cb5ca84655916ba8f024499ff2e23fbd4b51effa8bf454d2c5c40c1a5f4e1d50

Analysis

max time kernel
159s
max time network
184s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
03/12/2022, 07:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

IFXMWB~1.exe
Size

13KB
MD5

d5c5f9a8736c119ed87dfc7661d0cc24
SHA1

790eac77fd7d51ac19c36a35afa89ae8492e9b16
SHA256

5247ccedc9744c5c25eb13c036b48cffadde1f804372fc60f43c4d1d4abb879e
SHA512

7b0464eb27ea0277b776ad073cca8fed50c4d2b39d2d4fe7fc6f04c62af282f6fa1dbdbc6f9af5cbba0d68bc03b6fa4e9642f007508a15cae6ecd21544143426
SSDEEP

192:tfx1/biSj4MLsQ2BX13AakSvUkt7KeBDTdiPdP6lTDQc2nFaNJhLkwcud2DH9Vw9:tfxnT2BX1JNVjKVK2FaNJawcudoD7Ub

Score

8^/10

upx

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
5116	b2e.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4368-132-0x0000000000400000-0x0000000000417000-memory.dmp	upx

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation	IFXMWB~1.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation	b2e.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Kills process with taskkill 64 IoCs

evasion

pid	Process
4924	taskkill.exe
3464	taskkill.exe
4820	taskkill.exe
5060	taskkill.exe
4056	taskkill.exe
4860	taskkill.exe
4984	taskkill.exe
4188	taskkill.exe
2752	taskkill.exe
4304	taskkill.exe
4784	taskkill.exe
4836	taskkill.exe
4480	taskkill.exe
4960	taskkill.exe
2380	taskkill.exe
1636	taskkill.exe
1976	taskkill.exe
3344	taskkill.exe
1572	taskkill.exe
3700	taskkill.exe
4284	taskkill.exe
4828	taskkill.exe
2828	taskkill.exe
4548	taskkill.exe
1824	taskkill.exe
2556	taskkill.exe
3112	taskkill.exe
1856	taskkill.exe
1432	taskkill.exe
3460	taskkill.exe
944	taskkill.exe
648	taskkill.exe
60	taskkill.exe
4952	taskkill.exe
3660	taskkill.exe
3952	taskkill.exe
1776	taskkill.exe
2556	taskkill.exe
3144	taskkill.exe
2380	taskkill.exe
1268	taskkill.exe
2828	taskkill.exe
4052	taskkill.exe
672	taskkill.exe
4740	taskkill.exe
1664	taskkill.exe
4948	taskkill.exe
2360	taskkill.exe
3340	taskkill.exe
4660	taskkill.exe
872	taskkill.exe
3320	taskkill.exe
2204	taskkill.exe
1212	taskkill.exe
2500	taskkill.exe
2284	taskkill.exe
4500	taskkill.exe
4812	taskkill.exe
4596	taskkill.exe
4760	taskkill.exe
4780	taskkill.exe
4904	taskkill.exe
1468	taskkill.exe
3364	taskkill.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4596	taskkill.exe
Token: SeDebugPrivilege	2836	taskkill.exe
Token: SeDebugPrivilege	1212	taskkill.exe
Token: SeDebugPrivilege	1580	taskkill.exe
Token: SeDebugPrivilege	940	taskkill.exe
Token: SeDebugPrivilege	1112	taskkill.exe
Token: SeDebugPrivilege	2500	taskkill.exe
Token: SeDebugPrivilege	1572	taskkill.exe
Token: SeDebugPrivilege	4024	taskkill.exe
Token: SeDebugPrivilege	2620	taskkill.exe
Token: SeDebugPrivilege	4768	taskkill.exe
Token: SeDebugPrivilege	4188	taskkill.exe
Token: SeDebugPrivilege	4864	taskkill.exe
Token: SeDebugPrivilege	4924	taskkill.exe
Token: SeDebugPrivilege	4436	taskkill.exe
Token: SeDebugPrivilege	2512	taskkill.exe
Token: SeDebugPrivilege	2624	taskkill.exe
Token: SeDebugPrivilege	2756	taskkill.exe
Token: SeDebugPrivilege	1616	taskkill.exe
Token: SeDebugPrivilege	4392	taskkill.exe
Token: SeDebugPrivilege	4980	taskkill.exe
Token: SeDebugPrivilege	3144	taskkill.exe
Token: SeDebugPrivilege	3152	taskkill.exe
Token: SeDebugPrivilege	1320	taskkill.exe
Token: SeDebugPrivilege	4900	taskkill.exe
Token: SeDebugPrivilege	3660	taskkill.exe
Token: SeDebugPrivilege	496	taskkill.exe
Token: SeDebugPrivilege	4912	taskkill.exe
Token: SeDebugPrivilege	2132	taskkill.exe
Token: SeDebugPrivilege	2104	taskkill.exe
Token: SeDebugPrivilege	4364	taskkill.exe
Token: SeDebugPrivilege	1268	taskkill.exe
Token: SeDebugPrivilege	4304	taskkill.exe
Token: SeDebugPrivilege	2568	taskkill.exe
Token: SeDebugPrivilege	2964	taskkill.exe
Token: SeDebugPrivilege	3364	taskkill.exe
Token: SeDebugPrivilege	4208	taskkill.exe
Token: SeDebugPrivilege	3828	taskkill.exe
Token: SeDebugPrivilege	3432	taskkill.exe
Token: SeDebugPrivilege	1888	taskkill.exe
Token: SeDebugPrivilege	4680	taskkill.exe
Token: SeDebugPrivilege	2936	taskkill.exe
Token: SeDebugPrivilege	4064	taskkill.exe
Token: SeDebugPrivilege	1964	taskkill.exe
Token: SeDebugPrivilege	1800	taskkill.exe
Token: SeDebugPrivilege	648	taskkill.exe
Token: SeDebugPrivilege	4676	taskkill.exe
Token: SeDebugPrivilege	4548	taskkill.exe
Token: SeDebugPrivilege	4688	taskkill.exe
Token: SeDebugPrivilege	3644	taskkill.exe
Token: SeDebugPrivilege	4624	taskkill.exe
Token: SeDebugPrivilege	4392	taskkill.exe
Token: SeDebugPrivilege	2708	taskkill.exe
Token: SeDebugPrivilege	1116	taskkill.exe
Token: SeDebugPrivilege	2120	taskkill.exe
Token: SeDebugPrivilege	496	taskkill.exe
Token: SeDebugPrivilege	4816	taskkill.exe
Token: SeDebugPrivilege	1404	taskkill.exe
Token: SeDebugPrivilege	2276	taskkill.exe
Token: SeDebugPrivilege	4948	taskkill.exe
Token: SeDebugPrivilege	4364	taskkill.exe
Token: SeDebugPrivilege	1424	taskkill.exe
Token: SeDebugPrivilege	3720	taskkill.exe
Token: SeDebugPrivilege	1640	taskkill.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4368 wrote to memory of 5116	4368	IFXMWB~1.exe	82
PID 4368 wrote to memory of 5116	4368	IFXMWB~1.exe	82
PID 4368 wrote to memory of 5116	4368	IFXMWB~1.exe	82
PID 5116 wrote to memory of 3376	5116	b2e.exe	83
PID 5116 wrote to memory of 3376	5116	b2e.exe	83
PID 5116 wrote to memory of 3376	5116	b2e.exe	83
PID 3376 wrote to memory of 4596	3376	cmd.exe	88
PID 3376 wrote to memory of 4596	3376	cmd.exe	88
PID 3376 wrote to memory of 4596	3376	cmd.exe	88
PID 3376 wrote to memory of 2836	3376	cmd.exe	89
PID 3376 wrote to memory of 2836	3376	cmd.exe	89
PID 3376 wrote to memory of 2836	3376	cmd.exe	89
PID 3376 wrote to memory of 1212	3376	cmd.exe	90
PID 3376 wrote to memory of 1212	3376	cmd.exe	90
PID 3376 wrote to memory of 1212	3376	cmd.exe	90
PID 3376 wrote to memory of 1580	3376	cmd.exe	91
PID 3376 wrote to memory of 1580	3376	cmd.exe	91
PID 3376 wrote to memory of 1580	3376	cmd.exe	91
PID 3376 wrote to memory of 940	3376	cmd.exe	92
PID 3376 wrote to memory of 940	3376	cmd.exe	92
PID 3376 wrote to memory of 940	3376	cmd.exe	92
PID 3376 wrote to memory of 1112	3376	cmd.exe	93
PID 3376 wrote to memory of 1112	3376	cmd.exe	93
PID 3376 wrote to memory of 1112	3376	cmd.exe	93
PID 3376 wrote to memory of 2500	3376	cmd.exe	94
PID 3376 wrote to memory of 2500	3376	cmd.exe	94
PID 3376 wrote to memory of 2500	3376	cmd.exe	94
PID 3376 wrote to memory of 1572	3376	cmd.exe	95
PID 3376 wrote to memory of 1572	3376	cmd.exe	95
PID 3376 wrote to memory of 1572	3376	cmd.exe	95
PID 3376 wrote to memory of 4024	3376	cmd.exe	96
PID 3376 wrote to memory of 4024	3376	cmd.exe	96
PID 3376 wrote to memory of 4024	3376	cmd.exe	96
PID 3376 wrote to memory of 2620	3376	cmd.exe	97
PID 3376 wrote to memory of 2620	3376	cmd.exe	97
PID 3376 wrote to memory of 2620	3376	cmd.exe	97
PID 3376 wrote to memory of 4768	3376	cmd.exe	98
PID 3376 wrote to memory of 4768	3376	cmd.exe	98
PID 3376 wrote to memory of 4768	3376	cmd.exe	98
PID 3376 wrote to memory of 4188	3376	cmd.exe	99
PID 3376 wrote to memory of 4188	3376	cmd.exe	99
PID 3376 wrote to memory of 4188	3376	cmd.exe	99
PID 3376 wrote to memory of 4864	3376	cmd.exe	100
PID 3376 wrote to memory of 4864	3376	cmd.exe	100
PID 3376 wrote to memory of 4864	3376	cmd.exe	100
PID 3376 wrote to memory of 4924	3376	cmd.exe	101
PID 3376 wrote to memory of 4924	3376	cmd.exe	101
PID 3376 wrote to memory of 4924	3376	cmd.exe	101
PID 3376 wrote to memory of 4436	3376	cmd.exe	103
PID 3376 wrote to memory of 4436	3376	cmd.exe	103
PID 3376 wrote to memory of 4436	3376	cmd.exe	103
PID 3376 wrote to memory of 2512	3376	cmd.exe	104
PID 3376 wrote to memory of 2512	3376	cmd.exe	104
PID 3376 wrote to memory of 2512	3376	cmd.exe	104
PID 3376 wrote to memory of 2624	3376	cmd.exe	105
PID 3376 wrote to memory of 2624	3376	cmd.exe	105
PID 3376 wrote to memory of 2624	3376	cmd.exe	105
PID 3376 wrote to memory of 2756	3376	cmd.exe	106
PID 3376 wrote to memory of 2756	3376	cmd.exe	106
PID 3376 wrote to memory of 2756	3376	cmd.exe	106
PID 3376 wrote to memory of 1616	3376	cmd.exe	107
PID 3376 wrote to memory of 1616	3376	cmd.exe	107
PID 3376 wrote to memory of 1616	3376	cmd.exe	107
PID 3376 wrote to memory of 4392	3376	cmd.exe	108

C:\Users\Admin\AppData\Local\Temp\IFXMWB~1.exe
"C:\Users\Admin\AppData\Local\Temp\IFXMWB~1.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4368
- C:\Users\Admin\AppData\Local\Temp\13D6.tmp\b2e.exe
  "C:\Users\Admin\AppData\Local\Temp\13D6.tmp\b2e.exe" C:\Users\Admin\AppData\Local\Temp\13D6.tmp\b2e.exe C:\Users\Admin\AppData\Local\Temp "C:\Users\Admin\AppData\Local\Temp\IFXMWB~1.exe"
  2⤵
  - Executes dropped EXE
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:5116
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\1666.tmp\batfile.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3376
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im nod32krn.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:4596
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im nod32.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:2836
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im nod32kui.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1212
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im kav.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1580
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im kavmm.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:940
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im KAVPF.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1112
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im avgemc.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:2500
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im avgcc.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1572
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im avgamsvr.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:4024
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im avgupsvc.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:2620
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im avgw.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:4768
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im ashWebSv.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4188
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im ashDisp.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:4864
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im ashmaisv.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4924
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im ashserv.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:4436
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im aswupdsv.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:2512
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im ewidoctrl.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:2624
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im guard.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:2756
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im gcasDtServ.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1616
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im MsMpEng.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:4392
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im mcafee.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:4980
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im mghtml.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:3144
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im MsiExec.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:3152
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im outpost.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1320
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im isafe.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:4900
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im zapro.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:3660
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im zauinst.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:496
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im UpdClient.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:4912
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im zlcliente.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:2132
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im minilog.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:2104
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im zonealarm.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:4364
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im zlclient.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1268
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im ccapp.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:4304
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im ccsetmgr.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:2568
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im ccevtmgr.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:2964
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im Norton Auto-Protect.exe
      4⤵
      PID:3712
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im cccproxy.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:3364
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im navw32.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:4208
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im norton.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:3828
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im navapsvc.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:3432
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im npfmntor.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1888
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im logexprt.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:4680
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im nisum.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:2936
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im issvc.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:4064
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im cpdclnt.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1964
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im pccntupd.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1800
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im PCCTool.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:648
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im tmproxy.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:4676
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im tmntsrv.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:4548
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im pop3trap.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:4688
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im tsc.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:3644
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im PavPrSrv.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:4624
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im padmin.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:4392
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im PavProt.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:2708
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im pandaav.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1116
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im avengine.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:2120
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im apvxdwin.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:496
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im webProxy.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:4816
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im avguard.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1404
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im avgnt.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:2276
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im sched.exe
      4⤵
      Kills process with taskkill
      PID:60
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im avsched32.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:4948
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im SCCOMM.EXE
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:4364
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im Spiderml.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1424
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im vsserv.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:3720
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im bdswitch.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1640
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im bdss.exe
      4⤵
      PID:2176
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im INOTask.exe
      4⤵
      PID:4904
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im caissdt.exe
      4⤵
      PID:3952
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im InoRpc.exe
      4⤵
      Kills process with taskkill
      PID:3340
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im VetMsg.exe
      4⤵
      PID:3632
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im vettray.exe
      4⤵
      PID:1336
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im realmon.exe
      4⤵
      PID:3828
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im nod32krn.exe
      4⤵
      PID:1728
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im nod32.exe
      4⤵
      PID:1600
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im nod32kui.exe
      4⤵
      PID:1216
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im kav.exe
      4⤵
      PID:2364
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im kavmm.exe
      4⤵
      Kills process with taskkill
      PID:2556
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im KAVPF.exe
      4⤵
      PID:4064
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im avgemc.exe
      4⤵
      PID:1964
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im avgcc.exe
      4⤵
      PID:3160
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im avgamsvr.exe
      4⤵
      PID:2416
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im avgupsvc.exe
      4⤵
      Kills process with taskkill
      PID:3112
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im avgw.exe
      4⤵
      PID:4924
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im ashWebSv.exe
      4⤵
      Kills process with taskkill
      PID:4548
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im ashDisp.exe
      4⤵
      PID:1508
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im ashmaisv.exe
      4⤵
      PID:3268
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im ashserv.exe
      4⤵
      PID:3084
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im aswupdsv.exe
      4⤵
      PID:1496
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im ewidoctrl.exe
      4⤵
      Kills process with taskkill
      PID:1856
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im guard.exe
      4⤵
      PID:2028
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im gcasDtServ.exe
      4⤵
      PID:1372
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im MsMpEng.exe
      4⤵
      PID:732
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im mcafee.exe
      4⤵
      PID:1436
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im mghtml.exe
      4⤵
      Kills process with taskkill
      PID:1976
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im MsiExec.exe
      4⤵
      PID:2336
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im outpost.exe
      4⤵
      PID:1792
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im isafe.exe
      4⤵
      PID:4252
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im zapro.exe
      4⤵
      PID:1384
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im zauinst.exe
      4⤵
      PID:4164
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im UpdClient.exe
      4⤵
      PID:2532
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im zlcliente.exe
      4⤵
      PID:3660
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im minilog.exe
      4⤵
      PID:1524
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im zonealarm.exe
      4⤵
      PID:3464
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im zlclient.exe
      4⤵
      PID:4480
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im ccapp.exe
      4⤵
      PID:1120
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im ccsetmgr.exe
      4⤵
      PID:4816
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im ccevtmgr.exe
      4⤵
      PID:4664
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im Norton Auto-Protect.exe
      4⤵
      PID:3260
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im cccproxy.exe
      4⤵
      PID:2104
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im navw32.exe
      4⤵
      PID:5052
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im norton.exe
      4⤵
      PID:4880
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im navapsvc.exe
      4⤵
      PID:2256
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im npfmntor.exe
      4⤵
      PID:4704
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im logexprt.exe
      4⤵
      PID:3596
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im nisum.exe
      4⤵
      PID:404
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im issvc.exe
      4⤵
      PID:3852
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im cpdclnt.exe
      4⤵
      PID:1664
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im pccntupd.exe
      4⤵
      PID:1548
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im PCCTool.exe
      4⤵
      PID:4332
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im tmproxy.exe
      4⤵
      PID:1576
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im tmntsrv.exe
      4⤵
      PID:3880
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im pop3trap.exe
      4⤵
      PID:2324
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im tsc.exe
      4⤵
      PID:3960
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im PavPrSrv.exe
      4⤵
      PID:4176
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im padmin.exe
      4⤵
      PID:1928
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im PavProt.exe
      4⤵
      PID:4188
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im pandaav.exe
      4⤵
      PID:3956
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im avengine.exe
      4⤵
      PID:4676
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im apvxdwin.exe
      4⤵
      PID:3108
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im webProxy.exe
      4⤵
      PID:2856
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im avguard.exe
      4⤵
      PID:4504
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im avgnt.exe
      4⤵
      PID:1672
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im sched.exe
      4⤵
      PID:1924
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im avsched32.exe
      4⤵
      PID:2600
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im SCCOMM.EXE
      4⤵
      PID:1188
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im Spiderml.exe
      4⤵
      PID:3972
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im vsserv.exe
      4⤵
      PID:4308
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im bdswitch.exe
      4⤵
      PID:1644
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im bdss.exe
      4⤵
      PID:4624
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im INOTask.exe
      4⤵
      PID:812
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im caissdt.exe
      4⤵
      PID:4392
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im InoRpc.exe
      4⤵
      PID:5092
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im VetMsg.exe
      4⤵
      PID:3512
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im vettray.exe
      4⤵
      PID:1320
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im realmon.exe
      4⤵
      PID:3244
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM AVGUARD.exe
      4⤵
      PID:3640
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM AVGCtrl.exe
      4⤵
      PID:2748
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM CSS_1630.exe
      4⤵
      PID:4856
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM CSS-AVS.exe
      4⤵
      Kills process with taskkill
      PID:4952
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM ashdisp.exe
      4⤵
      PID:3208
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM ashmaisv.exe
      4⤵
      PID:1432
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM ashserv.exe
      4⤵
      PID:2752
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM ashwebsv.exe
      4⤵
      PID:4692
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM aswupdsv.exe
      4⤵
      Kills process with taskkill
      PID:672
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM AVGCC.exe
      4⤵
      PID:4284
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM AVGCC32.exe
      4⤵
      PID:2104
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM AVGEmc.exe
      4⤵
      PID:2348
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM AVGServ.exe
      4⤵
      PID:1268
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM AVGServ9.exe
      4⤵
      PID:3720
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM Avgw.exe
      4⤵
      PID:1676
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM vsserv.exe
      4⤵
      PID:2820
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM ewidoguard.exe
      4⤵
      PID:4068
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM ewidoctrl.exe
      4⤵
      PID:3892
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM kav.exe
      4⤵
      Kills process with taskkill
      PID:3364
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM kavsvc.exe
      4⤵
      PID:1816
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM MPFAgent.exe
      4⤵
      PID:988
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM MPFTray.exe
      4⤵
      PID:2344
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM Mscifapp.exe
      4⤵
      PID:4848
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM MSKSrvr.exe
      4⤵
      PID:4860
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM NOD32Krn.exe
      4⤵
      PID:940
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM NOD32Kui.exe
      4⤵
      PID:3432
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM PavPrS9x.exe
      4⤵
      PID:3612
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM NPFMntor.exe
      4⤵
      PID:2376
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM Nprotect.exe
      4⤵
      PID:2936
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM Nsched32.exe
      4⤵
      PID:1480
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM SymWSC.exe
      4⤵
      PID:4000
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /IM SpywareStrike.exe /IM SpywareStrike.exe
      4⤵
      PID:2948
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /IM ccProxy.exe /IM ccSetMgr.exe /IM SNDSrvc.exe /IM SPBBCSvc.exe /IM ccEvtMgr.exe /IM ccApp.exe /IM NMAIN.EXE /IM SBServ.exe /IM NOPDB.EXE
      4⤵
      PID:4864
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /IM symlcsvc.exe
      4⤵
      PID:3332
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /IM SymWSC.exe /IM UsrPrmpt.exe
      4⤵
      PID:4192
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /IM zlclient.exe /IM zonealarm.exe
      4⤵
      PID:1440
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /IM ewidoctrl.exe
      4⤵
      PID:1476
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /IM navapsvc.exe /IM NPFMntor.exe /IM navapw32.exe /IM SAVScan.exe
      4⤵
      Kills process with taskkill
      PID:1212
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /IM WRSSSDK.exe /IM SpySweeper.exe
      4⤵
      PID:4896
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /IM GBPoll.exe /IM navapsvc.exe /IM NPFMntor.exe /IM NPROTECT.EXE /IM NOPDB.EXE /IM GBTray.exe /IM NPFMntor.exe /IM GhostTray.exe /IM PQV2iSvc.exe
      4⤵
      PID:1844
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /IM kavsvc.exe /IM kav.exe
      4⤵
      PID:1856
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /IM mcdetect.exe /IM mctskshd.exe /IM mcregwiz.exe /IM mcagent.exe
      4⤵
      PID:2028
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /IM Pavsrv51.exe /IM AVENGINE.EXE /IM apvxdwin.exe /IM pavProxy.exe
      4⤵
      PID:1224
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /IM AVGUARD.EXE /IM AVWUPSRV.EXE /IM AVGNT.EXE /IM AVSched32.EXE
      4⤵
      PID:4308
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /IM avgcc.exe /IM avgamsvr.exe /IM avgupsvc.exe
      4⤵
      PID:1644
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /IM Pagent.exe /IM pagentwd.exe /IM pavsched.exe
      4⤵
      PID:4340
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /IM DefWatch.exe /IM Rtvscan.exe
      4⤵
      PID:1300
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /IM avgamsvr.exe /IM avgupsvc.exe
      4⤵
      PID:4804
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im nod32krn.exe
      4⤵
      PID:3144
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im nod32.exe
      4⤵
      Kills process with taskkill
      PID:1636
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im kav.exe
      4⤵
      PID:2504
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im kavmm.exe
      4⤵
      PID:3292
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im avgemc.exe
      4⤵
      PID:3756
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im avgcc.exe
      4⤵
      PID:4684
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im avgamsvr.exe
      4⤵
      PID:1144
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im avgupsvc.exe
      4⤵
      PID:3980
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im avgw.exe
      4⤵
      PID:3152
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im ashwebsv.exe
      4⤵
      PID:2380
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im ashdisp.exe
      4⤵
      PID:1540
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im ashmaisv.exe
      4⤵
      PID:1404
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im ashserv.exe
      4⤵
      PID:3248
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im ashwebsv.exe
      4⤵
      PID:4948
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im aswupdsv.exe
      4⤵
      PID:2560
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im ewidoctrl.exe
      4⤵
      PID:2612
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im guard.exe
      4⤵
      PID:1268
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im gcasdtserv.exe
      4⤵
      PID:3720
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im msmpeng.exe
      4⤵
      PID:2360
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im mcafee.exe
      4⤵
      PID:2256
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im mghml.exe
      4⤵
      PID:3608
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im msiexec.exe
      4⤵
      PID:4360
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im outpost.exe
      4⤵
      PID:2328
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im isafe.exe
      4⤵
      PID:3156
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im minilog.exe
      4⤵
      PID:4052
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im zonealarm.exe
      4⤵
      PID:776
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im zlclient.exe
      4⤵
      PID:4056
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im updclient.exe
      4⤵
      PID:4780
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im ccapp.exe
      4⤵
      PID:1464
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im navw32.exe
      4⤵
      PID:2636
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im norton.exe
      4⤵
      PID:4384
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im navapsvc.exe
      4⤵
      PID:1572
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im ccsetmgr.exe
      4⤵
      PID:4104
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im cccproxy.exe
      4⤵
      PID:3256
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im ccapp.exe
      4⤵
      PID:2896
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im ccevtmgr.exe
      4⤵
      PID:4100
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im npfmntor.exe
      4⤵
      Kills process with taskkill
      PID:4660
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im logexprt.exe
      4⤵
      PID:1192
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im nisum.exe
      4⤵
      PID:2312
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im issvc.exe
      4⤵
      PID:2196
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im cpdclnt.exe
      4⤵
      PID:1964
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im pavprsrv.exe
      4⤵
      PID:2416
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im pavprot.exe
      4⤵
      PID:3112
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im avengine.exe
      4⤵
      PID:4924
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im apvxdwin.exe
      4⤵
      PID:4548
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im webproxy.exe
      4⤵
      PID:1508
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im avguard.exe
      4⤵
      PID:3268
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im avgnt.exe
      4⤵
      PID:1924
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im shed.exe
      4⤵
      PID:4892
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im avsched32.exe
      4⤵
      PID:1544
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im sccomm.exe
      4⤵
      PID:3972
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im spiderml.exe
      4⤵
      PID:1616
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im sgmain.exe
      4⤵
      Kills process with taskkill
      PID:872
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im spywareguard.exe
      4⤵
      PID:4980
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im kpf4gui.exe
      4⤵
      PID:2512
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im kpf4ss.exe
      4⤵
      PID:1836
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im mcdash.exe
      4⤵
      PID:2208
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im mcdetect.exe
      4⤵
      PID:4764
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im mcregwiz.exe
      4⤵
      PID:3560
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im mcinfo.exe
      4⤵
      PID:4760
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im mghtml.exe
      4⤵
      PID:2204
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im oasclnt.exe
      4⤵
      Kills process with taskkill
      PID:3660
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im mpfagent.exe
      4⤵
      PID:1524
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im mpfconsole.exe
      4⤵
      PID:3464
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im mpfservice.exe
      4⤵
      PID:2072
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im mpftray.exe
      4⤵
      PID:4300
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im mpfwizard.exe
      4⤵
      Kills process with taskkill
      PID:1432
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im mvtx.exe
      4⤵
      Kills process with taskkill
      PID:2752
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im _avp32.exe
      4⤵
      Kills process with taskkill
      PID:4740
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im _avpcc.exe
      4⤵
      PID:4824
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im _avpm.exe
      4⤵
      PID:4316
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im ackwin32.exe
      4⤵
      PID:4376
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im advxdwin.exe
      4⤵
      Kills process with taskkill
      PID:4304
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im agentsvr.exe
      4⤵
      PID:2260
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im agv.exe
      4⤵
      PID:4568
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im ahnsd.exe
      4⤵
      PID:1676
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im alertsvc.exe
      4⤵
      PID:2820
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im alogserv.exe
      4⤵
      Kills process with taskkill
      PID:3952
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im amon.exe
      4⤵
      PID:2112
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im amon9x.exe
      4⤵
      PID:404
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im amonavp32.exe
      4⤵
      PID:3852
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im anti -trojan.exe
      4⤵
      Kills process with taskkill
      PID:1664
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im antivir.exe
      4⤵
      PID:4808
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im antivirus.exe
      4⤵
      PID:3592
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im ants.exe
      4⤵
      PID:5008
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im antssircam.exe
      4⤵
      Kills process with taskkill
      PID:4780
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im apimonitor.exe
      4⤵
      PID:1464
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im aplica32.exe
      4⤵
      PID:1216
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im apvxdwin.exe
      4⤵
      PID:2364
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im atcon.exe
      4⤵
      PID:2152
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im atguard.exe
      4⤵
      PID:2944
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im ats.exe
      4⤵
      PID:780
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im atscan.exe
      4⤵
      PID:4000
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im atupdater.exe
      4⤵
      Kills process with taskkill
      PID:3344
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im atwatch.exe
      4⤵
      Kills process with taskkill
      PID:1776
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im autodown.exe
      4⤵
      PID:1192
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im autotrace.exe
      4⤵
      PID:2312
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im autoupdate.exe
      4⤵
      PID:2196
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im avconsol.exe
      4⤵
      PID:1964
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im ave32.exe
      4⤵
      PID:2416
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im avgcc32.exe
      4⤵
      PID:3112
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im avgctrl.exe
      4⤵
      PID:4788
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im avgserv.exe
      4⤵
      PID:3624
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im avgserv9.exe
      4⤵
      PID:548
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im avgserv9schedapp.exe
      4⤵
      PID:3884
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im avgw.exe
      4⤵
      PID:4436
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im avkpop.exe
      4⤵
      Kills process with taskkill
      PID:3460
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im avkserv.exe
      4⤵
      PID:1124
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im avkservice.exe
      4⤵
      PID:2624
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im avkwcl9.exe
      4⤵
      PID:1372
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im avkwctl9.exe
      4⤵
      PID:732
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im avnt.exe
      4⤵
      Kills process with taskkill
      PID:3320
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im avp.exe
      4⤵
      PID:4624
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im avp32.exe
      4⤵
      PID:812
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im avpcc.exe
      4⤵
      PID:4804
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im AVPCC Service.exe
      4⤵
      PID:3144
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im avpccavpm.exe
      4⤵
      PID:4764
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im avpdos32.exe
      4⤵
      PID:3560
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im avpexec.exe
      4⤵
      Kills process with taskkill
      PID:4760
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im avpinst.exe
      4⤵
      Kills process with taskkill
      PID:2204
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im avpm.exe
      4⤵
      PID:3660
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im avpmonitor.exe
      4⤵
      PID:1524
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im avptc.exe
      4⤵
      Kills process with taskkill
      PID:3464
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im avptc32.exe
      4⤵
      PID:2072
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im avpupd.exe
      4⤵
      PID:4300
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im avpupdates.exe
      4⤵
      PID:1432
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im avrescue.exe
      4⤵
      PID:2752
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im avsched32.exe
      4⤵
      PID:4740
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im avsynmgr.exe
      4⤵
      PID:672
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im avwin95.exe
      4⤵
      PID:5052
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im avwinnt.exe
      4⤵
      PID:1640
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im avwupd32.exe
      4⤵
      PID:4368
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im avxgui.exe
      4⤵
      PID:4568
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im avxinit.exe
      4⤵
      PID:3076
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im avxlive.exe
      4⤵
      PID:3608
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im avxmonitor9x.exe
      4⤵
      PID:3632
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im avxmonitornt.exe
      4⤵
      PID:2112
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im avxnews.exe
      4⤵
      PID:404
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im avxquar.exe
      4⤵
      PID:3852
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im avxsch.exe
      4⤵
      PID:376
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im avxw.exe
      4⤵
      PID:4828
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im BACKLOG.exe
      4⤵
      PID:4860
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im bd_professional.exe
      4⤵
      PID:940
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im bidef.exe
      4⤵
      Kills process with taskkill
      PID:2500
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im bidserver.exe
      4⤵
      PID:2636
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im bipcp.exe
      4⤵
      PID:4384
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im bisp.exe
      4⤵
      Kills process with taskkill
      PID:1572
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im blackd.exe
      4⤵
      PID:4104
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im blackice.exe
      4⤵
      PID:3256
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im blackiceblackd.exe
      4⤵
      PID:3088
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im BootWarn.exe
      4⤵
      PID:1668
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im borg2.exe
      4⤵
      PID:4640
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im bs120.exe
      4⤵
      PID:1936
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im bullguard.exe
      4⤵
      PID:4188
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im ccApp.exe
      4⤵
      Kills process with taskkill
      PID:4820
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im ccevtmgr.exe
      4⤵
      PID:3988
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im ccIMScan.exe
      4⤵
      PID:2824
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im ccPwdSrc.exe
      4⤵
      Kills process with taskkill
      PID:944
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im ccpxysvc.exe
      4⤵
      PID:4924
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im ccSetMgr.exe
      4⤵
      PID:4548
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im cdp.exe
      4⤵
      PID:1508
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im cfiadmin.exe
      4⤵
      PID:3268
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im cfiaudit.exe
      4⤵
      PID:4840
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im cfinet.exe
      4⤵
      Kills process with taskkill
      PID:2284
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im cfinet32.exe
      4⤵
      PID:1820
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im claw95.exe
      4⤵
      PID:2744
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im claw95cf.exe
      4⤵
      PID:2008
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im clean.exe
      4⤵
      PID:2652
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im cleaner.exe
      4⤵
      PID:4340
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im cleaner3.exe
      4⤵
      PID:1300
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im cleanpc.exe
      4⤵
      PID:4252
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im cmgrdian.exe
      4⤵
      PID:3580
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im cmon016.exe
      4⤵
      PID:4836
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im codered.exe
      4⤵
      PID:2532
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im connectionmonitor.exe
      4⤵
      PID:3756
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im conseal.exe
      4⤵
      PID:4264
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im cpd.exe
      4⤵
      PID:3208
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im cpf9x206.exe
      4⤵
      PID:4908
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im ctrl.exe
      4⤵
      PID:640
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im defalert.exe
      4⤵
      Kills process with taskkill
      PID:4948
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im defence.exe
      4⤵
      PID:2560
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im defense.exe
      4⤵
      PID:2348
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im defscangui.exe
      4⤵
      PID:2176
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im defwatch.exe
      4⤵
      PID:2964
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im deputy.exe
      4⤵
      PID:4704
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im doors.exe
      4⤵
      PID:3340
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im dpf.exe
      4⤵
      PID:4360
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im drwatson.exe
      4⤵
      PID:4872
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im drweb32.exe
      4⤵
      PID:2344
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im dvp95.exe
      4⤵
      PID:4776
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im dvp95_0.exe
      4⤵
      PID:1548
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im ecengine.exe
      4⤵
      PID:380
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im edisk.exe
      4⤵
      PID:940
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im efpeadm.exe
      4⤵
      PID:2500
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im esafe.exe
      4⤵
      PID:2636
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im escanh95.exe
      4⤵
      PID:4384
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im escanhnt.exe
      4⤵
      PID:1572
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im escanv95.exe
      4⤵
      PID:4104
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im espwatch.exe
      4⤵
      PID:3256
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im etrustcipe.exe
      4⤵
      PID:3088
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im evpn.exe
      4⤵
      PID:1668
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im exantivirus -cnet.exe
      4⤵
      PID:4640
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im fameh32.exe
      4⤵
      PID:3848
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im fast.exe
      4⤵
      Kills process with taskkill
      PID:648
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im fch32.exe
      4⤵
      PID:2196
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im fih32.exe
      4⤵
      Kills process with taskkill
      PID:4500
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im findviru.exe
      4⤵
      PID:116
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im firewall.exe
      4⤵
      PID:1608
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im fix-it.exe
      4⤵
      PID:3624
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im flowprotector.exe
      4⤵
      PID:4036
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im fnrb32.exe
      4⤵
      PID:3268
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im fp -win.exe
      4⤵
      Kills process with taskkill
      PID:3700
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im fp -win_trial.exe
      4⤵
      PID:3644
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im fprot.exe
      4⤵
      PID:2624
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im frw.exe
      4⤵
      PID:1436
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im fsaa.exe
      4⤵
      PID:1976
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im fsav32.exe
      4⤵
      PID:2336
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im fsav95.exe
      4⤵
      PID:1792
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im fsave32.exe
      4⤵
      PID:2716
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im fsgk32.exe
      4⤵
      PID:5092
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im fsm32.exe
      4⤵
      PID:4764
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im fsma32.exe
      4⤵
      PID:3560
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im fsmb32.exe
      4⤵
      PID:3640
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im fwenc.exe
      4⤵
      PID:3164
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im gbmenu.exe
      4⤵
      PID:1120
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im gbpoll.exe
      4⤵
      PID:1144
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im gedit.exe
      4⤵
      PID:4224
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im generics.exe
      4⤵
      PID:2200
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im grief3878.exe
      4⤵
      PID:3840
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im guard.exe
      4⤵
      PID:1404
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im guarddog.exe
      4⤵
      PID:672
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im HackerEliminator.exe
      4⤵
      PID:5052
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im iamapp.exe
      4⤵
      PID:1640
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im iamserv.exe
      4⤵
      PID:1824
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im iamstats.exe
      4⤵
      PID:4904
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im ibmasn.exe
      4⤵
      PID:2256
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im ibmavsp.exe
      4⤵
      PID:3952
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im icload95.exe
      4⤵
      Kills process with taskkill
      PID:4784
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im icloadnt.exe
      4⤵
      PID:3816
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im icmon.exe
      4⤵
      Kills process with taskkill
      PID:4812
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im icsupp95.exe
      4⤵
      PID:2260
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im icsuppnt.exe
      4⤵
      PID:1280
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im iface.exe
      4⤵
      PID:5008
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im ifw2000.exe
      4⤵
      PID:4644
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im inoculateit.exe
      4⤵
      PID:1888
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im iomon98.exe
      4⤵
      PID:2332
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im iparmor.exe
      4⤵
      PID:1216
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im iris.exe
      4⤵
      PID:2364
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im isrv95.exe
      4⤵
      PID:2152
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im jammer.exe
      4⤵
      PID:2944
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im jedi.exe
      4⤵
      PID:780
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im kavpf.exe
      4⤵
      PID:4000
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im ldnetmon.exe
      4⤵
      PID:3344
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im ldpromenu.exe
      4⤵
      PID:4660
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im ldscan.exe
      4⤵
      PID:1936
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im localnet.exe
      4⤵
      PID:2948
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im lockdown.exe
      4⤵
      PID:4800
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im lookout.exe
      4⤵
      PID:3824
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im luall.exe
      4⤵
      PID:1056
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im lucomserver.exe
      4⤵
      PID:1420
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im luspt.exe
      4⤵
      PID:4596
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im mcafee.exe
      4⤵
      PID:492
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im mcagent.exe
      4⤵
      PID:4844
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im mcmnhdlr.exe
      4⤵
      PID:4892
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im mcshield.exe
      4⤵
      PID:3700
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im mcshieldvvstat.exe
      4⤵
      PID:3864
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im mctool.exe
      4⤵
      PID:2008
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im mcupdate.exe
      4⤵
      PID:1940
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im mcvsrte.exe
      4⤵
      PID:1196
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im mcvsshld.exe
      4⤵
      PID:4916
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im mgavrtcl.exe
      4⤵
      PID:812
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im mgavrte.exe
      4⤵
      PID:1384
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im mghtml.exe
      4⤵
      PID:4228
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im mgui.exe
      4⤵
      PID:4804
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im minilog.exe
      4⤵
      Kills process with taskkill
      PID:4836
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im mon.exe
      4⤵
      PID:2532
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im monitor.exe
      4⤵
      PID:496
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im monsys32.exe
      4⤵
      PID:4312
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im monsysnt.exe
      4⤵
      PID:4952
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im moolive.exe
      4⤵
      PID:4264
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im mpfservice.exe
      4⤵
      PID:4512
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im mpftray.exe
      4⤵
      PID:3236
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im mrflux.exe
      4⤵
      PID:1540
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im msinfo32.exe
      4⤵
      PID:768
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im mwatch.exe
      4⤵
      PID:740
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im mxtask.exe
      4⤵
      PID:2704
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im n32scanw.exe
      4⤵
      PID:4260
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im nav.exe
      4⤵
      PID:4368
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im NAV DefAlert.exe
      4⤵
      PID:3348
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im nav32.exe
      4⤵
      Kills process with taskkill
      PID:4904
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im navalert.exe
      4⤵
      PID:2256
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im navap.exe
      4⤵
      PID:3952
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im navapsvc.exe
      4⤵
      PID:4784
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im NAVAPW32.exe
      4⤵
      PID:3816
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im navauto -protect.exe
      4⤵
      PID:1160
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im navdx.exe
      4⤵
      PID:2320
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im navengnavex15.exe
      4⤵
      PID:1112
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im navlu32.exe
      4⤵
      PID:1728
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im navnt.exe
      4⤵
      PID:4680
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im navrunr.exe
      4⤵
      PID:1600
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im navstub.exe
      4⤵
      PID:4484
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im navw32.exe
      4⤵
      PID:2356
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im Navwnt.exe
      4⤵
      PID:1692
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im nc2000.exe
      4⤵
      Kills process with taskkill
      PID:2556
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im ndd32.exe
      4⤵
      PID:2896
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im neomonitor.exe
      4⤵
      PID:4100
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im neowatchlog.exe
      4⤵
      PID:1968
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im net2000.exe
      4⤵
      PID:2068
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im netarmor.exe
      4⤵
      PID:3476
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im netcommando.exe
      4⤵
      PID:4944
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im netinfo.exe
      4⤵
      PID:3620
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im netmon.exe
      4⤵
      PID:3988
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im netpro.exe
      4⤵
      PID:1440
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im netprotect.exe
      4⤵
      PID:1476
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im netscanpro.exe
      4⤵
      PID:548
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im netspyhunter -1.2.exe
      4⤵
      PID:1944
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im netstat.exe
      4⤵
      PID:4036
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im netutils.exe
      4⤵
      PID:1496
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im netutils].exe
      4⤵
      PID:1188
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im nimda.exe
      4⤵
      PID:1736
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im nisserv.exe
      4⤵
      PID:644
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im nisum.exe
      4⤵
      PID:1436
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im nisumnisservnisum.exe
      4⤵
      PID:1976
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im nmain.exe
      4⤵
      PID:2336
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im nod32.exe
      4⤵
      PID:2208
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im norman.exe
      4⤵
      PID:2708
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im norman_32.exe
      4⤵
      PID:4204
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im norman_av.exe
      4⤵
      PID:1688
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im norman32.exe
      4⤵
      PID:5092
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im normanav.exe
      4⤵
      PID:3292
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im normist.exe
      4⤵
      PID:2204
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im norton.exe
      4⤵
      PID:5040
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im Norton Auto-Protect.exe
      4⤵
      Kills process with taskkill
      PID:4480
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im norton_av.exe
      4⤵
      PID:1744
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im nortonav.exe
      4⤵
      PID:2496
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im notstart.exe
      4⤵
      PID:3968
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im npfmessenger.exe
      4⤵
      PID:2072
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im npfw.exe
      4⤵
      PID:3260
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im npfw32.exe
      4⤵
      PID:5104
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im nprotect.exe
      4⤵
      PID:4824
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im npscheck.exe
      4⤵
      PID:2228
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im npssvc.exe
      4⤵
      PID:1268
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im nresq32.exe
      4⤵
      Kills process with taskkill
      PID:2360
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im nsched32.exe
      4⤵
      PID:2280
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im nschednt.exe
      4⤵
      PID:4704
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im nsplugin.exe
      4⤵
      PID:3340
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im ntrtscan.exe
      4⤵
      PID:4360
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im ntvdm.exe
      4⤵
      PID:4872
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im ntxconfig.exe
      4⤵
      PID:2344
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im nui.exe
      4⤵
      PID:408
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im nupgrade.exe
      4⤵
      PID:4860
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im nvarch16.exe
      4⤵
      PID:1576
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im nvc95.exe
      4⤵
      PID:3768
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im nvsvc32.exe
      4⤵
      PID:3612
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im nwservice.exe
      4⤵
      PID:4024
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im nwtool16.exe
      4⤵
      PID:2620
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im offguard.exe
      4⤵
      PID:4108
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im OPScan.exe
      4⤵
      PID:1800
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im ostronet.exe
      4⤵
      PID:1860
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im outpost.exe
      4⤵
      PID:1880
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im padmin.exe
      4⤵
      PID:1776
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im panda.exe
      4⤵
      PID:5060
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im pandaav.exe
      4⤵
      PID:1928
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im panixk.exe
      4⤵
      PID:2436
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im pav.exe
      4⤵
      PID:2760
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im pavcl.exe
      4⤵
      PID:1964
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im pavproxy.exe
      4⤵
      PID:2824
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im pavsched.exe
      4⤵
      PID:4788
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im pavw.exe
      4⤵
      PID:3836
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im pc -cillan.exe
      4⤵
      PID:1944
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im pc -cillin.exe
      4⤵
      PID:2972
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im pccclient.exe
      4⤵
      PID:3268
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im pccguide.exe
      4⤵
      PID:892
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im pcciomon.exe
      4⤵
      PID:4960
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im pccntmon.exe
      4⤵
      PID:2868
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im pccwin97.exe
      4⤵
      PID:644
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im pccwin98.exe
      4⤵
      PID:1940
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im pcfwallicon.exe
      4⤵
      PID:1196
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im pcscan.exe
      4⤵
      PID:4252
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im periscope.exe
      4⤵
      PID:2108
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im persfw.exe
      4⤵
      Kills process with taskkill
      PID:3144
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im pf2.exe
      4⤵
      PID:1116
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im pfwadmin.exe
      4⤵
      PID:4080
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im pingscan.exe
      4⤵
      PID:4164
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im platin.exe
      4⤵
      PID:1232
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im pop3trap.exe
      4⤵
      PID:3416
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im poproxy.exe
      4⤵
      PID:3264
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im portdetective.exe
      4⤵
      PID:3148
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im portmonitor.exe
      4⤵
      PID:3208
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im ppinupdt.exe
      4⤵
      PID:4300
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im pptbc.exe
      4⤵
      PID:4492
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im ppvstop.exe
      4⤵
      PID:4316
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im processmonitor.exe
      4⤵
      PID:4948
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im procexplorerv10#.exe
      4⤵
      PID:2704
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im programauditor.exe
      4⤵
      PID:4260
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im proport.exe
      4⤵
      PID:4368
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im protectx.exe
      4⤵
      PID:4004
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im pspf.exe
      4⤵
      PID:3328
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im purge.exe
      4⤵
      PID:2268
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im pview95.exe
      4⤵
      PID:2256
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im pw32.exe
      4⤵
      PID:1664
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im qconsole.exe
      4⤵
      PID:4288
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im rav.exe
      4⤵
      PID:4828
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im rav7.exe
      4⤵
      PID:2320
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im rav7win.exe
      4⤵
      PID:1112
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im realmon.exe
      4⤵
      PID:4332
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im regrun2.exe
      4⤵
      Kills process with taskkill
      PID:1468
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im rescue.exe
      4⤵
      PID:1700
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im rrguard.exe
      4⤵
      PID:3960
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im rshell.exe
      4⤵
      PID:4176
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im rtvscn95.exe
      4⤵
      PID:1480
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im rulaunch.exe
      4⤵
      PID:1520
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im safeweb.exe
      4⤵
      PID:3372
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im SAVscan.exe
      4⤵
      PID:4856
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im sbserv.exe
      4⤵
      PID:2124
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im SBservice.exe
      4⤵
      PID:4100
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im scan.exe
      4⤵
      PID:1776
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im scan32.exe
      4⤵
      PID:648
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im scan95.exe
      4⤵
      PID:3988
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im scanpm.exe
      4⤵
      PID:944
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im scrscan.exe
      4⤵
      PID:2856
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im sd.exe
      4⤵
      Kills process with taskkill
      PID:4596
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im SENS.exe
      4⤵
      PID:2972
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im serv95.exe
      4⤵
      PID:3268
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im sfc.exe
      4⤵
      PID:892
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im sh.exe
      4⤵
      PID:4960
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im sharedaccess.exe
      4⤵
      PID:2868
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im shn.exe
      4⤵
      PID:644
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im smc.exe
      4⤵
      PID:1940
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im sofi.exe
      4⤵
      PID:1196
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im sophos.exe
      4⤵
      PID:4232
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im sophos_av.exe
      4⤵
      PID:1688
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im sophosav.exe
      4⤵
      PID:1320
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im spf.exe
      4⤵
      PID:496
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im sphinx.exe
      4⤵
      PID:3660
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im spy.exe
      4⤵
      PID:4592
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im spygate.exe
      4⤵
      Kills process with taskkill
      PID:2380
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im spyx.exe
      4⤵
      PID:4664
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im spyxx.exe
      4⤵
      PID:4908
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im srwatch.exe
      4⤵
      PID:4060
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im ss3edit.exe
      4⤵
      Kills process with taskkill
      PID:4284
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im st2.exe
      4⤵
      PID:2560
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im supftrl.exe
      4⤵
      PID:1824
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im supp95.exe
      4⤵
      PID:4568
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im supporter5.exe
      4⤵
      PID:3364
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im sweep95.exe
      4⤵
      PID:2836
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im sweepnet.exe
      4⤵
      PID:4052
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im sweepsrv.sys.exe
      4⤵
      PID:1820
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im sweepsrv.sysvshwin32.exe
      4⤵
      PID:2256
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im swnetsup.exe
      4⤵
      PID:3952
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im symantec.exe
      4⤵
      PID:4288
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im Symantec Core LC.exe
      4⤵
      Kills process with taskkill
      PID:4828
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im symlcsvc.exe
      4⤵
      PID:408
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im symproxysvc.exe
      4⤵
      PID:4860
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im symtray.exe
      4⤵
      PID:1888
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im sysedit.exe
      4⤵
      PID:940
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im taskmon.exe
      4⤵
      PID:2500
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im taumon.exe
      4⤵
      PID:2636
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im tauscan.exe
      4⤵
      Kills process with taskkill
      PID:2828
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im tbscan.exe
      4⤵
      PID:924
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im tcm.exe
      4⤵
      PID:5100
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im tctca.exe
      4⤵
      PID:4984
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im tds -3.exe
      4⤵
      PID:3372
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im tds2 -98.exe
      4⤵
      PID:1948
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im tds2 -nt.exe
      4⤵
      PID:4208
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im tfak.exe
      4⤵
      PID:3280
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im tfak5.exe
      4⤵
      PID:4640
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im tgbob.exe
      4⤵
      Kills process with taskkill
      PID:5060
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im trendmicro.exe
      4⤵
      PID:4800
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im trjscan.exe
      4⤵
      PID:1964
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im trojantrap3.exe
      4⤵
      PID:2824
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im TrueVector.exe
      4⤵
      PID:4788
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im undoboot.exe
      4⤵
      PID:2600
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im update.exe
      4⤵
      PID:2284
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im vbcmserv.exe
      4⤵
      PID:4892
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im vbcons.exe
      4⤵
      PID:3700
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im vbust.exe
      4⤵
      PID:4432
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im vbwin9x.exe
      4⤵
      Kills process with taskkill
      PID:4960
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im vbwinntw.exe
      4⤵
      PID:2008
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im vccmserv.exe
      4⤵
      PID:2652
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im vcontrol.exe
      4⤵
      PID:228
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im vet32.exe
      4⤵
      PID:4916
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im vet95.exe
      4⤵
      PID:3512
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im vettray.exe
      4⤵
      PID:1116
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im vir -help.exe
      4⤵
      PID:4280
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im virus.exe
      4⤵
      PID:1320
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im virusmdpersonalfirewall.exe
      4⤵
      PID:496
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im vnlan300.exe
      4⤵
      PID:3660
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im vnpc3000.exe
      4⤵
      PID:4592
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im vpc32.exe
      4⤵
      Kills process with taskkill
      PID:2380
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im vpfw30s.exe
      4⤵
      PID:4664
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im vptray.exe
      4⤵
      PID:4908
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im vscan40.exe
      4⤵
      PID:4060
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im vsched.exe
      4⤵
      PID:4284
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im vsecomr.exe
      4⤵
      PID:2560
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im vshwin32.exe
      4⤵
      Kills process with taskkill
      PID:1824
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im vshwin32vbcmserv.exe
      4⤵
      PID:4568
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im vsmain.exe
      4⤵
      PID:3364
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im vsmon.exe
      4⤵
      PID:2836
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im vsstat.exe
      4⤵
      Kills process with taskkill
      PID:4052
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im vswin9xe.exe
      4⤵
      PID:3852
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im vswinntse.exe
      4⤵
      PID:3724
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im w9x.exe
      4⤵
      PID:4784
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im watchdog.exe
      4⤵
      Kills process with taskkill
      PID:4056
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im webscanx.exe
      4⤵
      PID:4828
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im webtrap.exe
      4⤵
      PID:408
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im wfindv32.exe
      4⤵
      Kills process with taskkill
      PID:4860
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im wgfe95.exe
      4⤵
      PID:1888
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im whoswatchingme.exe
      4⤵
      PID:940
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im wimmun32.exe
      4⤵
      PID:2500
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im winrecon.exe
      4⤵
      PID:2636
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im winroute.exe
      4⤵
      Kills process with taskkill
      PID:2828
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im winsfcm.exe
      4⤵
      PID:924
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im wnt.exe
      4⤵
      PID:5100
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im wqkmm3878.exe
      4⤵
      Kills process with taskkill
      PID:4984
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im wradmin.exe
      4⤵
      PID:3752
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im wrctrl.exe
      4⤵
      PID:4520
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im wsbgate.exe
      4⤵
      PID:1948
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im wyvernworksfirewall.exe
      4⤵
      PID:2124
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im zapro.exe
      4⤵
      PID:4600

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\13D6.tmp\b2e.exe

Filesize
62KB

MD5
1f4e38dfb8a47410353a22260c63870c

SHA1
26c4098ccae89670171c80d6d5c530ff368462a9

SHA256
8d01f2e9789ead191a05f0dd25a5db6c5e8e397701ec080bdb0fdab86a732095

SHA512
b4f2b734839835e42a1ea9fd59e018b8380ab65725e34a70706730235a48ac7856ea7c7ed1034d7d28430a5bd8e4c487c5d93918790f24b2efd8cf6343b579dd

Download Submit
C:\Users\Admin\AppData\Local\Temp\13D6.tmp\b2e.exe

Filesize
62KB

MD5
1f4e38dfb8a47410353a22260c63870c

SHA1
26c4098ccae89670171c80d6d5c530ff368462a9

SHA256
8d01f2e9789ead191a05f0dd25a5db6c5e8e397701ec080bdb0fdab86a732095

SHA512
b4f2b734839835e42a1ea9fd59e018b8380ab65725e34a70706730235a48ac7856ea7c7ed1034d7d28430a5bd8e4c487c5d93918790f24b2efd8cf6343b579dd

Download Submit
C:\Users\Admin\AppData\Local\Temp\1666.tmp\batfile.bat

Filesize
54KB

MD5
3e0b3c608056055e4332e59f31e626bc

SHA1
38c47ebba8da1403f52ff8b0dd299cf3ff41e32d

SHA256
c84eb811d92d2ff6e7064c847b73ee4688fe561951531e8559da91b330ae0ece

SHA512
b7795e514491675d4fc9dc88e80cd613694d76055f35c5160b4f53f08920f4df6fc14f14ac2f95d86cae323e80893662efcc7db3b5e407cf159beb86c561fd35

Download Submit
memory/4368-132-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/5116-136-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download