Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
67s -
max time network
112s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
25/12/2023, 07:14
Static task
static1
Behavioral task
behavioral1
Sample
0dfde1a4c8f38abc290a7e4ad757edea.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
0dfde1a4c8f38abc290a7e4ad757edea.exe
Resource
win10v2004-20231215-en
Errors
General
-
Target
0dfde1a4c8f38abc290a7e4ad757edea.exe
-
Size
1.6MB
-
MD5
0dfde1a4c8f38abc290a7e4ad757edea
-
SHA1
a267435dd6ed2994325bf13f88710e48088b0a31
-
SHA256
f0062067c120a8f25766476d9155dbfb0a76845a395b24b810bca895b110f735
-
SHA512
47c479981b786201eaceed43fbb382135c038067eb1495d431ea3ea712f99e2e32dc23cbbfa34b8a47d09b500fc6b817f7d6b4ba01918d2b745a83e353382d07
-
SSDEEP
49152:YzP7qZDJfRuuDO3AWHGqB8NNOyeDrmQ0w13:YsuIwmvNNE/50w13
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 640 °×½ð°æ.exe -
resource yara_rule behavioral2/memory/640-8-0x0000000010000000-0x000000001003D000-memory.dmp upx behavioral2/memory/640-16-0x0000000010000000-0x000000001003D000-memory.dmp upx behavioral2/memory/640-21-0x0000000010000000-0x000000001003D000-memory.dmp upx behavioral2/memory/640-27-0x0000000010000000-0x000000001003D000-memory.dmp upx behavioral2/memory/640-30-0x0000000010000000-0x000000001003D000-memory.dmp upx behavioral2/memory/640-39-0x0000000010000000-0x000000001003D000-memory.dmp upx behavioral2/memory/640-47-0x0000000010000000-0x000000001003D000-memory.dmp upx behavioral2/memory/640-53-0x0000000010000000-0x000000001003D000-memory.dmp upx behavioral2/memory/640-55-0x0000000010000000-0x000000001003D000-memory.dmp upx behavioral2/memory/640-58-0x0000000010000000-0x000000001003D000-memory.dmp upx behavioral2/memory/640-61-0x0000000010000000-0x000000001003D000-memory.dmp upx behavioral2/memory/640-62-0x0000000010000000-0x000000001003D000-memory.dmp upx behavioral2/memory/640-51-0x0000000010000000-0x000000001003D000-memory.dmp upx behavioral2/memory/640-49-0x0000000010000000-0x000000001003D000-memory.dmp upx behavioral2/memory/640-45-0x0000000010000000-0x000000001003D000-memory.dmp upx behavioral2/memory/640-42-0x0000000010000000-0x000000001003D000-memory.dmp upx behavioral2/memory/640-37-0x0000000010000000-0x000000001003D000-memory.dmp upx behavioral2/memory/640-35-0x0000000010000000-0x000000001003D000-memory.dmp upx behavioral2/memory/640-32-0x0000000010000000-0x000000001003D000-memory.dmp upx behavioral2/memory/640-25-0x0000000010000000-0x000000001003D000-memory.dmp upx behavioral2/memory/640-23-0x0000000010000000-0x000000001003D000-memory.dmp upx behavioral2/memory/640-19-0x0000000010000000-0x000000001003D000-memory.dmp upx behavioral2/memory/640-14-0x0000000010000000-0x000000001003D000-memory.dmp upx behavioral2/memory/640-13-0x0000000010000000-0x000000001003D000-memory.dmp upx behavioral2/memory/640-12-0x0000000010000000-0x000000001003D000-memory.dmp upx behavioral2/memory/640-11-0x0000000010000000-0x000000001003D000-memory.dmp upx behavioral2/memory/640-63-0x0000000010000000-0x000000001003D000-memory.dmp upx behavioral2/memory/640-79-0x0000000010000000-0x000000001003D000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Kills process with taskkill 64 IoCs
pid Process 4204 taskkill.exe 3184 taskkill.exe 3776 taskkill.exe 3204 taskkill.exe 2024 taskkill.exe 4952 taskkill.exe 1708 taskkill.exe 4236 taskkill.exe 4460 taskkill.exe 4228 taskkill.exe 3524 taskkill.exe 4836 taskkill.exe 3184 taskkill.exe 1804 taskkill.exe 1148 taskkill.exe 216 taskkill.exe 3584 taskkill.exe 2204 taskkill.exe 4256 taskkill.exe 2068 taskkill.exe 3272 taskkill.exe 928 taskkill.exe 4876 taskkill.exe 1640 taskkill.exe 4920 taskkill.exe 3820 taskkill.exe 412 taskkill.exe 3560 taskkill.exe 4828 taskkill.exe 4204 taskkill.exe 2000 taskkill.exe 2096 taskkill.exe 4388 taskkill.exe 4208 taskkill.exe 376 taskkill.exe 3776 taskkill.exe 3208 taskkill.exe 2140 taskkill.exe 4236 taskkill.exe 4844 taskkill.exe 1468 taskkill.exe 840 taskkill.exe 3272 taskkill.exe 3980 taskkill.exe 3336 taskkill.exe 4108 taskkill.exe 3972 taskkill.exe 2196 taskkill.exe 3712 taskkill.exe 4068 taskkill.exe 116 taskkill.exe 1564 taskkill.exe 2400 taskkill.exe 2108 taskkill.exe 736 taskkill.exe 1852 taskkill.exe 4500 taskkill.exe 4360 taskkill.exe 4844 taskkill.exe 1108 taskkill.exe 1452 taskkill.exe 1468 taskkill.exe 1152 taskkill.exe 3024 taskkill.exe -
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Search Page = "http://www.baidu.com/index.php?tn=zengjinlong_pg" 0dfde1a4c8f38abc290a7e4ad757edea.exe Key created \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\Software\Microsoft\Internet Explorer\TypedURLs 0dfde1a4c8f38abc290a7e4ad757edea.exe Set value (str) \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\SOFTWARE\Microsoft\Internet Explorer\TypedURLs\url1 = "http://www.85ba.com/" 0dfde1a4c8f38abc290a7e4ad757edea.exe Set value (str) \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\SOFTWARE\Microsoft\Internet Explorer\TypedURLs\url2 = "http://www.21ku.cn/" 0dfde1a4c8f38abc290a7e4ad757edea.exe Key created \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\Software\Microsoft\Internet Explorer\Main 0dfde1a4c8f38abc290a7e4ad757edea.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 640 °×½ð°æ.exe 640 °×½ð°æ.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: 33 640 °×½ð°æ.exe Token: SeIncBasePriorityPrivilege 640 °×½ð°æ.exe Token: 33 640 °×½ð°æ.exe Token: SeIncBasePriorityPrivilege 640 °×½ð°æ.exe Token: 33 640 °×½ð°æ.exe Token: SeIncBasePriorityPrivilege 640 °×½ð°æ.exe Token: 33 640 °×½ð°æ.exe Token: SeIncBasePriorityPrivilege 640 °×½ð°æ.exe Token: 33 640 °×½ð°æ.exe Token: SeIncBasePriorityPrivilege 640 °×½ð°æ.exe Token: 33 640 °×½ð°æ.exe Token: SeIncBasePriorityPrivilege 640 °×½ð°æ.exe Token: 33 640 °×½ð°æ.exe Token: SeIncBasePriorityPrivilege 640 °×½ð°æ.exe Token: 33 640 °×½ð°æ.exe Token: SeIncBasePriorityPrivilege 640 °×½ð°æ.exe Token: 33 640 °×½ð°æ.exe Token: SeIncBasePriorityPrivilege 640 °×½ð°æ.exe Token: 33 640 °×½ð°æ.exe Token: SeIncBasePriorityPrivilege 640 °×½ð°æ.exe Token: 33 640 °×½ð°æ.exe Token: SeIncBasePriorityPrivilege 640 °×½ð°æ.exe Token: SeSystemtimePrivilege 640 °×½ð°æ.exe Token: SeDebugPrivilege 412 taskkill.exe Token: SeDebugPrivilege 4388 taskkill.exe Token: SeDebugPrivilege 4204 taskkill.exe Token: SeDebugPrivilege 4108 Conhost.exe Token: SeDebugPrivilege 4916 taskkill.exe Token: SeDebugPrivilege 2204 Conhost.exe Token: SeDebugPrivilege 2400 taskkill.exe Token: 33 640 °×½ð°æ.exe Token: SeIncBasePriorityPrivilege 640 °×½ð°æ.exe Token: SeSystemtimePrivilege 640 °×½ð°æ.exe Token: SeDebugPrivilege 4952 taskkill.exe Token: SeDebugPrivilege 4836 taskkill.exe Token: SeDebugPrivilege 2108 Conhost.exe Token: SeDebugPrivilege 1640 taskkill.exe Token: SeDebugPrivilege 4736 Conhost.exe Token: SeDebugPrivilege 216 taskkill.exe Token: SeDebugPrivilege 1152 Conhost.exe Token: SeSystemtimePrivilege 640 °×½ð°æ.exe Token: 33 640 °×½ð°æ.exe Token: SeIncBasePriorityPrivilege 640 °×½ð°æ.exe Token: SeDebugPrivilege 4844 Conhost.exe Token: SeDebugPrivilege 1148 taskkill.exe Token: SeDebugPrivilege 4500 taskkill.exe Token: SeDebugPrivilege 2196 taskkill.exe Token: SeDebugPrivilege 2024 Conhost.exe Token: SeDebugPrivilege 1804 taskkill.exe Token: SeDebugPrivilege 3272 taskkill.exe Token: 33 640 °×½ð°æ.exe Token: SeIncBasePriorityPrivilege 640 °×½ð°æ.exe Token: SeSystemtimePrivilege 640 °×½ð°æ.exe Token: SeDebugPrivilege 4256 Conhost.exe Token: SeDebugPrivilege 1468 taskkill.exe Token: SeDebugPrivilege 2068 taskkill.exe Token: SeDebugPrivilege 3524 taskkill.exe Token: SeDebugPrivilege 1708 taskkill.exe Token: SeDebugPrivilege 3776 Conhost.exe Token: SeDebugPrivilege 4360 taskkill.exe Token: 33 640 °×½ð°æ.exe Token: SeIncBasePriorityPrivilege 640 °×½ð°æ.exe Token: SeSystemtimePrivilege 640 °×½ð°æ.exe Token: 33 640 °×½ð°æ.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 640 °×½ð°æ.exe 640 °×½ð°æ.exe 640 °×½ð°æ.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1588 wrote to memory of 640 1588 0dfde1a4c8f38abc290a7e4ad757edea.exe 91 PID 1588 wrote to memory of 640 1588 0dfde1a4c8f38abc290a7e4ad757edea.exe 91 PID 1588 wrote to memory of 640 1588 0dfde1a4c8f38abc290a7e4ad757edea.exe 91 PID 640 wrote to memory of 4204 640 °×½ð°æ.exe 246 PID 640 wrote to memory of 4204 640 °×½ð°æ.exe 246 PID 640 wrote to memory of 4204 640 °×½ð°æ.exe 246 PID 640 wrote to memory of 4916 640 °×½ð°æ.exe 173 PID 640 wrote to memory of 4916 640 °×½ð°æ.exe 173 PID 640 wrote to memory of 4916 640 °×½ð°æ.exe 173 PID 640 wrote to memory of 412 640 °×½ð°æ.exe 172 PID 640 wrote to memory of 412 640 °×½ð°æ.exe 172 PID 640 wrote to memory of 412 640 °×½ð°æ.exe 172 PID 640 wrote to memory of 2400 640 °×½ð°æ.exe 114 PID 640 wrote to memory of 2400 640 °×½ð°æ.exe 114 PID 640 wrote to memory of 2400 640 °×½ð°æ.exe 114 PID 640 wrote to memory of 4108 640 °×½ð°æ.exe 254 PID 640 wrote to memory of 4108 640 °×½ð°æ.exe 254 PID 640 wrote to memory of 4108 640 °×½ð°æ.exe 254 PID 640 wrote to memory of 2204 640 °×½ð°æ.exe 120 PID 640 wrote to memory of 2204 640 °×½ð°æ.exe 120 PID 640 wrote to memory of 2204 640 °×½ð°æ.exe 120 PID 640 wrote to memory of 4388 640 °×½ð°æ.exe 104 PID 640 wrote to memory of 4388 640 °×½ð°æ.exe 104 PID 640 wrote to memory of 4388 640 °×½ð°æ.exe 104 PID 640 wrote to memory of 1152 640 °×½ð°æ.exe 202 PID 640 wrote to memory of 1152 640 °×½ð°æ.exe 202 PID 640 wrote to memory of 1152 640 °×½ð°æ.exe 202 PID 640 wrote to memory of 4952 640 °×½ð°æ.exe 170 PID 640 wrote to memory of 4952 640 °×½ð°æ.exe 170 PID 640 wrote to memory of 4952 640 °×½ð°æ.exe 170 PID 640 wrote to memory of 2108 640 °×½ð°æ.exe 186 PID 640 wrote to memory of 2108 640 °×½ð°æ.exe 186 PID 640 wrote to memory of 2108 640 °×½ð°æ.exe 186 PID 640 wrote to memory of 4836 640 °×½ð°æ.exe 168 PID 640 wrote to memory of 4836 640 °×½ð°æ.exe 168 PID 640 wrote to memory of 4836 640 °×½ð°æ.exe 168 PID 640 wrote to memory of 1640 640 °×½ð°æ.exe 167 PID 640 wrote to memory of 1640 640 °×½ð°æ.exe 167 PID 640 wrote to memory of 1640 640 °×½ð°æ.exe 167 PID 640 wrote to memory of 216 640 °×½ð°æ.exe 166 PID 640 wrote to memory of 216 640 °×½ð°æ.exe 166 PID 640 wrote to memory of 216 640 °×½ð°æ.exe 166 PID 640 wrote to memory of 4736 640 °×½ð°æ.exe 203 PID 640 wrote to memory of 4736 640 °×½ð°æ.exe 203 PID 640 wrote to memory of 4736 640 °×½ð°æ.exe 203 PID 640 wrote to memory of 4844 640 °×½ð°æ.exe 223 PID 640 wrote to memory of 4844 640 °×½ð°æ.exe 223 PID 640 wrote to memory of 4844 640 °×½ð°æ.exe 223 PID 640 wrote to memory of 1148 640 °×½ð°æ.exe 160 PID 640 wrote to memory of 1148 640 °×½ð°æ.exe 160 PID 640 wrote to memory of 1148 640 °×½ð°æ.exe 160 PID 640 wrote to memory of 1804 640 °×½ð°æ.exe 159 PID 640 wrote to memory of 1804 640 °×½ð°æ.exe 159 PID 640 wrote to memory of 1804 640 °×½ð°æ.exe 159 PID 640 wrote to memory of 4500 640 °×½ð°æ.exe 158 PID 640 wrote to memory of 4500 640 °×½ð°æ.exe 158 PID 640 wrote to memory of 4500 640 °×½ð°æ.exe 158 PID 640 wrote to memory of 2024 640 °×½ð°æ.exe 226 PID 640 wrote to memory of 2024 640 °×½ð°æ.exe 226 PID 640 wrote to memory of 2024 640 °×½ð°æ.exe 226 PID 640 wrote to memory of 2196 640 °×½ð°æ.exe 155 PID 640 wrote to memory of 2196 640 °×½ð°æ.exe 155 PID 640 wrote to memory of 2196 640 °×½ð°æ.exe 155 PID 640 wrote to memory of 3272 640 °×½ð°æ.exe 230
Processes
-
C:\Users\Admin\AppData\Local\Temp\0dfde1a4c8f38abc290a7e4ad757edea.exe"C:\Users\Admin\AppData\Local\Temp\0dfde1a4c8f38abc290a7e4ad757edea.exe"1⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
PID:1588 -
C:\Users\Admin\AppData\Local\Temp\°×½ð°æ.exeC:\Users\Admin\AppData\Local\Temp\°×½ð°æ.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:640 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im 360tray.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4388
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im VsTskMgr.exe3⤵
- Kills process with taskkill
PID:2204
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im Mcshield.exe3⤵
- Kills process with taskkill
PID:4108
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im Ravmon.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2400
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im 360tray.exe3⤵
- Kills process with taskkill
PID:4256
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im 360tray.exe3⤵
- Kills process with taskkill
PID:4208
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im VsTskMgr.exe3⤵
- Kills process with taskkill
PID:4500
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im Mcshield.exe3⤵
- Kills process with taskkill
PID:4228
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im Ravmon.exe3⤵
- Kills process with taskkill
PID:4068
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im Rav.exe3⤵
- Kills process with taskkill
PID:376
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im KVXP.kxp3⤵
- Kills process with taskkill
PID:3972
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im kavsvc.exe3⤵
- Kills process with taskkill
PID:4236 -
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
- Suspicious use of AdjustPrivilegeToken
PID:3776
-
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im VsTskMgr.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4360
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im Mcshield.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2068
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im Ravmon.exe3⤵
- Kills process with taskkill
PID:3776 -
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
- Suspicious use of AdjustPrivilegeToken
PID:2108
-
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im Rav.exe3⤵
- Kills process with taskkill
PID:1468 -
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
- Suspicious use of AdjustPrivilegeToken
PID:4256
-
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im KVXP.kxp3⤵PID:1708
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im kavsvc.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3524
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im 360tray.exe3⤵
- Kills process with taskkill
PID:3272
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im VsTskMgr.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2196
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im Mcshield.exe3⤵
- Kills process with taskkill
PID:2024
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im Ravmon.exe3⤵
- Suspicious use of AdjustPrivilegeToken
PID:4500
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im Rav.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1804
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im KVXP.kxp3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1148
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im kavsvc.exe3⤵
- Kills process with taskkill
PID:4844
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im 360tray.exe3⤵PID:4736
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im VsTskMgr.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:216
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im Mcshield.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1640
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im Ravmon.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4836
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im Rav.exe3⤵
- Kills process with taskkill
PID:2108
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im KVXP.kxp3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4952
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im kavsvc.exe3⤵
- Kills process with taskkill
PID:1152
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im Rav.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:412
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im KVXP.kxp3⤵
- Suspicious use of AdjustPrivilegeToken
PID:4916
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im kavsvc.exe3⤵
- Kills process with taskkill
PID:4204
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im 360tray.exe3⤵
- Kills process with taskkill
PID:736
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im VsTskMgr.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1708
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im Mcshield.exe3⤵
- Kills process with taskkill
PID:3184
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im Ravmon.exe3⤵
- Kills process with taskkill
PID:3584
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im Rav.exe3⤵
- Kills process with taskkill
PID:4844
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im KVXP.kxp3⤵
- Kills process with taskkill
PID:928
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im kavsvc.exe3⤵
- Kills process with taskkill
PID:3776
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im kavsvc.exe3⤵
- Kills process with taskkill
PID:3560
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Windows\system32\reg.bat3⤵PID:664
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im 360tray.exe3⤵
- Kills process with taskkill
PID:3024
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im VsTskMgr.exe3⤵
- Kills process with taskkill
PID:116
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im Mcshield.exe3⤵
- Kills process with taskkill
PID:1852
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im Ravmon.exe3⤵
- Kills process with taskkill
PID:3184
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im Rav.exe3⤵
- Kills process with taskkill
PID:4920
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im KVXP.kxp3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3272
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im kavsvc.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1468
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im 360tray.exe3⤵
- Kills process with taskkill
PID:2000
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im VsTskMgr.exe3⤵
- Kills process with taskkill
PID:4236
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im Mcshield.exe3⤵PID:716
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im Ravmon.exe3⤵
- Kills process with taskkill
PID:1108
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im Rav.exe3⤵PID:2848
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im KVXP.kxp3⤵PID:5088
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im kavsvc.exe3⤵PID:1564
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im 360tray.exe3⤵
- Kills process with taskkill
PID:4828
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im VsTskMgr.exe3⤵
- Kills process with taskkill
PID:3980
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im Mcshield.exe3⤵PID:3144
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im Ravmon.exe3⤵
- Kills process with taskkill
PID:2096
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im Rav.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4204
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im KVXP.kxp3⤵
- Kills process with taskkill
PID:4876
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im kavsvc.exe3⤵PID:4568
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im 360tray.exe3⤵PID:828
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im VsTskMgr.exe3⤵
- Kills process with taskkill
PID:3820
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im Mcshield.exe3⤵
- Kills process with taskkill
PID:3712
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im Ravmon.exe3⤵
- Kills process with taskkill
PID:840
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im Rav.exe3⤵
- Kills process with taskkill
PID:3204
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im KVXP.kxp3⤵
- Kills process with taskkill
PID:3336
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im kavsvc.exe3⤵PID:744
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im 360tray.exe3⤵PID:2040
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im VsTskMgr.exe3⤵
- Kills process with taskkill
PID:3208
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im Mcshield.exe3⤵
- Kills process with taskkill
PID:2140
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im Ravmon.exe3⤵
- Kills process with taskkill
PID:1564
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im Rav.exe3⤵
- Kills process with taskkill
PID:4460
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im KVXP.kxp3⤵
- Kills process with taskkill
PID:1452
-
-
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵
- Suspicious use of AdjustPrivilegeToken
PID:2204
-
C:\Windows\system32\usoclient.exeC:\Windows\system32\usoclient.exe StartScan1⤵PID:376
-
C:\Windows\System32\Upfc.exeC:\Windows\System32\Upfc.exe /launchtype periodic /cv hDSxN0W93E2QMwwCnL9QIQ.01⤵PID:732
-
C:\Windows\System32\sihclient.exeC:\Windows\System32\sihclient.exe /cv hDSxN0W93E2QMwwCnL9QIQ.0.22⤵PID:4228
-
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵
- Suspicious use of AdjustPrivilegeToken
PID:1152
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵
- Suspicious use of AdjustPrivilegeToken
PID:4736
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x4 /state0:0xa390e855 /state1:0x41c64e6d1⤵PID:5064
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵
- Suspicious use of AdjustPrivilegeToken
PID:4844
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵
- Suspicious use of AdjustPrivilegeToken
PID:2024
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵
- Suspicious use of AdjustPrivilegeToken
PID:4108
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}1⤵PID:736
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}1⤵PID:3204
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}1⤵PID:3712