING.EXE
1020	PING.EXE
1656	PING.EXE
2352	PING.EXE
1628	PING.EXE
1728	PING.EXE
1904	PING.EXE
2840	PING.EXE
1320	PING.EXE
2544	PING.EXE
1920	PING.EXE
488	PING.EXE
284	PING.EXE
1960	PING.EXE
2544	PING.EXE
1500	PING.EXE
1248	PING.EXE
2844	Process not Found
2912	PING.EXE
872	PING.EXE
2272	PING.EXE
2452	PING.EXE
2876	PING.EXE
2892	PING.EXE
1560	PING.EXE
1952	PING.EXE
1548	PING.EXE
1644	PING.EXE
1600	PING.EXE
1552	PING.EXE
232	PING.EXE
3040	PING.EXE
1792	PING.EXE
704	PING.EXE
2596	PING.EXE
2224	PING.EXE
2172	PING.EXE
1688	PING.EXE
2680	PING.EXE
3052	PING.EXE
3000	Process not Found
284	PING.EXE
1884	PING.EXE
2000	PING.EXE
1252	PING.EXE
2792	PING.EXE
2072	Process not Found
788	PING.EXE
268	PING.EXE
2532	PING.EXE
2756	PING.EXE
1436	PING.EXE
2796	PING.EXE
2536	PING.EXE
216	PING.EXE
1760	PING.EXE
1000	Process not Found
1296	Process not Found
1864	PING.EXE
2988	PING.EXE
1148	PING.EXE

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	2580	WMIC.exe
Token: SeSecurityPrivilege	2580	WMIC.exe
Token: SeTakeOwnershipPrivilege	2580	WMIC.exe
Token: SeLoadDriverPrivilege	2580	WMIC.exe
Token: SeSystemProfilePrivilege	2580	WMIC.exe
Token: SeSystemtimePrivilege	2580	WMIC.exe
Token: SeProfSingleProcessPrivilege	2580	WMIC.exe
Token: SeIncBasePriorityPrivilege	2580	WMIC.exe
Token: SeCreatePagefilePrivilege	2580	WMIC.exe
Token: SeBackupPrivilege	2580	WMIC.exe
Token: SeRestorePrivilege	2580	WMIC.exe
Token: SeShutdownPrivilege	2580	WMIC.exe
Token: SeDebugPrivilege	2580	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2580	WMIC.exe
Token: SeRemoteShutdownPrivilege	2580	WMIC.exe
Token: SeUndockPrivilege	2580	WMIC.exe
Token: SeManageVolumePrivilege	2580	WMIC.exe
Token: 33	2580	WMIC.exe
Token: 34	2580	WMIC.exe
Token: 35	2580	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2580	WMIC.exe
Token: SeSecurityPrivilege	2580	WMIC.exe
Token: SeTakeOwnershipPrivilege	2580	WMIC.exe
Token: SeLoadDriverPrivilege	2580	WMIC.exe
Token: SeSystemProfilePrivilege	2580	WMIC.exe
Token: SeSystemtimePrivilege	2580	WMIC.exe
Token: SeProfSingleProcessPrivilege	2580	WMIC.exe
Token: SeIncBasePriorityPrivilege	2580	WMIC.exe
Token: SeCreatePagefilePrivilege	2580	WMIC.exe
Token: SeBackupPrivilege	2580	WMIC.exe
Token: SeRestorePrivilege	2580	WMIC.exe
Token: SeShutdownPrivilege	2580	WMIC.exe
Token: SeDebugPrivilege	2580	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2580	WMIC.exe
Token: SeRemoteShutdownPrivilege	2580	WMIC.exe
Token: SeUndockPrivilege	2580	WMIC.exe
Token: SeManageVolumePrivilege	2580	WMIC.exe
Token: 33	2580	WMIC.exe
Token: 34	2580	WMIC.exe
Token: 35	2580	WMIC.exe
Token: SeBackupPrivilege	2584	vssvc.exe
Token: SeRestorePrivilege	2584	vssvc.exe
Token: SeAuditPrivilege	2584	vssvc.exe
Token: SeDebugPrivilege	2332	taskkill.exe
Token: SeDebugPrivilege	1572	taskkill.exe
Token: SeDebugPrivilege	2520	taskkill.exe
Token: SeDebugPrivilege	1652	taskkill.exe
Token: SeDebugPrivilege	648	taskkill.exe
Token: SeDebugPrivilege	2956	taskkill.exe
Token: SeDebugPrivilege	2488	taskkill.exe
Token: SeDebugPrivilege	2308	taskkill.exe
Token: SeDebugPrivilege	2296	taskkill.exe
Token: SeDebugPrivilege	2112	taskkill.exe
Token: SeDebugPrivilege	2548	taskkill.exe
Token: SeDebugPrivilege	796	taskkill.exe
Token: SeDebugPrivilege	608	taskkill.exe
Token: SeDebugPrivilege	1484	taskkill.exe
Token: SeDebugPrivilege	3032	taskkill.exe
Token: SeDebugPrivilege	2228	taskkill.exe
Token: SeDebugPrivilege	1192	taskkill.exe
Token: SeDebugPrivilege	2364	taskkill.exe
Token: SeDebugPrivilege	852	taskkill.exe
Token: SeDebugPrivilege	1496	taskkill.exe
Token: SeDebugPrivilege	308	taskkill.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1668 wrote to memory of 1964	1668	0adde4246aaa9fb3964d1d6cf3c29b1b13074015b250eb8e5591339f92e1e3ca.exe	28
PID 1668 wrote to memory of 1964	1668	0adde4246aaa9fb3964d1d6cf3c29b1b13074015b250eb8e5591339f92e1e3ca.exe	28
PID 1668 wrote to memory of 1964	1668	0adde4246aaa9fb3964d1d6cf3c29b1b13074015b250eb8e5591339f92e1e3ca.exe	28
PID 1668 wrote to memory of 1964	1668	0adde4246aaa9fb3964d1d6cf3c29b1b13074015b250eb8e5591339f92e1e3ca.exe	28
PID 1668 wrote to memory of 3044	1668	0adde4246aaa9fb3964d1d6cf3c29b1b13074015b250eb8e5591339f92e1e3ca.exe	29
PID 1668 wrote to memory of 3044	1668	0adde4246aaa9fb3964d1d6cf3c29b1b13074015b250eb8e5591339f92e1e3ca.exe	29
PID 1668 wrote to memory of 3044	1668	0adde4246aaa9fb3964d1d6cf3c29b1b13074015b250eb8e5591339f92e1e3ca.exe	29
PID 1668 wrote to memory of 3044	1668	0adde4246aaa9fb3964d1d6cf3c29b1b13074015b250eb8e5591339f92e1e3ca.exe	29
PID 1964 wrote to memory of 2580	1964	cmd.exe	32
PID 1964 wrote to memory of 2580	1964	cmd.exe	32
PID 1964 wrote to memory of 2580	1964	cmd.exe	32
PID 3044 wrote to memory of 2732	3044	cmd.exe	33
PID 3044 wrote to memory of 2732	3044	cmd.exe	33
PID 3044 wrote to memory of 2732	3044	cmd.exe	33
PID 1668 wrote to memory of 1892	1668	0adde4246aaa9fb3964d1d6cf3c29b1b13074015b250eb8e5591339f92e1e3ca.exe	38
PID 1668 wrote to memory of 1892	1668	0adde4246aaa9fb3964d1d6cf3c29b1b13074015b250eb8e5591339f92e1e3ca.exe	38
PID 1668 wrote to memory of 1892	1668	0adde4246aaa9fb3964d1d6cf3c29b1b13074015b250eb8e5591339f92e1e3ca.exe	38
PID 1668 wrote to memory of 1892	1668	0adde4246aaa9fb3964d1d6cf3c29b1b13074015b250eb8e5591339f92e1e3ca.exe	38
PID 1892 wrote to memory of 284	1892	cmd.exe	40
PID 1892 wrote to memory of 284	1892	cmd.exe	40
PID 1892 wrote to memory of 284	1892	cmd.exe	40
PID 1892 wrote to memory of 284	1892	cmd.exe	40
PID 1892 wrote to memory of 2332	1892	cmd.exe	41
PID 1892 wrote to memory of 2332	1892	cmd.exe	41
PID 1892 wrote to memory of 2332	1892	cmd.exe	41
PID 1892 wrote to memory of 2332	1892	cmd.exe	41
PID 1892 wrote to memory of 1572	1892	cmd.exe	42
PID 1892 wrote to memory of 1572	1892	cmd.exe	42
PID 1892 wrote to memory of 1572	1892	cmd.exe	42
PID 1892 wrote to memory of 1572	1892	cmd.exe	42
PID 1892 wrote to memory of 2520	1892	cmd.exe	43
PID 1892 wrote to memory of 2520	1892	cmd.exe	43
PID 1892 wrote to memory of 2520	1892	cmd.exe	43
PID 1892 wrote to memory of 2520	1892	cmd.exe	43
PID 1892 wrote to memory of 1652	1892	cmd.exe	44
PID 1892 wrote to memory of 1652	1892	cmd.exe	44
PID 1892 wrote to memory of 1652	1892	cmd.exe	44
PID 1892 wrote to memory of 1652	1892	cmd.exe	44
PID 1892 wrote to memory of 648	1892	cmd.exe	45
PID 1892 wrote to memory of 648	1892	cmd.exe	45
PID 1892 wrote to memory of 648	1892	cmd.exe	45
PID 1892 wrote to memory of 648	1892	cmd.exe	45
PID 1892 wrote to memory of 2956	1892	cmd.exe	46
PID 1892 wrote to memory of 2956	1892	cmd.exe	46
PID 1892 wrote to memory of 2956	1892	cmd.exe	46
PID 1892 wrote to memory of 2956	1892	cmd.exe	46
PID 1892 wrote to memory of 2488	1892	cmd.exe	47
PID 1892 wrote to memory of 2488	1892	cmd.exe	47
PID 1892 wrote to memory of 2488	1892	cmd.exe	47
PID 1892 wrote to memory of 2488	1892	cmd.exe	47
PID 1892 wrote to memory of 2308	1892	cmd.exe	48
PID 1892 wrote to memory of 2308	1892	cmd.exe	48
PID 1892 wrote to memory of 2308	1892	cmd.exe	48
PID 1892 wrote to memory of 2308	1892	cmd.exe	48
PID 1892 wrote to memory of 2296	1892	cmd.exe	49
PID 1892 wrote to memory of 2296	1892	cmd.exe	49
PID 1892 wrote to memory of 2296	1892	cmd.exe	49
PID 1892 wrote to memory of 2296	1892	cmd.exe	49
PID 1892 wrote to memory of 2112	1892	cmd.exe	50
PID 1892 wrote to memory of 2112	1892	cmd.exe	50
PID 1892 wrote to memory of 2112	1892	cmd.exe	50
PID 1892 wrote to memory of 2112	1892	cmd.exe	50
PID 1892 wrote to memory of 2548	1892	cmd.exe	51
PID 1892 wrote to memory of 2548	1892	cmd.exe	51

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\0adde4246aaa9fb3964d1d6cf3c29b1b13074015b250eb8e5591339f92e1e3ca.exe
"C:\Users\Admin\AppData\Local\Temp\0adde4246aaa9fb3964d1d6cf3c29b1b13074015b250eb8e5591339f92e1e3ca.exe"
1⤵
- Enumerates connected drives
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1668
- C:\Windows\system32\cmd.exe
  cmd /c "wmic shadowcopy delete /nointeractive"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1964
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic shadowcopy delete /nointeractive
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2580
- C:\Windows\system32\cmd.exe
  cmd /c "vssadmin Delete Shadows /All /Quiet"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3044
- - C:\Windows\system32\vssadmin.exe
    vssadmin Delete Shadows /All /Quiet
    3⤵
    - Interacts with shadow copies
    PID:2732
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\ProgramData\1.bat
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1892
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 2
    3⤵
    - Runs ping.exe
    PID:284
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im sql*
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2332
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im oracle*
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1572
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im mysq*
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2520
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im chrome*
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1652
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im veeam*
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:648
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im firefox*
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2956
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im excel*
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2488
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im msaccess*
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2308
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im onenote*
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2296
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im outlook*
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2112
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im powerpnt*
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2548
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im winword*
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:796
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im wuauclt*
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:608
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 2
    3⤵
    - Runs ping.exe
    PID:2912
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im sql*
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1484
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im oracle*
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3032
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im mysq*
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2228
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im chrome*
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1192
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im veeam*
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2364
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im firefox*
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:852
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im excel*
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1496
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im msaccess*
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:308
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im onenote*
    3⤵
    PID:1760
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im outlook*
    3⤵
    PID:1220
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im powerpnt*
    3⤵
    - Kills process with taskkill
    PID:2056
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im winword*
    3⤵
    PID:1700
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im wuauclt*
    3⤵
    PID:112
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 2
    3⤵
    PID:1196
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im sql*
    3⤵
    PID:1448
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im oracle*
    3⤵
    PID:2192
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im mysq*
    3⤵
    PID:2544
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im chrome*
    3⤵
    PID:2052
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im veeam*
    3⤵
    PID:2604
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im firefox*
    3⤵
    - Kills process with taskkill
    PID:2580
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im excel*
    3⤵
    PID:2540
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im msaccess*
    3⤵
    PID:2708
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im onenote*
    3⤵
    PID:2808
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im outlook*
    3⤵
    PID:1628
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im powerpnt*
    3⤵
    PID:212
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im winword*
    3⤵
    PID:2064
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im wuauclt*
    3⤵
    PID:2732
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 2
    3⤵
    PID:824
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im sql*
    3⤵
    PID:1684
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im oracle*
    3⤵
    PID:1572
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im mysq*
    3⤵
    PID:2520
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im chrome*
    3⤵
    PID:1652
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im veeam*
    3⤵
    PID:648
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im firefox*
    3⤵
    PID:2956
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im excel*
    3⤵
    PID:2304
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im msaccess*
    3⤵
    PID:1856
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im onenote*
    3⤵
    PID:2280
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im outlook*
    3⤵
    PID:336
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im powerpnt*
    3⤵
    PID:1424
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im winword*
    3⤵
    PID:1592
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im wuauclt*
    3⤵
    PID:1328
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 2
    3⤵
    - Runs ping.exe
    PID:1864
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im sql*
    3⤵
    PID:3032
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im oracle*
    3⤵
    PID:1940
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im mysq*
    3⤵
    PID:352
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im chrome*
    3⤵
    PID:1232
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im veeam*
    3⤵
    PID:1312
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im firefox*
    3⤵
    PID:3056
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im excel*
    3⤵
    PID:332
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im msaccess*
    3⤵
    PID:856
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im onenote*
    3⤵
    PID:2160
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im outlook*
    3⤵
    PID:1264
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im powerpnt*
    3⤵
    PID:2100
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im winword*
    3⤵
    PID:996
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im wuauclt*
    3⤵
    PID:2248
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 2
    3⤵
    - Runs ping.exe
    PID:1960
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im sql*
    3⤵
    PID:908
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im oracle*
    3⤵
    PID:900
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im mysq*
    3⤵
    PID:1676
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im chrome*
    3⤵
    PID:1544
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im veeam*
    3⤵
    PID:2768
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im firefox*
    3⤵
    PID:2468
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im excel*
    3⤵
    PID:1896
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im msaccess*
    3⤵
    PID:2712
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im onenote*
    3⤵
    PID:2804
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im outlook*
    3⤵
    PID:2820
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im powerpnt*
    3⤵
    PID:2368
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im winword*
    3⤵
    PID:216
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im wuauclt*
    3⤵
    PID:2600
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 2
    3⤵
    - Runs ping.exe
    PID:2592
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im sql*
    3⤵
    PID:2856
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im oracle*
    3⤵
    PID:2412
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im mysq*
    3⤵
    PID:1148
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im chrome*
    3⤵
    PID:1284
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im veeam*
    3⤵
    PID:1212
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im firefox*
    3⤵
    PID:2488
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im excel*
    3⤵
    - Kills process with taskkill
    PID:1936
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im msaccess*
    3⤵
    PID:2432
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im onenote*
    3⤵
    PID:1852
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im outlook*
    3⤵
    PID:612
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im powerpnt*
    3⤵
    PID:1416
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im winword*
    3⤵
    PID:1432
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im wuauclt*
    3⤵
    PID:1452
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 2
    3⤵
    - Runs ping.exe
    PID:1156
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im sql*
    3⤵
    PID:1120
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im oracle*
    3⤵
    PID:2892
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im mysq*
    3⤵
    PID:848
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im chrome*
    3⤵
    PID:1320
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im veeam*
    3⤵
    PID:1304
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im firefox*
    3⤵
    PID:2644
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im excel*
    3⤵
    PID:1648
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im msaccess*
    3⤵
    PID:916
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im onenote*
    3⤵
    PID:2208
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im outlook*
    3⤵
    PID:1456
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im powerpnt*
    3⤵
    PID:2324
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im winword*
    3⤵
    PID:2340
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im wuauclt*
    3⤵
    PID:384
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 2
    3⤵
    - Runs ping.exe
    PID:2352
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im sql*
    3⤵
    PID:1616
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im oracle*
    3⤵
    PID:1988
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im mysq*
    3⤵
    PID:1448
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im chrome*
    3⤵
    PID:2192
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im veeam*
    3⤵
    - Kills process with taskkill
    PID:2544
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im firefox*
    3⤵
    PID:1548
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im excel*
    3⤵
    PID:2736
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im msaccess*
    3⤵
    PID:2000
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im onenote*
    3⤵
    PID:2540
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im outlook*
    3⤵
    PID:2700
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im powerpnt*
    3⤵
    PID:2812
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im winword*
    3⤵
    PID:1628
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im wuauclt*
    3⤵
    PID:2740
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 2
    3⤵
    - Runs ping.exe
    PID:1884
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im sql*
    3⤵
    PID:1444
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im oracle*
    3⤵
    PID:1248
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im mysq*
    3⤵
    PID:1576
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im chrome*
    3⤵
    - Kills process with taskkill
    PID:1460
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im veeam*
    3⤵
    PID:1296
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im firefox*
    3⤵
    PID:1280
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im excel*
    3⤵
    - Kills process with taskkill
    PID:1200
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im msaccess*
    3⤵
    PID:2028
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im onenote*
    3⤵
    PID:2836
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im outlook*
    3⤵
    PID:2288
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im powerpnt*
    3⤵
    PID:692
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im winword*
    3⤵
    PID:1424
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im wuauclt*
    3⤵
    PID:820
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 2
    3⤵
    - Runs ping.exe
    PID:1792
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im sql*
    3⤵
    PID:1588
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im oracle*
    3⤵
    PID:2416
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im mysq*
    3⤵
    PID:2356
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im chrome*
    3⤵
    PID:1720
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im veeam*
    3⤵
    PID:1000
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im firefox*
    3⤵
    PID:1764
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im excel*
    3⤵
    - Kills process with taskkill
    PID:1028
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im msaccess*
    3⤵
    PID:1220
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im onenote*
    3⤵
    PID:2232
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im outlook*
    3⤵
    PID:2784
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im powerpnt*
    3⤵
    - Kills process with taskkill
    PID:1264
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im winword*
    3⤵
    PID:2100
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im wuauclt*
    3⤵
    PID:1692
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 2
    3⤵
    PID:2248
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im sql*
    3⤵
    PID:2748
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im oracle*
    3⤵
    PID:1032
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im mysq*
    3⤵
    PID:2680
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im chrome*
    3⤵
    PID:628
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im veeam*
    3⤵
    PID:1364
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im firefox*
    3⤵
    PID:1496
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im excel*
    3⤵
    PID:220
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im msaccess*
    3⤵
    PID:2596
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im onenote*
    3⤵
    PID:2524
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im outlook*
    3⤵
    PID:2492
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im powerpnt*
    3⤵
    PID:1988
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im winword*
    3⤵
    PID:1448
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im wuauclt*
    3⤵
    PID:2192
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 2
    3⤵
    - Runs ping.exe
    PID:2544
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im sql*
    3⤵
    PID:2668
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im oracle*
    3⤵
    PID:2660
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im mysq*
    3⤵
    PID:2816
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im chrome*
    3⤵
    PID:1528
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im veeam*
    3⤵
    PID:228
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im firefox*
    3⤵
    PID:2608
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im excel*
    3⤵
    PID:2992
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im msaccess*
    3⤵
    PID:2444
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im onenote*
    3⤵
    PID:2808
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im outlook*
    3⤵
    PID:292
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im powerpnt*
    3⤵
    PID:2424
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im winword*
    3⤵
    PID:1600
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im wuauclt*
    3⤵
    PID:1472
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 2
    3⤵
    - Runs ping.exe
    PID:2988
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im sql*
    3⤵
    PID:2400
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im oracle*
    3⤵
    PID:2956
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im mysq*
    3⤵
    PID:2008
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im chrome*
    3⤵
    PID:2244
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im veeam*
    3⤵
    PID:2256
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im firefox*
    3⤵
    PID:604
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im excel*
    3⤵
    PID:788
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im msaccess*
    3⤵
    PID:608
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im onenote*
    3⤵
    PID:1644
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im outlook*
    3⤵
    PID:1864
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im powerpnt*
    3⤵
    PID:3032
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im winword*
    3⤵
    PID:1940
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im wuauclt*
    3⤵
    PID:352
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 2
    3⤵
    - Runs ping.exe
    PID:1500
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im sql*
    3⤵
    PID:1764
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im oracle*
    3⤵
    PID:1028
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im mysq*
    3⤵
    PID:1220
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im chrome*
    3⤵
    PID:2232
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im veeam*
    3⤵
    PID:2784
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im firefox*
    3⤵
    PID:1264
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im excel*
    3⤵
    PID:2100
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im msaccess*
    3⤵
    PID:1692
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im onenote*
    3⤵
    PID:3008
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im outlook*
    3⤵
    PID:2744
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im powerpnt*
    3⤵
    PID:2328
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im winword*
    3⤵
    PID:2672
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im wuauclt*
    3⤵
    PID:2088
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 2
    3⤵
    PID:2128
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im sql*
    3⤵
    PID:1496
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im oracle*
    3⤵
    PID:220
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im mysq*
    3⤵
    PID:2596
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im chrome*
    3⤵
    PID:2108
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im veeam*
    3⤵
    PID:1672
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im firefox*
    3⤵
    PID:1944
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im excel*
    3⤵
    PID:2764
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im msaccess*
    3⤵
    - Kills process with taskkill
    PID:2788
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im onenote*
    3⤵
    PID:2544
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im outlook*
    3⤵
    PID:2668
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im powerpnt*
    3⤵
    PID:2540
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im winword*
    3⤵
    PID:236
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im wuauclt*
    3⤵
    PID:1528
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 2
    3⤵
    PID:228
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im sql*
    3⤵
    PID:2536
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im oracle*
    3⤵
    PID:2600
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im mysq*
    3⤵
    PID:2592
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im chrome*
    3⤵
    - Kills process with taskkill
    PID:2856
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im veeam*
    3⤵
    PID:292
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im firefox*
    3⤵
    PID:2424
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im excel*
    3⤵
    PID:1600
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im msaccess*
    3⤵
    PID:1472
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im onenote*
    3⤵
    - Kills process with taskkill
    PID:1652
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im outlook*
    3⤵
    PID:1280
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im powerpnt*
    3⤵
    PID:1200
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im winword*
    3⤵
    PID:2028
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im wuauclt*
    3⤵
    PID:336
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 2
    3⤵
    PID:1756
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im sql*
    3⤵
    PID:692
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im oracle*
    3⤵
    PID:1424
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im mysq*
    3⤵
    PID:820
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im chrome*
    3⤵
    PID:1328
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im veeam*
    3⤵
    PID:1588
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im firefox*
    3⤵
    PID:2416
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im excel*
    3⤵
    PID:2356
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im msaccess*
    3⤵
    PID:1720
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im onenote*
    3⤵
    PID:1304
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im outlook*
    3⤵
    PID:972
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im powerpnt*
    3⤵
    PID:2136
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im winword*
    3⤵
    PID:1952
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im wuauclt*
    3⤵
    PID:1700
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 2
    3⤵
    PID:112
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im sql*
    3⤵
    PID:1264
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im oracle*
    3⤵
    - Kills process with taskkill
    PID:2100
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im mysq*
    3⤵
    PID:1692
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im chrome*
    3⤵
    PID:3008
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im veeam*
    3⤵
    PID:2744
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im firefox*
    3⤵
    PID:2328
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im excel*
    3⤵
    PID:2672
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im msaccess*
    3⤵
    PID:2088
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im onenote*
    3⤵
    PID:1364
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im outlook*
    3⤵
    PID:2188
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im powerpnt*
    3⤵
    PID:1868
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im winword*
    3⤵
    PID:1196
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im wuauclt*
    3⤵
    PID:908
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 2
    3⤵
    - Runs ping.exe
    PID:1552
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im sql*
    3⤵
    PID:2872
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im oracle*
    3⤵
    PID:1520
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im mysq*
    3⤵
    PID:2768
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im chrome*
    3⤵
    PID:2736
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im veeam*
    3⤵
    PID:2000
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im firefox*
    3⤵
    PID:2792
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im excel*
    3⤵
    PID:2804
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im msaccess*
    3⤵
    PID:1904
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im onenote*
    3⤵
    PID:1752
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im outlook*
    3⤵
    PID:2760
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im powerpnt*
    3⤵
    PID:1516
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im winword*
    3⤵
    PID:1684
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im wuauclt*
    3⤵
    PID:1380
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 2
    3⤵
    - Runs ping.exe
    PID:1436
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im sql*
    3⤵
    PID:1148
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im oracle*
    3⤵
    PID:1284
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im mysq*
    3⤵
    PID:1472
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im chrome*
    3⤵
    PID:1652
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im veeam*
    3⤵
    PID:1280
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im firefox*
    3⤵
    PID:1200
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im excel*
    3⤵
    PID:2028
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im msaccess*
    3⤵
    PID:336
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im onenote*
    3⤵
    PID:2288
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im outlook*
    3⤵
    PID:604
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im powerpnt*
    3⤵
    PID:1424
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im winword*
    3⤵
    PID:820
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im wuauclt*
    3⤵
    PID:1328
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 2
    3⤵
    PID:1588
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im sql*
    3⤵
    PID:2416
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im oracle*
    3⤵
    PID:2356
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im mysq*
    3⤵
    PID:1720
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im chrome*
    3⤵
    PID:1304
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im veeam*
    3⤵
    PID:972
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im firefox*
    3⤵
    PID:2136
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im excel*
    3⤵
    PID:1952
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im msaccess*
    3⤵
    PID:1700
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im onenote*
    3⤵
    - Kills process with taskkill
    PID:2784
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im outlook*
    3⤵
    PID:996
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im powerpnt*
    3⤵
    PID:384
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im winword*
    3⤵
    PID:2752
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im wuauclt*
    3⤵
    PID:400
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 2
    3⤵
    PID:2744
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im sql*
    3⤵
    PID:2328
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im oracle*
    3⤵
    PID:2672
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im mysq*
    3⤵
    - Kills process with taskkill
    PID:2088
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im chrome*
    3⤵
    PID:1364
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im veeam*
    3⤵
    PID:380
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im firefox*
    3⤵
    PID:1984
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im excel*
    3⤵
    PID:900
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im msaccess*
    3⤵
    PID:2324
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im onenote*
    3⤵
    PID:1552
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im outlook*
    3⤵
    PID:2872
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im powerpnt*
    3⤵
    PID:1520
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im winword*
    3⤵
    PID:2768
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im wuauclt*
    3⤵
    PID:2736
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 2
    3⤵
    - Runs ping.exe
    PID:2000
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im sql*
    3⤵
    PID:2540
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im oracle*
    3⤵
    PID:236
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im mysq*
    3⤵
    PID:1528
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im chrome*
    3⤵
    PID:2636
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im veeam*
    3⤵
    - Kills process with taskkill
    PID:2740
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im firefox*
    3⤵
    PID:824
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im excel*
    3⤵
    PID:2732
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im msaccess*
    3⤵
    PID:2856
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im onenote*
    3⤵
    PID:1704
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im outlook*
    3⤵
    PID:2984
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im powerpnt*
    3⤵
    PID:1296
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im winword*
    3⤵
    PID:2868
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im wuauclt*
    3⤵
    PID:1072
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 2
    3⤵
    - Runs ping.exe
    PID:1020
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im sql*
    3⤵
    PID:712
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im oracle*
    3⤵
    PID:788
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im mysq*
    3⤵
    PID:604
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im chrome*
    3⤵
    PID:1424
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im veeam*
    3⤵
    PID:1864
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im firefox*
    3⤵
    PID:1212
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im excel*
    3⤵
    PID:1588
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im msaccess*
    3⤵
    PID:2416
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im onenote*
    3⤵
    PID:2356
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im outlook*
    3⤵
    PID:1720
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im powerpnt*
    3⤵
    PID:1304
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im winword*
    3⤵
    PID:972
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im wuauclt*
    3⤵
    PID:2136
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 2
    3⤵
    - Runs ping.exe
    PID:1952
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im sql*
    3⤵
    - Kills process with taskkill
    PID:1700
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im oracle*
    3⤵
    - Kills process with taskkill
    PID:2784
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im mysq*
    3⤵
    PID:996
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im chrome*
    3⤵
    PID:384
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im veeam*
    3⤵
    PID:2752
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im firefox*
    3⤵
    PID:400
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im excel*
    3⤵
    PID:2680
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im msaccess*
    3⤵
    PID:628
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im onenote*
    3⤵
    PID:2620
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im outlook*
    3⤵
    PID:1876
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im powerpnt*
    3⤵
    PID:1688
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im winword*
    3⤵
    PID:2148
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im wuauclt*
    3⤵
    PID:1616
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 2
    3⤵
    - Runs ping.exe
    PID:1656
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im sql*
    3⤵
    PID:2324
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im oracle*
    3⤵
    PID:1552
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im mysq*
    3⤵
    PID:2872
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im chrome*
    3⤵
    PID:1520
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im veeam*
    3⤵
    PID:2668
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im firefox*
    3⤵
    PID:1912
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im excel*
    3⤵
    PID:224
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im msaccess*
    3⤵
    PID:2368
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im onenote*
    3⤵
    PID:212
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im outlook*
    3⤵
    PID:2444
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im powerpnt*
    3⤵
    PID:2560
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im winword*
    3⤵
    PID:284
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im wuauclt*
    3⤵
    PID:2412
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 2
    3⤵
    - Runs ping.exe
    PID:2796
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im sql*
    3⤵
    PID:1460
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im oracle*
    3⤵
    PID:2276
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im mysq*
    3⤵
    PID:2488
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im chrome*
    3⤵
    PID:2432
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im veeam*
    3⤵
    PID:612
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im firefox*
    3⤵
    PID:1052
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im excel*
    3⤵
    PID:2288
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im msaccess*
    3⤵
    PID:692
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im onenote*
    3⤵
    PID:1744
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im outlook*
    3⤵
    PID:1860
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im powerpnt*
    3⤵
    PID:1328
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im winword*
    3⤵
    PID:1592
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im wuauclt*
    3⤵
    PID:1320
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 2
    3⤵
    - Runs ping.exe
    PID:1760
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im sql*
    3⤵
    PID:3048
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im oracle*
    3⤵
    PID:332
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im mysq*
    3⤵
    PID:928
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im chrome*
    3⤵
    PID:2160
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im veeam*
    3⤵
    PID:1152
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im firefox*
    3⤵
    PID:2388
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im excel*
    3⤵
    PID:588
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im msaccess*
    3⤵
    PID:1996
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im onenote*
    3⤵
    PID:2100
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im outlook*
    3⤵
    PID:2748
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im powerpnt*
    3⤵
    PID:1236
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im winword*
    3⤵
    PID:2344
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im wuauclt*
    3⤵
    PID:3004
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 2
    3⤵
    - Runs ping.exe
    PID:2172
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im sql*
    3⤵
    PID:2944
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im oracle*
    3⤵
    PID:1668
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im mysq*
    3⤵
    - Kills process with taskkill
    PID:1736
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im chrome*
    3⤵
    PID:1808
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im veeam*
    3⤵
    PID:1988
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im firefox*
    3⤵
    PID:2460
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im excel*
    3⤵
    - Kills process with taskkill
    PID:1728
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im msaccess*
    3⤵
    PID:1316
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im onenote*
    3⤵
    PID:2468
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im outlook*
    3⤵
    - Kills process with taskkill
    PID:2768
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im powerpnt*
    3⤵
    PID:2712
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im winword*
    3⤵
    PID:2700
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im wuauclt*
    3⤵
    PID:2540
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 2
    3⤵
    - Runs ping.exe
    PID:232
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im sql*
    3⤵
    PID:1904
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im oracle*
    3⤵
    PID:1752
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im mysq*
    3⤵
    PID:2808
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im chrome*
    3⤵
    PID:1516
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im veeam*
    3⤵
    PID:1248
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im firefox*
    3⤵
    PID:2856
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im excel*
    3⤵
    PID:1704
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im msaccess*
    3⤵
    PID:2052
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im onenote*
    3⤵
    - Kills process with taskkill
    PID:1600
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im outlook*
    3⤵
    PID:2300
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im powerpnt*
    3⤵
    PID:268
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im winword*
    3⤵
    PID:656
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im wuauclt*
    3⤵
    PID:540
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 2
    3⤵
    - Runs ping.exe
    PID:788
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im sql*
    3⤵
    PID:608
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im oracle*
    3⤵
    - Kills process with taskkill
    PID:1644
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im mysq*
    3⤵
    PID:3024
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im chrome*
    3⤵
    PID:848
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im veeam*
    3⤵
    PID:1804
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im firefox*
    3⤵
    PID:352
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im excel*
    3⤵
    PID:1000
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im msaccess*
    3⤵
    PID:1732
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im onenote*
    3⤵
    PID:2532
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im outlook*
    3⤵
    PID:328
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im powerpnt*
    3⤵
    PID:568
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im winword*
    3⤵
    PID:2092
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im wuauclt*
    3⤵
    PID:1608
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 2
    3⤵
    - Runs ping.exe
    PID:704
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im sql*
    3⤵
    PID:2464
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im oracle*
    3⤵
    - Kills process with taskkill
    PID:1972
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im mysq*
    3⤵
    PID:2044
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im chrome*
    3⤵
    PID:2336
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im veeam*
    3⤵
    PID:2420
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im firefox*
    3⤵
    PID:2264
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im excel*
    3⤵
    PID:2672
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im msaccess*
    3⤵
    PID:1004
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im onenote*
    3⤵
    PID:1960
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im outlook*
    3⤵
    - Kills process with taskkill
    PID:380
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im powerpnt*
    3⤵
    PID:2404
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im winword*
    3⤵
    PID:1540
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im wuauclt*
    3⤵
    PID:1944
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 2
    3⤵
    - Runs ping.exe
    PID:1548
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im sql*
    3⤵
    PID:2604
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im oracle*
    3⤵
    PID:2716
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im mysq*
    3⤵
    - Kills process with taskkill
    PID:2736
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im chrome*
    3⤵
    PID:1676
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im veeam*
    3⤵
    PID:204
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im firefox*
    3⤵
    PID:1628
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im excel*
    3⤵
    PID:228
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im msaccess*
    3⤵
    PID:2448
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im onenote*
    3⤵
    PID:2332
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im outlook*
    3⤵
    - Kills process with taskkill
    PID:1508
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im powerpnt*
    3⤵
    PID:1376
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im winword*
    3⤵
    PID:2864
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im wuauclt*
    3⤵
    - Kills process with taskkill
    PID:648
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 2
    3⤵
    - Runs ping.exe
    PID:1148
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im sql*
    3⤵
    PID:1284
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im oracle*
    3⤵
    PID:2040
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im mysq*
    3⤵
    PID:268
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im chrome*
    3⤵
    PID:656
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im veeam*
    3⤵
    PID:540
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im firefox*
    3⤵
    PID:2228
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im excel*
    3⤵
    PID:1156
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im msaccess*
    3⤵
    PID:1928
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im onenote*
    3⤵
    PID:1636
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im outlook*
    3⤵
    - Kills process with taskkill
    PID:448
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im powerpnt*
    3⤵
    PID:1320
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im winword*
    3⤵
    PID:1312
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im wuauclt*
    3⤵
    PID:2644
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 2
    3⤵
    - Runs ping.exe
    PID:1252
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im sql*
    3⤵
    PID:1784
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im oracle*
    3⤵
    PID:2900
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im mysq*
    3⤵
    - Kills process with taskkill
    PID:2232
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im chrome*
    3⤵
    PID:2388
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im veeam*
    3⤵
    PID:2828
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im firefox*
    3⤵
    PID:996
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im excel*
    3⤵
    PID:3008
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im msaccess*
    3⤵
    - Kills process with taskkill
    PID:2752
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im onenote*
    3⤵
    PID:2996
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im outlook*
    3⤵
    PID:896
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im powerpnt*
    3⤵
    PID:856
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im winword*
    3⤵
    PID:2012
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im wuauclt*
    3⤵
    PID:1876
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 2
    3⤵
    - Runs ping.exe
    PID:1688
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im sql*
    3⤵
    PID:1956
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im oracle*
    3⤵
    PID:1696
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im mysq*
    3⤵
    PID:2480
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im chrome*
    3⤵
    PID:2252
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im veeam*
    3⤵
    PID:2400
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im firefox*
    3⤵
    PID:1548
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im excel*
    3⤵
    PID:2604
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im msaccess*
    3⤵
    PID:2716
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im onenote*
    3⤵
    PID:2736
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im outlook*
    3⤵
    PID:2700
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im powerpnt*
    3⤵
    PID:2540
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im winword*
    3⤵
    PID:2608
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im wuauclt*
    3⤵
    PID:2992
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 2
    3⤵
    - Runs ping.exe
    PID:2536
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im sql*
    3⤵
    PID:2332
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im oracle*
    3⤵
    PID:1508
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im mysq*
    3⤵
    PID:1376
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im chrome*
    3⤵
    PID:2864
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im veeam*
    3⤵
    PID:648
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im firefox*
    3⤵
    - Kills process with taskkill
    PID:2424
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im excel*
    3⤵
    PID:1600
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im msaccess*
    3⤵
    PID:1020
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im onenote*
    3⤵
    PID:336
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im outlook*
    3⤵
    PID:2940
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im powerpnt*
    3⤵
    PID:2636
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im winword*
    3⤵
    PID:788
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im wuauclt*
    3⤵
    PID:608
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 2
    3⤵
    - Runs ping.exe
    PID:1644
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im sql*
    3⤵
    PID:3024
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im oracle*
    3⤵
    PID:448
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im mysq*
    3⤵
    PID:1320
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im chrome*
    3⤵
    PID:1312
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im veeam*
    3⤵
    PID:2644
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im firefox*
    3⤵
    PID:944
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im excel*
    3⤵
    PID:992
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im msaccess*
    3⤵
    - Kills process with taskkill
    PID:1732
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im onenote*
    3⤵
    PID:2532
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im outlook*
    3⤵
    PID:328
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im powerpnt*
    3⤵
    PID:1700
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im winword*
    3⤵
    PID:2092
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im wuauclt*
    3⤵
    PID:2136
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 2
    3⤵
    - Runs ping.exe
    PID:872
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im sql*
    3⤵
    PID:2320
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im oracle*
    3⤵
    PID:208
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im mysq*
    3⤵
    PID:2744
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im chrome*
    3⤵
    PID:1712
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im veeam*
    3⤵
    PID:2620
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im firefox*
    3⤵
    PID:2524
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im excel*
    3⤵
    PID:1364
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im msaccess*
    3⤵
    PID:1620
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im onenote*
    3⤵
    PID:1004
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im outlook*
    3⤵
    PID:1960
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im powerpnt*
    3⤵
    PID:1988
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im winword*
    3⤵
    PID:900
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im wuauclt*
    3⤵
    PID:1944
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 2
    3⤵
    - Runs ping.exe
    PID:2840
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im sql*
    3⤵
    PID:1316
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im oracle*
    3⤵
    PID:1520
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im mysq*
    3⤵
    PID:2668
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im chrome*
    3⤵
    PID:1912
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im veeam*
    3⤵
    PID:236
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im firefox*
    3⤵
    PID:2640
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im excel*
    3⤵
    PID:212
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im msaccess*
    3⤵
    PID:3044
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im onenote*
    3⤵
    PID:824
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im outlook*
    3⤵
    PID:1884
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im powerpnt*
    3⤵
    PID:2860
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im winword*
    3⤵
    PID:2520
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im wuauclt*
    3⤵
    PID:292
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 2
    3⤵
    PID:1436
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im sql*
    3⤵
    PID:2052
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im oracle*
    3⤵
    PID:2432
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im mysq*
    3⤵
    PID:612
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im chrome*
    3⤵
    PID:320
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im veeam*
    3⤵
    PID:1756
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im firefox*
    3⤵
    PID:1192
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im excel*
    3⤵
    PID:3036
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im msaccess*
    3⤵
    PID:1596
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im onenote*
    3⤵
    PID:976
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im outlook*
    3⤵
    PID:1588
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im powerpnt*
    3⤵
    PID:2396
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im winword*
    3⤵
    PID:2272
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im wuauclt*
    3⤵
    PID:2080
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 2
    3⤵
    - Runs ping.exe
    PID:1320
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im sql*
    3⤵
    PID:1312
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im oracle*
    3⤵
    PID:2644
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im mysq*
    3⤵
    PID:944
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im chrome*
    3⤵
    PID:2624
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im veeam*
    3⤵
    PID:112
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im firefox*
    3⤵
    PID:2436
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im excel*
    3⤵
    PID:1888
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im msaccess*
    3⤵
    PID:1608
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im onenote*
    3⤵
    PID:1124
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im outlook*
    3⤵
    PID:1212
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im powerpnt*
    3⤵
    PID:3008
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im winword*
    3⤵
    PID:488
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im wuauclt*
    3⤵
    PID:2996
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 2
    3⤵
    - Runs ping.exe
    PID:2680
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im sql*
    3⤵
    PID:856
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im oracle*
    3⤵
    PID:1668
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im mysq*
    3⤵
    PID:1876
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im chrome*
    3⤵
    PID:1736
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im veeam*
    3⤵
    PID:1616
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im firefox*
    3⤵
    PID:1656
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im excel*
    3⤵
    PID:2460
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im msaccess*
    3⤵
    PID:1696
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im onenote*
    3⤵
    PID:2896
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im outlook*
    3⤵
    PID:2684
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im powerpnt*
    3⤵
    PID:2768
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im winword*
    3⤵
    PID:2792
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im wuauclt*
    3⤵
    PID:224
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 2
    3⤵
    PID:312
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im sql*
    3⤵
    PID:1676
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im oracle*
    3⤵
    PID:204
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im mysq*
    3⤵
    PID:1628
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im chrome*
    3⤵
    PID:2992
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im veeam*
    3⤵
    PID:1684
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im firefox*
    3⤵
    PID:1492
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im excel*
    3⤵
    PID:1336
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im msaccess*
    3⤵
    PID:2984
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im onenote*
    3⤵
    PID:2960
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im outlook*
    3⤵
    PID:2808
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im powerpnt*
    3⤵
    PID:2112
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im winword*
    3⤵
    PID:2244
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im wuauclt*
    3⤵
    PID:1052
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 2
    3⤵
    - Runs ping.exe
    PID:268
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im sql*
    3⤵
    PID:656
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im oracle*
    3⤵
    PID:1792
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im mysq*
    3⤵
    PID:788
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im chrome*
    3⤵
    PID:852
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im veeam*
    3⤵
    PID:1928
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im firefox*
    3⤵
    PID:2416
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im excel*
    3⤵
    PID:2356
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im msaccess*
    3⤵
    PID:2056
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im onenote*
    3⤵
    PID:332
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im outlook*
    3⤵
    PID:2240
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im powerpnt*
    3⤵
    PID:2348
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im winword*
    3⤵
    PID:2452
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im wuauclt*
    3⤵
    - Kills process with taskkill
    PID:1220
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 2
    3⤵
    - Runs ping.exe
    PID:2532
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im sql*
    3⤵
    PID:288
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im oracle*
    3⤵
    PID:2232
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im mysq*
    3⤵
    PID:1228
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im chrome*
    3⤵
    PID:2828
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im veeam*
    3⤵
    PID:704
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im firefox*
    3⤵
    PID:400
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im excel*
    3⤵
    PID:1632
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im msaccess*
    3⤵
    PID:1032
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im onenote*
    3⤵
    PID:896
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im outlook*
    3⤵
    PID:2876
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im powerpnt*
    3⤵
    PID:2088
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im winword*
    3⤵
    PID:2492
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im wuauclt*
    3⤵
    PID:1428
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 2
    3⤵
    - Runs ping.exe
    PID:2596
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im sql*
    3⤵
    PID:1984
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im oracle*
    3⤵
    PID:2404
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im mysq*
    3⤵
    PID:2480
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im chrome*
    3⤵
    PID:2252
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im veeam*
    3⤵
    PID:2840
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im firefox*
    3⤵
    PID:2000
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im excel*
    3⤵
    PID:2712
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im msaccess*
    3⤵
    PID:3028
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im onenote*
    3⤵
    PID:2368
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im outlook*
    3⤵
    PID:2696
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im powerpnt*
    3⤵
    PID:312
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im winword*
    3⤵
    PID:1676
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im wuauclt*
    3⤵
    PID:204
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 2
    3⤵
    - Runs ping.exe
    PID:1628
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im sql*
    3⤵
    PID:2992
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im oracle*
    3⤵
    PID:2600
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im mysq*
    3⤵
    PID:1516
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im chrome*
    3⤵
    PID:1576
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im veeam*
    3⤵
    PID:1460
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im firefox*
    3⤵
    PID:1704
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im excel*
    3⤵
    PID:2488
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im msaccess*
    3⤵
    PID:1936
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im onenote*
    3⤵
    PID:2244
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im outlook*
    3⤵
    PID:1052
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im powerpnt*
    3⤵
    PID:1432
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im winword*
    3⤵
    PID:1484
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im wuauclt*
    3⤵
    PID:1424
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 2
    3⤵
    PID:820
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im sql*
    3⤵
    PID:852
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im oracle*
    3⤵
    PID:1928
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im mysq*
    3⤵
    PID:2416
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im chrome*
    3⤵
    PID:2356
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im veeam*
    3⤵
    PID:2056
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im firefox*
    3⤵
    PID:332
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im excel*
    3⤵
    PID:2240
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im msaccess*
    3⤵
    PID:2348
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im onenote*
    3⤵
    PID:2496
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im outlook*
    3⤵
    PID:1764
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im powerpnt*
    3⤵
    PID:1784
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im winword*
    3⤵
    PID:2972
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im wuauclt*
    3⤵
    PID:2784
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 2
    3⤵
    - Runs ping.exe
    PID:2756
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im sql*
    3⤵
    PID:928
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im oracle*
    3⤵
    PID:996
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im mysq*
    3⤵
    PID:2100
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im chrome*
    3⤵
    PID:2752
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im veeam*
    3⤵
    PID:2996
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im firefox*
    3⤵
    PID:2680
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im excel*
    3⤵
    PID:2420
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im msaccess*
    3⤵
    PID:2264
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im onenote*
    3⤵
    PID:1740
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im outlook*
    3⤵
    PID:1196
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im powerpnt*
    3⤵
    PID:1688
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im winword*
    3⤵
    PID:1988
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im wuauclt*
    3⤵
    PID:2016
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 2
    3⤵
    - Runs ping.exe
    PID:1728
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im sql*
    3⤵
    PID:380
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im oracle*
    3⤵
    PID:2312
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im mysq*
    3⤵
    PID:2400
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im chrome*
    3⤵
    PID:1896
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im veeam*
    3⤵
    PID:2720
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im firefox*
    3⤵
    PID:1564
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im excel*
    3⤵
    PID:2676
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im msaccess*
    3⤵
    PID:2640
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im onenote*
    3⤵
    PID:1752
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im outlook*
    3⤵
    PID:3044
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im powerpnt*
    3⤵
    PID:2448
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im winword*
    3⤵
    - Kills process with taskkill
    PID:3064
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im wuauclt*
    3⤵
    PID:2592
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 2
    3⤵
    - Runs ping.exe
    PID:1248
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im sql*
    3⤵
    - Kills process with taskkill
    PID:2276
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im oracle*
    3⤵
    - Kills process with taskkill
    PID:2988
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im mysq*
    3⤵
    PID:1472
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im chrome*
    3⤵
    PID:2808
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im veeam*
    3⤵
    PID:2912
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im firefox*
    3⤵
    PID:336
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im excel*
    3⤵
    PID:1380
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im msaccess*
    3⤵
    PID:2636
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im onenote*
    3⤵
    PID:3036
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im outlook*
    3⤵
    PID:2908
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im powerpnt*
    3⤵
    PID:976
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im winword*
    3⤵
    PID:1588
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im wuauclt*
    3⤵
    PID:2396
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 2
    3⤵
    - Runs ping.exe
    PID:2272
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im sql*
    3⤵
    PID:692
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im oracle*
    3⤵
    PID:3048
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im mysq*
    3⤵
    PID:1312
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im chrome*
    3⤵
    PID:2728
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im veeam*
    3⤵
    PID:2068
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im firefox*
    3⤵
    PID:924
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im excel*
    3⤵
    PID:2920
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im msaccess*
    3⤵
    PID:2436
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im onenote*
    3⤵
    PID:2092
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im outlook*
    3⤵
    PID:2136
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im powerpnt*
    3⤵
    PID:1692
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im winword*
    3⤵
    PID:2320
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im wuauclt*
    3⤵
    - Kills process with taskkill
    PID:208
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 2
    3⤵
    - Runs ping.exe
    PID:488
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im sql*
    3⤵
    PID:1532
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im oracle*
    3⤵
    PID:2620
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im mysq*
    3⤵
    PID:2188
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im chrome*
    3⤵
    - Kills process with taskkill
    PID:2128
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im veeam*
    3⤵
    PID:2012
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im firefox*
    3⤵
    PID:2672
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im excel*
    3⤵
    PID:1196
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im msaccess*
    3⤵
    PID:1688
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im onenote*
    3⤵
    PID:1988
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im outlook*
    3⤵
    PID:2016
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im powerpnt*
    3⤵
    PID:2468
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im winword*
    3⤵
    PID:1548
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im wuauclt*
    3⤵
    PID:1520
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 2
    3⤵
    - Runs ping.exe
    PID:2544
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im sql*
    3⤵
    PID:2220
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im oracle*
    3⤵
    PID:2800
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im mysq*
    3⤵
    PID:236
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im chrome*
    3⤵
    PID:2580
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im veeam*
    3⤵
    PID:216
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im firefox*
    3⤵
    PID:2444
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im excel*
    3⤵
    - Kills process with taskkill
    PID:2560
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im msaccess*
    3⤵
    PID:284
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im onenote*
    3⤵
    - Kills process with taskkill
    PID:2796
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im outlook*
    3⤵
    PID:1376
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im powerpnt*
    3⤵
    PID:2308
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im winword*
    3⤵
    PID:1296
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im wuauclt*
    3⤵
    PID:2052
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 2
    3⤵
    - Runs ping.exe
    PID:1600
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im sql*
    3⤵
    PID:1420
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im oracle*
    3⤵
    PID:2256
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im mysq*
    3⤵
    PID:1744
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im chrome*
    3⤵
    PID:1452
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im veeam*
    3⤵
    PID:1920
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im firefox*
    3⤵
    PID:1596
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im excel*
    3⤵
    PID:1328
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im msaccess*
    3⤵
    PID:788
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im onenote*
    3⤵
    PID:1940
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im outlook*
    3⤵
    PID:308
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im powerpnt*
    3⤵
    - Kills process with taskkill
    PID:2080
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im winword*
    3⤵
    PID:2304
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im wuauclt*
    3⤵
    PID:1556
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 2
    3⤵
    PID:2120
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im sql*
    3⤵
    PID:944
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im oracle*
    3⤵
    PID:1120
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im mysq*
    3⤵
    PID:2900
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im chrome*
    3⤵
    PID:2208
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im veeam*
    3⤵
    PID:1888
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im firefox*
    3⤵
    PID:836
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im excel*
    3⤵
    PID:872
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im msaccess*
    3⤵
    PID:1212
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im onenote*
    3⤵
    PID:3008
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im outlook*
    3⤵
    PID:3000
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im powerpnt*
    3⤵
    PID:1632
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im winword*
    3⤵
    PID:1032
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im wuauclt*
    3⤵
    PID:896
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 2
    3⤵
    - Runs ping.exe
    PID:2876
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im sql*
    3⤵
    PID:1620
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im oracle*
    3⤵
    PID:1004
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im mysq*
    3⤵
    PID:1960
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im chrome*
    3⤵
    PID:2852
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im veeam*
    3⤵
    PID:1984
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im firefox*
    3⤵
    PID:1544
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im excel*
    3⤵
    PID:2248
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im msaccess*
    3⤵
    PID:1652
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im onenote*
    3⤵
    PID:2872
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im outlook*
    3⤵
    PID:2072
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im powerpnt*
    3⤵
    PID:2816
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im winword*
    3⤵
    PID:2708
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im wuauclt*
    3⤵
    PID:2812
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 2
    3⤵
    - Runs ping.exe
    PID:1904
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im sql*
    3⤵
    PID:2696
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im oracle*
    3⤵
    PID:212
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im mysq*
    3⤵
    PID:1808
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im chrome*
    3⤵
    PID:2764
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im veeam*
    3⤵
    PID:2732
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im firefox*
    3⤵
    PID:1572
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im excel*
    3⤵
    - Kills process with taskkill
    PID:1684
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im msaccess*
    3⤵
    - Kills process with taskkill
    PID:880
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im onenote*
    3⤵
    PID:1336
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im outlook*
    3⤵
    PID:2984
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im powerpnt*
    3⤵
    PID:1416
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im winword*
    3⤵
    PID:1284
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im wuauclt*
    3⤵
    PID:1020
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 2
    3⤵
    - Runs ping.exe
    PID:2224
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im sql*
    3⤵
    - Kills process with taskkill
    PID:2296
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im oracle*
    3⤵
    PID:1432
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im mysq*
    3⤵
    PID:656
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im chrome*
    3⤵
    PID:1424
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im veeam*
    3⤵
    PID:820
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im firefox*
    3⤵
    PID:1636
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im excel*
    3⤵
    PID:448
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im msaccess*
    3⤵
    PID:2416
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im onenote*
    3⤵
    PID:2356
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im outlook*
    3⤵
    PID:576
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im powerpnt*
    3⤵
    PID:1664
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im winword*
    3⤵
    PID:992
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im wuauclt*
    3⤵
    PID:2940
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 2
    3⤵
    - Runs ping.exe
    PID:2452
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im sql*
    3⤵
    PID:1764
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im oracle*
    3⤵
    PID:1784
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im mysq*
    3⤵
    PID:2972
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im chrome*
    3⤵
    PID:588
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im veeam*
    3⤵
    PID:2756
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im firefox*
    3⤵
    PID:1972
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im excel*
    3⤵
    PID:2748
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im msaccess*
    3⤵
    - Kills process with taskkill
    PID:108
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im onenote*
    3⤵
    PID:2172
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im outlook*
    3⤵
    PID:2996
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im powerpnt*
    3⤵
    PID:2680
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im winword*
    3⤵
    PID:1876
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im wuauclt*
    3⤵
    PID:1496
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 2
    3⤵
    PID:1616
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im sql*
    3⤵
    PID:2596
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im oracle*
    3⤵
    PID:900
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im mysq*
    3⤵
    PID:2404
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im chrome*
    3⤵
    PID:2660
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im veeam*
    3⤵
    PID:2976
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im firefox*
    3⤵
    PID:2788
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im excel*
    3⤵
    PID:2768
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im msaccess*
    3⤵
    PID:2736
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im onenote*
    3⤵
    PID:224
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im outlook*
    3⤵
    PID:2720
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im powerpnt*
    3⤵
    PID:936
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im winword*
    3⤵
    PID:1564
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im wuauclt*
    3⤵
    PID:2580
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 2
    3⤵
    - Runs ping.exe
    PID:216
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im sql*
    3⤵
    PID:1808
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im oracle*
    3⤵
    PID:2764
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im mysq*
    3⤵
    PID:2732
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im chrome*
    3⤵
    PID:1572
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im veeam*
    3⤵
    PID:1684
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im firefox*
    3⤵
    PID:1216
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im excel*
    3⤵
    PID:1436
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im msaccess*
    3⤵
    PID:1472
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im onenote*
    3⤵
    PID:1704
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im outlook*
    3⤵
    PID:2288
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im powerpnt*
    3⤵
    PID:2040
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im winword*
    3⤵
    PID:1380
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im wuauclt*
    3⤵
    PID:1192
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 2
    3⤵
    - Runs ping.exe
    PID:1920
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im sql*
    3⤵
    PID:2908
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im oracle*
    3⤵
    - Kills process with taskkill
    PID:1232
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im mysq*
    3⤵
    PID:1804
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im chrome*
    3⤵
    PID:2364
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im veeam*
    3⤵
    PID:1000
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im firefox*
    3⤵
    PID:708
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im excel*
    3⤵
    PID:2644
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im msaccess*
    3⤵
    - Kills process with taskkill
    PID:608
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im onenote*
    3⤵
    PID:2120
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im outlook*
    3⤵
    PID:944
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im powerpnt*
    3⤵
    PID:1120
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im winword*
    3⤵
    PID:2900
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im wuauclt*
    3⤵
    PID:1608
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 2
    3⤵
    - Runs ping.exe
    PID:2892
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im sql*
    3⤵
    PID:2828
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im oracle*
    3⤵
    PID:704
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im mysq*
    3⤵
    PID:1732
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im chrome*
    3⤵
    PID:3008
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im veeam*
    3⤵
    PID:3000
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im firefox*
    3⤵
    PID:1632
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im excel*
    3⤵
    PID:856
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im msaccess*
    3⤵
    PID:2344
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im onenote*
    3⤵
    PID:2128
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im outlook*
    3⤵
    PID:2012
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im powerpnt*
    3⤵
    PID:2672
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im winword*
    3⤵
    PID:1656
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im wuauclt*
    3⤵
    PID:2460
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 2
    3⤵
    - Runs ping.exe
    PID:3040
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im sql*
    3⤵
    PID:2956
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im oracle*
    3⤵
    PID:1728
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im mysq*
    3⤵
    PID:2252
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im chrome*
    3⤵
    PID:2840
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im veeam*
    3⤵
    PID:2400
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im firefox*
    3⤵
    PID:2648
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im excel*
    3⤵
    PID:2628
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im msaccess*
    3⤵
    PID:940
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im onenote*
    3⤵
    PID:2820
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im outlook*
    3⤵
    PID:272
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im powerpnt*
    3⤵
    PID:1640
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im winword*
    3⤵
    PID:2740
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im wuauclt*
    3⤵
    - Kills process with taskkill
    PID:1968
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 2
    3⤵
    - Runs ping.exe
    PID:284
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im sql*
    3⤵
    PID:2792
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im oracle*
    3⤵
    PID:648
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im mysq*
    3⤵
    PID:1476
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im chrome*
    3⤵
    PID:1492
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im veeam*
    3⤵
    PID:2988
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im firefox*
    3⤵
    PID:2808
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im excel*
    3⤵
    PID:2912
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im msaccess*
    3⤵
    PID:712
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im onenote*
    3⤵
    PID:1020
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im outlook*
    3⤵
    PID:268
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im powerpnt*
    3⤵
    - Kills process with taskkill
    PID:2296
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im winword*
    3⤵
    PID:1932
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im wuauclt*
    3⤵
    PID:3024
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 2
    3⤵
    - Runs ping.exe
    PID:3052
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im sql*
    3⤵
    PID:1760
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im oracle*
    3⤵
    PID:352
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im mysq*
    3⤵
    PID:308
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im chrome*
    3⤵
    PID:2080
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im veeam*
    3⤵
    PID:2304
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im firefox*
    3⤵
    PID:1556
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im excel*
    3⤵
    PID:332
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im msaccess*
    3⤵
    PID:2240
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im onenote*
    3⤵
    PID:2348
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im outlook*
    3⤵
    - Kills process with taskkill
    PID:328
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im powerpnt*
    3⤵
    PID:2436
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im winword*
    3⤵
    PID:1228
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im wuauclt*
    3⤵
    PID:1692
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 2
    3⤵
    - Runs ping.exe
    PID:1560
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im sql*
    3⤵
    PID:1212
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im oracle*
    3⤵
    PID:928
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im mysq*
    3⤵
    - Kills process with taskkill
    PID:400
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im chrome*
    3⤵
    PID:2100
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im veeam*
    3⤵
    PID:2172
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im firefox*
    3⤵
    PID:2656
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im excel*
    3⤵
    PID:2264
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im msaccess*
    3⤵
    PID:628
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im onenote*
    3⤵
    PID:2744
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im outlook*
    3⤵
    PID:1540
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im powerpnt*
    3⤵
    PID:1552
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im winword*
    3⤵
    PID:2024
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im wuauclt*
    3⤵
    PID:1544
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 2
    3⤵
    PID:2604
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im sql*
    3⤵
    - Kills process with taskkill
    PID:2976
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im oracle*
    3⤵
    PID:2000
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im mysq*
    3⤵
    PID:2716
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im chrome*
    3⤵
    PID:1896
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im veeam*
    3⤵
    PID:2800
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im firefox*
    3⤵
    PID:2700
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im excel*
    3⤵
    PID:2964
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im msaccess*
    3⤵
    PID:220
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im onenote*
    3⤵
    - Kills process with taskkill
    PID:1752
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im outlook*
    3⤵
    PID:204
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im powerpnt*
    3⤵
    PID:1884
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im winword*
    3⤵
    PID:2568
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im wuauclt*
    3⤵
    - Kills process with taskkill
    PID:284
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 2
    3⤵
    - Runs ping.exe
    PID:2792
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im sql*
    3⤵
    PID:1248
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im oracle*
    3⤵
    PID:2028
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im mysq*
    3⤵
    - Kills process with taskkill
    PID:880
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im chrome*
    3⤵
    PID:1576
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im veeam*
    3⤵
    PID:2052
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im firefox*
    3⤵
    PID:1600
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im excel*
    3⤵
    PID:2300
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im msaccess*
    3⤵
    PID:1936
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im onenote*
    3⤵
    PID:1744
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im outlook*
    3⤵
    PID:412
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im powerpnt*
    3⤵
    PID:1932
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im winword*
    3⤵
    PID:3024
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im wuauclt*
    3⤵
    - Kills process with taskkill
    PID:3052
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 2
    3⤵
    - Runs ping.exe
    PID:1760
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im sql*
    3⤵
    PID:2380
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im oracle*
    3⤵
    PID:916
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im mysq*
    3⤵
    PID:2728
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im chrome*
    3⤵
    PID:2160
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im veeam*
    3⤵
    PID:1264
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im firefox*
    3⤵
    PID:2920
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im excel*
    3⤵
    PID:2452
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1668 -s 920
  2⤵
  - Program crash
  PID:2500

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2584

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Discovery