0f8722c9ae30238f2f1ecf9b05f6c27a3ff491103d33a20a51cb06bbdd812c3a

Analysis

max time kernel
149s
max time network
115s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/08/2026, 02:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-02_a128b65ef77cd0dfb6a409d2c93d206e_cobalt-strike_icedid_njrat_satacom_stealc.exe
Size 175KB
Sample260802-dap8aacb63
SHA256 0f8722c9ae30238f2f1ecf9b05f6c27a3ff491103d33a20a51cb06bbdd812c3a
MD5 a128b65ef77cd0dfb6a409d2c93d206e
SHA1 c8c601ec576c1ba8cdf5e910d6ef39b33e3c7030
SHA512 757478d541a679693e0d1564e3d8c86c49683d0e4c176389b2f98dc08c42ff214cb559dba942684c551431a8b1f9fa3c2bbc5eedce9f26b1e40779ecaa9ad155
SSDEEP 3072:Z+msQE1atGNEoien+lOcqtIqWGFdbXCb6/g1g9l+YAIxU7B:ZgQE1at1Eq5qtI4DAEa7
TLSH
T16D045C16B3E910FAE1779279C9A10642F777782507209BDF03A043B6AF276D19D3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion execution persistence privilege_escalation

Malware Config

Signatures

Disables Task Manager via registry modification
defense_evasion

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindowsService.lnk	2026-08-02_a128b65ef77cd0dfb6a409d2c93d206e_cobalt-strike_icedid_njrat_satacom_stealc.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindowsService.lnk	2026-08-02_a128b65ef77cd0dfb6a409d2c93d206e_cobalt-strike_icedid_njrat_satacom_stealc.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsServiceHost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\svchost.exe"	2026-08-02_a128b65ef77cd0dfb6a409d2c93d206e_cobalt-strike_icedid_njrat_satacom_stealc.exe

Executes a command shell one-liner 1 TTPs 64 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5364	cmd.exe
5944	cmd.exe
588	cmd.exe
6016	cmd.exe
1612	cmd.exe
4204	cmd.exe
1548	cmd.exe
1684	cmd.exe
3892	cmd.exe
1264	cmd.exe
2216	cmd.exe
5992	cmd.exe
5952	cmd.exe
3384	cmd.exe
1236	cmd.exe
4860	cmd.exe
1228	cmd.exe
3720	cmd.exe
1536	cmd.exe
5736	cmd.exe
4280	cmd.exe
5412	cmd.exe
4536	cmd.exe
1776	cmd.exe
4920	cmd.exe
5144	cmd.exe
2260	cmd.exe
2072	cmd.exe
2532	cmd.exe
3420	cmd.exe
2456	cmd.exe
876	cmd.exe
1356	cmd.exe
5368	cmd.exe
4812	cmd.exe
2196	cmd.exe
5304	cmd.exe
252	cmd.exe
2856	cmd.exe
2164	cmd.exe
5728	cmd.exe
1428	cmd.exe
5720	cmd.exe
1372	cmd.exe
4120	cmd.exe
2000	cmd.exe
2112	cmd.exe
3376	cmd.exe
4424	cmd.exe
3124	cmd.exe
2328	cmd.exe
1496	cmd.exe
2368	cmd.exe
3040	cmd.exe
1268	cmd.exe
5332	cmd.exe
240	cmd.exe
3248	cmd.exe
3596	cmd.exe
5912	cmd.exe
4460	cmd.exe
2052	cmd.exe
2644	cmd.exe
2584	cmd.exe

Kills process with taskkill 64 IoCs

defense_evasion

pid	Process
5172	taskkill.exe
5412	taskkill.exe
5092	taskkill.exe
4840	taskkill.exe
4668	taskkill.exe
3340	taskkill.exe
3368	taskkill.exe
3600	taskkill.exe
2432	taskkill.exe
4788	taskkill.exe
2112	taskkill.exe
1280	taskkill.exe
5148	taskkill.exe
2768	taskkill.exe
5224	taskkill.exe
3488	taskkill.exe
4784	taskkill.exe
6120	taskkill.exe
3736	taskkill.exe
1872	taskkill.exe
5088	taskkill.exe
5956	taskkill.exe
428	taskkill.exe
3152	taskkill.exe
6120	taskkill.exe
4740	taskkill.exe
5976	taskkill.exe
3952	taskkill.exe
5828	taskkill.exe
1328	taskkill.exe
5620	taskkill.exe
2152	taskkill.exe
5956	taskkill.exe
5432	taskkill.exe
1424	taskkill.exe
4584	taskkill.exe
5752	taskkill.exe
3880	taskkill.exe
4792	taskkill.exe
3332	taskkill.exe
1176	taskkill.exe
4668	taskkill.exe
5124	taskkill.exe
5232	taskkill.exe
1432	taskkill.exe
4952	taskkill.exe
5092	taskkill.exe
1596	taskkill.exe
6108	taskkill.exe
4424	taskkill.exe
1704	taskkill.exe
688	taskkill.exe
3520	taskkill.exe
4948	taskkill.exe
956	taskkill.exe
3720	taskkill.exe
1124	taskkill.exe
1160	taskkill.exe
2552	taskkill.exe
1100	taskkill.exe
5304	taskkill.exe
5124	taskkill.exe
1960	taskkill.exe
4432	taskkill.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2108	schtasks.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3452	taskkill.exe
Token: SeDebugPrivilege	1160	taskkill.exe
Token: SeDebugPrivilege	1612	taskkill.exe
Token: SeDebugPrivilege	4840	taskkill.exe
Token: SeDebugPrivilege	1576	taskkill.exe
Token: SeDebugPrivilege	4352	taskkill.exe
Token: SeDebugPrivilege	5092	taskkill.exe
Token: SeDebugPrivilege	3488	taskkill.exe
Token: SeDebugPrivilege	3880	taskkill.exe
Token: SeDebugPrivilege	6124	taskkill.exe
Token: SeDebugPrivilege	2152	taskkill.exe
Token: SeDebugPrivilege	2852	taskkill.exe
Token: SeDebugPrivilege	564	taskkill.exe
Token: SeDebugPrivilege	3276	taskkill.exe
Token: SeDebugPrivilege	1596	taskkill.exe
Token: SeDebugPrivilege	4828	taskkill.exe
Token: SeDebugPrivilege	2432	taskkill.exe
Token: SeDebugPrivilege	3048	taskkill.exe
Token: SeDebugPrivilege	4432	taskkill.exe
Token: SeDebugPrivilege	5800	taskkill.exe
Token: SeDebugPrivilege	4784	taskkill.exe
Token: SeDebugPrivilege	4792	taskkill.exe
Token: SeDebugPrivilege	2628	taskkill.exe
Token: SeDebugPrivilege	420	taskkill.exe
Token: SeDebugPrivilege	4912	taskkill.exe
Token: SeDebugPrivilege	2552	taskkill.exe
Token: SeDebugPrivilege	3332	taskkill.exe
Token: SeDebugPrivilege	3820	taskkill.exe
Token: SeDebugPrivilege	6108	taskkill.exe
Token: SeDebugPrivilege	3024	taskkill.exe
Token: SeDebugPrivilege	6120	taskkill.exe
Token: SeDebugPrivilege	5172	taskkill.exe
Token: SeDebugPrivilege	5136	taskkill.exe
Token: SeDebugPrivilege	4788	taskkill.exe
Token: SeDebugPrivilege	4952	taskkill.exe
Token: SeDebugPrivilege	2112	taskkill.exe
Token: SeDebugPrivilege	2148	taskkill.exe
Token: SeDebugPrivilege	2604	taskkill.exe
Token: SeDebugPrivilege	4532	taskkill.exe
Token: SeDebugPrivilege	4652	taskkill.exe
Token: SeDebugPrivilege	3624	taskkill.exe
Token: SeDebugPrivilege	5412	taskkill.exe
Token: SeDebugPrivilege	428	taskkill.exe
Token: SeDebugPrivilege	5828	taskkill.exe
Token: SeDebugPrivilege	2596	taskkill.exe
Token: SeDebugPrivilege	4108	taskkill.exe
Token: SeDebugPrivilege	2552	taskkill.exe
Token: SeDebugPrivilege	5956	taskkill.exe
Token: SeDebugPrivilege	3416	taskkill.exe
Token: SeDebugPrivilege	3152	taskkill.exe
Token: SeDebugPrivilege	4668	taskkill.exe
Token: SeDebugPrivilege	5304	taskkill.exe
Token: SeDebugPrivilege	5224	taskkill.exe
Token: SeDebugPrivilege	956	taskkill.exe
Token: SeDebugPrivilege	1100	taskkill.exe
Token: SeDebugPrivilege	3384	taskkill.exe
Token: SeDebugPrivilege	564	taskkill.exe
Token: SeDebugPrivilege	1616	taskkill.exe
Token: SeDebugPrivilege	3736	taskkill.exe
Token: SeDebugPrivilege	3800	taskkill.exe
Token: SeDebugPrivilege	2036	taskkill.exe
Token: SeDebugPrivilege	5948	taskkill.exe
Token: SeDebugPrivilege	4424	taskkill.exe
Token: SeDebugPrivilege	4504	taskkill.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1240	2026-08-02_a128b65ef77cd0dfb6a409d2c93d206e_cobalt-strike_icedid_njrat_satacom_stealc.exe
1240	2026-08-02_a128b65ef77cd0dfb6a409d2c93d206e_cobalt-strike_icedid_njrat_satacom_stealc.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1240 wrote to memory of 2108	1240	2026-08-02_a128b65ef77cd0dfb6a409d2c93d206e_cobalt-strike_icedid_njrat_satacom_stealc.exe	88
PID 1240 wrote to memory of 700	1240	2026-08-02_a128b65ef77cd0dfb6a409d2c93d206e_cobalt-strike_icedid_njrat_satacom_stealc.exe	89
PID 700 wrote to memory of 3452	700	cmd.exe	93
PID 1240 wrote to memory of 4248	1240	2026-08-02_a128b65ef77cd0dfb6a409d2c93d206e_cobalt-strike_icedid_njrat_satacom_stealc.exe	95
PID 4248 wrote to memory of 1160	4248	cmd.exe	97
PID 1240 wrote to memory of 5736	1240	2026-08-02_a128b65ef77cd0dfb6a409d2c93d206e_cobalt-strike_icedid_njrat_satacom_stealc.exe	98
PID 5736 wrote to memory of 1612	5736	cmd.exe	100
PID 1240 wrote to memory of 3536	1240	2026-08-02_a128b65ef77cd0dfb6a409d2c93d206e_cobalt-strike_icedid_njrat_satacom_stealc.exe	101
PID 3536 wrote to memory of 4840	3536	cmd.exe	103
PID 1240 wrote to memory of 3188	1240	2026-08-02_a128b65ef77cd0dfb6a409d2c93d206e_cobalt-strike_icedid_njrat_satacom_stealc.exe	104
PID 3188 wrote to memory of 1576	3188	cmd.exe	106
PID 1240 wrote to memory of 4920	1240	2026-08-02_a128b65ef77cd0dfb6a409d2c93d206e_cobalt-strike_icedid_njrat_satacom_stealc.exe	107
PID 4920 wrote to memory of 4352	4920	cmd.exe	109
PID 1240 wrote to memory of 1128	1240	2026-08-02_a128b65ef77cd0dfb6a409d2c93d206e_cobalt-strike_icedid_njrat_satacom_stealc.exe	110
PID 1128 wrote to memory of 5092	1128	cmd.exe	112
PID 1240 wrote to memory of 5436	1240	2026-08-02_a128b65ef77cd0dfb6a409d2c93d206e_cobalt-strike_icedid_njrat_satacom_stealc.exe	113
PID 5436 wrote to memory of 3488	5436	cmd.exe	115
PID 1240 wrote to memory of 5860	1240	2026-08-02_a128b65ef77cd0dfb6a409d2c93d206e_cobalt-strike_icedid_njrat_satacom_stealc.exe	116
PID 5860 wrote to memory of 3880	5860	cmd.exe	118
PID 1240 wrote to memory of 1944	1240	2026-08-02_a128b65ef77cd0dfb6a409d2c93d206e_cobalt-strike_icedid_njrat_satacom_stealc.exe	119
PID 1944 wrote to memory of 6124	1944	cmd.exe	121
PID 1240 wrote to memory of 1496	1240	2026-08-02_a128b65ef77cd0dfb6a409d2c93d206e_cobalt-strike_icedid_njrat_satacom_stealc.exe	122
PID 1496 wrote to memory of 2152	1496	cmd.exe	124
PID 1240 wrote to memory of 1372	1240	2026-08-02_a128b65ef77cd0dfb6a409d2c93d206e_cobalt-strike_icedid_njrat_satacom_stealc.exe	125
PID 1372 wrote to memory of 2852	1372	cmd.exe	127
PID 1240 wrote to memory of 2584	1240	2026-08-02_a128b65ef77cd0dfb6a409d2c93d206e_cobalt-strike_icedid_njrat_satacom_stealc.exe	128
PID 2584 wrote to memory of 564	2584	cmd.exe	130
PID 1240 wrote to memory of 5864	1240	2026-08-02_a128b65ef77cd0dfb6a409d2c93d206e_cobalt-strike_icedid_njrat_satacom_stealc.exe	131
PID 5864 wrote to memory of 3276	5864	cmd.exe	133
PID 1240 wrote to memory of 5472	1240	2026-08-02_a128b65ef77cd0dfb6a409d2c93d206e_cobalt-strike_icedid_njrat_satacom_stealc.exe	134
PID 5472 wrote to memory of 1596	5472	cmd.exe	136
PID 1240 wrote to memory of 5020	1240	2026-08-02_a128b65ef77cd0dfb6a409d2c93d206e_cobalt-strike_icedid_njrat_satacom_stealc.exe	137
PID 5020 wrote to memory of 4828	5020	cmd.exe	139
PID 1240 wrote to memory of 1660	1240	2026-08-02_a128b65ef77cd0dfb6a409d2c93d206e_cobalt-strike_icedid_njrat_satacom_stealc.exe	140
PID 1660 wrote to memory of 2432	1660	cmd.exe	142
PID 1240 wrote to memory of 1592	1240	2026-08-02_a128b65ef77cd0dfb6a409d2c93d206e_cobalt-strike_icedid_njrat_satacom_stealc.exe	143
PID 1592 wrote to memory of 3048	1592	cmd.exe	145
PID 1240 wrote to memory of 5708	1240	2026-08-02_a128b65ef77cd0dfb6a409d2c93d206e_cobalt-strike_icedid_njrat_satacom_stealc.exe	146
PID 5708 wrote to memory of 4432	5708	cmd.exe	148
PID 1240 wrote to memory of 5712	1240	2026-08-02_a128b65ef77cd0dfb6a409d2c93d206e_cobalt-strike_icedid_njrat_satacom_stealc.exe	149
PID 5712 wrote to memory of 5800	5712	cmd.exe	151
PID 1240 wrote to memory of 5144	1240	2026-08-02_a128b65ef77cd0dfb6a409d2c93d206e_cobalt-strike_icedid_njrat_satacom_stealc.exe	152
PID 5144 wrote to memory of 4784	5144	cmd.exe	154
PID 1240 wrote to memory of 1536	1240	2026-08-02_a128b65ef77cd0dfb6a409d2c93d206e_cobalt-strike_icedid_njrat_satacom_stealc.exe	155
PID 1536 wrote to memory of 4792	1536	cmd.exe	157
PID 1240 wrote to memory of 1832	1240	2026-08-02_a128b65ef77cd0dfb6a409d2c93d206e_cobalt-strike_icedid_njrat_satacom_stealc.exe	158
PID 1832 wrote to memory of 2628	1832	cmd.exe	160
PID 1240 wrote to memory of 2644	1240	2026-08-02_a128b65ef77cd0dfb6a409d2c93d206e_cobalt-strike_icedid_njrat_satacom_stealc.exe	161
PID 2644 wrote to memory of 420	2644	cmd.exe	163
PID 1240 wrote to memory of 2780	1240	2026-08-02_a128b65ef77cd0dfb6a409d2c93d206e_cobalt-strike_icedid_njrat_satacom_stealc.exe	164
PID 2780 wrote to memory of 4912	2780	cmd.exe	166
PID 1240 wrote to memory of 1244	1240	2026-08-02_a128b65ef77cd0dfb6a409d2c93d206e_cobalt-strike_icedid_njrat_satacom_stealc.exe	167
PID 1244 wrote to memory of 2552	1244	cmd.exe	169
PID 1240 wrote to memory of 5808	1240	2026-08-02_a128b65ef77cd0dfb6a409d2c93d206e_cobalt-strike_icedid_njrat_satacom_stealc.exe	170
PID 5808 wrote to memory of 3332	5808	cmd.exe	172
PID 1240 wrote to memory of 2260	1240	2026-08-02_a128b65ef77cd0dfb6a409d2c93d206e_cobalt-strike_icedid_njrat_satacom_stealc.exe	173
PID 2260 wrote to memory of 3820	2260	cmd.exe	175
PID 1240 wrote to memory of 3168	1240	2026-08-02_a128b65ef77cd0dfb6a409d2c93d206e_cobalt-strike_icedid_njrat_satacom_stealc.exe	176
PID 3168 wrote to memory of 6108	3168	cmd.exe	178
PID 1240 wrote to memory of 4628	1240	2026-08-02_a128b65ef77cd0dfb6a409d2c93d206e_cobalt-strike_icedid_njrat_satacom_stealc.exe	179
PID 4628 wrote to memory of 3024	4628	cmd.exe	181
PID 1240 wrote to memory of 1264	1240	2026-08-02_a128b65ef77cd0dfb6a409d2c93d206e_cobalt-strike_icedid_njrat_satacom_stealc.exe	182
PID 1264 wrote to memory of 6120	1264	cmd.exe	184
PID 1240 wrote to memory of 1844	1240	2026-08-02_a128b65ef77cd0dfb6a409d2c93d206e_cobalt-strike_icedid_njrat_satacom_stealc.exe	185

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-08-02_a128b65ef77cd0dfb6a409d2c93d206e_cobalt-strike_icedid_njrat_satacom_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-02_a128b65ef77cd0dfb6a409d2c93d206e_cobalt-strike_icedid_njrat_satacom_stealc.exe"
1⤵
- Creates a file in the Startup directory
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1240
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /create /tn "WindowsUpdateTask" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe" /sc onlogon /f /rl highest
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2108
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im explorer.exe >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:700
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im explorer.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3452
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im taskmgr.exe >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4248
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im taskmgr.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1160
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im cmd.exe >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5736
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im cmd.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1612
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im powershell.exe >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3536
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im powershell.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4840
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im explorer.exe >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3188
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im explorer.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1576
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im taskmgr.exe >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4920
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im taskmgr.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4352
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im cmd.exe >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1128
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im cmd.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5092
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im powershell.exe >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5436
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im powershell.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3488
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im explorer.exe >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5860
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im explorer.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3880
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im taskmgr.exe >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1944
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im taskmgr.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:6124
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im cmd.exe >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1496
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im cmd.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2152
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im powershell.exe >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1372
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im powershell.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2852
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im explorer.exe >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2584
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im explorer.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:564
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im taskmgr.exe >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5864
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im taskmgr.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3276
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im cmd.exe >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5472
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im cmd.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1596
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im powershell.exe >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5020
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im powershell.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4828
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im explorer.exe >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1660
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im explorer.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2432
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im taskmgr.exe >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1592
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im taskmgr.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3048
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im cmd.exe >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5708
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im cmd.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4432
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im powershell.exe >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5712
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im powershell.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:5800
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im explorer.exe >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5144
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im explorer.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4784
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im taskmgr.exe >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1536
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im taskmgr.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4792
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im cmd.exe >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1832
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im cmd.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2628
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im powershell.exe >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2644
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im powershell.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:420
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im explorer.exe >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2780
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im explorer.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4912
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im taskmgr.exe >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1244
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im taskmgr.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2552
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im cmd.exe >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5808
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im cmd.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3332
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im powershell.exe >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2260
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im powershell.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3820
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im explorer.exe >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3168
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im explorer.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:6108
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im taskmgr.exe >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4628
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im taskmgr.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3024
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im cmd.exe >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1264
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im cmd.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:6120
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im powershell.exe >nul 2>&1
  2⤵
  PID:1844
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im powershell.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5172
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im explorer.exe >nul 2>&1
  2⤵
  PID:2912
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im explorer.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:5136
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im taskmgr.exe >nul 2>&1
  2⤵
  PID:6080
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im taskmgr.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4788
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im cmd.exe >nul 2>&1
  2⤵
  PID:5128
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im cmd.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4952
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im powershell.exe >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:2072
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im powershell.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2112
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im explorer.exe >nul 2>&1
  2⤵
  PID:616
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im explorer.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2148
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im taskmgr.exe >nul 2>&1
  2⤵
  PID:5096
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im taskmgr.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2604
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im cmd.exe >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:5912
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im cmd.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4532
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im powershell.exe >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:5952
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im powershell.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4652
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im explorer.exe >nul 2>&1
  2⤵
  PID:4328
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im explorer.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3624
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im taskmgr.exe >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:2532
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im taskmgr.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5412
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im cmd.exe >nul 2>&1
  2⤵
  PID:4956
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im cmd.exe
    3⤵
    PID:876
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im powershell.exe >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:3420
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im powershell.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:428
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im explorer.exe >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:4120
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im explorer.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5828
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im taskmgr.exe >nul 2>&1
  2⤵
  PID:2704
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im taskmgr.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2596
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im cmd.exe >nul 2>&1
  2⤵
  PID:2100
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im cmd.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4108
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im powershell.exe >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:6016
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im powershell.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2552
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im explorer.exe >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:4460
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im explorer.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5956
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im taskmgr.exe >nul 2>&1
  2⤵
  PID:1404
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im taskmgr.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3416
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im cmd.exe >nul 2>&1
  2⤵
  PID:848
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im cmd.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3152
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im powershell.exe >nul 2>&1
  2⤵
  PID:2640
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im powershell.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4668
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im explorer.exe >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:2052
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im explorer.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5304
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im taskmgr.exe >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:2216
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im taskmgr.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5224
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im cmd.exe >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:2000
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im cmd.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:956
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im powershell.exe >nul 2>&1
  2⤵
  PID:3296
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im powershell.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1100
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im explorer.exe >nul 2>&1
  2⤵
  PID:3204
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im explorer.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3384
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im taskmgr.exe >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:2112
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im taskmgr.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:564
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im cmd.exe >nul 2>&1
  2⤵
  PID:2148
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im cmd.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1616
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im powershell.exe >nul 2>&1
  2⤵
  PID:4632
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im powershell.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3736
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im explorer.exe >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:5364
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im explorer.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3800
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im taskmgr.exe >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:3376
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im taskmgr.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2036
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im cmd.exe >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:4280
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im cmd.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:5948
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im powershell.exe >nul 2>&1
  2⤵
  PID:5628
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im powershell.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4424
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im explorer.exe >nul 2>&1
  2⤵
  PID:4716
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im explorer.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4504
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im taskmgr.exe >nul 2>&1
  2⤵
  PID:1676
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im taskmgr.exe
    3⤵
    PID:5336
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im cmd.exe >nul 2>&1
  2⤵
  PID:2620
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im cmd.exe
    3⤵
    PID:1236
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im powershell.exe >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:5332
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im powershell.exe
    3⤵
    PID:260
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im explorer.exe >nul 2>&1
  2⤵
  PID:3632
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im explorer.exe
    3⤵
    PID:5372
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im taskmgr.exe >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:240
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im taskmgr.exe
    3⤵
    PID:4512
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im cmd.exe >nul 2>&1
  2⤵
  PID:3488
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im cmd.exe
    3⤵
    PID:5896
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im powershell.exe >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:2368
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im powershell.exe
    3⤵
    - Kills process with taskkill
    PID:5124
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im explorer.exe >nul 2>&1
  2⤵
  PID:4732
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im explorer.exe
    3⤵
    PID:5040
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im taskmgr.exe >nul 2>&1
  2⤵
  PID:5968
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im taskmgr.exe
    3⤵
    - Kills process with taskkill
    PID:1280
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im cmd.exe >nul 2>&1
  2⤵
  PID:2068
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im cmd.exe
    3⤵
    - Kills process with taskkill
    PID:5232
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im powershell.exe >nul 2>&1
  2⤵
  PID:4548
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im powershell.exe
    3⤵
    PID:5888
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im explorer.exe >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:1684
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im explorer.exe
    3⤵
    - Kills process with taskkill
    PID:1704
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im taskmgr.exe >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:3384
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im taskmgr.exe
    3⤵
    - Kills process with taskkill
    PID:1328
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im cmd.exe >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:2456
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im cmd.exe
    3⤵
    PID:4884
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im powershell.exe >nul 2>&1
  2⤵
  PID:1772
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im powershell.exe
    3⤵
    - Kills process with taskkill
    PID:688
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im explorer.exe >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:1356
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im explorer.exe
    3⤵
    PID:4804
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im taskmgr.exe >nul 2>&1
  2⤵
  PID:6068
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im taskmgr.exe
    3⤵
    PID:1764
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im cmd.exe >nul 2>&1
  2⤵
  PID:1224
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im cmd.exe
    3⤵
    PID:1424
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im powershell.exe >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:3040
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im powershell.exe
    3⤵
    PID:6052
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im explorer.exe >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:876
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im explorer.exe
    3⤵
    PID:5148
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im taskmgr.exe >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:1612
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im taskmgr.exe
    3⤵
    PID:4724
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im cmd.exe >nul 2>&1
  2⤵
  PID:5336
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im cmd.exe
    3⤵
    PID:4108
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im powershell.exe >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:1236
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im powershell.exe
    3⤵
    PID:2876
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im explorer.exe >nul 2>&1
  2⤵
  PID:4224
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im explorer.exe
    3⤵
    PID:4536
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im taskmgr.exe >nul 2>&1
  2⤵
  PID:5372
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im taskmgr.exe
    3⤵
    PID:3560
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im cmd.exe >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:5944
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im cmd.exe
    3⤵
    PID:5772
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im powershell.exe >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:5728
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im powershell.exe
    3⤵
    - Kills process with taskkill
    PID:5124
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im explorer.exe >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:4860
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im explorer.exe
    3⤵
    - Kills process with taskkill
    PID:6120
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im taskmgr.exe >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:5368
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im taskmgr.exe
    3⤵
    PID:5260
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im cmd.exe >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:588
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im cmd.exe
    3⤵
    PID:1528
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im powershell.exe >nul 2>&1
  2⤵
  PID:5284
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im powershell.exe
    3⤵
    - Kills process with taskkill
    PID:5432
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im explorer.exe >nul 2>&1
  2⤵
  PID:2720
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im explorer.exe
    3⤵
    - Kills process with taskkill
    PID:1872
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im taskmgr.exe >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:3892
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im taskmgr.exe
    3⤵
    - Kills process with taskkill
    PID:4740
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im cmd.exe >nul 2>&1
  2⤵
  PID:6112
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im cmd.exe
    3⤵
    PID:5320
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im powershell.exe >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:4812
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im powershell.exe
    3⤵
    PID:3228
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im explorer.exe >nul 2>&1
  2⤵
  PID:5648
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im explorer.exe
    3⤵
    PID:5204
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im taskmgr.exe >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:4204
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im taskmgr.exe
    3⤵
    PID:4936
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im cmd.exe >nul 2>&1
  2⤵
  PID:1444
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im cmd.exe
    3⤵
    - Kills process with taskkill
    PID:1124
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im powershell.exe >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:5412
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im powershell.exe
    3⤵
    - Kills process with taskkill
    PID:1176
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im explorer.exe >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:3248
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im explorer.exe
    3⤵
    - Kills process with taskkill
    PID:5148
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im taskmgr.exe >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:3596
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im taskmgr.exe
    3⤵
    PID:5824
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im cmd.exe >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:2196
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im cmd.exe
    3⤵
    PID:2920
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im powershell.exe >nul 2>&1
  2⤵
  PID:3068
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im powershell.exe
    3⤵
    PID:2004
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im explorer.exe >nul 2>&1
  2⤵
  PID:3336
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im explorer.exe
    3⤵
    - Kills process with taskkill
    PID:3340
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im taskmgr.exe >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:4536
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im taskmgr.exe
    3⤵
    - Kills process with taskkill
    PID:5092
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im cmd.exe >nul 2>&1
  2⤵
  PID:5448
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im cmd.exe
    3⤵
    - Kills process with taskkill
    PID:3720
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im powershell.exe >nul 2>&1
  2⤵
  PID:5772
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im powershell.exe
    3⤵
    PID:5508
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im explorer.exe >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:1268
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im explorer.exe
    3⤵
    - Kills process with taskkill
    PID:3520
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im taskmgr.exe >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:5304
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im taskmgr.exe
    3⤵
    PID:4372
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im cmd.exe >nul 2>&1
  2⤵
  PID:3888
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im cmd.exe
    3⤵
    PID:2500
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im powershell.exe >nul 2>&1
  2⤵
  PID:3676
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im powershell.exe
    3⤵
    PID:3996
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im explorer.exe >nul 2>&1
  2⤵
  PID:1288
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im explorer.exe
    3⤵
    PID:5532
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im taskmgr.exe >nul 2>&1
  2⤵
  PID:4308
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im taskmgr.exe
    3⤵
    PID:5100
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im cmd.exe >nul 2>&1
  2⤵
  PID:3052
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im cmd.exe
    3⤵
    PID:5464
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im powershell.exe >nul 2>&1
  2⤵
  PID:4848
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im powershell.exe
    3⤵
    PID:2688
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im explorer.exe >nul 2>&1
  2⤵
  PID:4908
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im explorer.exe
    3⤵
    PID:1764
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im taskmgr.exe >nul 2>&1
  2⤵
  PID:3512
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im taskmgr.exe
    3⤵
    - Kills process with taskkill
    PID:3368
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im cmd.exe >nul 2>&1
  2⤵
  PID:5800
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im cmd.exe
    3⤵
    - Kills process with taskkill
    PID:3600
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im powershell.exe >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:4424
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im powershell.exe
    3⤵
    - Kills process with taskkill
    PID:1432
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im explorer.exe >nul 2>&1
  2⤵
  PID:4876
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im explorer.exe
    3⤵
    PID:1084
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im taskmgr.exe >nul 2>&1
  2⤵
  PID:1492
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im taskmgr.exe
    3⤵
    PID:1936
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im cmd.exe >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:252
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im cmd.exe
    3⤵
    - Kills process with taskkill
    PID:1960
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im powershell.exe >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:2856
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im powershell.exe
    3⤵
    - Kills process with taskkill
    PID:5088
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im explorer.exe >nul 2>&1
  2⤵
  PID:1400
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im explorer.exe
    3⤵
    - Kills process with taskkill
    PID:5976
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im taskmgr.exe >nul 2>&1
  2⤵
  PID:6108
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im taskmgr.exe
    3⤵
    - Kills process with taskkill
    PID:5956
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im cmd.exe >nul 2>&1
  2⤵
  PID:5508
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im cmd.exe
    3⤵
    - Kills process with taskkill
    PID:5620
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im powershell.exe >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:5992
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im powershell.exe
    3⤵
    PID:5196
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im explorer.exe >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:3124
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im explorer.exe
    3⤵
    PID:5932
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im taskmgr.exe >nul 2>&1
  2⤵
  PID:1528
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im taskmgr.exe
    3⤵
    PID:4788
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im cmd.exe >nul 2>&1
  2⤵
  PID:1756
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im cmd.exe
    3⤵
    PID:3980
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im powershell.exe >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:1228
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im powershell.exe
    3⤵
    PID:2724
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im explorer.exe >nul 2>&1
  2⤵
  PID:1144
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im explorer.exe
    3⤵
    PID:1504
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im taskmgr.exe >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:2164
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im taskmgr.exe
    3⤵
    - Kills process with taskkill
    PID:4952
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im cmd.exe >nul 2>&1
  2⤵
  PID:2976
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im cmd.exe
    3⤵
    - Kills process with taskkill
    PID:3952
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im powershell.exe >nul 2>&1
  2⤵
  PID:1132
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im powershell.exe
    3⤵
    PID:2928
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im explorer.exe >nul 2>&1
  2⤵
  PID:1956
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im explorer.exe
    3⤵
    - Kills process with taskkill
    PID:1424
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im taskmgr.exe >nul 2>&1
  2⤵
  PID:5660
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im taskmgr.exe
    3⤵
    PID:3800
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im cmd.exe >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:1428
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im cmd.exe
    3⤵
    - Kills process with taskkill
    PID:4584
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im powershell.exe >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:5720
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im powershell.exe
    3⤵
    PID:2144
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im explorer.exe >nul 2>&1
  2⤵
  PID:4504
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im explorer.exe
    3⤵
    PID:4176
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im taskmgr.exe >nul 2>&1
  2⤵
  PID:1220
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im taskmgr.exe
    3⤵
    - Kills process with taskkill
    PID:4948
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im cmd.exe >nul 2>&1
  2⤵
  PID:2876
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im cmd.exe
    3⤵
    PID:6100
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im powershell.exe >nul 2>&1
  2⤵
  PID:1276
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im powershell.exe
    3⤵
    PID:4496
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im explorer.exe >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:1776
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im explorer.exe
    3⤵
    PID:3704
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im taskmgr.exe >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:1548
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im taskmgr.exe
    3⤵
    PID:3140
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im cmd.exe >nul 2>&1
  2⤵
  PID:5228
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im cmd.exe
    3⤵
    - Kills process with taskkill
    PID:5752
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im powershell.exe >nul 2>&1
  2⤵
  PID:4996
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im powershell.exe
    3⤵
    - Kills process with taskkill
    PID:4668
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im explorer.exe >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:3720
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im explorer.exe
    3⤵
    PID:5512
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im taskmgr.exe >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:2328
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im taskmgr.exe
    3⤵
    - Kills process with taskkill
    PID:2768
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im cmd.exe >nul 2>&1
  2⤵
  PID:4296
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im cmd.exe
    3⤵
    PID:5936
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im powershell.exe >nul 2>&1
  2⤵
  PID:5208
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im powershell.exe
    3⤵
    PID:6088