39a1bc8c9a41da81a92115b50d2e8428e06825810ce616c26f64b9adfcbe2c69

Analysis

max time kernel
150s
max time network
118s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
03/07/2024, 06:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

21551e1b22ab94000213378e2847053b_JaffaCakes118.exe
Size

37KB
MD5

21551e1b22ab94000213378e2847053b
SHA1

358b938e0ada7b9f95ce68281a0bf32c8d834b28
SHA256

39a1bc8c9a41da81a92115b50d2e8428e06825810ce616c26f64b9adfcbe2c69
SHA512

1dff9e01f191e69cc8488bb54cf2795398b38cca439013c8326cf34c3fc2ebe01c263056b9bb5624e1026a1b5f1f9c8ed6542c8cab30388c8d899c85c054e60a
SSDEEP

768:xvSK4e1PmWr/99cGnkYr9WaHTXc0Kj9SM4qphCqUfJ3Ean/g7Fo9CKtHEk:6AzsJYbHr0hsLqodEanWYHE

Score

7^/10

persistence upx

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2736	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
2836	wlock.exe

Loads dropped DLL 2 IoCs

pid	Process
1752	21551e1b22ab94000213378e2847053b_JaffaCakes118.exe
1752	21551e1b22ab94000213378e2847053b_JaffaCakes118.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1752-0-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral1/memory/1752-21-0x0000000000400000-0x000000000041E000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\wlock = "C:\\Users\\Admin\\wlock\\wlock.exe"	reg.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Kills process with taskkill 64 IoCs

evasion

pid	Process
1148	taskkill.exe
1752	taskkill.exe
1992	taskkill.exe
316	taskkill.exe
2448	taskkill.exe
1824	taskkill.exe
2928	taskkill.exe
540	taskkill.exe
2708	taskkill.exe
1796	taskkill.exe
852	taskkill.exe
2860	taskkill.exe
2068	taskkill.exe
2112	taskkill.exe
2140	taskkill.exe
1964	taskkill.exe
2016	taskkill.exe
1912	taskkill.exe
332	taskkill.exe
676	taskkill.exe
1856	taskkill.exe
1832	taskkill.exe
1704	taskkill.exe
1148	taskkill.exe
2316	taskkill.exe
2036	taskkill.exe
2752	taskkill.exe
2392	taskkill.exe
572	taskkill.exe
3016	taskkill.exe
2056	taskkill.exe
820	taskkill.exe
2508	taskkill.exe
1964	taskkill.exe
1724	taskkill.exe
3068	taskkill.exe
2340	taskkill.exe
2112	taskkill.exe
2540	taskkill.exe
1796	taskkill.exe
1864	taskkill.exe
1056	taskkill.exe
1796	taskkill.exe
2300	taskkill.exe
2640	taskkill.exe
1924	taskkill.exe
2428	taskkill.exe
904	taskkill.exe
2868	taskkill.exe
1740	taskkill.exe
1588	taskkill.exe
1432	taskkill.exe
1308	taskkill.exe
2916	taskkill.exe
1728	taskkill.exe
1536	taskkill.exe
2212	taskkill.exe
2480	taskkill.exe
2116	taskkill.exe
2348	taskkill.exe
1524	taskkill.exe
2140	taskkill.exe
964	taskkill.exe
2848	taskkill.exe

Modifies Control Panel 1 IoCs

evasion

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Control Panel\Desktop\ScreenSaveActive = "0"	wlock.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	1752	21551e1b22ab94000213378e2847053b_JaffaCakes118.exe
Token: SeDebugPrivilege	2732	taskkill.exe
Token: SeDebugPrivilege	2584	taskkill.exe
Token: SeDebugPrivilege	2088	taskkill.exe
Token: SeDebugPrivilege	1736	taskkill.exe
Token: SeDebugPrivilege	2864	taskkill.exe
Token: SeDebugPrivilege	2912	taskkill.exe
Token: SeDebugPrivilege	1536	taskkill.exe
Token: SeDebugPrivilege	768	taskkill.exe
Token: SeDebugPrivilege	1224	taskkill.exe
Token: SeDebugPrivilege	2508	taskkill.exe
Token: SeDebugPrivilege	2792	taskkill.exe
Token: SeDebugPrivilege	1404	taskkill.exe
Token: SeDebugPrivilege	1964	taskkill.exe
Token: SeDebugPrivilege	1236	taskkill.exe
Token: SeDebugPrivilege	2120	taskkill.exe
Token: SeDebugPrivilege	1952	taskkill.exe
Token: SeDebugPrivilege	484	taskkill.exe
Token: SeDebugPrivilege	1508	taskkill.exe
Token: SeDebugPrivilege	3048	taskkill.exe
Token: SeDebugPrivilege	664	taskkill.exe
Token: SeDebugPrivilege	1912	taskkill.exe
Token: SeDebugPrivilege	1340	taskkill.exe
Token: SeDebugPrivilege	1356	taskkill.exe
Token: SeDebugPrivilege	1044	taskkill.exe
Token: SeDebugPrivilege	952	taskkill.exe
Token: SeDebugPrivilege	1656	taskkill.exe
Token: SeDebugPrivilege	2252	taskkill.exe
Token: SeDebugPrivilege	1856	taskkill.exe
Token: SeDebugPrivilege	2328	taskkill.exe
Token: SeDebugPrivilege	1616	taskkill.exe
Token: SeDebugPrivilege	2440	taskkill.exe
Token: SeDebugPrivilege	2460	taskkill.exe
Token: SeDebugPrivilege	2728	taskkill.exe
Token: SeDebugPrivilege	2148	taskkill.exe
Token: SeDebugPrivilege	2944	taskkill.exe
Token: SeDebugPrivilege	2204	taskkill.exe
Token: SeDebugPrivilege	2580	taskkill.exe
Token: SeDebugPrivilege	2860	taskkill.exe
Token: SeDebugPrivilege	2896	taskkill.exe
Token: SeDebugPrivilege	1528	taskkill.exe
Token: SeDebugPrivilege	1640	taskkill.exe
Token: SeDebugPrivilege	1728	taskkill.exe
Token: SeDebugPrivilege	1544	taskkill.exe
Token: SeDebugPrivilege	2804	taskkill.exe
Token: SeDebugPrivilege	848	taskkill.exe
Token: SeDebugPrivilege	1276	taskkill.exe
Token: SeDebugPrivilege	2016	taskkill.exe
Token: SeDebugPrivilege	2144	taskkill.exe
Token: SeDebugPrivilege	2976	taskkill.exe
Token: SeDebugPrivilege	592	taskkill.exe
Token: SeDebugPrivilege	1392	taskkill.exe
Token: SeDebugPrivilege	2368	taskkill.exe
Token: SeDebugPrivilege	1056	taskkill.exe
Token: SeDebugPrivilege	2392	taskkill.exe
Token: SeDebugPrivilege	1808	taskkill.exe
Token: SeDebugPrivilege	1912	taskkill.exe
Token: SeDebugPrivilege	1340	taskkill.exe
Token: SeDebugPrivilege	1356	taskkill.exe
Token: SeDebugPrivilege	1044	taskkill.exe
Token: SeDebugPrivilege	952	taskkill.exe
Token: SeDebugPrivilege	1976	taskkill.exe
Token: SeDebugPrivilege	2296	taskkill.exe
Token: SeDebugPrivilege	1524	taskkill.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2836	wlock.exe
2836	wlock.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1752 wrote to memory of 2440	1752	21551e1b22ab94000213378e2847053b_JaffaCakes118.exe	28
PID 1752 wrote to memory of 2440	1752	21551e1b22ab94000213378e2847053b_JaffaCakes118.exe	28
PID 1752 wrote to memory of 2440	1752	21551e1b22ab94000213378e2847053b_JaffaCakes118.exe	28
PID 1752 wrote to memory of 2440	1752	21551e1b22ab94000213378e2847053b_JaffaCakes118.exe	28
PID 2440 wrote to memory of 1800	2440	cmd.exe	30
PID 2440 wrote to memory of 1800	2440	cmd.exe	30
PID 2440 wrote to memory of 1800	2440	cmd.exe	30
PID 2440 wrote to memory of 1800	2440	cmd.exe	30
PID 1752 wrote to memory of 2836	1752	21551e1b22ab94000213378e2847053b_JaffaCakes118.exe	31
PID 1752 wrote to memory of 2836	1752	21551e1b22ab94000213378e2847053b_JaffaCakes118.exe	31
PID 1752 wrote to memory of 2836	1752	21551e1b22ab94000213378e2847053b_JaffaCakes118.exe	31
PID 1752 wrote to memory of 2836	1752	21551e1b22ab94000213378e2847053b_JaffaCakes118.exe	31
PID 1752 wrote to memory of 2736	1752	21551e1b22ab94000213378e2847053b_JaffaCakes118.exe	32
PID 1752 wrote to memory of 2736	1752	21551e1b22ab94000213378e2847053b_JaffaCakes118.exe	32
PID 1752 wrote to memory of 2736	1752	21551e1b22ab94000213378e2847053b_JaffaCakes118.exe	32
PID 1752 wrote to memory of 2736	1752	21551e1b22ab94000213378e2847053b_JaffaCakes118.exe	32
PID 2836 wrote to memory of 2732	2836	wlock.exe	33
PID 2836 wrote to memory of 2732	2836	wlock.exe	33
PID 2836 wrote to memory of 2732	2836	wlock.exe	33
PID 2836 wrote to memory of 2732	2836	wlock.exe	33
PID 2836 wrote to memory of 2584	2836	wlock.exe	37
PID 2836 wrote to memory of 2584	2836	wlock.exe	37
PID 2836 wrote to memory of 2584	2836	wlock.exe	37
PID 2836 wrote to memory of 2584	2836	wlock.exe	37
PID 2836 wrote to memory of 2088	2836	wlock.exe	39
PID 2836 wrote to memory of 2088	2836	wlock.exe	39
PID 2836 wrote to memory of 2088	2836	wlock.exe	39
PID 2836 wrote to memory of 2088	2836	wlock.exe	39
PID 2836 wrote to memory of 1736	2836	wlock.exe	41
PID 2836 wrote to memory of 1736	2836	wlock.exe	41
PID 2836 wrote to memory of 1736	2836	wlock.exe	41
PID 2836 wrote to memory of 1736	2836	wlock.exe	41
PID 2836 wrote to memory of 2864	2836	wlock.exe	43
PID 2836 wrote to memory of 2864	2836	wlock.exe	43
PID 2836 wrote to memory of 2864	2836	wlock.exe	43
PID 2836 wrote to memory of 2864	2836	wlock.exe	43
PID 2836 wrote to memory of 2912	2836	wlock.exe	45
PID 2836 wrote to memory of 2912	2836	wlock.exe	45
PID 2836 wrote to memory of 2912	2836	wlock.exe	45
PID 2836 wrote to memory of 2912	2836	wlock.exe	45
PID 2836 wrote to memory of 1536	2836	wlock.exe	47
PID 2836 wrote to memory of 1536	2836	wlock.exe	47
PID 2836 wrote to memory of 1536	2836	wlock.exe	47
PID 2836 wrote to memory of 1536	2836	wlock.exe	47
PID 2836 wrote to memory of 768	2836	wlock.exe	49
PID 2836 wrote to memory of 768	2836	wlock.exe	49
PID 2836 wrote to memory of 768	2836	wlock.exe	49
PID 2836 wrote to memory of 768	2836	wlock.exe	49
PID 2836 wrote to memory of 1224	2836	wlock.exe	51
PID 2836 wrote to memory of 1224	2836	wlock.exe	51
PID 2836 wrote to memory of 1224	2836	wlock.exe	51
PID 2836 wrote to memory of 1224	2836	wlock.exe	51
PID 2836 wrote to memory of 2508	2836	wlock.exe	53
PID 2836 wrote to memory of 2508	2836	wlock.exe	53
PID 2836 wrote to memory of 2508	2836	wlock.exe	53
PID 2836 wrote to memory of 2508	2836	wlock.exe	53
PID 2836 wrote to memory of 2792	2836	wlock.exe	55
PID 2836 wrote to memory of 2792	2836	wlock.exe	55
PID 2836 wrote to memory of 2792	2836	wlock.exe	55
PID 2836 wrote to memory of 2792	2836	wlock.exe	55
PID 2836 wrote to memory of 1404	2836	wlock.exe	57
PID 2836 wrote to memory of 1404	2836	wlock.exe	57
PID 2836 wrote to memory of 1404	2836	wlock.exe	57
PID 2836 wrote to memory of 1404	2836	wlock.exe	57

C:\Users\Admin\AppData\Local\Temp\21551e1b22ab94000213378e2847053b_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\21551e1b22ab94000213378e2847053b_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1752
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c REG ADD HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v wlock /t REG_SZ /d "C:\Users\Admin\wlock\wlock.exe" /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2440
- - C:\Windows\SysWOW64\reg.exe
    REG ADD HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v wlock /t REG_SZ /d "C:\Users\Admin\wlock\wlock.exe" /f
    3⤵
    - Adds Run key to start application
    PID:1800
- C:\Users\Admin\wlock\wlock.exe
  "C:\Users\Admin\wlock\wlock.exe" f
  2⤵
  - Executes dropped EXE
  - Modifies Control Panel
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2836
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2732
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2584
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2088
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1736
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2864
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2912
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1536
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:768
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1224
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2508
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2792
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1404
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1964
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1236
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2120
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1952
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:484
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1508
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3048
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:664
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1912
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1340
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1356
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1044
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:952
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1656
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2252
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1856
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2328
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1616
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2440
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2460
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2728
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2148
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2944
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2204
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2580
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2860
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2896
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1528
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1640
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1728
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1544
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2804
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:848
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1276
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2016
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2144
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2976
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:592
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1392
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2368
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1056
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2392
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1808
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1912
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1340
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1356
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1044
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:952
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1976
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2296
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1524
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:1748
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:1608
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2440
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2460
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2820
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2116
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2816
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:3032
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:3040
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2860
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2896
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:1592
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    - Kills process with taskkill
    PID:1536
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:1696
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:1692
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:3044
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:848
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2012
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:1972
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:1948
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2716
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:532
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:1496
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2368
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:1056
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:664
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2928
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2264
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:1340
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    - Kills process with taskkill
    PID:964
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:1044
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:952
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:3008
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:1804
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2324
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:1600
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:1612
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2440
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2676
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2764
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2736
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:1664
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2204
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2924
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2860
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2896
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:1596
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:1536
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:1224
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:1692
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:3044
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2168
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:1256
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2068
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2916
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:1952
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:532
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:1496
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2384
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:352
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:448
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    - Kills process with taskkill
    PID:2928
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:340
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:1340
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:408
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2004
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2996
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:3008
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:1792
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2324
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2432
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2104
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2456
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2744
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2820
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    - Kills process with taskkill
    PID:2116
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2608
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:3032
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2748
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    - Kills process with taskkill
    PID:1432
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    - Kills process with taskkill
    PID:1796
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2332
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:1516
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2036
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:1308
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:1320
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:848
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2012
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:1972
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:572
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2716
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2504
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:308
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2176
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:1056
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:676
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:1408
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    - Kills process with taskkill
    PID:820
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:1340
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2112
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2004
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2996
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:3008
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:1792
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2752
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2432
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2640
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2712
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2556
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2820
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    - Kills process with taskkill
    PID:2708
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2608
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:1736
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2920
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2932
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:1452
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:1728
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:1516
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2036
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:1692
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:1320
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    - Kills process with taskkill
    PID:1964
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2012
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:332
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    - Kills process with taskkill
    PID:572
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:1104
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:532
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:308
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2368
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:352
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:1568
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:1408
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:1032
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2964
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    - Kills process with taskkill
    PID:1704
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2004
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:892
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:3008
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:1792
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2480
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2432
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2640
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2712
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2556
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2820
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:3040
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2880
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2204
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:1688
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:1432
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2520
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2800
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:900
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2420
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    - Kills process with taskkill
    PID:1308
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:1288
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:784
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2280
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    - Kills process with taskkill
    PID:2916
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:1812
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2308
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:1868
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    - Kills process with taskkill
    PID:2392
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:1016
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:1816
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:664
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:1652
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:1912
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:1672
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:408
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2240
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:1200
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2224
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2272
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2752
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2644
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2460
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2672
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2612
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:1664
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2736
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2912
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:1736
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:864
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2932
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2984
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2592
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2748
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2024
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2168
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:1256
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2068
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2284
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:1948
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:1492
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:1120
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2368
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:1056
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:1928
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2264
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:820
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:1340
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    - Kills process with taskkill
    PID:1588
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:1724
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2364
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    - Kills process with taskkill
    PID:1740
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2252
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2148
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2600
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:1872
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:1752
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2232
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2580
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2708
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2892
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:1796
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2724
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:1648
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:1576
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:1772
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:1240
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2968
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:264
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:1972
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:540
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:940
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:484
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:1012
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2476
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2176
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:316
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    - Kills process with taskkill
    PID:2016
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2412
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2428
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2112
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2004
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2996
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:1200
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2348
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2740
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:1608
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    - Kills process with taskkill
    PID:2640
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2456
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2556
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2612
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2948
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2608
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:3032
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    - Kills process with taskkill
    PID:3016
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:1328
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2668
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2924
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:1960
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:328
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2512
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:988
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2120
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:3004
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2280
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    - Kills process with taskkill
    PID:1148
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:824
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:1684
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:976
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2156
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:340
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2416
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:1156
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2188
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2988
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2328
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2364
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:1600
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2252
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:1984
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2960
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:1872
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2852
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2788
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2820
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2708
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:1640
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:768
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2896
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:1824
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:1576
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:1772
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:1240
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:1404
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2260
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:1244
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:3056
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    - Kills process with taskkill
    PID:332
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2916
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2064
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:1488
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2072
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:1816
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2016
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:1656
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:3000
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:1340
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2992
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    - Kills process with taskkill
    PID:1724
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:1200
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:1768
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2740
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    - Kills process with taskkill
    PID:3068
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2688
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2808
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2556
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2232
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2876
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2692
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:1460
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:1996
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:1124
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2668
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2924
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2592
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:328
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2972
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:1308
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2120
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    - Kills process with taskkill
    PID:540
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2276
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:1948
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2500
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:852
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2476
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:1876
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:316
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:772
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:1656
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:3000
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2964
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2004
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2560
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2940
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:1200
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2324
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2480
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:1524
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2432
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2672
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2136
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    - Kills process with taskkill
    PID:2340
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2236
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2692
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    - Kills process with taskkill
    PID:2860
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:1996
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:1328
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    - Kills process with taskkill
    PID:2508
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2520
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:1728
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2060
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:1404
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2168
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:1008
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:540
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:332
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:484
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2064
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:1104
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:356
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2072
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:1816
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2016
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    - Kills process with taskkill
    PID:2112
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:1616
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2188
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2212
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2008
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:1724
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:1028
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2728
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2700
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    - Kills process with taskkill
    PID:2540
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2828
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:324
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2888
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2820
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2596
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:1636
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2184
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2896
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2572
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2800
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    - Kills process with taskkill
    PID:1924
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2636
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2632
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:1500
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    - Kills process with taskkill
    PID:2068
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2504
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:1012
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2916
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:1148
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:808
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2056
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:1820
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:1128
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:316
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:1292
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:904
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:112
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2132
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:1588
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2780
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    - Kills process with taskkill
    PID:2348
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:1028
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2728
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2480
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2540
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2828
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:324
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2888
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2820
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2708
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    - Kills process with taskkill
    PID:1752
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2184
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2604
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2572
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:1248
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:1960
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:1716
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:1308
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:1256
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:1508
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2276
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:1392
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2500
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:1016
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2084
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2156
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:340
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2936
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:1044
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:3012
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:1672
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:1504
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2560
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2364
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2148
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2824
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:1200
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2600
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2764
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    - Kills process with taskkill
    PID:2848
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2432
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2868
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    - Kills process with taskkill
    PID:1796
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:1460
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:3016
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:768
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2668
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:1576
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:848
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2144
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2748
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2956
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:1404
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:3056
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2012
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2284
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2472
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    - Kills process with taskkill
    PID:1992
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2124
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:808
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2056
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:568
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2928
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    - Kills process with taskkill
    PID:316
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2112
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2412
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:112
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:1980
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    - Kills process with taskkill
    PID:2448
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:1612
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2252
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2460
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2324
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2704
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2672
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2160
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2580
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2676
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2692
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2708
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:1996
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2184
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2896
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:1432
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:328
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2972
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:1964
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    - Kills process with taskkill
    PID:1864
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:1952
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:572
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2280
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:1288
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2308
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:1568
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:1408
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2416
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:952
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:1856
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2064
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:904
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2908
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2628
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2272
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2680
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2576
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2644
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2088
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2556
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2612
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2116
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2640
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2292
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    - Kills process with taskkill
    PID:1796
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2796
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:3016
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2792
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2668
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:900
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:1880
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:1696
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2860
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2956
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:1244
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:592
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:1508
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:1120
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2496
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:1992
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2124
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:1356
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2056
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:568
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:820
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:1976
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    - Kills process with taskkill
    PID:2112
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    - Kills process with taskkill
    PID:2428
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:1504
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2484
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:1588
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:1620
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2940
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:1028
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2744
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2856
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:324
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2736
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2868
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    - Kills process with taskkill
    PID:1524
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2796
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:1124
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2792
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    - Kills process with taskkill
    PID:2300
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2604
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:1880
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:1592
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:1540
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:1404
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:1256
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:3056
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:3044
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:448
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2500
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:1488
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:620
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:1104
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    - Kills process with taskkill
    PID:2056
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:1876
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    - Kills process with taskkill
    PID:2316
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:1032
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2476
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2188
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:976
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:1980
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:1724
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2464
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2460
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:1984
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2960
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2704
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2640
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2580
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:1796
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:1872
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2880
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2984
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:864
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:900
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2592
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:604
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2860
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2812
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:1244
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2800
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2168
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:1120
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:1840
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:1052
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2164
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:1356
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:3000
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:1632
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:820
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:1976
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2112
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2412
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2444
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2108
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2696
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:1620
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2992
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:1028
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2876
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2608
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2852
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2948
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:1832
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:1736
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2492
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:1752
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2292
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2968
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2572
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    - Kills process with taskkill
    PID:2036
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:1624
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2512
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:3004
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2520
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2140
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:1868
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    - Kills process with taskkill
    PID:1148
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:1288
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2264
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:1928
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:1556
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2424
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:1292
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:1856
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:1044
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:1520
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2176
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:1800
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2484
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    - Kills process with taskkill
    PID:2212
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2780
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:1200
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2700
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2764
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2816
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:1628
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2136
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2948
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2004
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2884
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2492
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2708
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:1240
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2804
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:1516
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:1732
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:1880
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:784
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:600
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:1164
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    - Kills process with taskkill
    PID:2140
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:1528
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:1320
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:1288
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2500
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:1692
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2504
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    - Kills process with taskkill
    PID:676
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:1292
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    - Kills process with taskkill
    PID:1856
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2064
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:1700
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2224
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:1800
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2484
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    - Kills process with taskkill
    PID:2752
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2348
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2584
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2600
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2760
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:1588
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:3040
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:3024
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2784
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2808
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:844
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    - Kills process with taskkill
    PID:1824
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:628
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    - Kills process with taskkill
    PID:1728
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2528
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2260
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:1648
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2748
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:1008
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:3004
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2208
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:572
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2516
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2496
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:824
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2164
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    - Kills process with taskkill
    PID:852
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:952
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:340
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:1656
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:1856
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    - Kills process with taskkill
    PID:904
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2476
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2108
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2448
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2576
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2644
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:1028
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2764
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2904
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:944
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:876
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    - Kills process with taskkill
    PID:1832
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    - Kills process with taskkill
    PID:2868
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    - Kills process with taskkill
    PID:2480
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:1996
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:1544
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:1576
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2508
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2604
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:1108
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:1592
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:1964
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:1404
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:1164
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    - Kills process with taskkill
    PID:2140
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:3044
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:1540
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2520
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2500
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:808
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe /f
    3⤵
    PID:2504
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\21551E~1.EXE > NuL
  2⤵
  - Deletes itself
  PID:2736

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\wlock\wlock.exe

Filesize
77KB

MD5
35d59cddf9703c68e54ce84787464fbf

SHA1
f988df8ba86f6a3d9c76ec0c911cb0e002306155

SHA256
ab589a7db1a68cc8f9427f05217f7e0d10de894b6a1ec270f9a9721869be7058

SHA512
887641b9049eddf4ccabbfa81b96f5addbecc3dc5af0be4018edac7fd545c74547b029416a1adf53a258992ad505185629496e5af937a69c3d3c21e265654338

Download Submit
memory/1752-0-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1752-21-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1752-10-0x00000000003F0000-0x00000000003F1000-memory.dmp

Filesize
4KB

Download
memory/2836-14-0x0000000000080000-0x0000000000081000-memory.dmp

Filesize
4KB

Download
memory/2836-20-0x0000000000070000-0x0000000000071000-memory.dmp

Filesize
4KB

Download
memory/2836-19-0x0000000000070000-0x0000000000071000-memory.dmp

Filesize
4KB

Download
memory/2836-18-0x0000000000070000-0x0000000000071000-memory.dmp

Filesize
4KB

Download
memory/2836-17-0x0000000000070000-0x0000000000071000-memory.dmp

Filesize
4KB

Download
memory/2836-16-0x0000000000070000-0x0000000000071000-memory.dmp

Filesize
4KB

Download
memory/2836-15-0x0000000000070000-0x0000000000071000-memory.dmp

Filesize
4KB

Download
memory/2836-13-0x0000000000070000-0x0000000000071000-memory.dmp

Filesize
4KB

Download
memory/2836-12-0x0000000000070000-0x0000000000071000-memory.dmp

Filesize
4KB

Download
memory/2836-23-0x0000000000070000-0x0000000000071000-memory.dmp

Filesize
4KB

Download
memory/2836-22-0x0000000000070000-0x0000000000071000-memory.dmp

Filesize
4KB

Download
memory/2836-11-0x0000000000070000-0x0000000000071000-memory.dmp

Filesize
4KB

Download
memory/2836-24-0x0000000000070000-0x0000000000071000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads