Terminating malware execution on an endpoint computing device

A system for terminating malware execution on an endpoint computing device, the system comprising:

• one or more computer-readable media having computer-executable instructions stored thereon;
• and
• one or more processors that, having executed the computer-executable instructions, are configured to:
• generate a shadow process data structure based on software process events captured on an endpoint computing device;
• create a malware detection record based upon a received malware verdict;
• detect one or more software processes in the shadow process data structure associated with a malware process identified in the malware verdict;
• update the malware detection record to include first indicia for the detected software processes;
• for each detected software process being executed:
• initiate a process termination request for the detected software process and update the malware detection record to include second indicia for the detected software process based upon acceptance or rejection of the process termination request, and
• for each detected software process that has completed execution:
• update the malware detection record to include third indicia for the detected software process;
• and
• determine whether a malware termination operation is complete on the endpoint computing device.