8c22ece3be7102ecfaf72269cc8b937d9c632bac21fd919105216db99e7eb2ce

Analysis

max time kernel
150s
max time network
113s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
12/07/2026, 23:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
8j4tthj.exe
Size 3.3MB
Sample260712-2zed3shw3q
SHA256 8c22ece3be7102ecfaf72269cc8b937d9c632bac21fd919105216db99e7eb2ce
MD5 8a576399df1f4140b0ca9d1cfc72a980
SHA1 407dcc02f03956a4931a4fe6a6054fe7c0d501cc
SHA512 e7f4d9edb9948d9ab905e3b259c227e20e8e8918d466e183e0adfbe79204a595fc9a47481e04f2fd09532b22728ae823f2afcf60a8d1a6df3c9fcea87ca50755
SSDEEP 49152:0SThZjEoNhMxP5i3MLcAXZMPS7s8JyeaaTt:0iXNcrcAXps8JyeaaTt
TLSH
T144F5F84369DB0DE5CED677B861D72339A734FD718A291F2BAA08C5312D536C4AD2EB00
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion execution

Malware Config

Signatures

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
820	sc.exe
568	sc.exe

Kills process with taskkill 64 IoCs

defense_evasion

pid	Process
3860	taskkill.exe
2976	taskkill.exe
2492	taskkill.exe
2124	taskkill.exe
2020	taskkill.exe
2612	taskkill.exe
204	taskkill.exe
4704	taskkill.exe
6120	taskkill.exe
3980	taskkill.exe
476	taskkill.exe
4712	taskkill.exe
1828	taskkill.exe
4212	taskkill.exe
4412	taskkill.exe
1564	taskkill.exe
2620	taskkill.exe
996	taskkill.exe
1160	taskkill.exe
2140	taskkill.exe
2796	taskkill.exe
2428	taskkill.exe
3720	taskkill.exe
4808	taskkill.exe
4444	taskkill.exe
4124	taskkill.exe
2964	taskkill.exe
5348	taskkill.exe
4912	taskkill.exe
3828	taskkill.exe
3708	taskkill.exe
3440	taskkill.exe
3056	taskkill.exe
5732	taskkill.exe
5064	taskkill.exe
3876	taskkill.exe
5920	taskkill.exe
4248	taskkill.exe
948	taskkill.exe
3880	taskkill.exe
8	taskkill.exe
1304	taskkill.exe
5480	taskkill.exe
5680	taskkill.exe
1132	taskkill.exe
2408	taskkill.exe
3872	taskkill.exe
5608	taskkill.exe
1156	taskkill.exe
3248	taskkill.exe
5404	taskkill.exe
5724	taskkill.exe
5000	taskkill.exe
4884	taskkill.exe
1288	taskkill.exe
1252	taskkill.exe
2672	taskkill.exe
2188	taskkill.exe
5680	taskkill.exe
876	taskkill.exe
204	taskkill.exe
1244	taskkill.exe
1632	taskkill.exe
4696	taskkill.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2112	8j4tthj.exe
2112	8j4tthj.exe
2112	8j4tthj.exe
2112	8j4tthj.exe
2112	8j4tthj.exe
2112	8j4tthj.exe
2112	8j4tthj.exe
2112	8j4tthj.exe
2112	8j4tthj.exe
2112	8j4tthj.exe
2112	8j4tthj.exe
2112	8j4tthj.exe
2112	8j4tthj.exe
2112	8j4tthj.exe
2112	8j4tthj.exe
2112	8j4tthj.exe
2112	8j4tthj.exe
2112	8j4tthj.exe
2112	8j4tthj.exe
2112	8j4tthj.exe
2112	8j4tthj.exe
2112	8j4tthj.exe
2112	8j4tthj.exe
2112	8j4tthj.exe
2112	8j4tthj.exe
2112	8j4tthj.exe
2112	8j4tthj.exe
2112	8j4tthj.exe
2112	8j4tthj.exe
2112	8j4tthj.exe
2112	8j4tthj.exe
2112	8j4tthj.exe
2112	8j4tthj.exe
2112	8j4tthj.exe
2112	8j4tthj.exe
2112	8j4tthj.exe
2112	8j4tthj.exe
2112	8j4tthj.exe
2112	8j4tthj.exe
2112	8j4tthj.exe
2112	8j4tthj.exe
2112	8j4tthj.exe
2112	8j4tthj.exe
2112	8j4tthj.exe
2112	8j4tthj.exe
2112	8j4tthj.exe
2112	8j4tthj.exe
2112	8j4tthj.exe
2112	8j4tthj.exe
2112	8j4tthj.exe
2112	8j4tthj.exe
2112	8j4tthj.exe
2112	8j4tthj.exe
2112	8j4tthj.exe
2112	8j4tthj.exe
2112	8j4tthj.exe
2112	8j4tthj.exe
2112	8j4tthj.exe
2112	8j4tthj.exe
2112	8j4tthj.exe
2112	8j4tthj.exe
2112	8j4tthj.exe
2112	8j4tthj.exe
2112	8j4tthj.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2112	8j4tthj.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2112	8j4tthj.exe
Token: SeDebugPrivilege	876	taskkill.exe
Token: SeDebugPrivilege	8	taskkill.exe
Token: SeDebugPrivilege	5332	taskkill.exe
Token: SeDebugPrivilege	3056	taskkill.exe
Token: SeDebugPrivilege	5348	taskkill.exe
Token: SeDebugPrivilege	4924	taskkill.exe
Token: SeDebugPrivilege	1760	taskkill.exe
Token: SeDebugPrivilege	1252	taskkill.exe
Token: SeDebugPrivilege	5572	taskkill.exe
Token: SeDebugPrivilege	1828	taskkill.exe
Token: SeDebugPrivilege	2408	taskkill.exe
Token: SeDebugPrivilege	4528	taskkill.exe
Token: SeDebugPrivilege	3872	taskkill.exe
Token: SeDebugPrivilege	3740	taskkill.exe
Token: SeDebugPrivilege	204	taskkill.exe
Token: SeDebugPrivilege	2884	taskkill.exe
Token: SeDebugPrivilege	2428	taskkill.exe
Token: SeDebugPrivilege	5732	taskkill.exe
Token: SeDebugPrivilege	4936	taskkill.exe
Token: SeDebugPrivilege	2672	taskkill.exe
Token: SeDebugPrivilege	6028	taskkill.exe
Token: SeDebugPrivilege	4264	taskkill.exe
Token: SeDebugPrivilege	3332	taskkill.exe
Token: SeDebugPrivilege	2040	taskkill.exe
Token: SeDebugPrivilege	5920	taskkill.exe
Token: SeDebugPrivilege	5680	taskkill.exe
Token: SeDebugPrivilege	1304	taskkill.exe
Token: SeDebugPrivilege	3880	taskkill.exe
Token: SeDebugPrivilege	352	taskkill.exe
Token: SeDebugPrivilege	5860	taskkill.exe
Token: SeDebugPrivilege	4248	taskkill.exe
Token: SeDebugPrivilege	5260	taskkill.exe
Token: SeDebugPrivilege	2976	taskkill.exe
Token: SeDebugPrivilege	5064	taskkill.exe
Token: SeDebugPrivilege	5480	taskkill.exe
Token: SeDebugPrivilege	1232	taskkill.exe
Token: SeDebugPrivilege	4212	taskkill.exe
Token: SeDebugPrivilege	4412	taskkill.exe
Token: SeDebugPrivilege	1564	taskkill.exe
Token: SeDebugPrivilege	3720	taskkill.exe
Token: SeDebugPrivilege	2620	taskkill.exe
Token: SeDebugPrivilege	4912	taskkill.exe
Token: SeDebugPrivilege	4352	taskkill.exe
Token: SeDebugPrivilege	2492	taskkill.exe
Token: SeDebugPrivilege	3304	taskkill.exe
Token: SeDebugPrivilege	5560	taskkill.exe
Token: SeDebugPrivilege	2336	taskkill.exe
Token: SeDebugPrivilege	996	taskkill.exe
Token: SeDebugPrivilege	3828	taskkill.exe
Token: SeDebugPrivilege	5404	taskkill.exe
Token: SeDebugPrivilege	3876	taskkill.exe
Token: SeDebugPrivilege	1160	taskkill.exe
Token: SeDebugPrivilege	204	taskkill.exe
Token: SeDebugPrivilege	2884	taskkill.exe
Token: SeDebugPrivilege	3980	taskkill.exe
Token: SeDebugPrivilege	3016	taskkill.exe
Token: SeDebugPrivilege	2804	taskkill.exe
Token: SeDebugPrivilege	6028	taskkill.exe
Token: SeDebugPrivilege	5484	taskkill.exe
Token: SeDebugPrivilege	5608	taskkill.exe
Token: SeDebugPrivilege	2328	taskkill.exe
Token: SeDebugPrivilege	3860	taskkill.exe
Token: SeDebugPrivilege	4808	taskkill.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2112 wrote to memory of 2036	2112	8j4tthj.exe	88
PID 2112 wrote to memory of 1568	2112	8j4tthj.exe	89
PID 2036 wrote to memory of 876	2036	cmd.exe	90
PID 1568 wrote to memory of 820	1568	cmd.exe	91
PID 2112 wrote to memory of 2064	2112	8j4tthj.exe	93
PID 2064 wrote to memory of 568	2064	cmd.exe	94
PID 2112 wrote to memory of 2452	2112	8j4tthj.exe	95
PID 2452 wrote to memory of 8	2452	cmd.exe	96
PID 2112 wrote to memory of 1752	2112	8j4tthj.exe	97
PID 1752 wrote to memory of 5332	1752	cmd.exe	98
PID 2112 wrote to memory of 2472	2112	8j4tthj.exe	99
PID 2472 wrote to memory of 3056	2472	cmd.exe	100
PID 2112 wrote to memory of 4084	2112	8j4tthj.exe	101
PID 4084 wrote to memory of 5348	4084	cmd.exe	102
PID 2112 wrote to memory of 1380	2112	8j4tthj.exe	103
PID 1380 wrote to memory of 4924	1380	cmd.exe	104
PID 2112 wrote to memory of 620	2112	8j4tthj.exe	105
PID 620 wrote to memory of 1760	620	cmd.exe	106
PID 2112 wrote to memory of 4460	2112	8j4tthj.exe	107
PID 4460 wrote to memory of 1252	4460	cmd.exe	108
PID 2112 wrote to memory of 992	2112	8j4tthj.exe	109
PID 992 wrote to memory of 5572	992	cmd.exe	110
PID 2112 wrote to memory of 2588	2112	8j4tthj.exe	111
PID 2588 wrote to memory of 1828	2588	cmd.exe	112
PID 2112 wrote to memory of 676	2112	8j4tthj.exe	113
PID 676 wrote to memory of 2408	676	cmd.exe	114
PID 2112 wrote to memory of 2432	2112	8j4tthj.exe	115
PID 2432 wrote to memory of 4528	2432	cmd.exe	116
PID 2112 wrote to memory of 3320	2112	8j4tthj.exe	117
PID 3320 wrote to memory of 3872	3320	cmd.exe	118
PID 2112 wrote to memory of 4168	2112	8j4tthj.exe	119
PID 4168 wrote to memory of 3740	4168	cmd.exe	120
PID 2112 wrote to memory of 2840	2112	8j4tthj.exe	121
PID 2840 wrote to memory of 204	2840	cmd.exe	122
PID 2112 wrote to memory of 3512	2112	8j4tthj.exe	123
PID 3512 wrote to memory of 2884	3512	cmd.exe	124
PID 2112 wrote to memory of 1248	2112	8j4tthj.exe	125
PID 1248 wrote to memory of 2428	1248	cmd.exe	126
PID 2112 wrote to memory of 468	2112	8j4tthj.exe	127
PID 468 wrote to memory of 5732	468	cmd.exe	128
PID 2112 wrote to memory of 5544	2112	8j4tthj.exe	129
PID 5544 wrote to memory of 4936	5544	cmd.exe	130
PID 2112 wrote to memory of 1600	2112	8j4tthj.exe	131
PID 1600 wrote to memory of 2672	1600	cmd.exe	132
PID 2112 wrote to memory of 1068	2112	8j4tthj.exe	133
PID 1068 wrote to memory of 6028	1068	cmd.exe	134
PID 2112 wrote to memory of 3488	2112	8j4tthj.exe	135
PID 3488 wrote to memory of 4264	3488	cmd.exe	136
PID 2112 wrote to memory of 4408	2112	8j4tthj.exe	137
PID 4408 wrote to memory of 3332	4408	cmd.exe	138
PID 2112 wrote to memory of 1996	2112	8j4tthj.exe	139
PID 1996 wrote to memory of 2040	1996	cmd.exe	140
PID 2112 wrote to memory of 1120	2112	8j4tthj.exe	142
PID 1120 wrote to memory of 5920	1120	cmd.exe	143
PID 2112 wrote to memory of 2416	2112	8j4tthj.exe	144
PID 2416 wrote to memory of 5680	2416	cmd.exe	145
PID 2112 wrote to memory of 5924	2112	8j4tthj.exe	146
PID 5924 wrote to memory of 1304	5924	cmd.exe	147
PID 2112 wrote to memory of 940	2112	8j4tthj.exe	148
PID 940 wrote to memory of 3880	940	cmd.exe	149
PID 2112 wrote to memory of 4448	2112	8j4tthj.exe	150
PID 4448 wrote to memory of 352	4448	cmd.exe	151
PID 2112 wrote to memory of 5748	2112	8j4tthj.exe	152
PID 5748 wrote to memory of 5860	5748	cmd.exe	153

C:\Users\Admin\AppData\Local\Temp\8j4tthj.exe
"C:\Users\Admin\AppData\Local\Temp\8j4tthj.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2112
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2036
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:876
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop vgc >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1568
- - C:\Windows\system32\sc.exe
    sc stop vgc
    3⤵
    - Launches sc.exe
    PID:820
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start vgc >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2064
- - C:\Windows\system32\sc.exe
    sc start vgc
    3⤵
    - Launches sc.exe
    PID:568
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2452
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:8
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1752
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:5332
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2472
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3056
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4084
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5348
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1380
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4924
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:620
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1760
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4460
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1252
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:992
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:5572
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2588
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1828
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:676
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2408
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2432
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4528
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3320
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3872
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4168
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3740
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2840
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:204
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3512
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2884
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1248
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2428
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:468
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5732
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5544
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4936
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1600
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2672
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1068
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:6028
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3488
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4264
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4408
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3332
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1996
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2040
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1120
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5920
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2416
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:5680
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5924
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1304
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:940
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3880
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4448
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:352
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5748
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:5860
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  PID:3116
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4248
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  PID:5352
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:5260
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  PID:2968
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2976
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  PID:4768
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5064
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  PID:4152
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5480
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  PID:4676
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1232
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  PID:4796
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4212
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  PID:4840
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4412
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  PID:4724
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1564
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  PID:260
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3720
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  PID:4920
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2620
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  PID:2908
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4912
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  PID:716
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4352
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  PID:1472
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2492
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  PID:4428
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3304
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  PID:1760
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:5560
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  PID:2092
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2336
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  PID:4780
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:996
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  PID:2300
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3828
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  PID:3796
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5404
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  PID:2992
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3876
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  PID:2828
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1160
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  PID:1576
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:204
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  PID:3172
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2884
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  PID:2428
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3980
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  PID:3364
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3016
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  PID:4088
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2804
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  PID:5624
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:6028
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  PID:4424
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:5484
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  PID:5380
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5608
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  PID:5964
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2328
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  PID:4588
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3860
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  PID:4880
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4808
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  PID:5800
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Kills process with taskkill
    PID:5680
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  PID:4268
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    PID:3400
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  PID:2244
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    PID:3760
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  PID:4900
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Kills process with taskkill
    PID:4696
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  PID:2928
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    PID:2872
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  PID:2856
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Kills process with taskkill
    PID:4444
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  PID:4908
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Kills process with taskkill
    PID:4248
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  PID:2632
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    PID:2376
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  PID:4312
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    PID:1596
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  PID:5064
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    PID:4124
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  PID:1196
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    PID:4860
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  PID:1232
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    PID:1388
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  PID:1432
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    PID:1880
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  PID:5332
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    PID:1848
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  PID:2756
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Kills process with taskkill
    PID:2188
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  PID:2776
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    PID:4668
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  PID:5992
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    PID:4260
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  PID:2728
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    PID:5488
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  PID:1780
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Kills process with taskkill
    PID:2492
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  PID:3304
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Kills process with taskkill
    PID:4704
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  PID:252
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Kills process with taskkill
    PID:6120
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  PID:5512
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    PID:3100
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  PID:6044
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    PID:6060
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  PID:3244
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    PID:3728
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  PID:2304
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    PID:3740
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  PID:3976
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Kills process with taskkill
    PID:3708
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  PID:4512
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Kills process with taskkill
    PID:5000
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  PID:2972
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    PID:4612
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  PID:4992
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Kills process with taskkill
    PID:3980
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  PID:4128
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Kills process with taskkill
    PID:476
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  PID:2672
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Kills process with taskkill
    PID:2124
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  PID:3184
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Kills process with taskkill
    PID:1156
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  PID:4380
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Kills process with taskkill
    PID:4884
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  PID:4144
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Kills process with taskkill
    PID:948
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  PID:2356
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    PID:4208
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  PID:2328
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    PID:5584
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  PID:4076
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    PID:5344
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  PID:5840
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Kills process with taskkill
    PID:3860
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  PID:3260
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Kills process with taskkill
    PID:3248
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  PID:3776
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Kills process with taskkill
    PID:4712
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  PID:2012
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    PID:5756
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  PID:5016
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Kills process with taskkill
    PID:5680
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  PID:2560
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    PID:4456
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  PID:3400
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Kills process with taskkill
    PID:1288
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  PID:1844
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    PID:1036
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  PID:2872
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    PID:4280
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  PID:5336
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Kills process with taskkill
    PID:2796
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  PID:2456
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    PID:3608
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  PID:936
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    PID:2760
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  PID:2228
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Kills process with taskkill
    PID:4124
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  PID:3396
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    PID:2808
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  PID:3252
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Kills process with taskkill
    PID:2964
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  PID:5224
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Kills process with taskkill
    PID:2020
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  PID:1848
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    PID:4360
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  PID:2188
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Kills process with taskkill
    PID:1132
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  PID:4116
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Kills process with taskkill
    PID:3440
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  PID:1396
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    PID:5784
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  PID:4352
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Kills process with taskkill
    PID:2612
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  PID:5836
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    PID:5560
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  PID:4852
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    PID:2636
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  PID:1912
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Kills process with taskkill
    PID:1244
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  PID:2044
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    PID:3684
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  PID:1836
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Kills process with taskkill
    PID:1632
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  PID:5296
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Kills process with taskkill
    PID:5724
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  PID:5832
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    PID:2148
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  PID:3368
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Kills process with taskkill
    PID:2140
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  PID:5972
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    PID:1952