99ca075d02ae5e665ba87a5bd1bb57b84cdcbafce5a0abae93fcb678c489ee96

Analysis

max time kernel
105s
max time network
120s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
12/08/2024, 02:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8cfc835eb0c76cd156dd77b938b15055_JaffaCakes118.exe
Size

640KB
MD5

8cfc835eb0c76cd156dd77b938b15055
SHA1

b706fb637008ab7345583113d79c4d3f27dcda32
SHA256

99ca075d02ae5e665ba87a5bd1bb57b84cdcbafce5a0abae93fcb678c489ee96
SHA512

66fb749f43d6f4b8d50db45f498012f8a7dbbd0bf995ee2f3c89487b40acfb9a9f00eced7e979fe9977ce6ee5f49f0775f745079d6be1fb2e9d72eb84696c97e
SSDEEP

12288:K2t+p51LpsGLLFjHfS9yZPoOKAgA3S5Fl0m0pcGieSzzQE6p:KiW5Ds2LVjgOjI3HpGFSf

Score

10^/10

discovery evasion persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SHELL = "c:\\windows\\actiw.exe, EXPLORER.EXE"	8cfc835eb0c76cd156dd77b938b15055_JaffaCakes118.exe

Disables Task Manager via registry modification
evasion

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Ñtfmon = "C:\\Users\\Admin\\AppData\\Local\\Temp\\8cfc835eb0c76cd156dd77b938b15055_JaffaCakes118.exe"	8cfc835eb0c76cd156dd77b938b15055_JaffaCakes118.exe

Modifies WinLogon 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\	8cfc835eb0c76cd156dd77b938b15055_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TASKKILL.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TASKKILL.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TASKKILL.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TASKKILL.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TASKKILL.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TASKKILL.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TASKKILL.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TASKKILL.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TASKKILL.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TASKKILL.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TASKKILL.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TASKKILL.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TASKKILL.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TASKKILL.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TASKKILL.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TASKKILL.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TASKKILL.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TASKKILL.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TASKKILL.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TASKKILL.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TASKKILL.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TASKKILL.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TASKKILL.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TASKKILL.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TASKKILL.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TASKKILL.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TASKKILL.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TASKKILL.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TASKKILL.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TASKKILL.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TASKKILL.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TASKKILL.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TASKKILL.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TASKKILL.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TASKKILL.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TASKKILL.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TASKKILL.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TASKKILL.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TASKKILL.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TASKKILL.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TASKKILL.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TASKKILL.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TASKKILL.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TASKKILL.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TASKKILL.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TASKKILL.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TASKKILL.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TASKKILL.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TASKKILL.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TASKKILL.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TASKKILL.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TASKKILL.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TASKKILL.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TASKKILL.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TASKKILL.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TASKKILL.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TASKKILL.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TASKKILL.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TASKKILL.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TASKKILL.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TASKKILL.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TASKKILL.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TASKKILL.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TASKKILL.exe

Kills process with taskkill 64 IoCs

evasion

pid	Process
1188	TASKKILL.exe
2132	TASKKILL.exe
2088	TASKKILL.exe
1316	TASKKILL.exe
2740	TASKKILL.exe
2856	TASKKILL.exe
1944	TASKKILL.exe
2408	TASKKILL.exe
1584	TASKKILL.exe
552	TASKKILL.exe
540	TASKKILL.exe
2000	TASKKILL.exe
2080	TASKKILL.exe
2628	TASKKILL.exe
2984	TASKKILL.exe
1296	TASKKILL.exe
1268	TASKKILL.exe
2476	TASKKILL.exe
2912	TASKKILL.exe
2476	TASKKILL.exe
2748	TASKKILL.exe
2000	TASKKILL.exe
1776	TASKKILL.exe
2304	TASKKILL.exe
2800	TASKKILL.exe
2232	TASKKILL.exe
868	TASKKILL.exe
668	TASKKILL.exe
2364	TASKKILL.exe
2272	TASKKILL.exe
2468	TASKKILL.exe
1188	TASKKILL.exe
1180	TASKKILL.exe
2828	TASKKILL.exe
2368	TASKKILL.exe
2904	TASKKILL.exe
2664	TASKKILL.exe
2764	TASKKILL.exe
2548	TASKKILL.exe
760	TASKKILL.exe
1672	TASKKILL.exe
2896	TASKKILL.exe
1732	TASKKILL.exe
2228	TASKKILL.exe
2732	TASKKILL.exe
2656	TASKKILL.exe
1852	TASKKILL.exe
384	TASKKILL.exe
1824	TASKKILL.exe
2500	TASKKILL.exe
1284	TASKKILL.exe
1768	TASKKILL.exe
2224	TASKKILL.exe
2496	TASKKILL.exe
2752	TASKKILL.exe
2556	TASKKILL.exe
1048	TASKKILL.exe
2296	TASKKILL.exe
1492	TASKKILL.exe
2444	TASKKILL.exe
2948	TASKKILL.exe
1492	TASKKILL.exe
2644	TASKKILL.exe
2036	TASKKILL.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	756	TASKKILL.exe
Token: SeDebugPrivilege	2644	TASKKILL.exe
Token: SeDebugPrivilege	2752	TASKKILL.exe
Token: SeDebugPrivilege	2988	TASKKILL.exe
Token: SeDebugPrivilege	2664	TASKKILL.exe
Token: SeDebugPrivilege	2780	TASKKILL.exe
Token: SeDebugPrivilege	2672	TASKKILL.exe
Token: SeDebugPrivilege	2244	TASKKILL.exe
Token: SeDebugPrivilege	3064	TASKKILL.exe
Token: SeDebugPrivilege	1732	TASKKILL.exe
Token: SeDebugPrivilege	2020	TASKKILL.exe
Token: SeDebugPrivilege	2496	TASKKILL.exe
Token: SeDebugPrivilege	1336	TASKKILL.exe
Token: SeDebugPrivilege	1064	TASKKILL.exe
Token: SeDebugPrivilege	1652	TASKKILL.exe
Token: SeDebugPrivilege	1776	TASKKILL.exe
Token: SeDebugPrivilege	2000	TASKKILL.exe
Token: SeDebugPrivilege	2992	TASKKILL.exe
Token: SeDebugPrivilege	2052	TASKKILL.exe
Token: SeDebugPrivilege	1772	TASKKILL.exe
Token: SeDebugPrivilege	1388	TASKKILL.exe
Token: SeDebugPrivilege	1188	TASKKILL.exe
Token: SeDebugPrivilege	384	TASKKILL.exe
Token: SeDebugPrivilege	632	TASKKILL.exe
Token: SeDebugPrivilege	696	TASKKILL.exe
Token: SeDebugPrivilege	1864	TASKKILL.exe
Token: SeDebugPrivilege	2420	TASKKILL.exe
Token: SeDebugPrivilege	2364	TASKKILL.exe
Token: SeDebugPrivilege	2080	TASKKILL.exe
Token: SeDebugPrivilege	2444	TASKKILL.exe
Token: SeDebugPrivilege	852	TASKKILL.exe
Token: SeDebugPrivilege	2696	TASKKILL.exe
Token: SeDebugPrivilege	2224	TASKKILL.exe
Token: SeDebugPrivilege	2820	TASKKILL.exe
Token: SeDebugPrivilege	2788	TASKKILL.exe
Token: SeDebugPrivilege	1572	TASKKILL.exe
Token: SeDebugPrivilege	2752	TASKKILL.exe
Token: SeDebugPrivilege	2484	TASKKILL.exe
Token: SeDebugPrivilege	2944	TASKKILL.exe
Token: SeDebugPrivilege	2860	TASKKILL.exe
Token: SeDebugPrivilege	2756	TASKKILL.exe
Token: SeDebugPrivilege	2920	TASKKILL.exe
Token: SeDebugPrivilege	2264	TASKKILL.exe
Token: SeDebugPrivilege	328	TASKKILL.exe
Token: SeDebugPrivilege	972	TASKKILL.exe
Token: SeDebugPrivilege	2040	TASKKILL.exe
Token: SeDebugPrivilege	1272	TASKKILL.exe
Token: SeDebugPrivilege	2116	TASKKILL.exe
Token: SeDebugPrivilege	1204	TASKKILL.exe
Token: SeDebugPrivilege	2500	TASKKILL.exe
Token: SeDebugPrivilege	2084	TASKKILL.exe
Token: SeDebugPrivilege	2388	TASKKILL.exe
Token: SeDebugPrivilege	916	TASKKILL.exe
Token: SeDebugPrivilege	1748	TASKKILL.exe
Token: SeDebugPrivilege	2628	TASKKILL.exe
Token: SeDebugPrivilege	1528	TASKKILL.exe
Token: SeDebugPrivilege	2208	TASKKILL.exe
Token: SeDebugPrivilege	3016	TASKKILL.exe
Token: SeDebugPrivilege	2028	TASKKILL.exe
Token: SeDebugPrivilege	1840	TASKKILL.exe
Token: SeDebugPrivilege	2252	TASKKILL.exe
Token: SeDebugPrivilege	1476	TASKKILL.exe
Token: SeDebugPrivilege	1896	TASKKILL.exe
Token: SeDebugPrivilege	1364	TASKKILL.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2456 wrote to memory of 756	2456	8cfc835eb0c76cd156dd77b938b15055_JaffaCakes118.exe	30
PID 2456 wrote to memory of 756	2456	8cfc835eb0c76cd156dd77b938b15055_JaffaCakes118.exe	30
PID 2456 wrote to memory of 756	2456	8cfc835eb0c76cd156dd77b938b15055_JaffaCakes118.exe	30
PID 2456 wrote to memory of 756	2456	8cfc835eb0c76cd156dd77b938b15055_JaffaCakes118.exe	30
PID 2456 wrote to memory of 2644	2456	8cfc835eb0c76cd156dd77b938b15055_JaffaCakes118.exe	33
PID 2456 wrote to memory of 2644	2456	8cfc835eb0c76cd156dd77b938b15055_JaffaCakes118.exe	33
PID 2456 wrote to memory of 2644	2456	8cfc835eb0c76cd156dd77b938b15055_JaffaCakes118.exe	33
PID 2456 wrote to memory of 2644	2456	8cfc835eb0c76cd156dd77b938b15055_JaffaCakes118.exe	33
PID 2456 wrote to memory of 2752	2456	8cfc835eb0c76cd156dd77b938b15055_JaffaCakes118.exe	34
PID 2456 wrote to memory of 2752	2456	8cfc835eb0c76cd156dd77b938b15055_JaffaCakes118.exe	34
PID 2456 wrote to memory of 2752	2456	8cfc835eb0c76cd156dd77b938b15055_JaffaCakes118.exe	34
PID 2456 wrote to memory of 2752	2456	8cfc835eb0c76cd156dd77b938b15055_JaffaCakes118.exe	34
PID 2456 wrote to memory of 2780	2456	8cfc835eb0c76cd156dd77b938b15055_JaffaCakes118.exe	36
PID 2456 wrote to memory of 2780	2456	8cfc835eb0c76cd156dd77b938b15055_JaffaCakes118.exe	36
PID 2456 wrote to memory of 2780	2456	8cfc835eb0c76cd156dd77b938b15055_JaffaCakes118.exe	36
PID 2456 wrote to memory of 2780	2456	8cfc835eb0c76cd156dd77b938b15055_JaffaCakes118.exe	36
PID 2456 wrote to memory of 2988	2456	8cfc835eb0c76cd156dd77b938b15055_JaffaCakes118.exe	38
PID 2456 wrote to memory of 2988	2456	8cfc835eb0c76cd156dd77b938b15055_JaffaCakes118.exe	38
PID 2456 wrote to memory of 2988	2456	8cfc835eb0c76cd156dd77b938b15055_JaffaCakes118.exe	38
PID 2456 wrote to memory of 2988	2456	8cfc835eb0c76cd156dd77b938b15055_JaffaCakes118.exe	38
PID 2456 wrote to memory of 2664	2456	8cfc835eb0c76cd156dd77b938b15055_JaffaCakes118.exe	40
PID 2456 wrote to memory of 2664	2456	8cfc835eb0c76cd156dd77b938b15055_JaffaCakes118.exe	40
PID 2456 wrote to memory of 2664	2456	8cfc835eb0c76cd156dd77b938b15055_JaffaCakes118.exe	40
PID 2456 wrote to memory of 2664	2456	8cfc835eb0c76cd156dd77b938b15055_JaffaCakes118.exe	40
PID 2456 wrote to memory of 2672	2456	8cfc835eb0c76cd156dd77b938b15055_JaffaCakes118.exe	42
PID 2456 wrote to memory of 2672	2456	8cfc835eb0c76cd156dd77b938b15055_JaffaCakes118.exe	42
PID 2456 wrote to memory of 2672	2456	8cfc835eb0c76cd156dd77b938b15055_JaffaCakes118.exe	42
PID 2456 wrote to memory of 2672	2456	8cfc835eb0c76cd156dd77b938b15055_JaffaCakes118.exe	42
PID 2456 wrote to memory of 2244	2456	8cfc835eb0c76cd156dd77b938b15055_JaffaCakes118.exe	45
PID 2456 wrote to memory of 2244	2456	8cfc835eb0c76cd156dd77b938b15055_JaffaCakes118.exe	45
PID 2456 wrote to memory of 2244	2456	8cfc835eb0c76cd156dd77b938b15055_JaffaCakes118.exe	45
PID 2456 wrote to memory of 2244	2456	8cfc835eb0c76cd156dd77b938b15055_JaffaCakes118.exe	45
PID 2456 wrote to memory of 1732	2456	8cfc835eb0c76cd156dd77b938b15055_JaffaCakes118.exe	46
PID 2456 wrote to memory of 1732	2456	8cfc835eb0c76cd156dd77b938b15055_JaffaCakes118.exe	46
PID 2456 wrote to memory of 1732	2456	8cfc835eb0c76cd156dd77b938b15055_JaffaCakes118.exe	46
PID 2456 wrote to memory of 1732	2456	8cfc835eb0c76cd156dd77b938b15055_JaffaCakes118.exe	46
PID 2456 wrote to memory of 2496	2456	8cfc835eb0c76cd156dd77b938b15055_JaffaCakes118.exe	47
PID 2456 wrote to memory of 2496	2456	8cfc835eb0c76cd156dd77b938b15055_JaffaCakes118.exe	47
PID 2456 wrote to memory of 2496	2456	8cfc835eb0c76cd156dd77b938b15055_JaffaCakes118.exe	47
PID 2456 wrote to memory of 2496	2456	8cfc835eb0c76cd156dd77b938b15055_JaffaCakes118.exe	47
PID 2456 wrote to memory of 1336	2456	8cfc835eb0c76cd156dd77b938b15055_JaffaCakes118.exe	50
PID 2456 wrote to memory of 1336	2456	8cfc835eb0c76cd156dd77b938b15055_JaffaCakes118.exe	50
PID 2456 wrote to memory of 1336	2456	8cfc835eb0c76cd156dd77b938b15055_JaffaCakes118.exe	50
PID 2456 wrote to memory of 1336	2456	8cfc835eb0c76cd156dd77b938b15055_JaffaCakes118.exe	50
PID 2456 wrote to memory of 2020	2456	8cfc835eb0c76cd156dd77b938b15055_JaffaCakes118.exe	51
PID 2456 wrote to memory of 2020	2456	8cfc835eb0c76cd156dd77b938b15055_JaffaCakes118.exe	51
PID 2456 wrote to memory of 2020	2456	8cfc835eb0c76cd156dd77b938b15055_JaffaCakes118.exe	51
PID 2456 wrote to memory of 2020	2456	8cfc835eb0c76cd156dd77b938b15055_JaffaCakes118.exe	51
PID 2456 wrote to memory of 3064	2456	8cfc835eb0c76cd156dd77b938b15055_JaffaCakes118.exe	52
PID 2456 wrote to memory of 3064	2456	8cfc835eb0c76cd156dd77b938b15055_JaffaCakes118.exe	52
PID 2456 wrote to memory of 3064	2456	8cfc835eb0c76cd156dd77b938b15055_JaffaCakes118.exe	52
PID 2456 wrote to memory of 3064	2456	8cfc835eb0c76cd156dd77b938b15055_JaffaCakes118.exe	52
PID 2456 wrote to memory of 1776	2456	8cfc835eb0c76cd156dd77b938b15055_JaffaCakes118.exe	57
PID 2456 wrote to memory of 1776	2456	8cfc835eb0c76cd156dd77b938b15055_JaffaCakes118.exe	57
PID 2456 wrote to memory of 1776	2456	8cfc835eb0c76cd156dd77b938b15055_JaffaCakes118.exe	57
PID 2456 wrote to memory of 1776	2456	8cfc835eb0c76cd156dd77b938b15055_JaffaCakes118.exe	57
PID 2456 wrote to memory of 1064	2456	8cfc835eb0c76cd156dd77b938b15055_JaffaCakes118.exe	58
PID 2456 wrote to memory of 1064	2456	8cfc835eb0c76cd156dd77b938b15055_JaffaCakes118.exe	58
PID 2456 wrote to memory of 1064	2456	8cfc835eb0c76cd156dd77b938b15055_JaffaCakes118.exe	58
PID 2456 wrote to memory of 1064	2456	8cfc835eb0c76cd156dd77b938b15055_JaffaCakes118.exe	58
PID 2456 wrote to memory of 1652	2456	8cfc835eb0c76cd156dd77b938b15055_JaffaCakes118.exe	59
PID 2456 wrote to memory of 1652	2456	8cfc835eb0c76cd156dd77b938b15055_JaffaCakes118.exe	59
PID 2456 wrote to memory of 1652	2456	8cfc835eb0c76cd156dd77b938b15055_JaffaCakes118.exe	59
PID 2456 wrote to memory of 1652	2456	8cfc835eb0c76cd156dd77b938b15055_JaffaCakes118.exe	59

C:\Users\Admin\AppData\Local\Temp\8cfc835eb0c76cd156dd77b938b15055_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\8cfc835eb0c76cd156dd77b938b15055_JaffaCakes118.exe"
1⤵
- Modifies WinLogon for persistence
- Adds Run key to start application
- Modifies WinLogon
- Suspicious use of WriteProcessMemory
PID:2456
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM explorer.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:756
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM taskmgr.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2644
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedit.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2752
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedt32.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2780
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM msconfig.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:2988
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM starter.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2664
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM cmd.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2672
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM taskmgr.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:2244
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedit.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1732
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedt32.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2496
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM msconfig.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1336
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM starter.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2020
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM cmd.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3064
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM taskmgr.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1776
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedit.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1064
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedt32.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1652
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM msconfig.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2000
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM starter.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2052
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM cmd.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2992
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM taskmgr.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1388
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedit.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1188
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedt32.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:384
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM msconfig.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1772
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM starter.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:632
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM cmd.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:696
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM taskmgr.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1864
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedit.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2420
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedt32.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2080
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM msconfig.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2444
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM starter.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:852
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM cmd.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2364
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM taskmgr.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2224
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedit.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2820
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedt32.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2696
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM msconfig.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2788
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM starter.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1572
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM cmd.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2752
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM taskmgr.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2756
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedit.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2484
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedt32.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:2860
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM msconfig.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2944
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM starter.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2264
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM cmd.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2920
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM taskmgr.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2040
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedit.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:328
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedt32.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:972
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM msconfig.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1272
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM starter.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1204
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM cmd.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2116
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM taskmgr.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2500
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedit.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2388
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedt32.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:916
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM msconfig.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2084
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM starter.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1748
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM cmd.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2628
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM taskmgr.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2208
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedit.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1528
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedt32.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3016
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM msconfig.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1840
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM starter.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2252
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM cmd.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2028
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM taskmgr.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1364
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedit.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1476
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedt32.exe
  2⤵
  PID:1656
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM msconfig.exe
  2⤵
  PID:1360
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM starter.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1896
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM cmd.exe
  2⤵
  PID:1916
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM taskmgr.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2608
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedit.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2824
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedt32.exe
  2⤵
  PID:2816
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM msconfig.exe
  2⤵
  PID:2584
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM starter.exe
  2⤵
  PID:2724
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM cmd.exe
  2⤵
  - Kills process with taskkill
  PID:2476
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM taskmgr.exe
  2⤵
  PID:2020
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedit.exe
  2⤵
  PID:2920
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedt32.exe
  2⤵
  PID:1900
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM msconfig.exe
  2⤵
  PID:1988
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM starter.exe
  2⤵
  PID:2836
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM cmd.exe
  2⤵
  PID:1648
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM taskmgr.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2984
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedit.exe
  2⤵
  PID:2380
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedt32.exe
  2⤵
  PID:2340
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM msconfig.exe
  2⤵
  PID:760
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM starter.exe
  2⤵
  PID:2116
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM cmd.exe
  2⤵
  PID:2312
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM taskmgr.exe
  2⤵
  PID:1356
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedit.exe
  2⤵
  PID:1844
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedt32.exe
  2⤵
  PID:2628
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM msconfig.exe
  2⤵
  PID:1716
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM starter.exe
  2⤵
  PID:2500
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM cmd.exe
  2⤵
  PID:1480
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM taskmgr.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1288
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedit.exe
  2⤵
  PID:1264
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedt32.exe
  2⤵
  PID:2216
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM msconfig.exe
  2⤵
  PID:1584
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM starter.exe
  2⤵
  PID:1672
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM cmd.exe
  2⤵
  PID:2620
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM taskmgr.exe
  2⤵
  PID:1360
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedit.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2700
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedt32.exe
  2⤵
  - Kills process with taskkill
  PID:2896
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM msconfig.exe
  2⤵
  PID:1656
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM starter.exe
  2⤵
  PID:940
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM cmd.exe
  2⤵
  PID:2492
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM taskmgr.exe
  2⤵
  PID:2356
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedit.exe
  2⤵
  PID:2724
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedt32.exe
  2⤵
  - Kills process with taskkill
  PID:1732
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM msconfig.exe
  2⤵
  PID:1964
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM starter.exe
  2⤵
  PID:1268
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM cmd.exe
  2⤵
  PID:2848
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM taskmgr.exe
  2⤵
  PID:2300
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedit.exe
  2⤵
  PID:824
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedt32.exe
  2⤵
  PID:1424
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM msconfig.exe
  2⤵
  PID:1988
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM starter.exe
  2⤵
  PID:1272
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM cmd.exe
  2⤵
  PID:2192
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM taskmgr.exe
  2⤵
  PID:1212
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedit.exe
  2⤵
  PID:2340
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedt32.exe
  2⤵
  PID:600
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM msconfig.exe
  2⤵
  PID:1580
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM starter.exe
  2⤵
  - Kills process with taskkill
  PID:2984
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM cmd.exe
  2⤵
  PID:1552
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM taskmgr.exe
  2⤵
  PID:2876
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedit.exe
  2⤵
  PID:1992
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedt32.exe
  2⤵
  PID:384
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM msconfig.exe
  2⤵
  PID:1316
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM starter.exe
  2⤵
  PID:2076
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM cmd.exe
  2⤵
  PID:1636
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM taskmgr.exe
  2⤵
  PID:1668
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedit.exe
  2⤵
  PID:2744
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedt32.exe
  2⤵
  - Kills process with taskkill
  PID:2556
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM msconfig.exe
  2⤵
  PID:2660
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM starter.exe
  2⤵
  PID:2808
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM cmd.exe
  2⤵
  PID:2128
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM taskmgr.exe
  2⤵
  PID:896
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedit.exe
  2⤵
  PID:2912
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedt32.exe
  2⤵
  PID:1948
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM msconfig.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2264
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM starter.exe
  2⤵
  PID:2816
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM cmd.exe
  2⤵
  PID:2924
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM taskmgr.exe
  2⤵
  - Kills process with taskkill
  PID:2036
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedit.exe
  2⤵
  PID:3032
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedt32.exe
  2⤵
  PID:2336
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM msconfig.exe
  2⤵
  PID:1848
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM starter.exe
  2⤵
  PID:3056
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM cmd.exe
  2⤵
  PID:2640
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM taskmgr.exe
  2⤵
  PID:2380
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedit.exe
  2⤵
  PID:1008
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedt32.exe
  2⤵
  PID:1664
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM msconfig.exe
  2⤵
  PID:1188
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM starter.exe
  2⤵
  PID:2312
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM cmd.exe
  2⤵
  PID:2192
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM taskmgr.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2028
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedit.exe
  2⤵
  - Kills process with taskkill
  PID:2500
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedt32.exe
  2⤵
  PID:2012
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM msconfig.exe
  2⤵
  PID:2392
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM starter.exe
  2⤵
  PID:2400
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM cmd.exe
  2⤵
  PID:1340
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM taskmgr.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:684
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedit.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1636
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedt32.exe
  2⤵
  PID:2088
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM msconfig.exe
  2⤵
  PID:2252
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM starter.exe
  2⤵
  PID:2596
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM cmd.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2788
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM taskmgr.exe
  2⤵
  PID:2552
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedit.exe
  2⤵
  PID:2808
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedt32.exe
  2⤵
  PID:2748
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM msconfig.exe
  2⤵
  PID:2792
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM starter.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2128
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM cmd.exe
  2⤵
  PID:1892
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM taskmgr.exe
  2⤵
  PID:2916
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedit.exe
  2⤵
  PID:3060
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedt32.exe
  2⤵
  PID:2884
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM msconfig.exe
  2⤵
  PID:2924
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM starter.exe
  2⤵
  PID:2720
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM cmd.exe
  2⤵
  - Kills process with taskkill
  PID:1944
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM taskmgr.exe
  2⤵
  PID:860
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedit.exe
  2⤵
  PID:1304
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedt32.exe
  2⤵
  PID:1968
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM msconfig.exe
  2⤵
  - Kills process with taskkill
  PID:1492
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM starter.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2640
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM cmd.exe
  2⤵
  PID:1208
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM taskmgr.exe
  2⤵
  PID:2184
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedit.exe
  2⤵
  - Kills process with taskkill
  PID:2408
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedt32.exe
  2⤵
  PID:2440
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM msconfig.exe
  2⤵
  PID:1592
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM starter.exe
  2⤵
  PID:2240
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM cmd.exe
  2⤵
  PID:2528
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM taskmgr.exe
  2⤵
  PID:2400
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedit.exe
  2⤵
  PID:2600
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedt32.exe
  2⤵
  PID:1264
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM msconfig.exe
  2⤵
  PID:2812
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM starter.exe
  2⤵
  PID:2216
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM cmd.exe
  2⤵
  PID:2804
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM taskmgr.exe
  2⤵
  PID:2616
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedit.exe
  2⤵
  PID:2824
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedt32.exe
  2⤵
  PID:2172
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM msconfig.exe
  2⤵
  PID:2708
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM starter.exe
  2⤵
  PID:684
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM cmd.exe
  2⤵
  PID:540
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM taskmgr.exe
  2⤵
  PID:1064
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedit.exe
  2⤵
  PID:2828
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedt32.exe
  2⤵
  PID:1948
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM msconfig.exe
  2⤵
  PID:1168
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM starter.exe
  2⤵
  PID:2532
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM cmd.exe
  2⤵
  PID:2196
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM taskmgr.exe
  2⤵
  PID:1516
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedit.exe
  2⤵
  PID:2020
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedt32.exe
  2⤵
  PID:1624
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM msconfig.exe
  2⤵
  PID:2880
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM starter.exe
  2⤵
  PID:2164
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM cmd.exe
  2⤵
  PID:2152
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM taskmgr.exe
  2⤵
  PID:1008
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedit.exe
  2⤵
  PID:1304
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedt32.exe
  2⤵
  PID:1492
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM msconfig.exe
  2⤵
  PID:1844
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM starter.exe
  2⤵
  PID:1716
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM cmd.exe
  2⤵
  PID:1212
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM taskmgr.exe
  2⤵
  PID:1560
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedit.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2984
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedt32.exe
  2⤵
  PID:2040
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM msconfig.exe
  2⤵
  PID:1584
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM starter.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:332
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM cmd.exe
  2⤵
  PID:1340
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM taskmgr.exe
  2⤵
  PID:2676
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedit.exe
  2⤵
  PID:2168
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedt32.exe
  2⤵
  PID:3036
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM msconfig.exe
  2⤵
  PID:2764
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM starter.exe
  2⤵
  PID:2804
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM cmd.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1296
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM taskmgr.exe
  2⤵
  PID:2704
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedit.exe
  2⤵
  PID:2724
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedt32.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2368
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM msconfig.exe
  2⤵
  PID:2288
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM starter.exe
  2⤵
  PID:2832
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM cmd.exe
  2⤵
  PID:1488
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM taskmgr.exe
  2⤵
  PID:1648
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedit.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2884
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedt32.exe
  2⤵
  PID:2632
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM msconfig.exe
  2⤵
  PID:1424
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM starter.exe
  2⤵
  - Kills process with taskkill
  PID:2912
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM cmd.exe
  2⤵
  PID:868
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM taskmgr.exe
  2⤵
  PID:2248
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedit.exe
  2⤵
  PID:2640
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedt32.exe
  2⤵
  PID:2668
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM msconfig.exe
  2⤵
  PID:1920
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM starter.exe
  2⤵
  PID:3012
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM cmd.exe
  2⤵
  PID:1208
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM taskmgr.exe
  2⤵
  - Kills process with taskkill
  PID:1180
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedit.exe
  2⤵
  PID:384
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedt32.exe
  2⤵
  PID:1848
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM msconfig.exe
  2⤵
  PID:600
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM starter.exe
  2⤵
  PID:2740
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM cmd.exe
  2⤵
  PID:2656
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM taskmgr.exe
  2⤵
  - Kills process with taskkill
  PID:2088
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedit.exe
  2⤵
  PID:2716
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedt32.exe
  2⤵
  PID:1584
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM msconfig.exe
  2⤵
  PID:1668
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM starter.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2984
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM cmd.exe
  2⤵
  - Kills process with taskkill
  PID:1316
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM taskmgr.exe
  2⤵
  PID:972
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedit.exe
  2⤵
  PID:2940
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedt32.exe
  2⤵
  - Kills process with taskkill
  PID:1296
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM msconfig.exe
  2⤵
  PID:2348
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM starter.exe
  2⤵
  PID:2804
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM cmd.exe
  2⤵
  PID:2664
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM taskmgr.exe
  2⤵
  PID:2000
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedit.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1288
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedt32.exe
  2⤵
  PID:1064
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM msconfig.exe
  2⤵
  PID:2276
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM starter.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2924
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM cmd.exe
  2⤵
  PID:2244
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM taskmgr.exe
  2⤵
  PID:1948
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedit.exe
  2⤵
  PID:2912
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedt32.exe
  2⤵
  PID:900
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM msconfig.exe
  2⤵
  PID:2632
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM starter.exe
  2⤵
  PID:2880
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM cmd.exe
  2⤵
  PID:2916
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM taskmgr.exe
  2⤵
  PID:1176
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedit.exe
  2⤵
  - Kills process with taskkill
  PID:2228
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedt32.exe
  2⤵
  PID:2528
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM msconfig.exe
  2⤵
  PID:1208
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM starter.exe
  2⤵
  PID:2628
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM cmd.exe
  2⤵
  PID:1588
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM taskmgr.exe
  2⤵
  PID:2656
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedit.exe
  2⤵
  PID:2468
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedt32.exe
  2⤵
  PID:2896
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM msconfig.exe
  2⤵
  PID:1816
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM starter.exe
  2⤵
  PID:2592
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM cmd.exe
  2⤵
  - Kills process with taskkill
  PID:2364
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM taskmgr.exe
  2⤵
  PID:2948
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedit.exe
  2⤵
  PID:2900
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedt32.exe
  2⤵
  PID:1584
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM msconfig.exe
  2⤵
  PID:2908
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM starter.exe
  2⤵
  PID:2056
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM cmd.exe
  2⤵
  PID:2388
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM taskmgr.exe
  2⤵
  PID:2664
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedit.exe
  2⤵
  PID:2848
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedt32.exe
  2⤵
  PID:2704
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM msconfig.exe
  2⤵
  PID:1296
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM starter.exe
  2⤵
  - Kills process with taskkill
  PID:2476
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM cmd.exe
  2⤵
  PID:2804
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM taskmgr.exe
  2⤵
  PID:1532
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedit.exe
  2⤵
  PID:888
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedt32.exe
  2⤵
  PID:1284
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM msconfig.exe
  2⤵
  PID:1904
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM starter.exe
  2⤵
  PID:1188
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM cmd.exe
  2⤵
  PID:1528
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM taskmgr.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1060
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedit.exe
  2⤵
  PID:1048
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedt32.exe
  2⤵
  PID:944
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM msconfig.exe
  2⤵
  PID:2668
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM starter.exe
  2⤵
  PID:1164
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM cmd.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2960
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM taskmgr.exe
  2⤵
  PID:2112
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedit.exe
  2⤵
  PID:2892
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedt32.exe
  2⤵
  PID:1204
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM msconfig.exe
  2⤵
  PID:1984
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM starter.exe
  2⤵
  PID:1012
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM cmd.exe
  2⤵
  PID:576
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM taskmgr.exe
  2⤵
  PID:2860
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedit.exe
  2⤵
  PID:2772
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedt32.exe
  2⤵
  PID:852
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM msconfig.exe
  2⤵
  PID:2760
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM starter.exe
  2⤵
  PID:2472
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM cmd.exe
  2⤵
  PID:2736
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM taskmgr.exe
  2⤵
  PID:2724
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedit.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:328
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedt32.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1360
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM msconfig.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2956
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM starter.exe
  2⤵
  PID:928
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM cmd.exe
  2⤵
  PID:2988
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM taskmgr.exe
  2⤵
  PID:3000
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedit.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2940
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedt32.exe
  2⤵
  PID:2868
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM msconfig.exe
  2⤵
  PID:748
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM starter.exe
  2⤵
  PID:2532
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM cmd.exe
  2⤵
  PID:2832
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM taskmgr.exe
  2⤵
  PID:1932
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedit.exe
  2⤵
  PID:1992
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedt32.exe
  2⤵
  PID:3068
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM msconfig.exe
  2⤵
  PID:1516
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM starter.exe
  2⤵
  - Kills process with taskkill
  PID:1188
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM cmd.exe
  2⤵
  PID:1364
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM taskmgr.exe
  2⤵
  PID:860
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedit.exe
  2⤵
  PID:1588
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedt32.exe
  2⤵
  PID:1420
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM msconfig.exe
  2⤵
  PID:2176
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM starter.exe
  2⤵
  PID:2040
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM cmd.exe
  2⤵
  PID:2084
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM taskmgr.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  PID:2740
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedit.exe
  2⤵
  PID:2064
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedt32.exe
  2⤵
  PID:2812
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM msconfig.exe
  2⤵
  PID:2972
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM starter.exe
  2⤵
  PID:2992
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM cmd.exe
  2⤵
  PID:2104
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM taskmgr.exe
  2⤵
  PID:2948
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedit.exe
  2⤵
  - Kills process with taskkill
  PID:2644
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedt32.exe
  2⤵
  PID:852
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM msconfig.exe
  2⤵
  PID:2552
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM starter.exe
  2⤵
  PID:1336
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM cmd.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2252
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM taskmgr.exe
  2⤵
  PID:1488
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedit.exe
  2⤵
  PID:1288
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedt32.exe
  2⤵
  - Kills process with taskkill
  PID:1584
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM msconfig.exe
  2⤵
  PID:2288
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM starter.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:328
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM cmd.exe
  2⤵
  - Kills process with taskkill
  PID:2000
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM taskmgr.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3056
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedit.exe
  2⤵
  PID:1692
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedt32.exe
  2⤵
  PID:2868
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM msconfig.exe
  2⤵
  PID:2016
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM starter.exe
  2⤵
  PID:2340
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM cmd.exe
  2⤵
  PID:2244
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM taskmgr.exe
  2⤵
  PID:2932
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedit.exe
  2⤵
  PID:1768
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedt32.exe
  2⤵
  PID:2184
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM msconfig.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2444
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM starter.exe
  2⤵
  PID:2668
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM cmd.exe
  2⤵
  PID:1844
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM taskmgr.exe
  2⤵
  - Kills process with taskkill
  PID:2732
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedit.exe
  2⤵
  PID:1920
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedt32.exe
  2⤵
  PID:2224
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM msconfig.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2176
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM starter.exe
  2⤵
  PID:2628
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM cmd.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2856
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM taskmgr.exe
  2⤵
  PID:2368
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedit.exe
  2⤵
  PID:1668
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedt32.exe
  2⤵
  PID:2260
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM msconfig.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  PID:2904
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM starter.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1676
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM cmd.exe
  2⤵
  PID:1812
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM taskmgr.exe
  2⤵
  PID:852
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedit.exe
  2⤵
  PID:2196
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedt32.exe
  2⤵
  PID:1360
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM msconfig.exe
  2⤵
  PID:1944
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM starter.exe
  2⤵
  PID:2056
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM cmd.exe
  2⤵
  PID:2644
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM taskmgr.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:824
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedit.exe
  2⤵
  PID:2728
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedt32.exe
  2⤵
  PID:816
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM msconfig.exe
  2⤵
  PID:1828
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM starter.exe
  2⤵
  PID:868
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM cmd.exe
  2⤵
  PID:2072
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM taskmgr.exe
  2⤵
  - Kills process with taskkill
  PID:1048
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedit.exe
  2⤵
  PID:1936
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedt32.exe
  2⤵
  PID:1532
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM msconfig.exe
  2⤵
  PID:2496
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM starter.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2012
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM cmd.exe
  2⤵
  PID:1624
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM taskmgr.exe
  2⤵
  PID:2184
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedit.exe
  2⤵
  PID:1636
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedt32.exe
  2⤵
  PID:384
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM msconfig.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2188
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM starter.exe
  2⤵
  PID:1492
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM cmd.exe
  2⤵
  PID:1904
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM taskmgr.exe
  2⤵
  PID:1316
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedit.exe
  2⤵
  PID:2616
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedt32.exe
  2⤵
  PID:2104
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM msconfig.exe
  2⤵
  PID:1356
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM starter.exe
  2⤵
  PID:2224
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM cmd.exe
  2⤵
  PID:2756
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM taskmgr.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2836
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedit.exe
  2⤵
  PID:1644
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedt32.exe
  2⤵
  PID:332
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM msconfig.exe
  2⤵
  PID:1732
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM starter.exe
  2⤵
  PID:2236
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM cmd.exe
  2⤵
  PID:2968
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM taskmgr.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1892
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedit.exe
  2⤵
  PID:2988
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedt32.exe
  2⤵
  PID:908
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM msconfig.exe
  2⤵
  PID:1720
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM starter.exe
  2⤵
  - Kills process with taskkill
  PID:1268
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM cmd.exe
  2⤵
  - Kills process with taskkill
  PID:2664
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM taskmgr.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1744
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedit.exe
  2⤵
  PID:888
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedt32.exe
  2⤵
  PID:2460
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM msconfig.exe
  2⤵
  PID:2052
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM starter.exe
  2⤵
  PID:2888
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM cmd.exe
  2⤵
  PID:2072
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM taskmgr.exe
  2⤵
  PID:2116
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedit.exe
  2⤵
  PID:2244
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedt32.exe
  2⤵
  PID:1504
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM msconfig.exe
  2⤵
  PID:2652
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM starter.exe
  2⤵
  PID:1648
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM cmd.exe
  2⤵
  PID:1020
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM taskmgr.exe
  2⤵
  PID:2392
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedit.exe
  2⤵
  PID:1420
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedt32.exe
  2⤵
  PID:2656
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM msconfig.exe
  2⤵
  PID:1636
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM starter.exe
  2⤵
  PID:1164
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM cmd.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2184
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM taskmgr.exe
  2⤵
  PID:3060
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedit.exe
  2⤵
  PID:2788
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedt32.exe
  2⤵
  PID:2616
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM msconfig.exe
  2⤵
  PID:2572
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM starter.exe
  2⤵
  PID:2936
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM cmd.exe
  2⤵
  PID:2904
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM taskmgr.exe
  2⤵
  PID:2972
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedit.exe
  2⤵
  PID:2696
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedt32.exe
  2⤵
  PID:2464
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM msconfig.exe
  2⤵
  PID:1640
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM starter.exe
  2⤵
  - Kills process with taskkill
  PID:2232
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM cmd.exe
  2⤵
  PID:1832
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM taskmgr.exe
  2⤵
  PID:2136
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedit.exe
  2⤵
  PID:2988
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedt32.exe
  2⤵
  PID:1776
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM msconfig.exe
  2⤵
  PID:1944
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM starter.exe
  2⤵
  PID:2636
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM cmd.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2024
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM taskmgr.exe
  2⤵
  PID:1208
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedit.exe
  2⤵
  PID:868
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedt32.exe
  2⤵
  PID:1552
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM msconfig.exe
  2⤵
  PID:996
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM starter.exe
  2⤵
  PID:2844
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM cmd.exe
  2⤵
  PID:2212
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM taskmgr.exe
  2⤵
  PID:912
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedit.exe
  2⤵
  PID:2244
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedt32.exe
  2⤵
  PID:2632
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM msconfig.exe
  2⤵
  PID:2932
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM starter.exe
  2⤵
  PID:1260
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM cmd.exe
  2⤵
  PID:1716
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM taskmgr.exe
  2⤵
  PID:2408
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedit.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2184
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedt32.exe
  2⤵
  PID:2172
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM msconfig.exe
  2⤵
  PID:2560
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM starter.exe
  2⤵
  PID:2612
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM cmd.exe
  2⤵
  PID:1840
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM taskmgr.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2736
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedit.exe
  2⤵
  PID:2224
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedt32.exe
  2⤵
  PID:2896
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM msconfig.exe
  2⤵
  PID:1920
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM starter.exe
  2⤵
  PID:2292
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM cmd.exe
  2⤵
  PID:1168
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM taskmgr.exe
  2⤵
  PID:2972
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedit.exe
  2⤵
  PID:1572
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedt32.exe
  2⤵
  PID:1780
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM msconfig.exe
  2⤵
  PID:2780
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM starter.exe
  2⤵
  PID:2388
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM cmd.exe
  2⤵
  PID:2036
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM taskmgr.exe
  2⤵
  PID:2476
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedit.exe
  2⤵
  PID:632
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedt32.exe
  2⤵
  PID:552
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM msconfig.exe
  2⤵
  PID:1500
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM starter.exe
  2⤵
  PID:908
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM cmd.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:968
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM taskmgr.exe
  2⤵
  PID:2332
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedit.exe
  2⤵
  PID:1552
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedt32.exe
  2⤵
  PID:2268
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM msconfig.exe
  2⤵
  PID:2212
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM starter.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1340
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM cmd.exe
  2⤵
  PID:2800
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM taskmgr.exe
  2⤵
  - Kills process with taskkill
  PID:2272
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedit.exe
  2⤵
  PID:2828
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedt32.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3056
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM msconfig.exe
  2⤵
  PID:2632
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM starter.exe
  2⤵
  PID:1476
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM cmd.exe
  2⤵
  PID:2244
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM taskmgr.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3016
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedit.exe
  2⤵
  PID:2408
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedt32.exe
  2⤵
  PID:1904
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM msconfig.exe
  2⤵
  PID:1492
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM starter.exe
  2⤵
  PID:2076
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM cmd.exe
  2⤵
  PID:1212
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM taskmgr.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:972
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedit.exe
  2⤵
  PID:2356
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedt32.exe
  2⤵
  PID:1116
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM msconfig.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2528
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM starter.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2292
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM cmd.exe
  2⤵
  PID:2556
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM taskmgr.exe
  2⤵
  PID:1544
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedit.exe
  2⤵
  PID:1344
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedt32.exe
  2⤵
  PID:1064
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM msconfig.exe
  2⤵
  PID:1780
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM starter.exe
  2⤵
  PID:2464
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM cmd.exe
  2⤵
  PID:2300
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM taskmgr.exe
  2⤵
  PID:1708
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedit.exe
  2⤵
  PID:2700
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedt32.exe
  2⤵
  PID:1776
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM msconfig.exe
  2⤵
  PID:2988
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM starter.exe
  2⤵
  PID:2324
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM cmd.exe
  2⤵
  PID:2192
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM taskmgr.exe
  2⤵
  PID:2928
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedit.exe
  2⤵
  PID:2888
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedt32.exe
  2⤵
  PID:1616
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM msconfig.exe
  2⤵
  PID:2288
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM starter.exe
  2⤵
  PID:2660
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM cmd.exe
  2⤵
  PID:2784
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM taskmgr.exe
  2⤵
  PID:1844
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedit.exe
  2⤵
  PID:1852
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedt32.exe
  2⤵
  PID:860
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM msconfig.exe
  2⤵
  PID:2828
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM starter.exe
  2⤵
  PID:2364
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM cmd.exe
  2⤵
  PID:2632
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM taskmgr.exe
  2⤵
  PID:2676
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedit.exe
  2⤵
  PID:1636
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedt32.exe
  2⤵
  PID:684
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM msconfig.exe
  2⤵
  PID:2176
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM starter.exe
  2⤵
  PID:3036
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM cmd.exe
  2⤵
  - Kills process with taskkill
  PID:2468
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM taskmgr.exe
  2⤵
  PID:3008
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedit.exe
  2⤵
  PID:1584
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedt32.exe
  2⤵
  PID:2956
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM msconfig.exe
  2⤵
  PID:1732
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM starter.exe
  2⤵
  PID:2552
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM cmd.exe
  2⤵
  PID:2912
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM taskmgr.exe
  2⤵
  PID:1344
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedit.exe
  2⤵
  PID:2484
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedt32.exe
  2⤵
  PID:1296
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM msconfig.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1452
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM starter.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1968
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM cmd.exe
  2⤵
  PID:1536
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM taskmgr.exe
  2⤵
  PID:1500
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedit.exe
  2⤵
  PID:2412
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedt32.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  PID:552
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM msconfig.exe
  2⤵
  PID:1892
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM starter.exe
  2⤵
  PID:2340
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM cmd.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2344
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM taskmgr.exe
  2⤵
  PID:696
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedit.exe
  2⤵
  PID:1048
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedt32.exe
  2⤵
  PID:2472
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM msconfig.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1888
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM starter.exe
  2⤵
  PID:756
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM cmd.exe
  2⤵
  PID:2440
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM taskmgr.exe
  2⤵
  PID:2656
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedit.exe
  2⤵
  PID:384
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedt32.exe
  2⤵
  PID:1852
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM msconfig.exe
  2⤵
  PID:2580
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM starter.exe
  2⤵
  PID:1320
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM cmd.exe
  2⤵
  - Kills process with taskkill
  PID:760
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM taskmgr.exe
  2⤵
  PID:2676
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedit.exe
  2⤵
  PID:2184
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedt32.exe
  2⤵
  PID:1904
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM msconfig.exe
  2⤵
  PID:2380
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM starter.exe
  2⤵
  - Kills process with taskkill
  PID:2296
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM cmd.exe
  2⤵
  PID:2712
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM taskmgr.exe
  2⤵
  PID:2724
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedit.exe
  2⤵
  PID:1272
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedt32.exe
  2⤵
  PID:2528
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM msconfig.exe
  2⤵
  - Kills process with taskkill
  PID:2764
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM starter.exe
  2⤵
  PID:2976
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM cmd.exe
  2⤵
  PID:2720
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM taskmgr.exe
  2⤵
  PID:2596
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedit.exe
  2⤵
  - Kills process with taskkill
  PID:2132
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedt32.exe
  2⤵
  PID:2972
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM msconfig.exe
  2⤵
  PID:1948
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM starter.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:816
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM cmd.exe
  2⤵
  PID:2300
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM taskmgr.exe
  2⤵
  PID:1932
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedit.exe
  2⤵
  PID:2680
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedt32.exe
  2⤵
  PID:2868
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM msconfig.exe
  2⤵
  - Kills process with taskkill
  PID:868
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM starter.exe
  2⤵
  PID:1600
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM cmd.exe
  2⤵
  PID:2308
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM taskmgr.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3012
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedit.exe
  2⤵
  PID:3068
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedt32.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1820
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM msconfig.exe
  2⤵
  PID:2208
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM starter.exe
  2⤵
  PID:824
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM cmd.exe
  2⤵
  PID:1188
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM taskmgr.exe
  2⤵
  PID:1716
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedit.exe
  2⤵
  - Kills process with taskkill
  PID:2656
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedt32.exe
  2⤵
  PID:1364
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM msconfig.exe
  2⤵
  PID:1852
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM starter.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1936
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM cmd.exe
  2⤵
  PID:956
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM taskmgr.exe
  2⤵
  PID:3060
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedit.exe
  2⤵
  PID:2676
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedt32.exe
  2⤵
  - Kills process with taskkill
  PID:1492
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM msconfig.exe
  2⤵
  PID:2592
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM starter.exe
  2⤵
  PID:2140
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM cmd.exe
  2⤵
  PID:584
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM taskmgr.exe
  2⤵
  PID:2508
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedit.exe
  2⤵
  PID:1316
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedt32.exe
  2⤵
  PID:1824
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM msconfig.exe
  2⤵
  PID:972
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM starter.exe
  2⤵
  PID:668
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM cmd.exe
  2⤵
  PID:2736
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM taskmgr.exe
  2⤵
  PID:1344
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedit.exe
  2⤵
  PID:2464
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedt32.exe
  2⤵
  PID:2212
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM msconfig.exe
  2⤵
  PID:2804
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM starter.exe
  2⤵
  PID:1644
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM cmd.exe
  2⤵
  PID:2036
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM taskmgr.exe
  2⤵
  - Kills process with taskkill
  PID:1776
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedit.exe
  2⤵
  PID:2332
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedt32.exe
  2⤵
  - Kills process with taskkill
  PID:2548
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM msconfig.exe
  2⤵
  PID:1660
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM starter.exe
  2⤵
  PID:1284
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM cmd.exe
  2⤵
  PID:2476
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM taskmgr.exe
  2⤵
  PID:1888
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedit.exe
  2⤵
  PID:2832
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedt32.exe
  2⤵
  PID:1552
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM msconfig.exe
  2⤵
  PID:2168
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM starter.exe
  2⤵
  PID:2688
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM cmd.exe
  2⤵
  PID:2248
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM taskmgr.exe
  2⤵
  PID:2364
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedit.exe
  2⤵
  PID:600
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedt32.exe
  2⤵
  PID:2392
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM msconfig.exe
  2⤵
  PID:2880
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM starter.exe
  2⤵
  PID:1180
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM cmd.exe
  2⤵
  - Kills process with taskkill
  PID:2828
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM taskmgr.exe
  2⤵
  PID:2748
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedit.exe
  2⤵
  PID:1904
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedt32.exe
  2⤵
  PID:2140
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM msconfig.exe
  2⤵
  PID:2740
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM starter.exe
  2⤵
  PID:1920
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM cmd.exe
  2⤵
  PID:2188
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM taskmgr.exe
  2⤵
  PID:1728
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedit.exe
  2⤵
  PID:3032
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedt32.exe
  2⤵
  PID:2720
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM msconfig.exe
  2⤵
  PID:2728
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM starter.exe
  2⤵
  - Kills process with taskkill
  PID:540
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM cmd.exe
  2⤵
  PID:1640
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM taskmgr.exe
  2⤵
  PID:2464
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedit.exe
  2⤵
  PID:1944
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedt32.exe
  2⤵
  - Kills process with taskkill
  PID:1768
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM msconfig.exe
  2⤵
  PID:2696
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM starter.exe
  2⤵
  PID:1536
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM cmd.exe
  2⤵
  PID:2596
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM taskmgr.exe
  2⤵
  PID:1776
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedit.exe
  2⤵
  PID:1992
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedt32.exe
  2⤵
  PID:1336
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM msconfig.exe
  2⤵
  PID:2824
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM starter.exe
  2⤵
  PID:1284
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM cmd.exe
  2⤵
  PID:2476
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM taskmgr.exe
  2⤵
  PID:2576
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedit.exe
  2⤵
  PID:1188
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedt32.exe
  2⤵
  PID:1552
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM msconfig.exe
  2⤵
  PID:696
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM starter.exe
  2⤵
  PID:2444
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM cmd.exe
  2⤵
  PID:1588
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM taskmgr.exe
  2⤵
  PID:2112
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedit.exe
  2⤵
  PID:2060
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedt32.exe
  2⤵
  PID:1636
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM msconfig.exe
  2⤵
  PID:2948
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM starter.exe
  2⤵
  PID:2420
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM cmd.exe
  2⤵
  PID:2092
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM taskmgr.exe
  2⤵
  PID:1584
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedit.exe
  2⤵
  PID:2516
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedt32.exe
  2⤵
  PID:2172
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM msconfig.exe
  2⤵
  PID:2908
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM starter.exe
  2⤵
  PID:1628
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM cmd.exe
  2⤵
  PID:2676
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM taskmgr.exe
  2⤵
  PID:2460
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedit.exe
  2⤵
  PID:2976
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedt32.exe
  2⤵
  PID:2780
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM msconfig.exe
  2⤵
  - Kills process with taskkill
  PID:2368
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM starter.exe
  2⤵
  PID:1624
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM cmd.exe
  2⤵
  PID:2728
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM taskmgr.exe
  2⤵
  - Kills process with taskkill
  PID:2304
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedit.exe
  2⤵
  PID:2696
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedt32.exe
  2⤵
  PID:1708
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM msconfig.exe
  2⤵
  PID:1892
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM starter.exe
  2⤵
  PID:2500
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM cmd.exe
  2⤵
  PID:1528
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM taskmgr.exe
  2⤵
  PID:996
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedit.exe
  2⤵
  PID:2844
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedt32.exe
  2⤵
  PID:1336
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM msconfig.exe
  2⤵
  PID:2412
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM starter.exe
  2⤵
  PID:1248
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM cmd.exe
  2⤵
  PID:1060
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM taskmgr.exe
  2⤵
  PID:2124
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedit.exe
  2⤵
  PID:2028
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedt32.exe
  2⤵
  PID:1852
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM msconfig.exe
  2⤵
  PID:2320
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM starter.exe
  2⤵
  PID:1332
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM cmd.exe
  2⤵
  PID:2924
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM taskmgr.exe
  2⤵
  PID:2952
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedit.exe
  2⤵
  PID:2112
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedt32.exe
  2⤵
  PID:1180
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM msconfig.exe
  2⤵
  PID:1664
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM starter.exe
  2⤵
  PID:2312
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM cmd.exe
  2⤵
  PID:1580
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM taskmgr.exe
  2⤵
  PID:1920
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedit.exe
  2⤵
  PID:1584
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedt32.exe
  2⤵
  PID:1204
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM msconfig.exe
  2⤵
  PID:2516
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM starter.exe
  2⤵
  - Kills process with taskkill
  PID:2224
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM cmd.exe
  2⤵
  - Kills process with taskkill
  PID:2748
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM taskmgr.exe
  2⤵
  PID:2728
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedit.exe
  2⤵
  - Kills process with taskkill
  PID:668
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedt32.exe
  2⤵
  PID:2816
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM msconfig.exe
  2⤵
  PID:2836
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM starter.exe
  2⤵
  PID:2052
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM cmd.exe
  2⤵
  PID:2780
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM taskmgr.exe
  2⤵
  PID:2304
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedit.exe
  2⤵
  PID:2972
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedt32.exe
  2⤵
  PID:1228
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM msconfig.exe
  2⤵
  PID:2212
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM starter.exe
  2⤵
  PID:2580
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM cmd.exe
  2⤵
  PID:2596
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM taskmgr.exe
  2⤵
  PID:2844
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedit.exe
  2⤵
  PID:1592
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedt32.exe
  2⤵
  PID:2472
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM msconfig.exe
  2⤵
  - Kills process with taskkill
  PID:1284
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM starter.exe
  2⤵
  PID:908
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM cmd.exe
  2⤵
  PID:2344
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM taskmgr.exe
  2⤵
  PID:1020
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedit.exe
  2⤵
  PID:824
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedt32.exe
  2⤵
  - Kills process with taskkill
  PID:2444
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM msconfig.exe
  2⤵
  PID:2068
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM starter.exe
  2⤵
  - Kills process with taskkill
  PID:1672
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM cmd.exe
  2⤵
  - Kills process with taskkill
  PID:1852
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM taskmgr.exe
  2⤵
  PID:2056
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedit.exe
  2⤵
  PID:2960
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedt32.exe
  2⤵
  PID:2092
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM msconfig.exe
  2⤵
  PID:2608
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM starter.exe
  2⤵
  PID:2840
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM cmd.exe
  2⤵
  - Kills process with taskkill
  PID:384
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM taskmgr.exe
  2⤵
  PID:684
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedit.exe
  2⤵
  PID:2856
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedt32.exe
  2⤵
  PID:3016
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM msconfig.exe
  2⤵
  PID:2380
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM starter.exe
  2⤵
  PID:1920
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM cmd.exe
  2⤵
  PID:2720
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM taskmgr.exe
  2⤵
  PID:2912
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedit.exe
  2⤵
  PID:2816
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedt32.exe
  2⤵
  PID:2368
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM msconfig.exe
  2⤵
  PID:2460
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM starter.exe
  2⤵
  PID:1824
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM cmd.exe
  2⤵
  PID:2492
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM taskmgr.exe
  2⤵
  PID:1776
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedit.exe
  2⤵
  PID:2784
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedt32.exe
  2⤵
  PID:888
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM msconfig.exe
  2⤵
  PID:2476
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM starter.exe
  2⤵
  PID:2500
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM cmd.exe
  2⤵
  PID:2212
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM taskmgr.exe
  2⤵
  PID:1660
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedit.exe
  2⤵
  PID:2576
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedt32.exe
  2⤵
  PID:996
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM msconfig.exe
  2⤵
  PID:1352
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM starter.exe
  2⤵
  PID:1340
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM cmd.exe
  2⤵
  PID:3068
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM taskmgr.exe
  2⤵
  PID:2208
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedit.exe
  2⤵
  PID:1952
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedt32.exe
  2⤵
  PID:2104
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM msconfig.exe
  2⤵
  - Kills process with taskkill
  PID:2948
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM starter.exe
  2⤵
  PID:2352
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM cmd.exe
  2⤵
  PID:1020
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM taskmgr.exe
  2⤵
  PID:1980
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedit.exe
  2⤵
  PID:956
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedt32.exe
  2⤵
  PID:1936
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM msconfig.exe
  2⤵
  PID:2968
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM starter.exe
  2⤵
  PID:2760
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM cmd.exe
  2⤵
  PID:2092
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM taskmgr.exe
  2⤵
  PID:2508
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedit.exe
  2⤵
  PID:1680
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedt32.exe
  2⤵
  PID:1732
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM msconfig.exe
  2⤵
  PID:2744
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM starter.exe
  2⤵
  PID:1356
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM cmd.exe
  2⤵
  PID:1584
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM taskmgr.exe
  2⤵
  PID:1744
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedit.exe
  2⤵
  - Kills process with taskkill
  PID:1824
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedt32.exe
  2⤵
  PID:3064
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM msconfig.exe
  2⤵
  PID:2340
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM starter.exe
  2⤵
  PID:2728
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM cmd.exe
  2⤵
  PID:1344
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM taskmgr.exe
  2⤵
  PID:1776
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedit.exe
  2⤵
  PID:3040
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedt32.exe
  2⤵
  - Kills process with taskkill
  PID:2800
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM msconfig.exe
  2⤵
  PID:1836
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM starter.exe
  2⤵
  PID:2580
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM cmd.exe
  2⤵
  PID:2784
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM taskmgr.exe
  2⤵
  PID:2980
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedit.exe
  2⤵
  PID:1660
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedt32.exe
  2⤵
  PID:632
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM msconfig.exe
  2⤵
  PID:2412
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM starter.exe
  2⤵
  PID:2576
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM cmd.exe
  2⤵
  PID:1848
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM taskmgr.exe
  2⤵
  PID:1364
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedit.exe
  2⤵
  PID:2296
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedt32.exe
  2⤵
  PID:2632
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM msconfig.exe
  2⤵
  PID:1516
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM starter.exe
  2⤵
  PID:1008
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM cmd.exe
  2⤵
  PID:2104
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM taskmgr.exe
  2⤵
  PID:2060
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedit.exe
  2⤵
  PID:1212
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedt32.exe
  2⤵
  PID:1556
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM msconfig.exe
  2⤵
  PID:2420
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM starter.exe
  2⤵
  PID:1560
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM cmd.exe
  2⤵
  PID:2936
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM taskmgr.exe
  2⤵
  PID:1040
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedit.exe
  2⤵
  PID:2132
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedt32.exe
  2⤵
  PID:1640
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM msconfig.exe
  2⤵
  PID:1808
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM starter.exe
  2⤵
  PID:2604
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM cmd.exe
  2⤵
  PID:2516
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM taskmgr.exe
  2⤵
  PID:668
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedit.exe
  2⤵
  PID:2388
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedt32.exe
  2⤵
  PID:2144
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM msconfig.exe
  2⤵
  PID:2284
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM starter.exe
  2⤵
  PID:1532
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM cmd.exe
  2⤵
  PID:540
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM taskmgr.exe
  2⤵
  PID:2972
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedit.exe
  2⤵
  PID:2024
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedt32.exe
  2⤵
  PID:2276
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM msconfig.exe
  2⤵
  PID:1924
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM starter.exe
  2⤵
  PID:2844
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM cmd.exe
  2⤵
  PID:2332
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM taskmgr.exe
  2⤵
  PID:1828
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedit.exe
  2⤵
  PID:3008
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedt32.exe
  2⤵
  PID:1616
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM msconfig.exe
  2⤵
  PID:2472
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM starter.exe
  2⤵
  PID:1188
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM cmd.exe
  2⤵
  PID:1916
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM taskmgr.exe
  2⤵
  PID:2556
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedit.exe
  2⤵
  PID:1812
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedt32.exe
  2⤵
  PID:2104
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM msconfig.exe
  2⤵
  PID:2608
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM starter.exe
  2⤵
  PID:1952
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM cmd.exe
  2⤵
  PID:2640
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM taskmgr.exe
  2⤵
  PID:1804
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedit.exe
  2⤵
  PID:2468
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedt32.exe
  2⤵
  PID:2828
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM msconfig.exe
  2⤵
  PID:332
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM starter.exe
  2⤵
  PID:384
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM cmd.exe
  2⤵
  PID:2896
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM taskmgr.exe
  2⤵
  PID:3032
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedit.exe
  2⤵
  PID:1064
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM regedt32.exe
  2⤵
  PID:2252
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM msconfig.exe
  2⤵
  - Kills process with taskkill
  PID:2856
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM starter.exe
  2⤵
  PID:868
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM cmd.exe
  2⤵
  PID:1076

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-1893969155-95603770-4230484281971780846-4839310671648370082-1067003755-639884320"
1⤵
PID:2560

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-13255089811178958409-1939606814-3918737201774659892-222952396-1195527344-1497025222"
1⤵
PID:1920

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "1462528958-1763864370-2119228262-877114290-1066496692419368871-1497083874-1729285389"
1⤵
PID:1552

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "677061311901615309780053521464105361169127949497778675812519268192100958433"
1⤵
PID:2268

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-602112533809680111713285750-1222589827-1374912030-448747873-1654285883-389118269"
1⤵
PID:2896

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-1650531375-373350357582894509157073257219606191651135786432-13277616372032918780"
1⤵
PID:1544

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-119136275-14900557871421973819737820970-9954853171504725622329309685-135251472"
1⤵
PID:908

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-1611603695-2020419759-97103604215908991-3507562951927719030107315861039714471"
1⤵
PID:2440

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-6524084201211362970615685730-1620774256-1651037600470306515461931361305704467"
1⤵
PID:2888

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-87125470890984088-836481175-6217747021491631992-1533738351-17796188691892676022"
1⤵
PID:760

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "736419832-188526967-11896227122066683664-1857435985-1158166463-1635872212-635520499"
1⤵
PID:1780

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-465242817936355093-168170360793189177110843447651624216477-100058610-632008476"
1⤵
PID:1048

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-1262080048-565538534-1275970776-12064832141298654044-4270287849298057611747428947"
1⤵
PID:2712

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-2018025902787169507-1978631888479491150-14844098099820769371274076506106657"
1⤵
PID:2928

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-964333035-1830715809234591361232620662-2083575097784362108-12805339391566302239"
1⤵
PID:2988

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "13089951491948590552081862600-133317116114730515361356067727-505702475866996449"
1⤵
PID:1968

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-1782880032-5027503861849049554-1550414718-1206314127-316076220-2142520922204254369"
1⤵
PID:2176

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "1851847562-327966411255532753127330144658142830615862748411471384187-977063747"
1⤵
PID:2828

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "1630333879-2077018485-8383253551802966658-9260587751863709803941325494413668288"
1⤵
PID:2676

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "1019730439-199026949518292565961721741401-2024459013-928305113-672028577-522944091"
1⤵
PID:2292

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-614942992-1867096019-789410855-2067234700-34802704714513676157250103781703055229"
1⤵
PID:1064

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "7558433041322373981121151390414046418321782345910-1858122146-8980065491319948835"
1⤵
PID:2552

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "872432110-279489146-253695307-20475394941633645740-166083072913855616911756755534"
1⤵
PID:1296

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "4292651681919180307-3513624271228024831-322070602-1575704819-729583525-1315008266"
1⤵
PID:2660

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "1509543006-1132797582-15152232731216493555161531174157457284813905443221693301931"
1⤵
PID:2332

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-1331775745-1382852011-309609135-17236244671838389481409400439-6556159072040034861"
1⤵
PID:2288

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "132238741666019815637336672432604357062772204120806393222091787573-319231314"
1⤵
PID:1716

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "2079726493-437005787-13432360571313478452-10134447811313100718-227507187485233865"
1⤵
PID:2976

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "1634320828-591588754-1827711654128999749414482677151079300830773252411-693808168"
1⤵
PID:2300

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-10224971281750963387903062913-89893808013624258321934962739-14973214861855380290"
1⤵
PID:756

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-75334762867475135612268658441074711217979698069-1996873875215535821-254447453"
1⤵
PID:1844

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-1698221797-2088258515-618367068-8431970471915143122-129914268-17624024741021654399"
1⤵
PID:2764

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "1437655661-1203262611-2064360744-41758529015012971221258582848-6543449154488194"
1⤵
PID:2528

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-1462859663-44822197517461368626287109099645528418145100002035515601-1957183220"
1⤵
PID:1892

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-2109284944-2051081660294602119-794750646-1909278868-2050620857-1992327022-75388090"
1⤵
PID:1500

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-412227355-1126079306100364583112855106551879465171357141268-21101220071736778333"
1⤵
PID:2272

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-1950584709-1412285866207263139215980425561123192123-2004433035-533498007-1586997382"
1⤵
PID:2244

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-2136169845-106398386365019393-14456350332110182213949434268-330647438-1316060564"
1⤵
PID:1820

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-1856979682-14742960371200628340-423986246-20271300757934053131226921757-195794532"
1⤵
PID:1852

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "1093778236-266398226-4932661213625722611109132016-17836346-456609252718052325"
1⤵
PID:1636

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-1910068724150711631-1383995476-1016660613-197700677-304786422159735939434563227"
1⤵
PID:1452

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "5129417957002489411728406413-1431451618-1550937865-1646020200-1088618903-935917523"
1⤵
PID:2192

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "1734205395-12154282802138878849-2666103641985715375-291752775-11924663881392899384"
1⤵
PID:2724

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "409483729-2141102941476776146-21777644410126256981264287691391666539-562579414"
1⤵
PID:1780

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-1408009469-867784877-1714470955-6236278521926242535693725264680655409-362966716"
1⤵
PID:3036

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "1557615870-11207997921773071505-20956558531577628979784050819-1455046081-348344754"
1⤵
PID:1932

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-1875564294-2005085638-1430380643-1275074645-172571947-1997443334-389777835-1808927434"
1⤵
PID:1344

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "273556010-79227932387620758721384783381789772429-913821916176129756-439642031"
1⤵
PID:2680

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-12131545581548943425-10668441211679097958-1133909696-15826321541683437274-496639320"
1⤵
PID:2868

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "340743418986198352-1866746921-1762074454-8128998764369658631581017516-1845839708"
1⤵
PID:1852

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2216-2-0x0000000076AB0000-0x0000000076BCF000-memory.dmp

Filesize
1.1MB

Download
memory/2216-3-0x0000000076BD0000-0x0000000076CCA000-memory.dmp

Filesize
1000KB

Download
memory/2456-0-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/2456-1-0x0000000000400000-0x00000000004A7000-memory.dmp

Filesize
668KB

Download
memory/2456-5-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads