623353e315a9af843873f021acf3375c5f5566e4de602be7d5690342a7f2d2b6

Analysis

max time kernel
150s
max time network
118s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
15/03/2024, 14:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

cba75eb2146cccc88fff11745d687e71.exe
Size

683KB
MD5

cba75eb2146cccc88fff11745d687e71
SHA1

1161e0b49bca75540f7c1a9285e2d98671f2a7a0
SHA256

623353e315a9af843873f021acf3375c5f5566e4de602be7d5690342a7f2d2b6
SHA512

8d97d51c8da99f07f3499b6a7153f35d724f72da619dc08e3781df0f0d1f0de1f9903982b09c91f142f9413cc293556e788ae0aa17eb077751a41d37f17e1b55
SSDEEP

768:Rg1PYfQnf9e9hfAZLKGT249QfACHW6o2iMI4Gd1qKMJZHChAR4U:QQ6f9WAZLk49QpHW6o7F8yFU

Score

10^/10

evasion persistence upx

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe C:\\Windows\\system32\\DvdPlayer.exe"	cba75eb2146cccc88fff11745d687e71.exe

Disables RegEdit via registry modification 1 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	cba75eb2146cccc88fff11745d687e71.exe

Disables Task Manager via registry modification
evasion

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2528-0-0x0000000000400000-0x0000000000427000-memory.dmp	upx
behavioral1/memory/2528-5-0x0000000000400000-0x0000000000427000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\DvdPlayer = "C:\\Windows\\system32\\DvdPlayer.exe"	cba75eb2146cccc88fff11745d687e71.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\DvdPlayer.exe	cba75eb2146cccc88fff11745d687e71.exe
File opened for modification	C:\Windows\SysWOW64\DvdPlayer.exe	cba75eb2146cccc88fff11745d687e71.exe

Kills process with taskkill 64 IoCs

evasion

pid	Process
2436	taskkill.exe
912	Process not Found
724	Process not Found
2372	taskkill.exe
1284	taskkill.exe
2676	taskkill.exe
2024	taskkill.exe
1384	taskkill.exe
2536	taskkill.exe
336	taskkill.exe
1656	Process not Found
1380	taskkill.exe
2324	taskkill.exe
2564	taskkill.exe
1492	Process not Found
412	Process not Found
1240	taskkill.exe
2488	taskkill.exe
3040	taskkill.exe
2316	taskkill.exe
3020	taskkill.exe
2888	taskkill.exe
1040	taskkill.exe
2788	taskkill.exe
2764	Process not Found
936	Process not Found
2764	taskkill.exe
1644	taskkill.exe
2920	taskkill.exe
2748	taskkill.exe
2416	Process not Found
2452	taskkill.exe
2100	taskkill.exe
2932	taskkill.exe
2268	taskkill.exe
856	taskkill.exe
1044	Process not Found
2900	taskkill.exe
1172	taskkill.exe
2320	Process not Found
3016	Process not Found
3008	taskkill.exe
2012	taskkill.exe
1544	taskkill.exe
2900	Process not Found
1616	Process not Found
916	taskkill.exe
1200	taskkill.exe
2012	taskkill.exe
2724	taskkill.exe
2128	Process not Found
1948	taskkill.exe
1108	taskkill.exe
2332	taskkill.exe
3020	taskkill.exe
1960	Process not Found
412	taskkill.exe
2572	taskkill.exe
2724	Process not Found
2208	taskkill.exe
784	Process not Found
2348	Process not Found
1688	taskkill.exe
2452	Process not Found

Runs net.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2528	cba75eb2146cccc88fff11745d687e71.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeSystemtimePrivilege	2528	cba75eb2146cccc88fff11745d687e71.exe
Token: SeDebugPrivilege	2084	taskkill.exe
Token: SeDebugPrivilege	2540	taskkill.exe
Token: SeSystemtimePrivilege	2528	cba75eb2146cccc88fff11745d687e71.exe
Token: SeDebugPrivilege	2452	taskkill.exe
Token: SeDebugPrivilege	1948	taskkill.exe
Token: SeSystemtimePrivilege	2528	cba75eb2146cccc88fff11745d687e71.exe
Token: SeDebugPrivilege	2884	taskkill.exe
Token: SeDebugPrivilege	2624	taskkill.exe
Token: SeSystemtimePrivilege	2528	cba75eb2146cccc88fff11745d687e71.exe
Token: SeDebugPrivilege	2680	taskkill.exe
Token: SeDebugPrivilege	2548	taskkill.exe
Token: SeSystemtimePrivilege	2528	cba75eb2146cccc88fff11745d687e71.exe
Token: SeDebugPrivilege	1380	taskkill.exe
Token: SeDebugPrivilege	1824	taskkill.exe
Token: SeSystemtimePrivilege	2528	cba75eb2146cccc88fff11745d687e71.exe
Token: SeDebugPrivilege	1492	taskkill.exe
Token: SeDebugPrivilege	532	taskkill.exe
Token: SeSystemtimePrivilege	2528	cba75eb2146cccc88fff11745d687e71.exe
Token: SeDebugPrivilege	2324	taskkill.exe
Token: SeDebugPrivilege	1764	taskkill.exe
Token: SeSystemtimePrivilege	2528	cba75eb2146cccc88fff11745d687e71.exe
Token: SeDebugPrivilege	2372	taskkill.exe
Token: SeDebugPrivilege	916	taskkill.exe
Token: SeSystemtimePrivilege	2528	cba75eb2146cccc88fff11745d687e71.exe
Token: SeDebugPrivilege	1364	taskkill.exe
Token: SeDebugPrivilege	1768	taskkill.exe
Token: SeSystemtimePrivilege	2528	cba75eb2146cccc88fff11745d687e71.exe
Token: SeDebugPrivilege	1240	taskkill.exe
Token: SeDebugPrivilege	2692	taskkill.exe
Token: SeSystemtimePrivilege	2528	cba75eb2146cccc88fff11745d687e71.exe
Token: SeDebugPrivilege	2540	taskkill.exe
Token: SeDebugPrivilege	2568	taskkill.exe
Token: SeSystemtimePrivilege	2528	cba75eb2146cccc88fff11745d687e71.exe
Token: SeDebugPrivilege	3008	taskkill.exe
Token: SeDebugPrivilege	2900	taskkill.exe
Token: SeSystemtimePrivilege	2528	cba75eb2146cccc88fff11745d687e71.exe
Token: SeDebugPrivilege	2504	taskkill.exe
Token: SeDebugPrivilege	268	taskkill.exe
Token: SeSystemtimePrivilege	2528	cba75eb2146cccc88fff11745d687e71.exe
Token: SeDebugPrivilege	2304	taskkill.exe
Token: SeDebugPrivilege	2544	taskkill.exe
Token: SeSystemtimePrivilege	2528	cba75eb2146cccc88fff11745d687e71.exe
Token: SeDebugPrivilege	292	taskkill.exe
Token: SeDebugPrivilege	1688	taskkill.exe
Token: SeSystemtimePrivilege	2528	cba75eb2146cccc88fff11745d687e71.exe
Token: SeDebugPrivilege	3060	taskkill.exe
Token: SeDebugPrivilege	1524	taskkill.exe
Token: SeSystemtimePrivilege	2528	cba75eb2146cccc88fff11745d687e71.exe
Token: SeDebugPrivilege	2248	taskkill.exe
Token: SeDebugPrivilege	1284	taskkill.exe
Token: SeSystemtimePrivilege	2528	cba75eb2146cccc88fff11745d687e71.exe
Token: SeDebugPrivilege	2100	taskkill.exe
Token: SeDebugPrivilege	1584	taskkill.exe
Token: SeSystemtimePrivilege	2528	cba75eb2146cccc88fff11745d687e71.exe
Token: SeDebugPrivilege	2272	taskkill.exe
Token: SeDebugPrivilege	2588	taskkill.exe
Token: SeSystemtimePrivilege	2528	cba75eb2146cccc88fff11745d687e71.exe
Token: SeDebugPrivilege	1760	taskkill.exe
Token: SeDebugPrivilege	3024	taskkill.exe
Token: SeSystemtimePrivilege	2528	cba75eb2146cccc88fff11745d687e71.exe
Token: SeDebugPrivilege	3012	taskkill.exe
Token: SeDebugPrivilege	2536	taskkill.exe
Token: SeSystemtimePrivilege	2528	cba75eb2146cccc88fff11745d687e71.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2528	cba75eb2146cccc88fff11745d687e71.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2528 wrote to memory of 1336	2528	cba75eb2146cccc88fff11745d687e71.exe	28
PID 2528 wrote to memory of 1336	2528	cba75eb2146cccc88fff11745d687e71.exe	28
PID 2528 wrote to memory of 1336	2528	cba75eb2146cccc88fff11745d687e71.exe	28
PID 2528 wrote to memory of 1336	2528	cba75eb2146cccc88fff11745d687e71.exe	28
PID 2528 wrote to memory of 2540	2528	cba75eb2146cccc88fff11745d687e71.exe	29
PID 2528 wrote to memory of 2540	2528	cba75eb2146cccc88fff11745d687e71.exe	29
PID 2528 wrote to memory of 2540	2528	cba75eb2146cccc88fff11745d687e71.exe	29
PID 2528 wrote to memory of 2540	2528	cba75eb2146cccc88fff11745d687e71.exe	29
PID 2528 wrote to memory of 2084	2528	cba75eb2146cccc88fff11745d687e71.exe	31
PID 2528 wrote to memory of 2084	2528	cba75eb2146cccc88fff11745d687e71.exe	31
PID 2528 wrote to memory of 2084	2528	cba75eb2146cccc88fff11745d687e71.exe	31
PID 2528 wrote to memory of 2084	2528	cba75eb2146cccc88fff11745d687e71.exe	31
PID 2528 wrote to memory of 2160	2528	cba75eb2146cccc88fff11745d687e71.exe	32
PID 2528 wrote to memory of 2160	2528	cba75eb2146cccc88fff11745d687e71.exe	32
PID 2528 wrote to memory of 2160	2528	cba75eb2146cccc88fff11745d687e71.exe	32
PID 2528 wrote to memory of 2160	2528	cba75eb2146cccc88fff11745d687e71.exe	32
PID 2160 wrote to memory of 2572	2160	net.exe	36
PID 2160 wrote to memory of 2572	2160	net.exe	36
PID 2160 wrote to memory of 2572	2160	net.exe	36
PID 2160 wrote to memory of 2572	2160	net.exe	36
PID 1336 wrote to memory of 2580	1336	net.exe	37
PID 1336 wrote to memory of 2580	1336	net.exe	37
PID 1336 wrote to memory of 2580	1336	net.exe	37
PID 1336 wrote to memory of 2580	1336	net.exe	37
PID 2528 wrote to memory of 2560	2528	cba75eb2146cccc88fff11745d687e71.exe	39
PID 2528 wrote to memory of 2560	2528	cba75eb2146cccc88fff11745d687e71.exe	39
PID 2528 wrote to memory of 2560	2528	cba75eb2146cccc88fff11745d687e71.exe	39
PID 2528 wrote to memory of 2560	2528	cba75eb2146cccc88fff11745d687e71.exe	39
PID 2528 wrote to memory of 1948	2528	cba75eb2146cccc88fff11745d687e71.exe	40
PID 2528 wrote to memory of 1948	2528	cba75eb2146cccc88fff11745d687e71.exe	40
PID 2528 wrote to memory of 1948	2528	cba75eb2146cccc88fff11745d687e71.exe	40
PID 2528 wrote to memory of 1948	2528	cba75eb2146cccc88fff11745d687e71.exe	40
PID 2528 wrote to memory of 2452	2528	cba75eb2146cccc88fff11745d687e71.exe	41
PID 2528 wrote to memory of 2452	2528	cba75eb2146cccc88fff11745d687e71.exe	41
PID 2528 wrote to memory of 2452	2528	cba75eb2146cccc88fff11745d687e71.exe	41
PID 2528 wrote to memory of 2452	2528	cba75eb2146cccc88fff11745d687e71.exe	41
PID 2528 wrote to memory of 2468	2528	cba75eb2146cccc88fff11745d687e71.exe	43
PID 2528 wrote to memory of 2468	2528	cba75eb2146cccc88fff11745d687e71.exe	43
PID 2528 wrote to memory of 2468	2528	cba75eb2146cccc88fff11745d687e71.exe	43
PID 2528 wrote to memory of 2468	2528	cba75eb2146cccc88fff11745d687e71.exe	43
PID 2560 wrote to memory of 1744	2560	net.exe	47
PID 2560 wrote to memory of 1744	2560	net.exe	47
PID 2560 wrote to memory of 1744	2560	net.exe	47
PID 2560 wrote to memory of 1744	2560	net.exe	47
PID 2468 wrote to memory of 2492	2468	net.exe	48
PID 2468 wrote to memory of 2492	2468	net.exe	48
PID 2468 wrote to memory of 2492	2468	net.exe	48
PID 2468 wrote to memory of 2492	2468	net.exe	48
PID 2528 wrote to memory of 2536	2528	cba75eb2146cccc88fff11745d687e71.exe	49
PID 2528 wrote to memory of 2536	2528	cba75eb2146cccc88fff11745d687e71.exe	49
PID 2528 wrote to memory of 2536	2528	cba75eb2146cccc88fff11745d687e71.exe	49
PID 2528 wrote to memory of 2536	2528	cba75eb2146cccc88fff11745d687e71.exe	49
PID 2528 wrote to memory of 2884	2528	cba75eb2146cccc88fff11745d687e71.exe	50
PID 2528 wrote to memory of 2884	2528	cba75eb2146cccc88fff11745d687e71.exe	50
PID 2528 wrote to memory of 2884	2528	cba75eb2146cccc88fff11745d687e71.exe	50
PID 2528 wrote to memory of 2884	2528	cba75eb2146cccc88fff11745d687e71.exe	50
PID 2528 wrote to memory of 2624	2528	cba75eb2146cccc88fff11745d687e71.exe	52
PID 2528 wrote to memory of 2624	2528	cba75eb2146cccc88fff11745d687e71.exe	52
PID 2528 wrote to memory of 2624	2528	cba75eb2146cccc88fff11745d687e71.exe	52
PID 2528 wrote to memory of 2624	2528	cba75eb2146cccc88fff11745d687e71.exe	52
PID 2528 wrote to memory of 2904	2528	cba75eb2146cccc88fff11745d687e71.exe	54
PID 2528 wrote to memory of 2904	2528	cba75eb2146cccc88fff11745d687e71.exe	54
PID 2528 wrote to memory of 2904	2528	cba75eb2146cccc88fff11745d687e71.exe	54
PID 2528 wrote to memory of 2904	2528	cba75eb2146cccc88fff11745d687e71.exe	54

C:\Users\Admin\AppData\Local\Temp\cba75eb2146cccc88fff11745d687e71.exe
"C:\Users\Admin\AppData\Local\Temp\cba75eb2146cccc88fff11745d687e71.exe"
1⤵
- Modifies WinLogon for persistence
- Disables RegEdit via registry modification
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2528
- C:\Windows\SysWOW64\net.exe
  net stop "mcshield"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1336
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "mcshield"
    3⤵
    PID:2580
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KRN.EXE
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2540
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KUI.EXE
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2084
- C:\Windows\SysWOW64\net.exe
  net stop "Norton Antivirus Auto Protect Service"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2160
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "Norton Antivirus Auto Protect Service"
    3⤵
    PID:2572
- C:\Windows\SysWOW64\net.exe
  net stop "mcshield"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2560
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "mcshield"
    3⤵
    PID:1744
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KRN.EXE
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1948
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KUI.EXE
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2452
- C:\Windows\SysWOW64\net.exe
  net stop "Norton Antivirus Auto Protect Service"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2468
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "Norton Antivirus Auto Protect Service"
    3⤵
    PID:2492
- C:\Windows\SysWOW64\net.exe
  net stop "mcshield"
  2⤵
  PID:2536
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "mcshield"
    3⤵
    PID:1032
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KRN.EXE
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2884
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KUI.EXE
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2624
- C:\Windows\SysWOW64\net.exe
  net stop "Norton Antivirus Auto Protect Service"
  2⤵
  PID:2904
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "Norton Antivirus Auto Protect Service"
    3⤵
    PID:3012
- C:\Windows\SysWOW64\net.exe
  net stop "mcshield"
  2⤵
  PID:2672
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "mcshield"
    3⤵
    PID:1228
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KRN.EXE
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2680
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KUI.EXE
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2548
- C:\Windows\SysWOW64\net.exe
  net stop "Norton Antivirus Auto Protect Service"
  2⤵
  PID:2788
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "Norton Antivirus Auto Protect Service"
    3⤵
    PID:1408
- C:\Windows\SysWOW64\net.exe
  net stop "mcshield"
  2⤵
  PID:2112
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "mcshield"
    3⤵
    PID:304
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KRN.EXE
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1824
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KUI.EXE
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1380
- C:\Windows\SysWOW64\net.exe
  net stop "Norton Antivirus Auto Protect Service"
  2⤵
  PID:1956
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "Norton Antivirus Auto Protect Service"
    3⤵
    PID:2164
- C:\Windows\SysWOW64\net.exe
  net stop "mcshield"
  2⤵
  PID:1496
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "mcshield"
    3⤵
    PID:1248
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KRN.EXE
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1492
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KUI.EXE
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:532
- C:\Windows\SysWOW64\net.exe
  net stop "Norton Antivirus Auto Protect Service"
  2⤵
  PID:1792
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "Norton Antivirus Auto Protect Service"
    3⤵
    PID:1556
- C:\Windows\SysWOW64\net.exe
  net stop "mcshield"
  2⤵
  PID:1896
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "mcshield"
    3⤵
    PID:936
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KRN.EXE
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2324
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KUI.EXE
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1764
- C:\Windows\SysWOW64\net.exe
  net stop "Norton Antivirus Auto Protect Service"
  2⤵
  PID:1808
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "Norton Antivirus Auto Protect Service"
    3⤵
    PID:656
- C:\Windows\SysWOW64\net.exe
  net stop "mcshield"
  2⤵
  PID:2028
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "mcshield"
    3⤵
    PID:844
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KRN.EXE
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:916
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KUI.EXE
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2372
- C:\Windows\SysWOW64\net.exe
  net stop "Norton Antivirus Auto Protect Service"
  2⤵
  PID:700
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "Norton Antivirus Auto Protect Service"
    3⤵
    PID:2080
- C:\Windows\SysWOW64\net.exe
  net stop "mcshield"
  2⤵
  PID:1716
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "mcshield"
    3⤵
    PID:1732
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KRN.EXE
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1364
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KUI.EXE
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1768
- C:\Windows\SysWOW64\net.exe
  net stop "Norton Antivirus Auto Protect Service"
  2⤵
  PID:880
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "Norton Antivirus Auto Protect Service"
    3⤵
    PID:1576
- C:\Windows\SysWOW64\net.exe
  net stop "mcshield"
  2⤵
  PID:2408
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "mcshield"
    3⤵
    PID:2564
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KRN.EXE
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1240
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KUI.EXE
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2692
- C:\Windows\SysWOW64\net.exe
  net stop "Norton Antivirus Auto Protect Service"
  2⤵
  PID:2580
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "Norton Antivirus Auto Protect Service"
    3⤵
    PID:2496
- C:\Windows\SysWOW64\net.exe
  net stop "mcshield"
  2⤵
  PID:2764
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "mcshield"
    3⤵
    PID:1656
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KRN.EXE
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2540
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KUI.EXE
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2568
- C:\Windows\SysWOW64\net.exe
  net stop "Norton Antivirus Auto Protect Service"
  2⤵
  PID:2512
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "Norton Antivirus Auto Protect Service"
    3⤵
    PID:2060
- C:\Windows\SysWOW64\net.exe
  net stop "mcshield"
  2⤵
  PID:2752
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "mcshield"
    3⤵
    PID:2892
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KRN.EXE
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2900
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KUI.EXE
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3008
- C:\Windows\SysWOW64\net.exe
  net stop "Norton Antivirus Auto Protect Service"
  2⤵
  PID:3028
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "Norton Antivirus Auto Protect Service"
    3⤵
    PID:2888
- C:\Windows\SysWOW64\net.exe
  net stop "mcshield"
  2⤵
  PID:3056
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "mcshield"
    3⤵
    PID:1224
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KRN.EXE
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2504
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KUI.EXE
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:268
- C:\Windows\SysWOW64\net.exe
  net stop "Norton Antivirus Auto Protect Service"
  2⤵
  PID:2816
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "Norton Antivirus Auto Protect Service"
    3⤵
    PID:776
- C:\Windows\SysWOW64\net.exe
  net stop "mcshield"
  2⤵
  PID:836
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "mcshield"
    3⤵
    PID:1776
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KRN.EXE
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2544
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KUI.EXE
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2304
- C:\Windows\SysWOW64\net.exe
  net stop "Norton Antivirus Auto Protect Service"
  2⤵
  PID:2112
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "Norton Antivirus Auto Protect Service"
    3⤵
    PID:2168
- C:\Windows\SysWOW64\net.exe
  net stop "mcshield"
  2⤵
  PID:2204
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "mcshield"
    3⤵
    PID:920
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KRN.EXE
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:292
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KUI.EXE
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1688
- C:\Windows\SysWOW64\net.exe
  net stop "Norton Antivirus Auto Protect Service"
  2⤵
  PID:1704
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "Norton Antivirus Auto Protect Service"
    3⤵
    PID:336
- C:\Windows\SysWOW64\net.exe
  net stop "mcshield"
  2⤵
  PID:584
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "mcshield"
    3⤵
    PID:1764
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KRN.EXE
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3060
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KUI.EXE
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1524
- C:\Windows\SysWOW64\net.exe
  net stop "Norton Antivirus Auto Protect Service"
  2⤵
  PID:1892
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "Norton Antivirus Auto Protect Service"
    3⤵
    PID:2328
- C:\Windows\SysWOW64\net.exe
  net stop "mcshield"
  2⤵
  PID:1540
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "mcshield"
    3⤵
    PID:604
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KRN.EXE
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2248
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KUI.EXE
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1284
- C:\Windows\SysWOW64\net.exe
  net stop "Norton Antivirus Auto Protect Service"
  2⤵
  PID:2080
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "Norton Antivirus Auto Protect Service"
    3⤵
    PID:2096
- C:\Windows\SysWOW64\net.exe
  net stop "mcshield"
  2⤵
  PID:2412
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "mcshield"
    3⤵
    PID:1976
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KRN.EXE
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2100
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KUI.EXE
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1584
- C:\Windows\SysWOW64\net.exe
  net stop "Norton Antivirus Auto Protect Service"
  2⤵
  PID:2772
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "Norton Antivirus Auto Protect Service"
    3⤵
    PID:2916
- C:\Windows\SysWOW64\net.exe
  net stop "mcshield"
  2⤵
  PID:1364
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "mcshield"
    3⤵
    PID:2600
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KRN.EXE
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2272
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KUI.EXE
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2588
- C:\Windows\SysWOW64\net.exe
  net stop "Norton Antivirus Auto Protect Service"
  2⤵
  PID:2564
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "Norton Antivirus Auto Protect Service"
    3⤵
    PID:2732
- C:\Windows\SysWOW64\net.exe
  net stop "mcshield"
  2⤵
  PID:2456
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "mcshield"
    3⤵
    PID:2520
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KRN.EXE
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1760
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KUI.EXE
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3024
- C:\Windows\SysWOW64\net.exe
  net stop "Norton Antivirus Auto Protect Service"
  2⤵
  PID:1656
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "Norton Antivirus Auto Protect Service"
    3⤵
    PID:1948
- C:\Windows\SysWOW64\net.exe
  net stop "mcshield"
  2⤵
  PID:840
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "mcshield"
    3⤵
    PID:2508
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KRN.EXE
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3012
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KUI.EXE
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2536
- C:\Windows\SysWOW64\net.exe
  net stop "Norton Antivirus Auto Protect Service"
  2⤵
  PID:2752
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "Norton Antivirus Auto Protect Service"
    3⤵
    PID:2872
- C:\Windows\SysWOW64\net.exe
  net stop "mcshield"
  2⤵
  PID:2896
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "mcshield"
    3⤵
    PID:1228
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KRN.EXE
  2⤵
  PID:2444
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KUI.EXE
  2⤵
  PID:1204
- C:\Windows\SysWOW64\net.exe
  net stop "Norton Antivirus Auto Protect Service"
  2⤵
  PID:2672
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "Norton Antivirus Auto Protect Service"
    3⤵
    PID:756
- C:\Windows\SysWOW64\net.exe
  net stop "mcshield"
  2⤵
  PID:348
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "mcshield"
    3⤵
    PID:1108
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KRN.EXE
  2⤵
  PID:2504
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KUI.EXE
  2⤵
  PID:2188
- C:\Windows\SysWOW64\net.exe
  net stop "Norton Antivirus Auto Protect Service"
  2⤵
  PID:1728
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "Norton Antivirus Auto Protect Service"
    3⤵
    PID:1772
- C:\Windows\SysWOW64\net.exe
  net stop "mcshield"
  2⤵
  PID:1496
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "mcshield"
    3⤵
    PID:1876
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KRN.EXE
  2⤵
  PID:336
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KUI.EXE
  2⤵
  - Kills process with taskkill
  PID:412
- C:\Windows\SysWOW64\net.exe
  net stop "Norton Antivirus Auto Protect Service"
  2⤵
  PID:1132
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "Norton Antivirus Auto Protect Service"
    3⤵
    PID:1940
- C:\Windows\SysWOW64\net.exe
  net stop "mcshield"
  2⤵
  PID:2944
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "mcshield"
    3⤵
    PID:2024
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KRN.EXE
  2⤵
  - Kills process with taskkill
  PID:1200
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KUI.EXE
  2⤵
  PID:1960
- C:\Windows\SysWOW64\net.exe
  net stop "Norton Antivirus Auto Protect Service"
  2⤵
  PID:1892
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "Norton Antivirus Auto Protect Service"
    3⤵
    PID:832
- C:\Windows\SysWOW64\net.exe
  net stop "mcshield"
  2⤵
  PID:2340
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "mcshield"
    3⤵
    PID:2296
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KRN.EXE
  2⤵
  PID:2096
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KUI.EXE
  2⤵
  PID:2956
- C:\Windows\SysWOW64\net.exe
  net stop "Norton Antivirus Auto Protect Service"
  2⤵
  PID:888
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "Norton Antivirus Auto Protect Service"
    3⤵
    PID:2248
- C:\Windows\SysWOW64\net.exe
  net stop "mcshield"
  2⤵
  PID:880
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "mcshield"
    3⤵
    PID:2208
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KRN.EXE
  2⤵
  PID:884
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KUI.EXE
  2⤵
  PID:2120
- C:\Windows\SysWOW64\net.exe
  net stop "Norton Antivirus Auto Protect Service"
  2⤵
  PID:2772
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "Norton Antivirus Auto Protect Service"
    3⤵
    PID:1732
- C:\Windows\SysWOW64\net.exe
  net stop "mcshield"
  2⤵
  PID:2620
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "mcshield"
    3⤵
    PID:2920
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KRN.EXE
  2⤵
  PID:1756
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KUI.EXE
  2⤵
  PID:2552
- C:\Windows\SysWOW64\net.exe
  net stop "Norton Antivirus Auto Protect Service"
  2⤵
  PID:1364
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "Norton Antivirus Auto Protect Service"
    3⤵
    PID:2720
- C:\Windows\SysWOW64\net.exe
  net stop "mcshield"
  2⤵
  PID:2460
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "mcshield"
    3⤵
    PID:1836
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KRN.EXE
  2⤵
  PID:2468
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KUI.EXE
  2⤵
  PID:2764
- C:\Windows\SysWOW64\net.exe
  net stop "Norton Antivirus Auto Protect Service"
  2⤵
  PID:2844
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "Norton Antivirus Auto Protect Service"
    3⤵
    PID:2132
- C:\Windows\SysWOW64\net.exe
  net stop "mcshield"
  2⤵
  PID:2568
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "mcshield"
    3⤵
    PID:2624
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KRN.EXE
  2⤵
  - Kills process with taskkill
  PID:2888
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KUI.EXE
  2⤵
  PID:2884
- C:\Windows\SysWOW64\net.exe
  net stop "Norton Antivirus Auto Protect Service"
  2⤵
  PID:2012
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "Norton Antivirus Auto Protect Service"
    3⤵
    PID:2880
- C:\Windows\SysWOW64\net.exe
  net stop "mcshield"
  2⤵
  PID:1344
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "mcshield"
    3⤵
    PID:2816
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KRN.EXE
  2⤵
  PID:776
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KUI.EXE
  2⤵
  PID:1228
- C:\Windows\SysWOW64\net.exe
  net stop "Norton Antivirus Auto Protect Service"
  2⤵
  PID:1028
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "Norton Antivirus Auto Protect Service"
    3⤵
    PID:1172
- C:\Windows\SysWOW64\net.exe
  net stop "mcshield"
  2⤵
  PID:1728
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "mcshield"
    3⤵
    PID:2680
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KRN.EXE
  2⤵
  PID:2008
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KUI.EXE
  2⤵
  - Kills process with taskkill
  PID:1108
- C:\Windows\SysWOW64\net.exe
  net stop "Norton Antivirus Auto Protect Service"
  2⤵
  PID:2204
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "Norton Antivirus Auto Protect Service"
    3⤵
    PID:1564
- C:\Windows\SysWOW64\net.exe
  net stop "mcshield"
  2⤵
  PID:2404
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "mcshield"
    3⤵
    PID:1880
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KRN.EXE
  2⤵
  PID:936
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KUI.EXE
  2⤵
  PID:292
- C:\Windows\SysWOW64\net.exe
  net stop "Norton Antivirus Auto Protect Service"
  2⤵
  PID:2948
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "Norton Antivirus Auto Protect Service"
    3⤵
    PID:336
- C:\Windows\SysWOW64\net.exe
  net stop "mcshield"
  2⤵
  PID:2024
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "mcshield"
    3⤵
    PID:1360
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KRN.EXE
  2⤵
  PID:2320
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KUI.EXE
  2⤵
  PID:844
- C:\Windows\SysWOW64\net.exe
  net stop "Norton Antivirus Auto Protect Service"
  2⤵
  PID:1616
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "Norton Antivirus Auto Protect Service"
    3⤵
    PID:1052
- C:\Windows\SysWOW64\net.exe
  net stop "mcshield"
  2⤵
  PID:888
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "mcshield"
    3⤵
    PID:1468
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KRN.EXE
  2⤵
  PID:1284
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KUI.EXE
  2⤵
  PID:2296
- C:\Windows\SysWOW64\net.exe
  net stop "Norton Antivirus Auto Protect Service"
  2⤵
  PID:2372
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "Norton Antivirus Auto Protect Service"
    3⤵
    PID:1968
- C:\Windows\SysWOW64\net.exe
  net stop "mcshield"
  2⤵
  PID:1512
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "mcshield"
    3⤵
    PID:1648
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KRN.EXE
  2⤵
  PID:1868
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KUI.EXE
  2⤵
  PID:2264
- C:\Windows\SysWOW64\net.exe
  net stop "Norton Antivirus Auto Protect Service"
  2⤵
  PID:2772
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "Norton Antivirus Auto Protect Service"
    3⤵
    PID:2236
- C:\Windows\SysWOW64\net.exe
  net stop "mcshield"
  2⤵
  PID:2496
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "mcshield"
    3⤵
    PID:2588
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KRN.EXE
  2⤵
  PID:2620
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KUI.EXE
  2⤵
  PID:2572
- C:\Windows\SysWOW64\net.exe
  net stop "Norton Antivirus Auto Protect Service"
  2⤵
  PID:2756
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "Norton Antivirus Auto Protect Service"
    3⤵
    PID:3068
- C:\Windows\SysWOW64\net.exe
  net stop "mcshield"
  2⤵
  PID:1984
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "mcshield"
    3⤵
    PID:1000
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KRN.EXE
  2⤵
  PID:2436
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KUI.EXE
  2⤵
  PID:560
- C:\Windows\SysWOW64\net.exe
  net stop "Norton Antivirus Auto Protect Service"
  2⤵
  PID:1664
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "Norton Antivirus Auto Protect Service"
    3⤵
    PID:2456
- C:\Windows\SysWOW64\net.exe
  net stop "mcshield"
  2⤵
  PID:2980
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "mcshield"
    3⤵
    PID:1852
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KRN.EXE
  2⤵
  PID:2992
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KUI.EXE
  2⤵
  PID:3028
- C:\Windows\SysWOW64\net.exe
  net stop "Norton Antivirus Auto Protect Service"
  2⤵
  PID:2624
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "Norton Antivirus Auto Protect Service"
    3⤵
    PID:2524
- C:\Windows\SysWOW64\net.exe
  net stop "mcshield"
  2⤵
  PID:2672
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "mcshield"
    3⤵
    PID:1224
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KRN.EXE
  2⤵
  - Kills process with taskkill
  PID:1040
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KUI.EXE
  2⤵
  PID:1204
- C:\Windows\SysWOW64\net.exe
  net stop "Norton Antivirus Auto Protect Service"
  2⤵
  PID:2488
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "Norton Antivirus Auto Protect Service"
    3⤵
    PID:2900
- C:\Windows\SysWOW64\net.exe
  net stop "mcshield"
  2⤵
  PID:1564
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "mcshield"
    3⤵
    PID:448
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KRN.EXE
  2⤵
  PID:1724
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KUI.EXE
  2⤵
  PID:1792
- C:\Windows\SysWOW64\net.exe
  net stop "Norton Antivirus Auto Protect Service"
  2⤵
  PID:1544
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "Norton Antivirus Auto Protect Service"
    3⤵
    PID:1704
- C:\Windows\SysWOW64\net.exe
  net stop "mcshield"
  2⤵
  PID:1880
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "mcshield"
    3⤵
    PID:588
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KRN.EXE
  2⤵
  PID:2636
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KUI.EXE
  2⤵
  PID:1248
- C:\Windows\SysWOW64\net.exe
  net stop "Norton Antivirus Auto Protect Service"
  2⤵
  PID:2304
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "Norton Antivirus Auto Protect Service"
    3⤵
    PID:1424
- C:\Windows\SysWOW64\net.exe
  net stop "mcshield"
  2⤵
  PID:1360
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "mcshield"
    3⤵
    PID:2276
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KRN.EXE
  2⤵
  PID:1960
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KUI.EXE
  2⤵
  PID:1616
- C:\Windows\SysWOW64\net.exe
  net stop "Norton Antivirus Auto Protect Service"
  2⤵
  PID:1540
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "Norton Antivirus Auto Protect Service"
    3⤵
    PID:1200
- C:\Windows\SysWOW64\net.exe
  net stop "mcshield"
  2⤵
  PID:2224
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "mcshield"
    3⤵
    PID:1580
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KRN.EXE
  2⤵
  PID:1680
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KUI.EXE
  2⤵
  - Kills process with taskkill
  PID:2208
- C:\Windows\SysWOW64\net.exe
  net stop "Norton Antivirus Auto Protect Service"
  2⤵
  PID:2956
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "Norton Antivirus Auto Protect Service"
    3⤵
    PID:2372
- C:\Windows\SysWOW64\net.exe
  net stop "mcshield"
  2⤵
  PID:1512
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "mcshield"
    3⤵
    PID:1576
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KRN.EXE
  2⤵
  PID:2608
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KUI.EXE
  2⤵
  PID:2236
- C:\Windows\SysWOW64\net.exe
  net stop "Norton Antivirus Auto Protect Service"
  2⤵
  PID:2760
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "Norton Antivirus Auto Protect Service"
    3⤵
    PID:2512
- C:\Windows\SysWOW64\net.exe
  net stop "mcshield"
  2⤵
  PID:1364
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "mcshield"
    3⤵
    PID:1756
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KRN.EXE
  2⤵
  PID:1992
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KUI.EXE
  2⤵
  PID:2560
- C:\Windows\SysWOW64\net.exe
  net stop "Norton Antivirus Auto Protect Service"
  2⤵
  PID:2280
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "Norton Antivirus Auto Protect Service"
    3⤵
    PID:2572
- C:\Windows\SysWOW64\net.exe
  net stop "mcshield"
  2⤵
  PID:1664
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "mcshield"
    3⤵
    PID:2856
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KRN.EXE
  2⤵
  PID:1760
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KUI.EXE
  2⤵
  PID:2520
- C:\Windows\SysWOW64\net.exe
  net stop "Norton Antivirus Auto Protect Service"
  2⤵
  PID:1000
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "Norton Antivirus Auto Protect Service"
    3⤵
    PID:2436
- C:\Windows\SysWOW64\net.exe
  net stop "mcshield"
  2⤵
  PID:2980
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "mcshield"
    3⤵
    PID:2788
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KRN.EXE
  2⤵
  PID:2652
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KUI.EXE
  2⤵
  PID:2524
- C:\Windows\SysWOW64\net.exe
  net stop "Norton Antivirus Auto Protect Service"
  2⤵
  PID:1936
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "Norton Antivirus Auto Protect Service"
    3⤵
    PID:2012
- C:\Windows\SysWOW64\net.exe
  net stop "mcshield"
  2⤵
  PID:1640
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "mcshield"
    3⤵
    PID:2548
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KRN.EXE
  2⤵
  PID:776
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KUI.EXE
  2⤵
  PID:1228
- C:\Windows\SysWOW64\net.exe
  net stop "Norton Antivirus Auto Protect Service"
  2⤵
  PID:2420
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "Norton Antivirus Auto Protect Service"
    3⤵
    PID:2168
- C:\Windows\SysWOW64\net.exe
  net stop "mcshield"
  2⤵
  PID:1956
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "mcshield"
    3⤵
    PID:2204
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KRN.EXE
  2⤵
  PID:2188
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KUI.EXE
  2⤵
  PID:992
- C:\Windows\SysWOW64\net.exe
  net stop "Norton Antivirus Auto Protect Service"
  2⤵
  PID:1544
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "Norton Antivirus Auto Protect Service"
    3⤵
    PID:1108
- C:\Windows\SysWOW64\net.exe
  net stop "mcshield"
  2⤵
  PID:2304
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "mcshield"
    3⤵
    PID:1132
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KRN.EXE
  2⤵
  PID:584
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KUI.EXE
  2⤵
  PID:1672
- C:\Windows\SysWOW64\net.exe
  net stop "Norton Antivirus Auto Protect Service"
  2⤵
  PID:2948
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "Norton Antivirus Auto Protect Service"
    3⤵
    PID:2784
- C:\Windows\SysWOW64\net.exe
  net stop "mcshield"
  2⤵
  PID:1164
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "mcshield"
    3⤵
    PID:1808
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KRN.EXE
  2⤵
  PID:2320
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KUI.EXE
  2⤵
  PID:844
- C:\Windows\SysWOW64\net.exe
  net stop "Norton Antivirus Auto Protect Service"
  2⤵
  PID:1360
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "Norton Antivirus Auto Protect Service"
    3⤵
    PID:956
- C:\Windows\SysWOW64\net.exe
  net stop "mcshield"
  2⤵
  PID:2224
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "mcshield"
    3⤵
    PID:1284
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KRN.EXE
  2⤵
  PID:1600
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KUI.EXE
  2⤵
  PID:2372
- C:\Windows\SysWOW64\net.exe
  net stop "Norton Antivirus Auto Protect Service"
  2⤵
  PID:2184
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "Norton Antivirus Auto Protect Service"
    3⤵
    PID:1976
- C:\Windows\SysWOW64\net.exe
  net stop "mcshield"
  2⤵
  PID:1768
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "mcshield"
    3⤵
    PID:1752
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KRN.EXE
  2⤵
  PID:1512
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KUI.EXE
  2⤵
  PID:2772
- C:\Windows\SysWOW64\net.exe
  net stop "Norton Antivirus Auto Protect Service"
  2⤵
  PID:2920
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "Norton Antivirus Auto Protect Service"
    3⤵
    PID:2532
- C:\Windows\SysWOW64\net.exe
  net stop "mcshield"
  2⤵
  PID:2480
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "mcshield"
    3⤵
    PID:2744
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KRN.EXE
  2⤵
  - Kills process with taskkill
  PID:2572
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KUI.EXE
  2⤵
  PID:3020
- C:\Windows\SysWOW64\net.exe
  net stop "Norton Antivirus Auto Protect Service"
  2⤵
  PID:2464
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "Norton Antivirus Auto Protect Service"
    3⤵
    PID:2588
- C:\Windows\SysWOW64\net.exe
  net stop "mcshield"
  2⤵
  PID:2468
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "mcshield"
    3⤵
    PID:2516
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KRN.EXE
  2⤵
  PID:2568
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KUI.EXE
  2⤵
  - Kills process with taskkill
  PID:2536
- C:\Windows\SysWOW64\net.exe
  net stop "Norton Antivirus Auto Protect Service"
  2⤵
  PID:760
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "Norton Antivirus Auto Protect Service"
    3⤵
    PID:2664
- C:\Windows\SysWOW64\net.exe
  net stop "mcshield"
  2⤵
  PID:2180
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "mcshield"
    3⤵
    PID:2872
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KRN.EXE
  2⤵
  PID:2992
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KUI.EXE
  2⤵
  PID:2500
- C:\Windows\SysWOW64\net.exe
  net stop "Norton Antivirus Auto Protect Service"
  2⤵
  PID:1936
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "Norton Antivirus Auto Protect Service"
    3⤵
    PID:2488
- C:\Windows\SysWOW64\net.exe
  net stop "mcshield"
  2⤵
  PID:1640
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "mcshield"
    3⤵
    PID:2256
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KRN.EXE
  2⤵
  PID:1740
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KUI.EXE
  2⤵
  PID:2168
- C:\Windows\SysWOW64\net.exe
  net stop "Norton Antivirus Auto Protect Service"
  2⤵
  PID:2628
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "Norton Antivirus Auto Protect Service"
    3⤵
    PID:2124
- C:\Windows\SysWOW64\net.exe
  net stop "mcshield"
  2⤵
  PID:1964
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "mcshield"
    3⤵
    PID:992
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KRN.EXE
  2⤵
  PID:2504
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KUI.EXE
  2⤵
  PID:412
- C:\Windows\SysWOW64\net.exe
  net stop "Norton Antivirus Auto Protect Service"
  2⤵
  PID:1544
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "Norton Antivirus Auto Protect Service"
    3⤵
    PID:1704
- C:\Windows\SysWOW64\net.exe
  net stop "mcshield"
  2⤵
  PID:1688
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "mcshield"
    3⤵
    PID:1940
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KRN.EXE
  2⤵
  PID:2136
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KUI.EXE
  2⤵
  PID:2328
- C:\Windows\SysWOW64\net.exe
  net stop "Norton Antivirus Auto Protect Service"
  2⤵
  PID:2948
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "Norton Antivirus Auto Protect Service"
    3⤵
    PID:1396
- C:\Windows\SysWOW64\net.exe
  net stop "mcshield"
  2⤵
  PID:1164
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "mcshield"
    3⤵
    PID:2360
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KRN.EXE
  2⤵
  PID:2128
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KUI.EXE
  2⤵
  PID:956
- C:\Windows\SysWOW64\net.exe
  net stop "Norton Antivirus Auto Protect Service"
  2⤵
  PID:1404
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "Norton Antivirus Auto Protect Service"
    3⤵
    PID:2248
- C:\Windows\SysWOW64\net.exe
  net stop "mcshield"
  2⤵
  PID:1572
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "mcshield"
    3⤵
    PID:1584
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KRN.EXE
  2⤵
  PID:1680
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KUI.EXE
  2⤵
  PID:1492
- C:\Windows\SysWOW64\net.exe
  net stop "Norton Antivirus Auto Protect Service"
  2⤵
  PID:1576
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "Norton Antivirus Auto Protect Service"
    3⤵
    PID:2208
- C:\Windows\SysWOW64\net.exe
  net stop "mcshield"
  2⤵
  PID:1768
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "mcshield"
    3⤵
    PID:2236
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KRN.EXE
  2⤵
  PID:2512
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KUI.EXE
  2⤵
  PID:2532
- C:\Windows\SysWOW64\net.exe
  net stop "Norton Antivirus Auto Protect Service"
  2⤵
  PID:2576
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "Norton Antivirus Auto Protect Service"
    3⤵
    PID:1948
- C:\Windows\SysWOW64\net.exe
  net stop "mcshield"
  2⤵
  PID:2892
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "mcshield"
    3⤵
    PID:1804
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KRN.EXE
  2⤵
  PID:2492
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KUI.EXE
  2⤵
  - Kills process with taskkill
  PID:2332
- C:\Windows\SysWOW64\net.exe
  net stop "Norton Antivirus Auto Protect Service"
  2⤵
  PID:2480
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "Norton Antivirus Auto Protect Service"
    3⤵
    PID:2572
- C:\Windows\SysWOW64\net.exe
  net stop "mcshield"
  2⤵
  PID:2468
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "mcshield"
    3⤵
    PID:2752
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KRN.EXE
  2⤵
  PID:2508
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KUI.EXE
  2⤵
  PID:2664
- C:\Windows\SysWOW64\net.exe
  net stop "Norton Antivirus Auto Protect Service"
  2⤵
  PID:2844
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "Norton Antivirus Auto Protect Service"
    3⤵
    PID:1984
- C:\Windows\SysWOW64\net.exe
  net stop "mcshield"
  2⤵
  PID:2180
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "mcshield"
    3⤵
    PID:2624
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KRN.EXE
  2⤵
  PID:348
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KUI.EXE
  2⤵
  - Kills process with taskkill
  PID:2488
- C:\Windows\SysWOW64\net.exe
  net stop "Norton Antivirus Auto Protect Service"
  2⤵
  PID:2708
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "Norton Antivirus Auto Protect Service"
    3⤵
    PID:2420
- C:\Windows\SysWOW64\net.exe
  net stop "mcshield"
  2⤵
  PID:2940
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "mcshield"
    3⤵
    PID:1740
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KRN.EXE
  2⤵
  PID:2680
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KUI.EXE
  2⤵
  PID:1204
- C:\Windows\SysWOW64\net.exe
  net stop "Norton Antivirus Auto Protect Service"
  2⤵
  PID:904
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "Norton Antivirus Auto Protect Service"
    3⤵
    PID:2288
- C:\Windows\SysWOW64\net.exe
  net stop "mcshield"
  2⤵
  PID:2192
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "mcshield"
    3⤵
    PID:2396
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KRN.EXE
  2⤵
  PID:2188
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KUI.EXE
  2⤵
  PID:1156
- C:\Windows\SysWOW64\net.exe
  net stop "Norton Antivirus Auto Protect Service"
  2⤵
  PID:1132
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "Norton Antivirus Auto Protect Service"
    3⤵
    PID:2324
- C:\Windows\SysWOW64\net.exe
  net stop "mcshield"
  2⤵
  PID:1952
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "mcshield"
    3⤵
    PID:2024
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KRN.EXE
  2⤵
  PID:1396
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KUI.EXE
  2⤵
  PID:1384
- C:\Windows\SysWOW64\net.exe
  net stop "Norton Antivirus Auto Protect Service"
  2⤵
  PID:532
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "Norton Antivirus Auto Protect Service"
    3⤵
    PID:2136
- C:\Windows\SysWOW64\net.exe
  net stop "mcshield"
  2⤵
  PID:2108
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "mcshield"
    3⤵
    PID:2976
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KRN.EXE
  2⤵
  PID:2268
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KUI.EXE
  2⤵
  PID:2632
- C:\Windows\SysWOW64\net.exe
  net stop "Norton Antivirus Auto Protect Service"
  2⤵
  PID:604
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "Norton Antivirus Auto Protect Service"
    3⤵
    PID:2248
- C:\Windows\SysWOW64\net.exe
  net stop "mcshield"
  2⤵
  PID:1976
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "mcshield"
    3⤵
    PID:2604
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KRN.EXE
  2⤵
  PID:1732
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KUI.EXE
  2⤵
  PID:472
- C:\Windows\SysWOW64\net.exe
  net stop "Norton Antivirus Auto Protect Service"
  2⤵
  PID:2348
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "Norton Antivirus Auto Protect Service"
    3⤵
    PID:2552
- C:\Windows\SysWOW64\net.exe
  net stop "mcshield"
  2⤵
  PID:2452
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "mcshield"
    3⤵
    PID:1596
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KRN.EXE
  2⤵
  PID:2560
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KUI.EXE
  2⤵
  PID:2272
- C:\Windows\SysWOW64\net.exe
  net stop "Norton Antivirus Auto Protect Service"
  2⤵
  PID:2196
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "Norton Antivirus Auto Protect Service"
    3⤵
    PID:2480
- C:\Windows\SysWOW64\net.exe
  net stop "mcshield"
  2⤵
  PID:2520
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "mcshield"
    3⤵
    PID:2536
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KRN.EXE
  2⤵
  PID:2516
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KUI.EXE
  2⤵
  PID:1744
- C:\Windows\SysWOW64\net.exe
  net stop "Norton Antivirus Auto Protect Service"
  2⤵
  PID:2904
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "Norton Antivirus Auto Protect Service"
    3⤵
    PID:1660
- C:\Windows\SysWOW64\net.exe
  net stop "mcshield"
  2⤵
  PID:3056
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "mcshield"
    3⤵
    PID:1504
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KRN.EXE
  2⤵
  - Kills process with taskkill
  PID:2676
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KUI.EXE
  2⤵
  PID:1760
- C:\Windows\SysWOW64\net.exe
  net stop "Norton Antivirus Auto Protect Service"
  2⤵
  PID:2880
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "Norton Antivirus Auto Protect Service"
    3⤵
    PID:2708
- C:\Windows\SysWOW64\net.exe
  net stop "mcshield"
  2⤵
  PID:268
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "mcshield"
    3⤵
    PID:2168
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KRN.EXE
  2⤵
  PID:1988
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KUI.EXE
  2⤵
  - Kills process with taskkill
  PID:2012
- C:\Windows\SysWOW64\net.exe
  net stop "Norton Antivirus Auto Protect Service"
  2⤵
  PID:2300
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "Norton Antivirus Auto Protect Service"
    3⤵
    PID:2388
- C:\Windows\SysWOW64\net.exe
  net stop "mcshield"
  2⤵
  PID:1088
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "mcshield"
    3⤵
    PID:2396
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KRN.EXE
  2⤵
  PID:1424
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KUI.EXE
  2⤵
  PID:1204
- C:\Windows\SysWOW64\net.exe
  net stop "Norton Antivirus Auto Protect Service"
  2⤵
  PID:2400
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "Norton Antivirus Auto Protect Service"
    3⤵
    PID:1892
- C:\Windows\SysWOW64\net.exe
  net stop "mcshield"
  2⤵
  PID:3036
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "mcshield"
    3⤵
    PID:2136
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KRN.EXE
  2⤵
  PID:1544
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KUI.EXE
  2⤵
  - Kills process with taskkill
  PID:1688
- C:\Windows\SysWOW64\net.exe
  net stop "Norton Antivirus Auto Protect Service"
  2⤵
  PID:1136
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "Norton Antivirus Auto Protect Service"
    3⤵
    PID:2404
- C:\Windows\SysWOW64\net.exe
  net stop "mcshield"
  2⤵
  PID:1580
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "mcshield"
    3⤵
    PID:2296
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KRN.EXE
  2⤵
  PID:2948
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KUI.EXE
  2⤵
  PID:888
- C:\Windows\SysWOW64\net.exe
  net stop "Norton Antivirus Auto Protect Service"
  2⤵
  PID:1672
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "Norton Antivirus Auto Protect Service"
    3⤵
    PID:1284
- C:\Windows\SysWOW64\net.exe
  net stop "mcshield"
  2⤵
  PID:572
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "mcshield"
    3⤵
    PID:1716
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KRN.EXE
  2⤵
  PID:2268
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KUI.EXE
  2⤵
  PID:1572
- C:\Windows\SysWOW64\net.exe
  net stop "Norton Antivirus Auto Protect Service"
  2⤵
  PID:1968
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "Norton Antivirus Auto Protect Service"
    3⤵
    PID:2552
- C:\Windows\SysWOW64\net.exe
  net stop "mcshield"
  2⤵
  PID:2772
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "mcshield"
    3⤵
    PID:2196
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KRN.EXE
  2⤵
  PID:1992
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KUI.EXE
  2⤵
  PID:1512
- C:\Windows\SysWOW64\net.exe
  net stop "Norton Antivirus Auto Protect Service"
  2⤵
  PID:2756
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "Norton Antivirus Auto Protect Service"
    3⤵
    PID:1664
- C:\Windows\SysWOW64\net.exe
  net stop "mcshield"
  2⤵
  PID:2532
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "mcshield"
    3⤵
    PID:1852
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KRN.EXE
  2⤵
  PID:3020
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KUI.EXE
  2⤵
  PID:2456
- C:\Windows\SysWOW64\net.exe
  net stop "Norton Antivirus Auto Protect Service"
  2⤵
  PID:1032
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "Norton Antivirus Auto Protect Service"
    3⤵
    PID:1660
- C:\Windows\SysWOW64\net.exe
  net stop "mcshield"
  2⤵
  PID:2516
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "mcshield"
    3⤵
    PID:2420
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KRN.EXE
  2⤵
  PID:1000
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KUI.EXE
  2⤵
  PID:2468
- C:\Windows\SysWOW64\net.exe
  net stop "Norton Antivirus Auto Protect Service"
  2⤵
  PID:960
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "Norton Antivirus Auto Protect Service"
    3⤵
    PID:840
- C:\Windows\SysWOW64\net.exe
  net stop "mcshield"
  2⤵
  PID:3016
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "mcshield"
    3⤵
    PID:2284
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KRN.EXE
  2⤵
  - Kills process with taskkill
  PID:3040
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KUI.EXE
  2⤵
  PID:2816
- C:\Windows\SysWOW64\net.exe
  net stop "Norton Antivirus Auto Protect Service"
  2⤵
  PID:1224
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "Norton Antivirus Auto Protect Service"
    3⤵
    PID:2300
- C:\Windows\SysWOW64\net.exe
  net stop "mcshield"
  2⤵
  PID:1328
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "mcshield"
    3⤵
    PID:1216
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KRN.EXE
  2⤵
  PID:2980
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KUI.EXE
  2⤵
  PID:1092
- C:\Windows\SysWOW64\net.exe
  net stop "Norton Antivirus Auto Protect Service"
  2⤵
  PID:2192
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "Norton Antivirus Auto Protect Service"
    3⤵
    PID:2088
- C:\Windows\SysWOW64\net.exe
  net stop "mcshield"
  2⤵
  PID:1108
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "mcshield"
    3⤵
    PID:2024
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KRN.EXE
  2⤵
  PID:1248
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KUI.EXE
  2⤵
  PID:2504
- C:\Windows\SysWOW64\net.exe
  net stop "Norton Antivirus Auto Protect Service"
  2⤵
  PID:412
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "Norton Antivirus Auto Protect Service"
    3⤵
    PID:292
- C:\Windows\SysWOW64\net.exe
  net stop "mcshield"
  2⤵
  PID:1536
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "mcshield"
    3⤵
    PID:2128
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KRN.EXE
  2⤵
  PID:2104
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KUI.EXE
  2⤵
  PID:700
- C:\Windows\SysWOW64\net.exe
  net stop "Norton Antivirus Auto Protect Service"
  2⤵
  PID:1544
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "Norton Antivirus Auto Protect Service"
    3⤵
    PID:2120
- C:\Windows\SysWOW64\net.exe
  net stop "mcshield"
  2⤵
  PID:2108
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "mcshield"
    3⤵
    PID:1584
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KRN.EXE
  2⤵
  PID:888
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KUI.EXE
  2⤵
  PID:900
- C:\Windows\SysWOW64\net.exe
  net stop "Norton Antivirus Auto Protect Service"
  2⤵
  PID:2040
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "Norton Antivirus Auto Protect Service"
    3⤵
    PID:2604
- C:\Windows\SysWOW64\net.exe
  net stop "mcshield"
  2⤵
  PID:1820
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "mcshield"
    3⤵
    PID:3068
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KRN.EXE
  2⤵
  PID:2268
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KUI.EXE
  2⤵
  PID:1976
- C:\Windows\SysWOW64\net.exe
  net stop "Norton Antivirus Auto Protect Service"
  2⤵
  PID:2152
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "Norton Antivirus Auto Protect Service"
    3⤵
    PID:1664
- C:\Windows\SysWOW64\net.exe
  net stop "mcshield"
  2⤵
  PID:2920
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "mcshield"
    3⤵
    PID:2812
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KRN.EXE
  2⤵
  PID:1804
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KUI.EXE
  2⤵
  PID:2280
- C:\Windows\SysWOW64\net.exe
  net stop "Norton Antivirus Auto Protect Service"
  2⤵
  PID:2876
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "Norton Antivirus Auto Protect Service"
    3⤵
    PID:2752
- C:\Windows\SysWOW64\net.exe
  net stop "mcshield"
  2⤵
  PID:2720
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "mcshield"
    3⤵
    PID:2628
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KRN.EXE
  2⤵
  PID:560
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KUI.EXE
  2⤵
  - Kills process with taskkill
  PID:2788
- C:\Windows\SysWOW64\net.exe
  net stop "Norton Antivirus Auto Protect Service"
  2⤵
  PID:2132
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "Norton Antivirus Auto Protect Service"
    3⤵
    PID:960
- C:\Windows\SysWOW64\net.exe
  net stop "mcshield"
  2⤵
  PID:2652
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "mcshield"
    3⤵
    PID:1792
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KRN.EXE
  2⤵
  PID:1760
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KUI.EXE
  2⤵
  PID:2124
- C:\Windows\SysWOW64\net.exe
  net stop "Norton Antivirus Auto Protect Service"
  2⤵
  PID:1984
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "Norton Antivirus Auto Protect Service"
    3⤵
    PID:2444
- C:\Windows\SysWOW64\net.exe
  net stop "mcshield"
  2⤵
  PID:992
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "mcshield"
    3⤵
    PID:2088
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KRN.EXE
  2⤵
  PID:2816
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KUI.EXE
  2⤵
  - Kills process with taskkill
  PID:2012
- C:\Windows\SysWOW64\net.exe
  net stop "Norton Antivirus Auto Protect Service"
  2⤵
  PID:1772
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "Norton Antivirus Auto Protect Service"
    3⤵
    PID:2192
- C:\Windows\SysWOW64\net.exe
  net stop "mcshield"
  2⤵
  PID:1892
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "mcshield"
    3⤵
    PID:292
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KRN.EXE
  2⤵
  PID:1204
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KUI.EXE
  2⤵
  - Kills process with taskkill
  PID:2324
- C:\Windows\SysWOW64\net.exe
  net stop "Norton Antivirus Auto Protect Service"
  2⤵
  PID:1724
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "Norton Antivirus Auto Protect Service"
    3⤵
    PID:412
- C:\Windows\SysWOW64\net.exe
  net stop "mcshield"
  2⤵
  PID:2252
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "mcshield"
    3⤵
    PID:2120
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KRN.EXE
  2⤵
  - Kills process with taskkill
  PID:2932
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KUI.EXE
  2⤵
  PID:2404
- C:\Windows\SysWOW64\net.exe
  net stop "Norton Antivirus Auto Protect Service"
  2⤵
  PID:336
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "Norton Antivirus Auto Protect Service"
    3⤵
    PID:1544
- C:\Windows\SysWOW64\net.exe
  net stop "mcshield"
  2⤵
  PID:2296
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "mcshield"
    3⤵
    PID:1828
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KRN.EXE
  2⤵
  PID:1604
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KUI.EXE
  2⤵
  PID:816
- C:\Windows\SysWOW64\net.exe
  net stop "Norton Antivirus Auto Protect Service"
  2⤵
  PID:2316
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "Norton Antivirus Auto Protect Service"
    3⤵
    PID:2596
- C:\Windows\SysWOW64\net.exe
  net stop "mcshield"
  2⤵
  PID:572
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "mcshield"
    3⤵
    PID:2348
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KRN.EXE
  2⤵
  - Kills process with taskkill
  PID:2748
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KUI.EXE
  2⤵
  PID:2080
- C:\Windows\SysWOW64\net.exe
  net stop "Norton Antivirus Auto Protect Service"
  2⤵
  PID:2732
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "Norton Antivirus Auto Protect Service"
    3⤵
    PID:2100
- C:\Windows\SysWOW64\net.exe
  net stop "mcshield"
  2⤵
  PID:2576
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "mcshield"
    3⤵
    PID:2460
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KRN.EXE
  2⤵
  PID:2608
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KUI.EXE
  2⤵
  PID:2712
- C:\Windows\SysWOW64\net.exe
  net stop "Norton Antivirus Auto Protect Service"
  2⤵
  PID:2740
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "Norton Antivirus Auto Protect Service"
    3⤵
    PID:2536
- C:\Windows\SysWOW64\net.exe
  net stop "mcshield"
  2⤵
  PID:1660
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "mcshield"
    3⤵
    PID:2516
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KRN.EXE
  2⤵
  PID:2084
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KUI.EXE
  2⤵
  PID:1804
- C:\Windows\SysWOW64\net.exe
  net stop "Norton Antivirus Auto Protect Service"
  2⤵
  PID:2456
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "Norton Antivirus Auto Protect Service"
    3⤵
    PID:3020
- C:\Windows\SysWOW64\net.exe
  net stop "mcshield"
  2⤵
  PID:2548
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "mcshield"
    3⤵
    PID:1984
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KRN.EXE
  2⤵
  - Kills process with taskkill
  PID:1172
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KUI.EXE
  2⤵
  PID:2508
- C:\Windows\SysWOW64\net.exe
  net stop "Norton Antivirus Auto Protect Service"
  2⤵
  PID:2848
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "Norton Antivirus Auto Protect Service"
    3⤵
    PID:3012
- C:\Windows\SysWOW64\net.exe
  net stop "mcshield"
  2⤵
  PID:268
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "mcshield"
    3⤵
    PID:1640
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KRN.EXE
  2⤵
  PID:2488
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KUI.EXE
  2⤵
  PID:1100
- C:\Windows\SysWOW64\net.exe
  net stop "Norton Antivirus Auto Protect Service"
  2⤵
  PID:988
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "Norton Antivirus Auto Protect Service"
    3⤵
    PID:608
- C:\Windows\SysWOW64\net.exe
  net stop "mcshield"
  2⤵
  PID:2400
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "mcshield"
    3⤵
    PID:2096
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KRN.EXE
  2⤵
  PID:2396
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KUI.EXE
  2⤵
  PID:2036
- C:\Windows\SysWOW64\net.exe
  net stop "Norton Antivirus Auto Protect Service"
  2⤵
  PID:3060
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "Norton Antivirus Auto Protect Service"
    3⤵
    PID:1392
- C:\Windows\SysWOW64\net.exe
  net stop "mcshield"
  2⤵
  PID:2328
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "mcshield"
    3⤵
    PID:1284
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KRN.EXE
  2⤵
  PID:1108
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KUI.EXE
  2⤵
  PID:1424
- C:\Windows\SysWOW64\net.exe
  net stop "Norton Antivirus Auto Protect Service"
  2⤵
  PID:1812
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "Norton Antivirus Auto Protect Service"
    3⤵
    PID:2360
- C:\Windows\SysWOW64\net.exe
  net stop "mcshield"
  2⤵
  PID:1672
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "mcshield"
    3⤵
    PID:2108
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KRN.EXE
  2⤵
  PID:2784
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KUI.EXE
  2⤵
  PID:1704
- C:\Windows\SysWOW64\net.exe
  net stop "Norton Antivirus Auto Protect Service"
  2⤵
  PID:1092
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "Norton Antivirus Auto Protect Service"
    3⤵
    PID:2064
- C:\Windows\SysWOW64\net.exe
  net stop "mcshield"
  2⤵
  PID:1948
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "mcshield"
    3⤵
    PID:888
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KRN.EXE
  2⤵
  - Kills process with taskkill
  PID:2724
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KUI.EXE
  2⤵
  PID:2320
- C:\Windows\SysWOW64\net.exe
  net stop "Norton Antivirus Auto Protect Service"
  2⤵
  PID:2224
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "Norton Antivirus Auto Protect Service"
    3⤵
    PID:2512
- C:\Windows\SysWOW64\net.exe
  net stop "mcshield"
  2⤵
  PID:584
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "mcshield"
    3⤵
    PID:2460
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KRN.EXE
  2⤵
  PID:2080
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KUI.EXE
  2⤵
  PID:1664
- C:\Windows\SysWOW64\net.exe
  net stop "Norton Antivirus Auto Protect Service"
  2⤵
  PID:2492
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "Norton Antivirus Auto Protect Service"
    3⤵
    PID:1756
- C:\Windows\SysWOW64\net.exe
  net stop "mcshield"
  2⤵
  PID:2272
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "mcshield"
    3⤵
    PID:2664
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KRN.EXE
  2⤵
  PID:1976
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KUI.EXE
  2⤵
  PID:2920
- C:\Windows\SysWOW64\net.exe
  net stop "Norton Antivirus Auto Protect Service"
  2⤵
  PID:1408
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "Norton Antivirus Auto Protect Service"
    3⤵
    PID:2720
- C:\Windows\SysWOW64\net.exe
  net stop "mcshield"
  2⤵
  PID:2084
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "mcshield"
    3⤵
    PID:2848
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KRN.EXE
  2⤵
  PID:1344
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KUI.EXE
  2⤵
  PID:960
- C:\Windows\SysWOW64\net.exe
  net stop "Norton Antivirus Auto Protect Service"
  2⤵
  PID:2872
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "Norton Antivirus Auto Protect Service"
    3⤵
    PID:3012
- C:\Windows\SysWOW64\net.exe
  net stop "mcshield"
  2⤵
  PID:1224
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "mcshield"
    3⤵
    PID:608
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KRN.EXE
  2⤵
  PID:2388
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KUI.EXE
  2⤵
  PID:3016
- C:\Windows\SysWOW64\net.exe
  net stop "Norton Antivirus Auto Protect Service"
  2⤵
  PID:1276
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "Norton Antivirus Auto Protect Service"
    3⤵
    PID:1760
- C:\Windows\SysWOW64\net.exe
  net stop "mcshield"
  2⤵
  PID:2088
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "mcshield"
    3⤵
    PID:2980
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KRN.EXE
  2⤵
  PID:1328
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KUI.EXE
  2⤵
  PID:2192
- C:\Windows\SysWOW64\net.exe
  net stop "Norton Antivirus Auto Protect Service"
  2⤵
  PID:1644
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "Norton Antivirus Auto Protect Service"
    3⤵
    PID:1028
- C:\Windows\SysWOW64\net.exe
  net stop "mcshield"
  2⤵
  PID:1468
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "mcshield"
    3⤵
    PID:2976
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KRN.EXE
  2⤵
  PID:2816
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KUI.EXE
  2⤵
  PID:2544
- C:\Windows\SysWOW64\net.exe
  net stop "Norton Antivirus Auto Protect Service"
  2⤵
  PID:3032
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "Norton Antivirus Auto Protect Service"
    3⤵
    PID:1616
- C:\Windows\SysWOW64\net.exe
  net stop "mcshield"
  2⤵
  PID:2256
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "mcshield"
    3⤵
    PID:1156
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KRN.EXE
  2⤵
  PID:1248
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KUI.EXE
  2⤵
  - Kills process with taskkill
  PID:1544
- C:\Windows\SysWOW64\net.exe
  net stop "Norton Antivirus Auto Protect Service"
  2⤵
  PID:2412
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "Norton Antivirus Auto Protect Service"
    3⤵
    PID:1092
- C:\Windows\SysWOW64\net.exe
  net stop "mcshield"
  2⤵
  PID:1364
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "mcshield"
    3⤵
    PID:3048
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KRN.EXE
  2⤵
  PID:2236
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KUI.EXE
  2⤵
  PID:564
- C:\Windows\SysWOW64\net.exe
  net stop "Norton Antivirus Auto Protect Service"
  2⤵
  PID:2348
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "Norton Antivirus Auto Protect Service"
    3⤵
    PID:1768
- C:\Windows\SysWOW64\net.exe
  net stop "mcshield"
  2⤵
  PID:1836
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "mcshield"
    3⤵
    PID:2280
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KRN.EXE
  2⤵
  PID:2268
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KUI.EXE
  2⤵
  PID:2600
- C:\Windows\SysWOW64\net.exe
  net stop "Norton Antivirus Auto Protect Service"
  2⤵
  PID:1732
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "Norton Antivirus Auto Protect Service"
    3⤵
    PID:2588
- C:\Windows\SysWOW64\net.exe
  net stop "mcshield"
  2⤵
  PID:2752
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "mcshield"
    3⤵
    PID:2520
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KRN.EXE
  2⤵
  - Kills process with taskkill
  PID:2564
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KUI.EXE
  2⤵
  PID:2892
- C:\Windows\SysWOW64\net.exe
  net stop "Norton Antivirus Auto Protect Service"
  2⤵
  PID:472
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "Norton Antivirus Auto Protect Service"
    3⤵
    PID:2924
- C:\Windows\SysWOW64\net.exe
  net stop "mcshield"
  2⤵
  PID:2608
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "mcshield"
    3⤵
    PID:2444
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KRN.EXE
  2⤵
  PID:2420
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KUI.EXE
  2⤵
  PID:2904
- C:\Windows\SysWOW64\net.exe
  net stop "Norton Antivirus Auto Protect Service"
  2⤵
  PID:2996
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "Norton Antivirus Auto Protect Service"
    3⤵
    PID:1984
- C:\Windows\SysWOW64\net.exe
  net stop "mcshield"
  2⤵
  PID:2416
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "mcshield"
    3⤵
    PID:1216
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KRN.EXE
  2⤵
  PID:1740
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KUI.EXE
  2⤵
  PID:2168
- C:\Windows\SysWOW64\net.exe
  net stop "Norton Antivirus Auto Protect Service"
  2⤵
  PID:1804
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "Norton Antivirus Auto Protect Service"
    3⤵
    PID:2468
- C:\Windows\SysWOW64\net.exe
  net stop "mcshield"
  2⤵
  PID:2304
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "mcshield"
    3⤵
    PID:1644
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KRN.EXE
  2⤵
  PID:2676
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KUI.EXE
  2⤵
  PID:1504
- C:\Windows\SysWOW64\net.exe
  net stop "Norton Antivirus Auto Protect Service"
  2⤵
  PID:1516
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "Norton Antivirus Auto Protect Service"
    3⤵
    PID:1028
- C:\Windows\SysWOW64\net.exe
  net stop "mcshield"
  2⤵
  PID:1200
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "mcshield"
    3⤵
    PID:832
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KRN.EXE
  2⤵
  PID:1136
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KUI.EXE
  2⤵
  PID:776
- C:\Windows\SysWOW64\net.exe
  net stop "Norton Antivirus Auto Protect Service"
  2⤵
  PID:1336
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "Norton Antivirus Auto Protect Service"
    3⤵
    PID:2328
- C:\Windows\SysWOW64\net.exe
  net stop "mcshield"
  2⤵
  PID:1812
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "mcshield"
    3⤵
    PID:2248
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KRN.EXE
  2⤵
  PID:336
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KUI.EXE
  2⤵
  PID:2816
- C:\Windows\SysWOW64\net.exe
  net stop "Norton Antivirus Auto Protect Service"
  2⤵
  PID:1524
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "Norton Antivirus Auto Protect Service"
    3⤵
    PID:2636
- C:\Windows\SysWOW64\net.exe
  net stop "mcshield"
  2⤵
  PID:2296
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "mcshield"
    3⤵
    PID:2348
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KRN.EXE
  2⤵
  PID:2028
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KUI.EXE
  2⤵
  PID:604
- C:\Windows\SysWOW64\net.exe
  net stop "Norton Antivirus Auto Protect Service"
  2⤵
  PID:1584
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "Norton Antivirus Auto Protect Service"
    3⤵
    PID:1948
- C:\Windows\SysWOW64\net.exe
  net stop "mcshield"
  2⤵
  PID:1828
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "mcshield"
    3⤵
    PID:2320
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KRN.EXE
  2⤵
  PID:2480
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KUI.EXE
  2⤵
  PID:956
- C:\Windows\SysWOW64\net.exe
  net stop "Norton Antivirus Auto Protect Service"
  2⤵
  PID:2728
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "Norton Antivirus Auto Protect Service"
    3⤵
    PID:1676
- C:\Windows\SysWOW64\net.exe
  net stop "mcshield"
  2⤵
  PID:2876
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "mcshield"
    3⤵
    PID:1936
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KRN.EXE
  2⤵
  PID:1664
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KUI.EXE
  2⤵
  - Kills process with taskkill
  PID:2268
- C:\Windows\SysWOW64\net.exe
  net stop "Norton Antivirus Auto Protect Service"
  2⤵
  PID:2724
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "Norton Antivirus Auto Protect Service"
    3⤵
    PID:1976
- C:\Windows\SysWOW64\net.exe
  net stop "mcshield"
  2⤵
  PID:2708
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "mcshield"
    3⤵
    PID:448
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KRN.EXE
  2⤵
  PID:2672
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KUI.EXE
  2⤵
  PID:2628
- C:\Windows\SysWOW64\net.exe
  net stop "Norton Antivirus Auto Protect Service"
  2⤵
  PID:2572
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "Norton Antivirus Auto Protect Service"
    3⤵
    PID:2996
- C:\Windows\SysWOW64\net.exe
  net stop "mcshield"
  2⤵
  PID:840
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "mcshield"
    3⤵
    PID:312
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KRN.EXE
  2⤵
  PID:1004
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KUI.EXE
  2⤵
  PID:3024
- C:\Windows\SysWOW64\net.exe
  net stop "Norton Antivirus Auto Protect Service"
  2⤵
  PID:2300
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "Norton Antivirus Auto Protect Service"
    3⤵
    PID:2112
- C:\Windows\SysWOW64\net.exe
  net stop "mcshield"
  2⤵
  PID:2464
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "mcshield"
    3⤵
    PID:2880
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KRN.EXE
  2⤵
  PID:1000
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KUI.EXE
  2⤵
  PID:1224
- C:\Windows\SysWOW64\net.exe
  net stop "Norton Antivirus Auto Protect Service"
  2⤵
  PID:2896
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "Norton Antivirus Auto Protect Service"
    3⤵
    PID:1132
- C:\Windows\SysWOW64\net.exe
  net stop "mcshield"
  2⤵
  PID:1040
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "mcshield"
    3⤵
    PID:2396
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KRN.EXE
  2⤵
  - Kills process with taskkill
  PID:2024
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KUI.EXE
  2⤵
  PID:1728
- C:\Windows\SysWOW64\net.exe
  net stop "Norton Antivirus Auto Protect Service"
  2⤵
  PID:2676
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "Norton Antivirus Auto Protect Service"
    3⤵
    PID:1200
- C:\Windows\SysWOW64\net.exe
  net stop "mcshield"
  2⤵
  PID:2404
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "mcshield"
    3⤵
    PID:2108
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KRN.EXE
  2⤵
  PID:1088
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KUI.EXE
  2⤵
  PID:1952
- C:\Windows\SysWOW64\net.exe
  net stop "Norton Antivirus Auto Protect Service"
  2⤵
  PID:776
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "Norton Antivirus Auto Protect Service"
    3⤵
    PID:2556
- C:\Windows\SysWOW64\net.exe
  net stop "mcshield"
  2⤵
  PID:1360
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "mcshield"
    3⤵
    PID:1424
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KRN.EXE
  2⤵
  - Kills process with taskkill
  PID:2316
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KUI.EXE
  2⤵
  PID:1680
- C:\Windows\SysWOW64\net.exe
  net stop "Norton Antivirus Auto Protect Service"
  2⤵
  PID:1604
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "Norton Antivirus Auto Protect Service"
    3⤵
    PID:1364
- C:\Windows\SysWOW64\net.exe
  net stop "mcshield"
  2⤵
  PID:2296
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "mcshield"
    3⤵
    PID:2956
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KRN.EXE
  2⤵
  PID:1248
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KUI.EXE
  2⤵
  PID:844
- C:\Windows\SysWOW64\net.exe
  net stop "Norton Antivirus Auto Protect Service"
  2⤵
  PID:1540
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "Norton Antivirus Auto Protect Service"
    3⤵
    PID:816
- C:\Windows\SysWOW64\net.exe
  net stop "mcshield"
  2⤵
  PID:2236
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "mcshield"
    3⤵
    PID:2520
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KRN.EXE
  2⤵
  PID:1836
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KUI.EXE
  2⤵
  PID:1732
- C:\Windows\SysWOW64\net.exe
  net stop "Norton Antivirus Auto Protect Service"
  2⤵
  PID:700
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "Norton Antivirus Auto Protect Service"
    3⤵
    PID:956
- C:\Windows\SysWOW64\net.exe
  net stop "mcshield"
  2⤵
  PID:3008
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "mcshield"
    3⤵
    PID:2796
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KRN.EXE
  2⤵
  PID:2924
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KUI.EXE
  2⤵
  PID:2292
- C:\Windows\SysWOW64\net.exe
  net stop "Norton Antivirus Auto Protect Service"
  2⤵
  PID:2204
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "Norton Antivirus Auto Protect Service"
    3⤵
    PID:2848
- C:\Windows\SysWOW64\net.exe
  net stop "mcshield"
  2⤵
  PID:2708
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "mcshield"
    3⤵
    PID:2508
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KRN.EXE
  2⤵
  PID:2284
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KUI.EXE
  2⤵
  PID:1512
- C:\Windows\SysWOW64\net.exe
  net stop "Norton Antivirus Auto Protect Service"
  2⤵
  PID:2180
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "Norton Antivirus Auto Protect Service"
    3⤵
    PID:840
- C:\Windows\SysWOW64\net.exe
  net stop "mcshield"
  2⤵
  PID:1760
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "mcshield"
    3⤵
    PID:2304
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KRN.EXE
  2⤵
  PID:1216
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KUI.EXE
  2⤵
  PID:3024
- C:\Windows\SysWOW64\net.exe
  net stop "Norton Antivirus Auto Protect Service"
  2⤵
  PID:904
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "Norton Antivirus Auto Protect Service"
    3⤵
    PID:1392
- C:\Windows\SysWOW64\net.exe
  net stop "mcshield"
  2⤵
  PID:2088
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "mcshield"
    3⤵
    PID:1892
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KRN.EXE
  2⤵
  PID:1656
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KUI.EXE
  2⤵
  - Kills process with taskkill
  PID:856
- C:\Windows\SysWOW64\net.exe
  net stop "Norton Antivirus Auto Protect Service"
  2⤵
  PID:1380
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "Norton Antivirus Auto Protect Service"
    3⤵
    PID:2396
- C:\Windows\SysWOW64\net.exe
  net stop "mcshield"
  2⤵
  PID:292
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "mcshield"
    3⤵
    PID:1324
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KRN.EXE
  2⤵
  PID:832
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KUI.EXE
  2⤵
  PID:2208
- C:\Windows\SysWOW64\net.exe
  net stop "Norton Antivirus Auto Protect Service"
  2⤵
  PID:2328
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "Norton Antivirus Auto Protect Service"
    3⤵
    PID:2404
- C:\Windows\SysWOW64\net.exe
  net stop "mcshield"
  2⤵
  PID:2036
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "mcshield"
    3⤵
    PID:1360
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KRN.EXE
  2⤵
  PID:1292
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KUI.EXE
  2⤵
  PID:2552
- C:\Windows\SysWOW64\net.exe
  net stop "Norton Antivirus Auto Protect Service"
  2⤵
  PID:1524
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "Norton Antivirus Auto Protect Service"
    3⤵
    PID:1424
- C:\Windows\SysWOW64\net.exe
  net stop "mcshield"
  2⤵
  PID:1948
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "mcshield"
    3⤵
    PID:888
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KRN.EXE
  2⤵
  PID:2604
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KUI.EXE
  2⤵
  PID:2544
- C:\Windows\SysWOW64\net.exe
  net stop "Norton Antivirus Auto Protect Service"
  2⤵
  PID:2620
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "Norton Antivirus Auto Protect Service"
    3⤵
    PID:816
- C:\Windows\SysWOW64\net.exe
  net stop "mcshield"
  2⤵
  PID:1828
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "mcshield"
    3⤵
    PID:2584
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KRN.EXE
  2⤵
  PID:1716
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KUI.EXE
  2⤵
  PID:2492
- C:\Windows\SysWOW64\net.exe
  net stop "Norton Antivirus Auto Protect Service"
  2⤵
  PID:2160
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "Norton Antivirus Auto Protect Service"
    3⤵
    PID:2828
- C:\Windows\SysWOW64\net.exe
  net stop "mcshield"
  2⤵
  PID:2856
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "mcshield"
    3⤵
    PID:472
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KRN.EXE
  2⤵
  PID:1756
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KUI.EXE
  2⤵
  PID:2236
- C:\Windows\SysWOW64\net.exe
  net stop "Norton Antivirus Auto Protect Service"
  2⤵
  PID:2536
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "Norton Antivirus Auto Protect Service"
    3⤵
    PID:2280
- C:\Windows\SysWOW64\net.exe
  net stop "mcshield"
  2⤵
  PID:2664
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "mcshield"
    3⤵
    PID:2720
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KRN.EXE
  2⤵
  PID:1664
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KUI.EXE
  2⤵
  PID:2204
- C:\Windows\SysWOW64\net.exe
  net stop "Norton Antivirus Auto Protect Service"
  2⤵
  PID:2548
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "Norton Antivirus Auto Protect Service"
    3⤵
    PID:2884
- C:\Windows\SysWOW64\net.exe
  net stop "mcshield"
  2⤵
  PID:840
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "mcshield"
    3⤵
    PID:2084
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KRN.EXE
  2⤵
  - Kills process with taskkill
  PID:2764
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KUI.EXE
  2⤵
  PID:2124
- C:\Windows\SysWOW64\net.exe
  net stop "Norton Antivirus Auto Protect Service"
  2⤵
  PID:3004
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "Norton Antivirus Auto Protect Service"
    3⤵
    PID:724
- C:\Windows\SysWOW64\net.exe
  net stop "mcshield"
  2⤵
  PID:2300
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "mcshield"
    3⤵
    PID:2880
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KRN.EXE
  2⤵
  PID:2900
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KUI.EXE
  2⤵
  PID:1028
- C:\Windows\SysWOW64\net.exe
  net stop "Norton Antivirus Auto Protect Service"
  2⤵
  PID:1172
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "Norton Antivirus Auto Protect Service"
    3⤵
    PID:992
- C:\Windows\SysWOW64\net.exe
  net stop "mcshield"
  2⤵
  PID:1380
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "mcshield"
    3⤵
    PID:1816
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KRN.EXE
  2⤵
  - Kills process with taskkill
  PID:1644
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KUI.EXE
  2⤵
  PID:1892
- C:\Windows\SysWOW64\net.exe
  net stop "Norton Antivirus Auto Protect Service"
  2⤵
  PID:608
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "Norton Antivirus Auto Protect Service"
    3⤵
    PID:2388
- C:\Windows\SysWOW64\net.exe
  net stop "mcshield"
  2⤵
  PID:2044
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "mcshield"
    3⤵
    PID:1564
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KRN.EXE
  2⤵
  PID:656
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KUI.EXE
  2⤵
  - Kills process with taskkill
  PID:1384
- C:\Windows\SysWOW64\net.exe
  net stop "Norton Antivirus Auto Protect Service"
  2⤵
  PID:2248
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "Norton Antivirus Auto Protect Service"
    3⤵
    PID:1284
- C:\Windows\SysWOW64\net.exe
  net stop "mcshield"
  2⤵
  PID:336
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "mcshield"
    3⤵
    PID:1364
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KRN.EXE
  2⤵
  PID:2948
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KUI.EXE
  2⤵
  PID:776
- C:\Windows\SysWOW64\net.exe
  net stop "Norton Antivirus Auto Protect Service"
  2⤵
  PID:2036
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "Norton Antivirus Auto Protect Service"
    3⤵
    PID:2256
- C:\Windows\SysWOW64\net.exe
  net stop "mcshield"
  2⤵
  PID:572
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "mcshield"
    3⤵
    PID:1544
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KRN.EXE
  2⤵
  PID:1540
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KUI.EXE
  2⤵
  PID:1492
- C:\Windows\SysWOW64\net.exe
  net stop "Norton Antivirus Auto Protect Service"
  2⤵
  PID:1688
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "Norton Antivirus Auto Protect Service"
    3⤵
    PID:2544
- C:\Windows\SysWOW64\net.exe
  net stop "mcshield"
  2⤵
  PID:2828
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "mcshield"
    3⤵
    PID:2812
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KRN.EXE
  2⤵
  PID:2220
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KUI.EXE
  2⤵
  PID:2332
- C:\Windows\SysWOW64\net.exe
  net stop "Norton Antivirus Auto Protect Service"
  2⤵
  PID:700
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "Norton Antivirus Auto Protect Service"
    3⤵
    PID:2320
- C:\Windows\SysWOW64\net.exe
  net stop "mcshield"
  2⤵
  PID:2744
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "mcshield"
    3⤵
    PID:3000
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KRN.EXE
  2⤵
  PID:564
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KUI.EXE
  2⤵
  - Kills process with taskkill
  PID:3020
- C:\Windows\SysWOW64\net.exe
  net stop "Norton Antivirus Auto Protect Service"
  2⤵
  PID:2312
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "Norton Antivirus Auto Protect Service"
    3⤵
    PID:2752
- C:\Windows\SysWOW64\net.exe
  net stop "mcshield"
  2⤵
  PID:2884
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "mcshield"
    3⤵
    PID:2892
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KRN.EXE
  2⤵
  - Kills process with taskkill
  PID:2920
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KUI.EXE
  2⤵
  PID:3012
- C:\Windows\SysWOW64\net.exe
  net stop "Norton Antivirus Auto Protect Service"
  2⤵
  PID:2560
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "Norton Antivirus Auto Protect Service"
    3⤵
    PID:1720
- C:\Windows\SysWOW64\net.exe
  net stop "mcshield"
  2⤵
  PID:2788
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "mcshield"
    3⤵
    PID:2764
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KRN.EXE
  2⤵
  PID:3004
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KUI.EXE
  2⤵
  PID:348
- C:\Windows\SysWOW64\net.exe
  net stop "Norton Antivirus Auto Protect Service"
  2⤵
  PID:2304
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "Norton Antivirus Auto Protect Service"
    3⤵
    PID:540
- C:\Windows\SysWOW64\net.exe
  net stop "mcshield"
  2⤵
  PID:2880
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "mcshield"
    3⤵
    PID:2424
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KRN.EXE
  2⤵
  PID:2940
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KUI.EXE
  2⤵
  PID:2396
- C:\Windows\SysWOW64\net.exe
  net stop "Norton Antivirus Auto Protect Service"
  2⤵
  PID:2400
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "Norton Antivirus Auto Protect Service"
    3⤵
    PID:3016
- C:\Windows\SysWOW64\net.exe
  net stop "mcshield"
  2⤵
  PID:2388
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "mcshield"
    3⤵
    PID:2328
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KRN.EXE
  2⤵
  PID:608
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KUI.EXE
  2⤵
  PID:2096
- C:\Windows\SysWOW64\net.exe
  net stop "Norton Antivirus Auto Protect Service"
  2⤵
  PID:1108
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "Norton Antivirus Auto Protect Service"
    3⤵
    PID:1644
- C:\Windows\SysWOW64\net.exe
  net stop "mcshield"
  2⤵
  PID:2248
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "mcshield"
    3⤵
    PID:1724
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KRN.EXE
  2⤵
  PID:1284
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KUI.EXE
  2⤵
  PID:1504
- C:\Windows\SysWOW64\net.exe
  net stop "Norton Antivirus Auto Protect Service"
  2⤵
  PID:2404
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "Norton Antivirus Auto Protect Service"
    3⤵
    PID:2512
- C:\Windows\SysWOW64\net.exe
  net stop "mcshield"
  2⤵
  PID:1616
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "mcshield"
    3⤵
    PID:2948
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KRN.EXE
  2⤵
  PID:2660
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KUI.EXE
  2⤵
  PID:1964
- C:\Windows\SysWOW64\net.exe
  net stop "Norton Antivirus Auto Protect Service"
  2⤵
  PID:2188
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "Norton Antivirus Auto Protect Service"
    3⤵
    PID:776
- C:\Windows\SysWOW64\net.exe
  net stop "mcshield"
  2⤵
  PID:2704
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "mcshield"
    3⤵
    PID:1572
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KRN.EXE
  2⤵
  PID:2296
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KUI.EXE
  2⤵
  PID:2544
- C:\Windows\SysWOW64\net.exe
  net stop "Norton Antivirus Auto Protect Service"
  2⤵
  PID:2224
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "Norton Antivirus Auto Protect Service"
    3⤵
    PID:1948
- C:\Windows\SysWOW64\net.exe
  net stop "mcshield"
  2⤵
  PID:2812
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "mcshield"
    3⤵
    PID:2436
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KRN.EXE
  2⤵
  PID:2600
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KUI.EXE
  2⤵
  PID:2492
- C:\Windows\SysWOW64\net.exe
  net stop "Norton Antivirus Auto Protect Service"
  2⤵
  PID:700
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "Norton Antivirus Auto Protect Service"
    3⤵
    PID:1204
- C:\Windows\SysWOW64\net.exe
  net stop "mcshield"
  2⤵
  PID:2744
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "mcshield"
    3⤵
    PID:960
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KRN.EXE
  2⤵
  PID:2856
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KUI.EXE
  2⤵
  PID:2752
- C:\Windows\SysWOW64\net.exe
  net stop "Norton Antivirus Auto Protect Service"
  2⤵
  PID:900
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "Norton Antivirus Auto Protect Service"
    3⤵
    PID:2272
- C:\Windows\SysWOW64\net.exe
  net stop "mcshield"
  2⤵
  PID:2884
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "mcshield"
    3⤵
    PID:1408
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KRN.EXE
  2⤵
  PID:2292
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KUI.EXE
  2⤵
  PID:2284
- C:\Windows\SysWOW64\net.exe
  net stop "Norton Antivirus Auto Protect Service"
  2⤵
  PID:1624
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "Norton Antivirus Auto Protect Service"
    3⤵
    PID:2672
- C:\Windows\SysWOW64\net.exe
  net stop "mcshield"
  2⤵
  PID:2628
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "mcshield"
    3⤵
    PID:1500
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KRN.EXE
  2⤵
  PID:2788
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KUI.EXE
  2⤵
  PID:540
- C:\Windows\SysWOW64\net.exe
  net stop "Norton Antivirus Auto Protect Service"
  2⤵
  PID:2112
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "Norton Antivirus Auto Protect Service"
    3⤵
    PID:2168
- C:\Windows\SysWOW64\net.exe
  net stop "mcshield"
  2⤵
  PID:916
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "mcshield"
    3⤵
    PID:1608
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KRN.EXE
  2⤵
  PID:2900
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KUI.EXE
  2⤵
  PID:1896
- C:\Windows\SysWOW64\net.exe
  net stop "Norton Antivirus Auto Protect Service"
  2⤵
  PID:268
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "Norton Antivirus Auto Protect Service"
    3⤵
    PID:1760
- C:\Windows\SysWOW64\net.exe
  net stop "mcshield"
  2⤵
  PID:1656
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "mcshield"
    3⤵
    PID:1892
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KRN.EXE
  2⤵
  PID:1108
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KUI.EXE
  2⤵
  PID:2488
- C:\Windows\SysWOW64\net.exe
  net stop "Norton Antivirus Auto Protect Service"
  2⤵
  PID:532
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "Norton Antivirus Auto Protect Service"
    3⤵
    PID:1324
- C:\Windows\SysWOW64\net.exe
  net stop "mcshield"
  2⤵
  PID:1952
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "mcshield"
    3⤵
    PID:2412
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KRN.EXE
  2⤵
  PID:2024
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KUI.EXE
  2⤵
  PID:1812
- C:\Windows\SysWOW64\net.exe
  net stop "Norton Antivirus Auto Protect Service"
  2⤵
  PID:412
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "Norton Antivirus Auto Protect Service"
    3⤵
    PID:1136
- C:\Windows\SysWOW64\net.exe
  net stop "mcshield"
  2⤵
  PID:1672
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "mcshield"
    3⤵
    PID:572
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KRN.EXE
  2⤵
  PID:1616
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KUI.EXE
  2⤵
  - Kills process with taskkill
  PID:336
- C:\Windows\SysWOW64\net.exe
  net stop "Norton Antivirus Auto Protect Service"
  2⤵
  PID:776
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "Norton Antivirus Auto Protect Service"
    3⤵
    PID:1092
- C:\Windows\SysWOW64\net.exe
  net stop "mcshield"
  2⤵
  PID:1492
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "mcshield"
    3⤵
    PID:1524
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KRN.EXE
  2⤵
  PID:888
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KUI.EXE
  2⤵
  PID:2596
- C:\Windows\SysWOW64\net.exe
  net stop "Norton Antivirus Auto Protect Service"
  2⤵
  PID:1596
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "Norton Antivirus Auto Protect Service"
    3⤵
    PID:2296
- C:\Windows\SysWOW64\net.exe
  net stop "mcshield"
  2⤵
  PID:2536
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "mcshield"
    3⤵
    PID:844
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KRN.EXE
  2⤵
  - Kills process with taskkill
  PID:2436
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KUI.EXE
  2⤵
  PID:2888
- C:\Windows\SysWOW64\net.exe
  net stop "Norton Antivirus Auto Protect Service"
  2⤵
  PID:2540
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "Norton Antivirus Auto Protect Service"
    3⤵
    PID:2492
- C:\Windows\SysWOW64\net.exe
  net stop "mcshield"
  2⤵
  PID:1756
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "mcshield"
    3⤵
    PID:1660
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KRN.EXE
  2⤵
  PID:2520
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KUI.EXE
  2⤵
  - Kills process with taskkill
  PID:3020
- C:\Windows\SysWOW64\net.exe
  net stop "Norton Antivirus Auto Protect Service"
  2⤵
  PID:2032
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "Norton Antivirus Auto Protect Service"
    3⤵
    PID:2204
- C:\Windows\SysWOW64\net.exe
  net stop "mcshield"
  2⤵
  PID:360
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "mcshield"
    3⤵
    PID:2920
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KRN.EXE
  2⤵
  PID:2132
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KUI.EXE
  2⤵
  PID:2456
- C:\Windows\SysWOW64\net.exe
  net stop "Norton Antivirus Auto Protect Service"
  2⤵
  PID:2764
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "Norton Antivirus Auto Protect Service"
    3⤵
    PID:1976
- C:\Windows\SysWOW64\net.exe
  net stop "mcshield"
  2⤵
  PID:988
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "mcshield"
    3⤵
    PID:1172
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KRN.EXE
  2⤵
  PID:2168
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KUI.EXE
  2⤵
  PID:1344
- C:\Windows\SysWOW64\net.exe
  net stop "Norton Antivirus Auto Protect Service"
  2⤵
  PID:2088
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "Norton Antivirus Auto Protect Service"
    3⤵
    PID:1004
- C:\Windows\SysWOW64\net.exe
  net stop "mcshield"
  2⤵
  PID:1816
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "mcshield"
    3⤵
    PID:1740
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KRN.EXE
  2⤵
  PID:2424
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KUI.EXE
  2⤵
  PID:1216
- C:\Windows\SysWOW64\net.exe
  net stop "Norton Antivirus Auto Protect Service"
  2⤵
  PID:1644
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "Norton Antivirus Auto Protect Service"
    3⤵
    PID:1468
- C:\Windows\SysWOW64\net.exe
  net stop "mcshield"
  2⤵
  PID:2388
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "mcshield"
    3⤵
    PID:1040
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KRN.EXE
  2⤵
  PID:2252
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KUI.EXE
  2⤵
  PID:2324
- C:\Windows\SysWOW64\net.exe
  net stop "Norton Antivirus Auto Protect Service"
  2⤵
  PID:2044
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "Norton Antivirus Auto Protect Service"
    3⤵
    PID:2328
- C:\Windows\SysWOW64\net.exe
  net stop "mcshield"
  2⤵
  PID:2552
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KRN.EXE
  2⤵
  PID:1136
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im NOD32KUI.EXE
  2⤵
  PID:1504

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2528-0-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/2528-5-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads