8c22ece3be7102ecfaf72269cc8b937d9c632bac21fd919105216db99e7eb2ce

Analysis

user interaction
yes
max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
12/07/2026, 23:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
vService.exe
Size 3.3MB
Sample260712-3fh4laby21
SHA256 8c22ece3be7102ecfaf72269cc8b937d9c632bac21fd919105216db99e7eb2ce
MD5 8a576399df1f4140b0ca9d1cfc72a980
SHA1 407dcc02f03956a4931a4fe6a6054fe7c0d501cc
SHA512 e7f4d9edb9948d9ab905e3b259c227e20e8e8918d466e183e0adfbe79204a595fc9a47481e04f2fd09532b22728ae823f2afcf60a8d1a6df3c9fcea87ca50755
SSDEEP 49152:0SThZjEoNhMxP5i3MLcAXZMPS7s8JyeaaTt:0iXNcrcAXps8JyeaaTt
TLSH
T144F5F84369DB0DE5CED677B861D72339A734FD718A291F2BAA08C5312D536C4AD2EB00
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion execution

Malware Config

Signatures

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3140	sc.exe
4548	sc.exe

Kills process with taskkill 64 IoCs

defense_evasion

pid	Process
1836	taskkill.exe
3016	taskkill.exe
3204	taskkill.exe
4920	taskkill.exe
4936	taskkill.exe
1656	taskkill.exe
688	taskkill.exe
2348	taskkill.exe
740	taskkill.exe
4536	taskkill.exe
2080	taskkill.exe
1548	taskkill.exe
4444	taskkill.exe
8	taskkill.exe
1488	taskkill.exe
2044	taskkill.exe
2696	taskkill.exe
3960	taskkill.exe
4068	taskkill.exe
1104	taskkill.exe
3288	taskkill.exe
1880	taskkill.exe
2368	taskkill.exe
3948	taskkill.exe
4872	taskkill.exe
1772	taskkill.exe
2660	taskkill.exe
3464	taskkill.exe
3288	taskkill.exe
2244	taskkill.exe
2624	taskkill.exe
2924	taskkill.exe
2472	taskkill.exe
1220	taskkill.exe
540	taskkill.exe
2324	taskkill.exe
1272	taskkill.exe
2980	taskkill.exe
4136	taskkill.exe
2568	taskkill.exe
1764	taskkill.exe
2356	taskkill.exe
1092	taskkill.exe
4664	taskkill.exe
4920	taskkill.exe
2304	taskkill.exe
2152	taskkill.exe
1132	taskkill.exe
4616	taskkill.exe
2776	taskkill.exe
4416	taskkill.exe
688	taskkill.exe
4592	taskkill.exe
3792	taskkill.exe
1192	taskkill.exe
1944	taskkill.exe
1652	taskkill.exe
3200	taskkill.exe
4532	taskkill.exe
1968	taskkill.exe
2964	taskkill.exe
3428	taskkill.exe
4472	taskkill.exe
2780	taskkill.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4736	vService.exe
4736	vService.exe
4736	vService.exe
4736	vService.exe
4736	vService.exe
4736	vService.exe
4736	vService.exe
4736	vService.exe
4736	vService.exe
4736	vService.exe
4736	vService.exe
4736	vService.exe
4736	vService.exe
4736	vService.exe
4736	vService.exe
4736	vService.exe
4736	vService.exe
4736	vService.exe
4736	vService.exe
4736	vService.exe
4736	vService.exe
4736	vService.exe
4736	vService.exe
4736	vService.exe
4736	vService.exe
4736	vService.exe
4736	vService.exe
4736	vService.exe
4736	vService.exe
4736	vService.exe
4736	vService.exe
4736	vService.exe
4736	vService.exe
4736	vService.exe
4736	vService.exe
4736	vService.exe
4736	vService.exe
4736	vService.exe
4736	vService.exe
4736	vService.exe
4736	vService.exe
4736	vService.exe
4736	vService.exe
4736	vService.exe
4736	vService.exe
4736	vService.exe
4736	vService.exe
4736	vService.exe
4736	vService.exe
4736	vService.exe
4736	vService.exe
4736	vService.exe
4736	vService.exe
4736	vService.exe
4736	vService.exe
4736	vService.exe
4736	vService.exe
4736	vService.exe
4736	vService.exe
4736	vService.exe
4736	vService.exe
4736	vService.exe
4736	vService.exe
4736	vService.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4736	vService.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4736	vService.exe
Token: SeDebugPrivilege	3028	taskkill.exe
Token: SeDebugPrivilege	940	taskkill.exe
Token: SeDebugPrivilege	4656	taskkill.exe
Token: SeDebugPrivilege	2368	taskkill.exe
Token: SeDebugPrivilege	3948	taskkill.exe
Token: SeDebugPrivilege	2152	taskkill.exe
Token: SeDebugPrivilege	1220	taskkill.exe
Token: SeDebugPrivilege	1216	taskkill.exe
Token: SeDebugPrivilege	1132	taskkill.exe
Token: SeDebugPrivilege	4724	taskkill.exe
Token: SeDebugPrivilege	3576	taskkill.exe
Token: SeDebugPrivilege	4872	taskkill.exe
Token: SeDebugPrivilege	3712	taskkill.exe
Token: SeDebugPrivilege	2472	taskkill.exe
Token: SeDebugPrivilege	540	taskkill.exe
Token: SeDebugPrivilege	2324	taskkill.exe
Token: SeDebugPrivilege	3580	taskkill.exe
Token: SeDebugPrivilege	4472	taskkill.exe
Token: SeDebugPrivilege	2696	taskkill.exe
Token: SeDebugPrivilege	3200	taskkill.exe
Token: SeDebugPrivilege	2660	taskkill.exe
Token: SeDebugPrivilege	4216	taskkill.exe
Token: SeDebugPrivilege	2624	taskkill.exe
Token: SeDebugPrivilege	3960	taskkill.exe
Token: SeDebugPrivilege	2392	taskkill.exe
Token: SeDebugPrivilege	2924	taskkill.exe
Token: SeDebugPrivilege	4536	taskkill.exe
Token: SeDebugPrivilege	4664	taskkill.exe
Token: SeDebugPrivilege	1124	taskkill.exe
Token: SeDebugPrivilege	4628	taskkill.exe
Token: SeDebugPrivilege	2780	taskkill.exe
Token: SeDebugPrivilege	1272	taskkill.exe
Token: SeDebugPrivilege	4416	taskkill.exe
Token: SeDebugPrivilege	1772	taskkill.exe
Token: SeDebugPrivilege	4068	taskkill.exe
Token: SeDebugPrivilege	4616	taskkill.exe
Token: SeDebugPrivilege	3264	taskkill.exe
Token: SeDebugPrivilege	1104	taskkill.exe
Token: SeDebugPrivilege	1540	taskkill.exe
Token: SeDebugPrivilege	1836	taskkill.exe
Token: SeDebugPrivilege	4924	taskkill.exe
Token: SeDebugPrivilege	3364	taskkill.exe
Token: SeDebugPrivilege	396	taskkill.exe
Token: SeDebugPrivilege	4684	taskkill.exe
Token: SeDebugPrivilege	2776	taskkill.exe
Token: SeDebugPrivilege	3464	taskkill.exe
Token: SeDebugPrivilege	4136	taskkill.exe
Token: SeDebugPrivilege	3960	taskkill.exe
Token: SeDebugPrivilege	4380	taskkill.exe
Token: SeDebugPrivilege	4220	taskkill.exe
Token: SeDebugPrivilege	2964	taskkill.exe
Token: SeDebugPrivilege	2152	taskkill.exe
Token: SeDebugPrivilege	4608	taskkill.exe
Token: SeDebugPrivilege	4804	taskkill.exe
Token: SeDebugPrivilege	4628	taskkill.exe
Token: SeDebugPrivilege	4444	taskkill.exe
Token: SeDebugPrivilege	876	taskkill.exe
Token: SeDebugPrivilege	3288	taskkill.exe
Token: SeDebugPrivilege	688	taskkill.exe
Token: SeDebugPrivilege	3308	taskkill.exe
Token: SeDebugPrivilege	8	taskkill.exe
Token: SeDebugPrivilege	972	taskkill.exe
Token: SeDebugPrivilege	5012	taskkill.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4736 wrote to memory of 3796	4736	vService.exe	90
PID 4736 wrote to memory of 2796	4736	vService.exe	89
PID 3796 wrote to memory of 3140	3796	cmd.exe	91
PID 2796 wrote to memory of 3028	2796	cmd.exe	92
PID 4736 wrote to memory of 5084	4736	vService.exe	94
PID 5084 wrote to memory of 4548	5084	cmd.exe	95
PID 4736 wrote to memory of 3756	4736	vService.exe	96
PID 3756 wrote to memory of 940	3756	cmd.exe	97
PID 4736 wrote to memory of 1224	4736	vService.exe	98
PID 1224 wrote to memory of 4656	1224	cmd.exe	99
PID 4736 wrote to memory of 2600	4736	vService.exe	100
PID 2600 wrote to memory of 2368	2600	cmd.exe	101
PID 4736 wrote to memory of 4860	4736	vService.exe	104
PID 4860 wrote to memory of 3948	4860	cmd.exe	105
PID 4736 wrote to memory of 3572	4736	vService.exe	107
PID 3572 wrote to memory of 2152	3572	cmd.exe	108
PID 4736 wrote to memory of 1952	4736	vService.exe	109
PID 1952 wrote to memory of 1220	1952	cmd.exe	110
PID 4736 wrote to memory of 4404	4736	vService.exe	111
PID 4404 wrote to memory of 1216	4404	cmd.exe	112
PID 4736 wrote to memory of 2336	4736	vService.exe	114
PID 2336 wrote to memory of 1132	2336	cmd.exe	115
PID 4736 wrote to memory of 2672	4736	vService.exe	116
PID 2672 wrote to memory of 4724	2672	cmd.exe	117
PID 4736 wrote to memory of 3300	4736	vService.exe	118
PID 3300 wrote to memory of 3576	3300	cmd.exe	119
PID 4736 wrote to memory of 4040	4736	vService.exe	122
PID 4040 wrote to memory of 4872	4040	cmd.exe	123
PID 4736 wrote to memory of 516	4736	vService.exe	124
PID 516 wrote to memory of 3712	516	cmd.exe	125
PID 4736 wrote to memory of 5020	4736	vService.exe	126
PID 5020 wrote to memory of 2472	5020	cmd.exe	127
PID 4736 wrote to memory of 4440	4736	vService.exe	128
PID 4440 wrote to memory of 540	4440	cmd.exe	129
PID 4736 wrote to memory of 3360	4736	vService.exe	130
PID 3360 wrote to memory of 2324	3360	cmd.exe	131
PID 4736 wrote to memory of 3624	4736	vService.exe	132
PID 3624 wrote to memory of 3580	3624	cmd.exe	133
PID 4736 wrote to memory of 4708	4736	vService.exe	134
PID 4708 wrote to memory of 4472	4708	cmd.exe	135
PID 4736 wrote to memory of 4212	4736	vService.exe	136
PID 4212 wrote to memory of 2696	4212	cmd.exe	137
PID 4736 wrote to memory of 1408	4736	vService.exe	138
PID 1408 wrote to memory of 3200	1408	cmd.exe	139
PID 4736 wrote to memory of 3776	4736	vService.exe	140
PID 3776 wrote to memory of 2660	3776	cmd.exe	141
PID 4736 wrote to memory of 3788	4736	vService.exe	142
PID 3788 wrote to memory of 4216	3788	cmd.exe	143
PID 4736 wrote to memory of 4520	4736	vService.exe	144
PID 4520 wrote to memory of 2624	4520	cmd.exe	145
PID 4736 wrote to memory of 3804	4736	vService.exe	146
PID 3804 wrote to memory of 3960	3804	cmd.exe	147
PID 4736 wrote to memory of 1976	4736	vService.exe	148
PID 1976 wrote to memory of 2392	1976	cmd.exe	149
PID 4736 wrote to memory of 3056	4736	vService.exe	151
PID 3056 wrote to memory of 2924	3056	cmd.exe	152
PID 4736 wrote to memory of 748	4736	vService.exe	153
PID 748 wrote to memory of 4536	748	cmd.exe	154
PID 4736 wrote to memory of 556	4736	vService.exe	155
PID 556 wrote to memory of 4664	556	cmd.exe	156
PID 4736 wrote to memory of 3692	4736	vService.exe	157
PID 3692 wrote to memory of 1124	3692	cmd.exe	158
PID 4736 wrote to memory of 4700	4736	vService.exe	160
PID 4700 wrote to memory of 4628	4700	cmd.exe	161

C:\Users\Admin\AppData\Local\Temp\vService.exe
"C:\Users\Admin\AppData\Local\Temp\vService.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4736
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2796
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3028
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop vgc >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3796
- - C:\Windows\system32\sc.exe
    sc stop vgc
    3⤵
    - Launches sc.exe
    PID:3140
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start vgc >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5084
- - C:\Windows\system32\sc.exe
    sc start vgc
    3⤵
    - Launches sc.exe
    PID:4548
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3756
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:940
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1224
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4656
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2600
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2368
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4860
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3948
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3572
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2152
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1952
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1220
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4404
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1216
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2336
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1132
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2672
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4724
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3300
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3576
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4040
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4872
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:516
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3712
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5020
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2472
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4440
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:540
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3360
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2324
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3624
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3580
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4708
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4472
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4212
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2696
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1408
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3200
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3776
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2660
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3788
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4216
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4520
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2624
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3804
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3960
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1976
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2392
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3056
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2924
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:748
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4536
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:556
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4664
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3692
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1124
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4700
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4628
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  PID:828
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2780
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  PID:3400
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1272
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  PID:2996
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4416
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  PID:4784
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1772
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  PID:3392
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4068
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  PID:4424
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4616
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  PID:3952
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3264
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  PID:3488
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1104
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  PID:2820
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1540
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  PID:3088
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1836
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  PID:4224
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4924
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  PID:4484
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3364
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  PID:2300
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:396
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  PID:4456
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4684
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  PID:2164
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2776
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  PID:4696
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3464
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  PID:5004
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4136
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  PID:4812
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3960
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  PID:4076
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4380
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  PID:2692
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4220
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  PID:3592
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2964
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  PID:4264
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2152
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  PID:1900
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4608
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  PID:2368
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4804
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  PID:3196
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4628
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  PID:4064
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4444
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  PID:3504
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:876
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  PID:3220
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3288
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  PID:3176
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:688
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  PID:2904
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3308
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  PID:3712
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:8
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  PID:3208
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:972
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  PID:1152
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:5012
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  PID:3580
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Kills process with taskkill
    PID:2980
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  PID:4580
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Kills process with taskkill
    PID:740
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  PID:4636
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    PID:3832
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  PID:2660
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    PID:2776
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  PID:3464
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Kills process with taskkill
    PID:1488
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  PID:4136
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    PID:4368
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  PID:4896
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    PID:5052
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  PID:4932
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Kills process with taskkill
    PID:4532
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  PID:780
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Kills process with taskkill
    PID:2568
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  PID:3368
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Kills process with taskkill
    PID:4536
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  PID:704
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Kills process with taskkill
    PID:4592
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  PID:2476
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Kills process with taskkill
    PID:4920
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  PID:3320
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    PID:1132
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  PID:4188
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Kills process with taskkill
    PID:1764
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  PID:4764
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    PID:2340
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  PID:5036
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Kills process with taskkill
    PID:3288
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  PID:3708
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    PID:1040
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  PID:4792
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    PID:5096
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  PID:3508
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    PID:2288
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  PID:2544
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Kills process with taskkill
    PID:2080
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  PID:1804
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Kills process with taskkill
    PID:3016
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  PID:4472
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Kills process with taskkill
    PID:3792
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  PID:2708
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    PID:3284
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  PID:4692
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Kills process with taskkill
    PID:1968
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  PID:4612
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Kills process with taskkill
    PID:1880
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  PID:60
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    PID:3500
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  PID:4944
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    PID:664
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  PID:1400
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Kills process with taskkill
    PID:2356
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  PID:4168
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Kills process with taskkill
    PID:2304
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  PID:1404
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Kills process with taskkill
    PID:3204
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  PID:5052
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Kills process with taskkill
    PID:1192
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  PID:4716
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    PID:4532
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  PID:1560
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    PID:552
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  PID:3784
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Kills process with taskkill
    PID:1944
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  PID:4608
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    PID:4116
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  PID:2728
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Kills process with taskkill
    PID:4920
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  PID:4544
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Kills process with taskkill
    PID:4936
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  PID:768
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    PID:3824
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  PID:2340
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    PID:1232
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  PID:4296
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Kills process with taskkill
    PID:1656
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  PID:4336
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Kills process with taskkill
    PID:688
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  PID:1444
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    PID:4428
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  PID:2288
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    PID:872
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  PID:1836
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    PID:2244
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  PID:1844
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    PID:2572
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  PID:3792
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    PID:3668
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  PID:3284
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Kills process with taskkill
    PID:1548
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  PID:832
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    PID:4328
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  PID:4684
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    PID:3536
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  PID:824
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    PID:3540
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  PID:3064
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Kills process with taskkill
    PID:3428
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  PID:3512
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    PID:4304
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  PID:4656
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    PID:2468
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  PID:2984
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    PID:1620
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  PID:4380
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Kills process with taskkill
    PID:2348
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  PID:3544
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Kills process with taskkill
    PID:1092
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  PID:1668
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    PID:4916
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  PID:4712
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Kills process with taskkill
    PID:1652
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  PID:1372
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Kills process with taskkill
    PID:2044
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  PID:456
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    PID:4444
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  PID:1272
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    PID:640
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  PID:4940
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    PID:3012
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  PID:1984
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    PID:4616
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  PID:176
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    PID:4604
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  PID:1104
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    PID:2740
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  PID:3164
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Kills process with taskkill
    PID:2244
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  PID:4120
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    PID:5012
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  PID:4128
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    PID:4632