wannacry | 268b9b8e07f7c0f7b895de751634cae25e5189aa33ec4da924b243adda41186c

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000\Control Panel\International\Geo\Nation	cmd.exe

Drops startup file 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\~SD26AC.tmp	WannaCry.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\~SD26B3.tmp	WannaCry.exe

Executes dropped EXE 22 IoCs

pid	Process
7008	taskdl.exe
4420	@[email protected]
1752	@[email protected]
6468	taskhsvc.exe
2848	taskdl.exe
6704	taskse.exe
5588	@[email protected]
6416	taskdl.exe
6388	taskse.exe
5124	@[email protected]
360	taskse.exe
4468	@[email protected]
1844	taskdl.exe
1372	taskse.exe
1696	@[email protected]
5180	taskdl.exe
396	taskse.exe
7116	@[email protected]
6516	taskdl.exe
2820	taskse.exe
5176	@[email protected]
4760	taskdl.exe

Loads dropped DLL 8 IoCs

pid	Process
6468	taskhsvc.exe
6468	taskhsvc.exe
6468	taskhsvc.exe
6468	taskhsvc.exe
6468	taskhsvc.exe
6468	taskhsvc.exe
6468	taskhsvc.exe
6468	taskhsvc.exe

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
3008	icacls.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\svgirwyi764 = "\"C:\\Users\\Admin\\Desktop\\tasksche.exe\""	reg.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs

Web Service

T1102

flow	ioc
321	raw.githubusercontent.com
262	camo.githubusercontent.com
268	camo.githubusercontent.com
320	raw.githubusercontent.com

Sets desktop wallpaper using registry 2 TTPs 2 IoCs

ransomware

Defacement

T1491

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Desktop\\@[email protected]"	WannaCry.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Desktop\\@[email protected]"	@[email protected]

Drops file in Windows directory 6 IoCs

description	ioc	Process
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdgeCP.exe
File opened for modification	C:\Windows\Debug\ESE.TXT	MicrosoftEdge.exe
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdge.exe
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdgeCP.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 5 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe

Enumerates processes with tasklist 1 TTPs 1 IoCs

Process Discovery

T1057

pid	Process
6420	tasklist.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Interacts with shadow copies 2 TTPs 1 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

pid	Process
4184	vssadmin.exe

Kills process with taskkill 64 IoCs

evasion

pid	Process
6860	taskkill.exe
6220	taskkill.exe
5388	Process not Found
4932	Process not Found
5176	taskkill.exe
6236	Process not Found
4968	Process not Found
6620	Process not Found
6244	Process not Found
4608	Process not Found
2436	Process not Found
6104	Process not Found
6396	Process not Found
2820	taskkill.exe
5664	taskkill.exe
4332	taskkill.exe
6628	Process not Found
6452	Process not Found
2520	Process not Found
5716	Process not Found
648	Process not Found
6372	Process not Found
2208	taskkill.exe
4932	taskkill.exe
884	taskkill.exe
3508	Process not Found
1824	Process not Found
5644	taskkill.exe
32	taskkill.exe
6804	taskkill.exe
6060	Process not Found
6384	Process not Found
5680	taskkill.exe
5828	Process not Found
5220	Process not Found
3896	Process not Found
3844	Process not Found
5316	Process not Found
5952	taskkill.exe
4924	taskkill.exe
4684	Process not Found
4356	Process not Found
4544	Process not Found
4712	taskkill.exe
2040	taskkill.exe
3304	taskkill.exe
3236	Process not Found
1116	Process not Found
2040	Process not Found
6788	taskkill.exe
7016	taskkill.exe
6504	Process not Found
6340	taskkill.exe
3344	taskkill.exe
4588	Process not Found
436	Process not Found
4440	taskkill.exe
6528	Process not Found
6772	Process not Found
5552	Process not Found
376	Process not Found
2260	Process not Found
4664	Process not Found
6348	Process not Found

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000\Software\Microsoft\Internet Explorer\Main	browser_broker.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdgeCP.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133590543385718037"	chrome.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\History\CachePrefix = "Visited:"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\ufile.io\NumberOfSubdomains = "0"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\ufile.io\ = "72"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\Content\CacheLimit = "256000"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\Meta\generator$MediaWiki	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DOMStorage\www.msn.com	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	NOTEPAD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\Total\ = "173"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\ufile.io	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\NodeSlot = "3"	NOTEPAD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage\ufile.io\NumberOfSubdomai = "0"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\ufile.io\NumberOfSubdomains = "1"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DomainSuggestion	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DomainSuggestion\NextUpdateDate = "421412766"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\Meta	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\ACGPolicyState = "8"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\LowMic	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modif = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-DeviceId = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Explorer\Main	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Explorer\Main\OperationalData = "1"	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History\CachePrefix = "Visited:"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionLow = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\CIStatus	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\ufile.io	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DomainSuggestion\FileNames\	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\NextUpdateDate = "421361543"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate\NextUpdateDate = "421428717"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BingPageData	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Privacy\InProgressFlags = "0"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = a6f3b3bce39bda01	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Rating\NextPromptBuild = "15063"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\CA\CTLs	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\ACGStatus\DynamicCodePolicy = 05000000	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VersionLow = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DataStore	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\Meta\generator$WordPress	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\EdpDomStorage\msn.com	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingDelete	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VersionHigh = "0"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = feb363a9e39bda01	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DomStorageState\EdpCleanupState = "0"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\Content	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\Main	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings	NOTEPAD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery\Active = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\Total	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DataStore\LastCleanup = 0000000000000000	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionLow = "395205405"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\Meta\generator$http://www.typepad.com/	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\google.com\NumberOfSubdomain = "1"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	NOTEPAD.EXE
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\IETld\LowMic	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DomStorageState	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\google.com	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DOMStorage	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\google.com\Total = "103"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	NOTEPAD.EXE

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

pid	Process
5096	reg.exe

Opens file in notepad (likely ransom note) 2 IoCs

ransomware

pid	Process
6828	NOTEPAD.EXE
5760	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
6712	chrome.exe
6712	chrome.exe
6340	chrome.exe
6340	chrome.exe
6468	taskhsvc.exe
6468	taskhsvc.exe
6468	taskhsvc.exe
6468	taskhsvc.exe
6468	taskhsvc.exe
6468	taskhsvc.exe

Suspicious behavior: MapViewOfSection 10 IoCs

pid	Process
2392	MicrosoftEdgeCP.exe
2392	MicrosoftEdgeCP.exe
2392	MicrosoftEdgeCP.exe
2392	MicrosoftEdgeCP.exe
2392	MicrosoftEdgeCP.exe
2392	MicrosoftEdgeCP.exe
2392	MicrosoftEdgeCP.exe
2392	MicrosoftEdgeCP.exe
2392	MicrosoftEdgeCP.exe
2392	MicrosoftEdgeCP.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
6712	chrome.exe
6712	chrome.exe
6712	chrome.exe
6712	chrome.exe
6712	chrome.exe
6712	chrome.exe
6712	chrome.exe
6712	chrome.exe
6712	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2276	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	2276	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	2276	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	2276	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	596	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	596	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	1116	MicrosoftEdge.exe
Token: SeDebugPrivilege	1116	MicrosoftEdge.exe
Token: SeDebugPrivilege	6088	firefox.exe
Token: SeDebugPrivilege	6088	firefox.exe
Token: SeShutdownPrivilege	6712	chrome.exe
Token: SeCreatePagefilePrivilege	6712	chrome.exe
Token: SeShutdownPrivilege	6712	chrome.exe
Token: SeCreatePagefilePrivilege	6712	chrome.exe
Token: SeShutdownPrivilege	6712	chrome.exe
Token: SeCreatePagefilePrivilege	6712	chrome.exe
Token: SeShutdownPrivilege	6712	chrome.exe
Token: SeCreatePagefilePrivilege	6712	chrome.exe
Token: SeShutdownPrivilege	6712	chrome.exe
Token: SeCreatePagefilePrivilege	6712	chrome.exe
Token: SeShutdownPrivilege	6712	chrome.exe
Token: SeCreatePagefilePrivilege	6712	chrome.exe
Token: SeShutdownPrivilege	6712	chrome.exe
Token: SeCreatePagefilePrivilege	6712	chrome.exe
Token: SeShutdownPrivilege	6712	chrome.exe
Token: SeCreatePagefilePrivilege	6712	chrome.exe
Token: SeShutdownPrivilege	6712	chrome.exe
Token: SeCreatePagefilePrivilege	6712	chrome.exe
Token: SeShutdownPrivilege	6712	chrome.exe
Token: SeCreatePagefilePrivilege	6712	chrome.exe
Token: SeShutdownPrivilege	6712	chrome.exe
Token: SeCreatePagefilePrivilege	6712	chrome.exe
Token: SeShutdownPrivilege	6712	chrome.exe
Token: SeCreatePagefilePrivilege	6712	chrome.exe
Token: SeShutdownPrivilege	6712	chrome.exe
Token: SeCreatePagefilePrivilege	6712	chrome.exe
Token: SeShutdownPrivilege	6712	chrome.exe
Token: SeCreatePagefilePrivilege	6712	chrome.exe
Token: SeShutdownPrivilege	6712	chrome.exe
Token: SeCreatePagefilePrivilege	6712	chrome.exe
Token: SeShutdownPrivilege	6712	chrome.exe
Token: SeCreatePagefilePrivilege	6712	chrome.exe
Token: SeShutdownPrivilege	6712	chrome.exe
Token: SeCreatePagefilePrivilege	6712	chrome.exe
Token: SeShutdownPrivilege	6712	chrome.exe
Token: SeCreatePagefilePrivilege	6712	chrome.exe
Token: SeShutdownPrivilege	6712	chrome.exe
Token: SeCreatePagefilePrivilege	6712	chrome.exe
Token: SeShutdownPrivilege	6712	chrome.exe
Token: SeCreatePagefilePrivilege	6712	chrome.exe
Token: SeShutdownPrivilege	6712	chrome.exe
Token: SeCreatePagefilePrivilege	6712	chrome.exe
Token: SeShutdownPrivilege	6712	chrome.exe
Token: SeCreatePagefilePrivilege	6712	chrome.exe
Token: SeShutdownPrivilege	6712	chrome.exe
Token: SeCreatePagefilePrivilege	6712	chrome.exe
Token: SeShutdownPrivilege	6712	chrome.exe
Token: SeCreatePagefilePrivilege	6712	chrome.exe
Token: SeShutdownPrivilege	6712	chrome.exe
Token: SeCreatePagefilePrivilege	6712	chrome.exe
Token: SeShutdownPrivilege	6712	chrome.exe
Token: SeCreatePagefilePrivilege	6712	chrome.exe
Token: SeShutdownPrivilege	6712	chrome.exe
Token: SeCreatePagefilePrivilege	6712	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
6088	firefox.exe
6088	firefox.exe
6088	firefox.exe
6088	firefox.exe
6712	chrome.exe
6712	chrome.exe
6712	chrome.exe
6712	chrome.exe
6712	chrome.exe
6712	chrome.exe
6712	chrome.exe
6712	chrome.exe
6712	chrome.exe
6712	chrome.exe
6712	chrome.exe
6712	chrome.exe
6712	chrome.exe
6712	chrome.exe
6712	chrome.exe
6712	chrome.exe
6712	chrome.exe
6712	chrome.exe
6712	chrome.exe
6712	chrome.exe
6712	chrome.exe
6712	chrome.exe
6712	chrome.exe
6712	chrome.exe
6712	chrome.exe
6712	chrome.exe
6712	chrome.exe
6712	chrome.exe
6712	chrome.exe
6712	chrome.exe
6712	chrome.exe
6712	chrome.exe
6712	chrome.exe
6712	chrome.exe
6712	chrome.exe
6712	chrome.exe
6712	chrome.exe
6712	chrome.exe
6712	chrome.exe
6712	chrome.exe
6712	chrome.exe
6712	chrome.exe
6712	chrome.exe
6712	chrome.exe
6712	chrome.exe
6712	chrome.exe
6712	chrome.exe
6712	chrome.exe
6712	chrome.exe
6712	chrome.exe
6712	chrome.exe
6712	chrome.exe
6712	chrome.exe
6712	chrome.exe
6712	chrome.exe
6712	chrome.exe
6712	chrome.exe
6712	chrome.exe
6712	chrome.exe
6712	chrome.exe

Suspicious use of SendNotifyMessage 51 IoCs

pid	Process
6088	firefox.exe
6088	firefox.exe
6088	firefox.exe
6712	chrome.exe
6712	chrome.exe
6712	chrome.exe
6712	chrome.exe
6712	chrome.exe
6712	chrome.exe
6712	chrome.exe
6712	chrome.exe
6712	chrome.exe
6712	chrome.exe
6712	chrome.exe
6712	chrome.exe
6712	chrome.exe
6712	chrome.exe
6712	chrome.exe
6712	chrome.exe
6712	chrome.exe
6712	chrome.exe
6712	chrome.exe
6712	chrome.exe
6712	chrome.exe
6712	chrome.exe
6712	chrome.exe
6712	chrome.exe
6712	chrome.exe
6712	chrome.exe
6712	chrome.exe
6712	chrome.exe
6712	chrome.exe
6712	chrome.exe
6712	chrome.exe
6712	chrome.exe
6712	chrome.exe
6712	chrome.exe
6712	chrome.exe
6712	chrome.exe
6712	chrome.exe
6712	chrome.exe
6712	chrome.exe
6712	chrome.exe
6712	chrome.exe
6712	chrome.exe
6712	chrome.exe
6712	chrome.exe
6712	chrome.exe
6712	chrome.exe
6712	chrome.exe
6712	chrome.exe

Suspicious use of SetWindowsHookEx 19 IoCs

pid	Process
1116	MicrosoftEdge.exe
2392	MicrosoftEdgeCP.exe
2276	MicrosoftEdgeCP.exe
2392	MicrosoftEdgeCP.exe
4708	MicrosoftEdgeCP.exe
6088	firefox.exe
5332	NOTEPAD.EXE
4420	@[email protected]
4420	@[email protected]
1752	@[email protected]
1752	@[email protected]
5588	@[email protected]
5588	@[email protected]
5124	@[email protected]
4468	@[email protected]
1696	@[email protected]
7116	@[email protected]
5176	@[email protected]
5176	@[email protected]

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2392 wrote to memory of 2028	2392	MicrosoftEdgeCP.exe	79
PID 2392 wrote to memory of 2028	2392	MicrosoftEdgeCP.exe	79
PID 2392 wrote to memory of 2028	2392	MicrosoftEdgeCP.exe	79
PID 2392 wrote to memory of 2028	2392	MicrosoftEdgeCP.exe	79
PID 2392 wrote to memory of 2028	2392	MicrosoftEdgeCP.exe	79
PID 2392 wrote to memory of 2028	2392	MicrosoftEdgeCP.exe	79
PID 2392 wrote to memory of 2028	2392	MicrosoftEdgeCP.exe	79
PID 2392 wrote to memory of 2028	2392	MicrosoftEdgeCP.exe	79
PID 2392 wrote to memory of 2028	2392	MicrosoftEdgeCP.exe	79
PID 2392 wrote to memory of 2028	2392	MicrosoftEdgeCP.exe	79
PID 2392 wrote to memory of 2028	2392	MicrosoftEdgeCP.exe	79
PID 2392 wrote to memory of 2028	2392	MicrosoftEdgeCP.exe	79
PID 2392 wrote to memory of 2028	2392	MicrosoftEdgeCP.exe	79
PID 2392 wrote to memory of 2028	2392	MicrosoftEdgeCP.exe	79
PID 2392 wrote to memory of 2028	2392	MicrosoftEdgeCP.exe	79
PID 2392 wrote to memory of 2028	2392	MicrosoftEdgeCP.exe	79
PID 2392 wrote to memory of 2028	2392	MicrosoftEdgeCP.exe	79
PID 2392 wrote to memory of 2028	2392	MicrosoftEdgeCP.exe	79
PID 2392 wrote to memory of 2028	2392	MicrosoftEdgeCP.exe	79
PID 2392 wrote to memory of 2028	2392	MicrosoftEdgeCP.exe	79
PID 2392 wrote to memory of 2028	2392	MicrosoftEdgeCP.exe	79
PID 2392 wrote to memory of 2028	2392	MicrosoftEdgeCP.exe	79
PID 2392 wrote to memory of 2028	2392	MicrosoftEdgeCP.exe	79
PID 2392 wrote to memory of 2028	2392	MicrosoftEdgeCP.exe	79
PID 2392 wrote to memory of 2028	2392	MicrosoftEdgeCP.exe	79
PID 2392 wrote to memory of 2160	2392	MicrosoftEdgeCP.exe	84
PID 2392 wrote to memory of 2160	2392	MicrosoftEdgeCP.exe	84
PID 2392 wrote to memory of 2160	2392	MicrosoftEdgeCP.exe	84
PID 2392 wrote to memory of 2160	2392	MicrosoftEdgeCP.exe	84
PID 2392 wrote to memory of 2160	2392	MicrosoftEdgeCP.exe	84
PID 2392 wrote to memory of 2160	2392	MicrosoftEdgeCP.exe	84
PID 2392 wrote to memory of 2160	2392	MicrosoftEdgeCP.exe	84
PID 2392 wrote to memory of 2160	2392	MicrosoftEdgeCP.exe	84
PID 2392 wrote to memory of 2160	2392	MicrosoftEdgeCP.exe	84
PID 2392 wrote to memory of 2160	2392	MicrosoftEdgeCP.exe	84
PID 2392 wrote to memory of 2160	2392	MicrosoftEdgeCP.exe	84
PID 2392 wrote to memory of 2160	2392	MicrosoftEdgeCP.exe	84
PID 2392 wrote to memory of 2160	2392	MicrosoftEdgeCP.exe	84
PID 2392 wrote to memory of 2160	2392	MicrosoftEdgeCP.exe	84
PID 2392 wrote to memory of 2160	2392	MicrosoftEdgeCP.exe	84
PID 2392 wrote to memory of 2160	2392	MicrosoftEdgeCP.exe	84
PID 2392 wrote to memory of 2160	2392	MicrosoftEdgeCP.exe	84
PID 2392 wrote to memory of 2160	2392	MicrosoftEdgeCP.exe	84
PID 2392 wrote to memory of 2160	2392	MicrosoftEdgeCP.exe	84
PID 2392 wrote to memory of 2160	2392	MicrosoftEdgeCP.exe	84
PID 2392 wrote to memory of 2160	2392	MicrosoftEdgeCP.exe	84
PID 2392 wrote to memory of 2160	2392	MicrosoftEdgeCP.exe	84
PID 2392 wrote to memory of 2160	2392	MicrosoftEdgeCP.exe	84
PID 2392 wrote to memory of 2160	2392	MicrosoftEdgeCP.exe	84
PID 2392 wrote to memory of 2160	2392	MicrosoftEdgeCP.exe	84
PID 2392 wrote to memory of 2160	2392	MicrosoftEdgeCP.exe	84
PID 2392 wrote to memory of 2160	2392	MicrosoftEdgeCP.exe	84
PID 2392 wrote to memory of 2160	2392	MicrosoftEdgeCP.exe	84
PID 7124 wrote to memory of 6088	7124	firefox.exe	89
PID 7124 wrote to memory of 6088	7124	firefox.exe	89
PID 7124 wrote to memory of 6088	7124	firefox.exe	89
PID 7124 wrote to memory of 6088	7124	firefox.exe	89
PID 7124 wrote to memory of 6088	7124	firefox.exe	89
PID 7124 wrote to memory of 6088	7124	firefox.exe	89
PID 7124 wrote to memory of 6088	7124	firefox.exe	89
PID 7124 wrote to memory of 6088	7124	firefox.exe	89
PID 7124 wrote to memory of 6088	7124	firefox.exe	89
PID 7124 wrote to memory of 6088	7124	firefox.exe	89
PID 7124 wrote to memory of 6088	7124	firefox.exe	89

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

Views/modifies file attributes 1 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
5236	attrib.exe
6792	attrib.exe

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\1.bat"
1⤵
- Checks computer location settings
PID:4924

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1116

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
- Modifies Internet Explorer settings
PID:5000

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2392

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2276

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:2028

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:596

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:3432

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
PID:4696

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:2160

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4708

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:7124
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:6088
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="6088.0.1601436207\1786469866" -parentBuildID 20221007134813 -prefsHandle 1740 -prefMapHandle 1720 -prefsLen 20747 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {84e15771-3802-4df8-ad62-c277385c9b4f} 6088 "\\.\pipe\gecko-crash-server-pipe.6088" 1832 24e7c3d6e58 gpu
    3⤵
    PID:796
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="6088.1.1196160394\1797182719" -parentBuildID 20221007134813 -prefsHandle 2156 -prefMapHandle 2152 -prefsLen 20828 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6fbd446c-86ec-457c-9123-884b5ae397a9} 6088 "\\.\pipe\gecko-crash-server-pipe.6088" 2184 24e71372e58 socket
    3⤵
    PID:5460
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="6088.2.500805873\560675360" -childID 1 -isForBrowser -prefsHandle 2808 -prefMapHandle 2732 -prefsLen 20931 -prefMapSize 233444 -jsInitHandle 1320 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {2f0e48a2-f5cb-4997-9584-08c865e983f1} 6088 "\\.\pipe\gecko-crash-server-pipe.6088" 2716 24e023cdf58 tab
    3⤵
    PID:6172
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="6088.3.1513931096\985220135" -childID 2 -isForBrowser -prefsHandle 3404 -prefMapHandle 3400 -prefsLen 26109 -prefMapSize 233444 -jsInitHandle 1320 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {0e0672b5-2729-4123-9547-2acb8d40e14e} 6088 "\\.\pipe\gecko-crash-server-pipe.6088" 3452 24e0286fe58 tab
    3⤵
    PID:5944
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="6088.4.168341368\1255972778" -childID 3 -isForBrowser -prefsHandle 4112 -prefMapHandle 4132 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1320 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {48495a8c-23eb-4f8c-99ff-2b73bbf81a4f} 6088 "\\.\pipe\gecko-crash-server-pipe.6088" 4140 24e035c0c58 tab
    3⤵
    PID:5792
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="6088.5.1324652023\1281732144" -childID 4 -isForBrowser -prefsHandle 4964 -prefMapHandle 4960 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1320 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {61cf7f34-d997-40d2-817b-77c53670d0d1} 6088 "\\.\pipe\gecko-crash-server-pipe.6088" 4972 24e035bee58 tab
    3⤵
    PID:5004
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="6088.6.1038033677\680561223" -childID 5 -isForBrowser -prefsHandle 4784 -prefMapHandle 4780 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1320 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {261fc30d-1945-4ce3-a90f-e6a1541dc694} 6088 "\\.\pipe\gecko-crash-server-pipe.6088" 5100 24e04b58f58 tab
    3⤵
    PID:1108
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="6088.7.417419294\191321156" -childID 6 -isForBrowser -prefsHandle 5216 -prefMapHandle 5220 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1320 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {99f06982-ab3d-46c8-85c3-c349e78034c2} 6088 "\\.\pipe\gecko-crash-server-pipe.6088" 5208 24e04b58358 tab
    3⤵
    PID:2272
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="6088.8.1734106913\112475731" -childID 7 -isForBrowser -prefsHandle 5672 -prefMapHandle 5668 -prefsLen 26424 -prefMapSize 233444 -jsInitHandle 1320 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {eebec732-a954-4889-898c-d8ff17fa4e95} 6088 "\\.\pipe\gecko-crash-server-pipe.6088" 5680 24e0684d058 tab
    3⤵
    PID:5672

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:6712
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7fffb9b69758,0x7fffb9b69768,0x7fffb9b69778
  2⤵
  PID:6724
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1592 --field-trial-handle=1724,i,2646455697465752942,10641567191435637805,131072 /prefetch:2
  2⤵
  PID:6948
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1900 --field-trial-handle=1724,i,2646455697465752942,10641567191435637805,131072 /prefetch:8
  2⤵
  PID:6932
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2080 --field-trial-handle=1724,i,2646455697465752942,10641567191435637805,131072 /prefetch:8
  2⤵
  PID:6920
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2852 --field-trial-handle=1724,i,2646455697465752942,10641567191435637805,131072 /prefetch:1
  2⤵
  PID:7040
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2860 --field-trial-handle=1724,i,2646455697465752942,10641567191435637805,131072 /prefetch:1
  2⤵
  PID:3548
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=3848 --field-trial-handle=1724,i,2646455697465752942,10641567191435637805,131072 /prefetch:1
  2⤵
  PID:1352
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4608 --field-trial-handle=1724,i,2646455697465752942,10641567191435637805,131072 /prefetch:8
  2⤵
  PID:4764
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4632 --field-trial-handle=1724,i,2646455697465752942,10641567191435637805,131072 /prefetch:8
  2⤵
  PID:5316
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4908 --field-trial-handle=1724,i,2646455697465752942,10641567191435637805,131072 /prefetch:8
  2⤵
  PID:6216
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4984 --field-trial-handle=1724,i,2646455697465752942,10641567191435637805,131072 /prefetch:8
  2⤵
  PID:5716
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4900 --field-trial-handle=1724,i,2646455697465752942,10641567191435637805,131072 /prefetch:8
  2⤵
  PID:5644
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=5032 --field-trial-handle=1724,i,2646455697465752942,10641567191435637805,131072 /prefetch:1
  2⤵
  PID:5236
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=3828 --field-trial-handle=1724,i,2646455697465752942,10641567191435637805,131072 /prefetch:1
  2⤵
  PID:1876
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5288 --field-trial-handle=1724,i,2646455697465752942,10641567191435637805,131072 /prefetch:8
  2⤵
  PID:5068
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --mojo-platform-channel-handle=5352 --field-trial-handle=1724,i,2646455697465752942,10641567191435637805,131072 /prefetch:1
  2⤵
  PID:7064
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=2856 --field-trial-handle=1724,i,2646455697465752942,10641567191435637805,131072 /prefetch:8
  2⤵
  PID:5784
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2928 --field-trial-handle=1724,i,2646455697465752942,10641567191435637805,131072 /prefetch:8
  2⤵
  PID:5448
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --mojo-platform-channel-handle=5580 --field-trial-handle=1724,i,2646455697465752942,10641567191435637805,131072 /prefetch:1
  2⤵
  PID:5808
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --mojo-platform-channel-handle=5072 --field-trial-handle=1724,i,2646455697465752942,10641567191435637805,131072 /prefetch:1
  2⤵
  PID:6572
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --mojo-platform-channel-handle=2892 --field-trial-handle=1724,i,2646455697465752942,10641567191435637805,131072 /prefetch:1
  2⤵
  PID:4704
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5808 --field-trial-handle=1724,i,2646455697465752942,10641567191435637805,131072 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:6340
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6016 --field-trial-handle=1724,i,2646455697465752942,10641567191435637805,131072 /prefetch:8
  2⤵
  PID:5468
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6040 --field-trial-handle=1724,i,2646455697465752942,10641567191435637805,131072 /prefetch:8
  2⤵
  PID:4712
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3900 --field-trial-handle=1724,i,2646455697465752942,10641567191435637805,131072 /prefetch:8
  2⤵
  PID:3180
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6100 --field-trial-handle=1724,i,2646455697465752942,10641567191435637805,131072 /prefetch:8
  2⤵
  PID:3676

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:4464

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:7092

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\test.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:6828

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\test - Copy.txt
1⤵
PID:1380

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\test - Copy.txt
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5332

C:\Users\Admin\Desktop\WannaCry.exe
"C:\Users\Admin\Desktop\WannaCry.exe"
1⤵
- Drops startup file
- Sets desktop wallpaper using registry
PID:2992
- C:\Windows\SysWOW64\attrib.exe
  attrib +h .
  2⤵
  - Views/modifies file attributes
  PID:5236
- C:\Windows\SysWOW64\icacls.exe
  icacls . /grant Everyone:F /T /C /Q
  2⤵
  - Modifies file permissions
  PID:3008
- C:\Users\Admin\Desktop\taskdl.exe
  taskdl.exe
  2⤵
  - Executes dropped EXE
  PID:7008
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c 108281714580947.bat
  2⤵
  PID:6644
- - C:\Windows\SysWOW64\cscript.exe
    cscript.exe //nologo m.vbs
    3⤵
    PID:6232
- C:\Windows\SysWOW64\attrib.exe
  attrib +h +s F:\$RECYCLE
  2⤵
  - Views/modifies file attributes
  PID:6792
- C:\Users\Admin\Desktop\@[email protected]
  @[email protected] co
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4420
- - C:\Users\Admin\Desktop\TaskData\Tor\taskhsvc.exe
    TaskData\Tor\taskhsvc.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    PID:6468
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c start /b @[email protected] vs
  2⤵
  PID:6356
- - C:\Users\Admin\Desktop\@[email protected]
    @[email protected] vs
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1752
  - - C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet
      4⤵
      PID:356
    - - C:\Windows\SysWOW64\vssadmin.exe
        
        vssadmin delete shadows /all /quiet
        5⤵
        Interacts with shadow copies
        
        PID:4184
    - - C:\Windows\SysWOW64\Wbem\WMIC.exe
        
        wmic shadowcopy delete
        5⤵
        
        PID:3940
- C:\Users\Admin\Desktop\taskdl.exe
  taskdl.exe
  2⤵
  - Executes dropped EXE
  PID:2848
- C:\Users\Admin\Desktop\taskse.exe
  taskse.exe C:\Users\Admin\Desktop\@[email protected]
  2⤵
  - Executes dropped EXE
  PID:6704
- C:\Users\Admin\Desktop\@[email protected]
  @[email protected]
  2⤵
  - Executes dropped EXE
  - Sets desktop wallpaper using registry
  - Suspicious use of SetWindowsHookEx
  PID:5588
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "svgirwyi764" /t REG_SZ /d "\"C:\Users\Admin\Desktop\tasksche.exe\"" /f
  2⤵
  PID:516
- - C:\Windows\SysWOW64\reg.exe
    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "svgirwyi764" /t REG_SZ /d "\"C:\Users\Admin\Desktop\tasksche.exe\"" /f
    3⤵
    - Adds Run key to start application
    - Modifies registry key
    PID:5096
- C:\Users\Admin\Desktop\taskdl.exe
  taskdl.exe
  2⤵
  - Executes dropped EXE
  PID:6416
- C:\Users\Admin\Desktop\taskse.exe
  taskse.exe C:\Users\Admin\Desktop\@[email protected]
  2⤵
  - Executes dropped EXE
  PID:6388
- C:\Users\Admin\Desktop\@[email protected]
  @[email protected]
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:5124
- C:\Users\Admin\Desktop\taskse.exe
  taskse.exe C:\Users\Admin\Desktop\@[email protected]
  2⤵
  - Executes dropped EXE
  PID:360
- C:\Users\Admin\Desktop\@[email protected]
  @[email protected]
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4468
- C:\Users\Admin\Desktop\taskdl.exe
  taskdl.exe
  2⤵
  - Executes dropped EXE
  PID:1844
- C:\Users\Admin\Desktop\taskse.exe
  taskse.exe C:\Users\Admin\Desktop\@[email protected]
  2⤵
  - Executes dropped EXE
  PID:1372
- C:\Users\Admin\Desktop\@[email protected]
  @[email protected]
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1696
- C:\Users\Admin\Desktop\taskdl.exe
  taskdl.exe
  2⤵
  - Executes dropped EXE
  PID:5180
- C:\Users\Admin\Desktop\taskse.exe
  taskse.exe C:\Users\Admin\Desktop\@[email protected]
  2⤵
  - Executes dropped EXE
  PID:396
- C:\Users\Admin\Desktop\@[email protected]
  @[email protected]
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:7116
- C:\Users\Admin\Desktop\taskdl.exe
  taskdl.exe
  2⤵
  - Executes dropped EXE
  PID:6516
- C:\Users\Admin\Desktop\taskse.exe
  taskse.exe C:\Users\Admin\Desktop\@[email protected]
  2⤵
  - Executes dropped EXE
  PID:2820
- C:\Users\Admin\Desktop\@[email protected]
  @[email protected]
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:5176
- C:\Users\Admin\Desktop\taskdl.exe
  taskdl.exe
  2⤵
  - Executes dropped EXE
  PID:4760

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\test.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:5760

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\test - Copy.txt
1⤵
PID:6140

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\test - Copy.txt
1⤵
PID:6584

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:5660

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\test - Copy.txt
1⤵
PID:5988

C:\Windows\System32\NOTEPAD.EXE
"C:\Windows\System32\NOTEPAD.EXE" C:\Users\Admin\Desktop\FA Adv Security Tool.bat
1⤵
PID:7112

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\FA Adv Security Tool.bat" "
1⤵
PID:3796
- C:\Windows\system32\tasklist.exe
  tasklist
  2⤵
  - Enumerates processes with tasklist
  PID:6420
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:5584
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:6508
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:4516
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:236
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:7120
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:6520
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:4064
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:6944
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:2916
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  - Kills process with taskkill
  PID:4332
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:5988
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:6464
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:5580
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:516
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:5592
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:2456
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:400
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:996
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:4664
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:6804
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:6408
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:6236
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:6352
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:2552
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:1352
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:5560
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:5664
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:4712
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:5264
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:6624
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:7064
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:3528
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:4468
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:5224
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:5024
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:5596
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:3716
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:4484
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:1716
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:3304
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:7072
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:4992
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:6484
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:2804
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:3216
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:5732
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:7112
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:5904
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:2268
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  - Kills process with taskkill
  PID:5952
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:5440
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:4512
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:4892
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:1372
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:5016
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:6672
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:6060
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:5240
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:5300
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:6356
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:7148
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:4616
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:5680
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:6472
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:5288
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:424
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:5992
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:7008
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:5408
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:6580
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:5588
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  - Kills process with taskkill
  PID:2208
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:4896
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:6928
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:5372
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:7028
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:2072
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:6364
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:6992
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:6584
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:6200
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:4540
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:7128
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:876
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:6232
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:3508
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:4108
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  - Kills process with taskkill
  PID:6860
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:4168
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:6400
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:704
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:6504
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  - Kills process with taskkill
  PID:6340
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:5292
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:6688
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:6776
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:4544
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:5712
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:7156
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:4572
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:2520
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:436
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:7100
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:1844
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:3104
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:2448
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:2004
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:6288
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:6852
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:1960
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:3180
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:4768
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:4172
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:6292
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:2980
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:6620
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:4476
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:4552
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:5324
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:596
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:6020
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:1964
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:884
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:5428
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:4720
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:6872
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:660
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:6348
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:6388
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  - Kills process with taskkill
  PID:2820
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:4264
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:760
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:3516
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:1296
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:6472
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:5288
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:424
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:5992
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:7008
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:6244
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:2500
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:6580
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:5588
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:2208
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:4896
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:6928
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:5372
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:7028
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:2072
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:6364
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:6992
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:6584
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:6200
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:4540
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:7128
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:876
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:6232
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:3508
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:4108
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:6860
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:4168
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:6400
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:704
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:7096
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:3892
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:6784
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:2344
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:5276
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:5248
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:6780
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:5260
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:6536
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:3816
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:5220
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:3700
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:360
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:832
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:5536
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:4416
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:4908
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:3248
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:4952
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:5884
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:2532
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:2584
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:4656
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:5720
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:3544
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:3012
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:3844
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:5172
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:2008
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:304
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:6800
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:6156
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:4440
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:6420
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:6360
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:6024
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:2352
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:4460
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:2252
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:5528
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:4028
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:5144
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:396
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:3148
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:7004
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:6816
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:5408
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  - Kills process with taskkill
  PID:5644
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:4420
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:1692
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:6508
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:4516
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:236
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:7120
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:2376
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:4064
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:6944
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:2916
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:4332
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:5988
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:6464
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:5580
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:516
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:5592
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:2456
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:400
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:6788
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:6220
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:1744
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:6400
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:6644
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:6312
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:5676
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:7144
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:5268
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:5664
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:4980
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:6540
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:5792
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:5544
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:3528
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:7092
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:2360
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:3076
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:6828
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:7040
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:1880
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:8
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:6492
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:6296
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:2900
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:1120
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:880
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:2236
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:376
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:3176
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:6104
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:2268
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:5952
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:5440
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:860
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:4892
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:6836
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:6404
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:6672
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:5432
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:5316
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:6356
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:7148
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:364
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:5284
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:3028
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:2572
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:7068
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:6160
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:524
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:3552
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:1468
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:4808
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:4744
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:4968
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:7036
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:372
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:6772
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:3388
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:6844
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:1204
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:5764
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:5920
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:5752
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  - Kills process with taskkill
  PID:32
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:5568
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:700
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:6528
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:5436
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:5576
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:5632
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:6384
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:6408
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:4320
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:508
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:3860
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:1352
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:764
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:5328
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:6692
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:592
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:1448
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:3540
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:4356
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:3572
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:5540
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:7088
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:6976
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:4880
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:4580
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:1604
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:5088
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:4768
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:4172
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:200
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:2584
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:644
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:4656
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:5720
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:5904
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:1440
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:3844
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:5172
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:1088
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:5332
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:352
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:1372
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:6396
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:1876
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:6360
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:2160
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:5388
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:4616
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:2508
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:7116
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:4684
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:5744
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:3148
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:6260
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:344
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:5160
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:1316
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:3552
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:1468
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:4808
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:4744
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:4968
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:7036
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:372
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:6772
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:3388
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:6844
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:1204
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:5764
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:5920
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:5752
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:32
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:5568
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:700
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:2804
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:2456
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:400
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:6788
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:2432
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:4868
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:1076
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:1752
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:6784
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:5308
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:5448
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:5468
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:1320
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  - Kills process with taskkill
  PID:5664
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:4980
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:6540
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:5792
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:5544
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:3528
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:7092
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:360
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:3076
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:6828
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:5092
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:1604
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:8
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:2028
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:5368
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:4132
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:3216
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:5732
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:7112
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:924
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:4432
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:1968
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:4576
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:1280
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:4380
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:6148
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:2308
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:4140
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:6420
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:3140
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:4264
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:5228
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:4612
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:5880
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:3100
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:2920
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:5300
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:5288
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:1460
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:7008
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:6816
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:5408
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:6380
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:2232
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:5584
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:2336
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:6808
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:1392
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:3200
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:6996
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:7132
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:5692
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:5924
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:4764
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:5828
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:5032
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:960
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:5212
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:6548
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:4504
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:5000
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:2436
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:4168
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:4900
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:6504
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:6340
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:5292
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:5272
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:6688
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:5560
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  - Kills process with taskkill
  PID:2040
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  - Kills process with taskkill
  PID:4712
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:5328
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:6692
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:592
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:1448
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:3540
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:3700
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:3572
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:5540
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:7088
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:6976
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:4880
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:3248
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:6424
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:6336
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:6484
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:168
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:6700
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:644
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:4656
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:5720
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:5904
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:1440
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:3844
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:5172
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:3132
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:4128
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:660
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:3536
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:6060
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:7056
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  - Kills process with taskkill
  PID:5176
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:4460
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:3516
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:364
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:2352
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:5144
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:4684
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:4760
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:7068
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:7004
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:7020
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:524
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:4932
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:3552
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:1692
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:6508
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:3940
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:356
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:2072
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:4064
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:2564
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:676
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:4588
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:6452
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:7128
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:5580
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:4244
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:5592
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:1016
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:5552
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:6972
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:6860
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:2524
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:5576
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:5632
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:6384
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:6400
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:1752
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:508
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:3860
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:1352
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:764
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:5268
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:6876
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:4472
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:6668
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:3204
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:5524
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:1504
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:5596
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:4676
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:2284
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:1380
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:7072
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:6864
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:4992
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  - Kills process with taskkill
  PID:4924
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:6620
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:4476
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:2236
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:5324
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:3012
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:6020
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:6980
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:5180
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  - Kills process with taskkill
  PID:884
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:5140
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:2744
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:352
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:4128
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:660
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:3536
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:6060
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:7056
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:5176
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:4460
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:3516
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:364
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:2352
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:5144
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:4684
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:4760
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:7068
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:7004
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:7020
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:524
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  - Kills process with taskkill
  PID:4932
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:308
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:2144
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:4968
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:6300
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:356
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:7036
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:6996
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:7132
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:3388
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:6844
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:1204
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:5764
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:3864
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:6704
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:5212
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:3984
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:4504
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:4820
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:2456
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:400
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:6248
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:6560
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:6644
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:5292
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:4320
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:1072
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:5308
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:6792
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:7156
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:4072
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:6448
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:4472
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:6668
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:3204
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:5524
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:1504
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:5596
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:4676
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:2284
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:1380
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:7072
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:6864
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:4992
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:4924
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:6620
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:4476
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:2236
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:5324
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:3012
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:6020
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:6980
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:5180
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:884
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:5140
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:2744
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:352
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:4128
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:660
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:3536
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:6060
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:7056
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:5176
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:4460
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:3516
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:4028
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:2820
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:3028
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:2572
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:7016
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:5808
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:6580
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:1316
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:3552
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:4932
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:308
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:2144
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:4968
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:6300
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:356
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:7036
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:6996
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:7132
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:3388
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:6844
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:1204
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:5764
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:3864
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:6704
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:5212
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:3984
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:3232
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  - Kills process with taskkill
  PID:6220
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  - Kills process with taskkill
  PID:6788
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:2432
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:4868
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:6776
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:3344
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:5676
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:5560
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:5448
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:5468
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:4412
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:5260
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:5220
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:4772
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:5336
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:4356
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:2448
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:4696
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:3184
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:6852
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:6828
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:1960
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:6028
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:5884
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:4768
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:5196
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:6628
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:6544
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:7112
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:1696
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:2268
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:5952
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:5440
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:1280
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:4892
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:4440
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:1372
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:6404
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:5240
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:2628
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:6356
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:5388
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:2052
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:2508
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:364
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:3516
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:4028
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:2820
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:3028
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:2572
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  - Kills process with taskkill
  PID:7016
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:5808
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:6580
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:1316
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:4516
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:2336
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:7120
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:6856
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:5320
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:6440
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:5704
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:6768
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:6664
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:5520
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:5920
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:5752
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:32
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:3236
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:7124
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:5556
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:2132
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:6972
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:2752
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:4168
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:4900
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:6504
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:6340
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:1076
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:5272
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:6688
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:6552
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:1320
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:5664
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:4980
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:6536
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:1448
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:3540
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:832
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:5536
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:4484
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:7088
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:3876
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:1880
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:5092
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:1604
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:8
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:1424
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:5196
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:6628
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:4476
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:2236
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:7112
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:1696
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:2268
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:5952
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:5440
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:1280
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:4892
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  - Kills process with taskkill
  PID:4440
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:1372
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:6404
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:5240
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:1876
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:6360
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:6820
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:760
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:4912
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:6472
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:1824
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:5744
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:4684
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:4884
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:7068
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:7004
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:3744
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:5416
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:7032
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:5584
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:6564
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:6868
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:1392
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:7012
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:6992
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:6584
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:5692
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:5988
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:4764
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:5828
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:876
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:5208
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:3864
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:6704
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:5212
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:5000
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  - Kills process with taskkill
  PID:6804
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:5684
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:6860
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:6236
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:7096
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:3704
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:6384
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:2344
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:4544
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:6792
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:7156
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:4072
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:7100
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:5792
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:6668
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:3204
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:5524
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:1504
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:4696
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:4676
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:6852
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:6828
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:1960
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:6028
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:6336
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:4924
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:6532
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:5104
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:3216
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:4656
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:5720
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:5904
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:6980
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:3844
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:5172
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:3132
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:6148
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:2308
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:7084
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:660
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:6568
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:224
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:5228
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  - Kills process with taskkill
  PID:5680
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:5880
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:532
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:5068
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:5992
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:3148
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:6160
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:6696
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:2572
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:5160
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:5808
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:6580
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:1316
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:6508
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:2144
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:4968
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:6856
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:828
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:6440
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:2916
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:6200
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:7132
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:3388
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:5096
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:6076
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:5580
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:5592
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:4100
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:4504
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:5436
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:996
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:3596
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:6860
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:6788
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:6372
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:5652
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:6776
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  - Kills process with taskkill
  PID:3344
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:1752
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:7064
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:5468
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:6692
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:6448
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:4468
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:6496
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:1376
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:212
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:3716
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:4416
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:7040
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  - Kills process with taskkill
  PID:3304
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:4952
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:6480
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:6296
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:8
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:6620
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:3648
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:6700
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:5324
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:3012
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:6020
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:2008
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:5180
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:884
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:6156
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:3608
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:6672
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:5432
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:208
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:3536
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:2628
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:508
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:5528
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:5284
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:164
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:2920
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:5300
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:5288
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:1460
- C:\Windows\system32\taskkill.exe
  taskkill /f /im @[email protected]
  2⤵
  PID:6260

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

File and Directory Permissions Modification

T1222

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

Credential Access

Discovery

Process Discovery

T1057

Query Registry

System Information Discovery