Analysis
-
max time kernel
98s -
max time network
124s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
19/07/2024, 17:50
Static task
static1
Behavioral task
behavioral1
Sample
5d02c2dbc14460660b0d3dd2509f078a_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
5d02c2dbc14460660b0d3dd2509f078a_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
5d02c2dbc14460660b0d3dd2509f078a_JaffaCakes118.exe
-
Size
91KB
-
MD5
5d02c2dbc14460660b0d3dd2509f078a
-
SHA1
2148d0c47021bfd9c601d415816202dd36f14a1a
-
SHA256
85d49ac2051c839d3df8b3724c74cc41cc198bc380f626af3287480a0a830b18
-
SHA512
676eccb27680a62247bd984be2d948b5b50e0b9e589eb145276494044160e212419d8ea50127038865f5483528f80afd9fc8344e495a1cf12a769adb30a00174
-
SSDEEP
1536:WHQt5bZFFb09ksiH/WFDmsN349sRMXFmX2Ae9noySYcJHiA:Ldb0910sB49VMHN
Malware Config
Signatures
-
Event Triggered Execution: Image File Execution Options Injection 1 TTPs 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ctfmon.exe\Debugger = "avgvmgr.exe" avgvmain.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ctfmon.exe avgvsca.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ctfmon.exe avruncm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ctfmon.exe Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ctfmon.exe\Debugger = "avgvcmd.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ctfmon.exe\Debugger = "avgvsca.exe" avscpd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ctfmon.exe\Debugger = "avgvsca.exe" avmptr.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ctfmon.exe avgvcmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ctfmon.exe avgvmgr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ctfmon.exe\Debugger = "avgvcnt.exe" avgvmgr.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ctfmon.exe Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ctfmon.exe Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ctfmon.exe\Debugger = "avgvcmd.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ctfmon.exe\Debugger = "avgvmain.exe" avgvcmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ctfmon.exe Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ctfmon.exe avsysdb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ctfmon.exe avgvmain.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ctfmon.exe\Debugger = "avsysdb.exe" avgvsca.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ctfmon.exe\Debugger = "avgvrnd.exe" avgvspc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ctfmon.exe\Debugger = "avmptr.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ctfmon.exe\Debugger = "avgvsm.exe" Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ctfmon.exe avgvsca.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ctfmon.exe\Debugger = "avgvcmd.exe" avgvcnt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ctfmon.exe avgvsca.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ctfmon.exe\Debugger = "avgvmgr.exe" Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ctfmon.exe Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ctfmon.exe Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ctfmon.exe avscang.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ctfmon.exe\Debugger = "avgvmain.exe" Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ctfmon.exe Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ctfmon.exe avgvcnt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ctfmon.exe avgvcnt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ctfmon.exe avgvcmd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ctfmon.exe\Debugger = "avgvsm.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ctfmon.exe\Debugger = "avgvspc.exe" Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ctfmon.exe Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ctfmon.exe\Debugger = "avgvcmd.exe" avscang.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ctfmon.exe\Debugger = "avgvcmd.exe" Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ctfmon.exe avgvsm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ctfmon.exe avgvmain.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ctfmon.exe\Debugger = "avgvmgr.exe" avrmnta.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ctfmon.exe Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ctfmon.exe avsysdb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ctfmon.exe avgvrnd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ctfmon.exe\Debugger = "avghsta.exe" avruncm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ctfmon.exe\Debugger = "avgvsca.exe" avgvsm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ctfmon.exe\Debugger = "avscpd.exe" avgvcmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ctfmon.exe Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ctfmon.exe\Debugger = "avghsta.exe" Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ctfmon.exe Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ctfmon.exe Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ctfmon.exe avgvcmd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ctfmon.exe\Debugger = "avscpd.exe" avgvcmd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ctfmon.exe\Debugger = "avghsta.exe" avmgsec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ctfmon.exe avmgsec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ctfmon.exe\Debugger = "avgvcmd.exe" avgvcnt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ctfmon.exe\Debugger = "avruncm.exe" avruncm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ctfmon.exe avsysdb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ctfmon.exe avrmnta.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ctfmon.exe\Debugger = "avgvcnt.exe" avghsta.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ctfmon.exe avgvmgr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ctfmon.exe\Debugger = "avgvsca.exe" Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ctfmon.exe Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ctfmon.exe\Debugger = "avrmnta.exe" avsysdb.exe -
Checks computer location settings 2 TTPs 64 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\Control Panel\International\Geo\Nation Process not Found Key value queried \REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\Control Panel\International\Geo\Nation avrmnta.exe Key value queried \REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\Control Panel\International\Geo\Nation avgvcnt.exe Key value queried \REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\Control Panel\International\Geo\Nation avmgsec.exe Key value queried \REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\Control Panel\International\Geo\Nation avgvmain.exe Key value queried \REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\Control Panel\International\Geo\Nation avghsta.exe Key value queried \REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\Control Panel\International\Geo\Nation Process not Found Key value queried \REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\Control Panel\International\Geo\Nation Process not Found Key value queried \REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\Control Panel\International\Geo\Nation 5d02c2dbc14460660b0d3dd2509f078a_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\Control Panel\International\Geo\Nation avmptr.exe Key value queried \REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\Control Panel\International\Geo\Nation avgvsca.exe Key value queried \REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\Control Panel\International\Geo\Nation avgvmgr.exe Key value queried \REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\Control Panel\International\Geo\Nation avmgsec.exe Key value queried \REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\Control Panel\International\Geo\Nation avgvcmd.exe Key value queried \REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\Control Panel\International\Geo\Nation avsysdb.exe Key value queried \REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\Control Panel\International\Geo\Nation Process not Found Key value queried \REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\Control Panel\International\Geo\Nation Process not Found Key value queried \REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\Control Panel\International\Geo\Nation avghsta.exe Key value queried \REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\Control Panel\International\Geo\Nation avgvmgr.exe Key value queried \REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\Control Panel\International\Geo\Nation avmptr.exe Key value queried \REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\Control Panel\International\Geo\Nation avgvmgr.exe Key value queried \REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\Control Panel\International\Geo\Nation 5d02c2dbc14460660b0d3dd2509f078a_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\Control Panel\International\Geo\Nation avsysdb.exe Key value queried \REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\Control Panel\International\Geo\Nation Process not Found Key value queried \REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\Control Panel\International\Geo\Nation Process not Found Key value queried \REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\Control Panel\International\Geo\Nation avgvmgr.exe Key value queried \REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\Control Panel\International\Geo\Nation avgvspc.exe Key value queried \REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\Control Panel\International\Geo\Nation avghsta.exe Key value queried \REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\Control Panel\International\Geo\Nation Process not Found Key value queried \REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\Control Panel\International\Geo\Nation avgvcmd.exe Key value queried \REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\Control Panel\International\Geo\Nation avscang.exe Key value queried \REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\Control Panel\International\Geo\Nation Process not Found Key value queried \REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\Control Panel\International\Geo\Nation avghsta.exe Key value queried \REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\Control Panel\International\Geo\Nation avruncm.exe Key value queried \REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\Control Panel\International\Geo\Nation avgvspc.exe Key value queried \REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\Control Panel\International\Geo\Nation Process not Found Key value queried \REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\Control Panel\International\Geo\Nation avscpd.exe Key value queried \REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\Control Panel\International\Geo\Nation avgvsca.exe Key value queried \REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\Control Panel\International\Geo\Nation avscang.exe Key value queried \REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\Control Panel\International\Geo\Nation avgvcnt.exe Key value queried \REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\Control Panel\International\Geo\Nation Process not Found Key value queried \REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\Control Panel\International\Geo\Nation Process not Found Key value queried \REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\Control Panel\International\Geo\Nation avgvmgr.exe Key value queried \REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\Control Panel\International\Geo\Nation avgvmain.exe Key value queried \REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\Control Panel\International\Geo\Nation avruncm.exe Key value queried \REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\Control Panel\International\Geo\Nation avgvspc.exe Key value queried \REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\Control Panel\International\Geo\Nation Process not Found Key value queried \REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\Control Panel\International\Geo\Nation avgvcmd.exe Key value queried \REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\Control Panel\International\Geo\Nation avgvsca.exe Key value queried \REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\Control Panel\International\Geo\Nation avgvcmd.exe Key value queried \REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\Control Panel\International\Geo\Nation avruncm.exe Key value queried \REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\Control Panel\International\Geo\Nation Process not Found Key value queried \REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\Control Panel\International\Geo\Nation Process not Found Key value queried \REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\Control Panel\International\Geo\Nation avsysdb.exe Key value queried \REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\Control Panel\International\Geo\Nation avgvmgr.exe Key value queried \REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\Control Panel\International\Geo\Nation Process not Found Key value queried \REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\Control Panel\International\Geo\Nation avgvcnt.exe Key value queried \REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\Control Panel\International\Geo\Nation avgvrnd.exe Key value queried \REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\Control Panel\International\Geo\Nation avghsta.exe Key value queried \REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\Control Panel\International\Geo\Nation Process not Found Key value queried \REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\Control Panel\International\Geo\Nation Process not Found Key value queried \REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\Control Panel\International\Geo\Nation Process not Found Key value queried \REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\Control Panel\International\Geo\Nation avsysdb.exe Key value queried \REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\Control Panel\International\Geo\Nation avgvsm.exe -
Executes dropped EXE 64 IoCs
pid Process 2036 avsysdb.exe 4108 avsysdb.exe 4356 avgvcmd.exe 4692 avgvcmd.exe 3172 avscpd.exe 3832 avscpd.exe 4640 avgvsca.exe 468 avgvsca.exe 4408 avmgsec.exe 3844 avmgsec.exe 1292 avghsta.exe 4904 avghsta.exe 2032 avsysdb.exe 3336 avsysdb.exe 3244 avrmnta.exe 3392 avrmnta.exe 4448 avghsta.exe 1548 avghsta.exe 3980 avgvcnt.exe 228 avgvcnt.exe 4408 avgvcmd.exe 1548 avgvcmd.exe 2168 avgvmain.exe 4100 avgvmain.exe 2940 avgvmgr.exe 4624 avgvmgr.exe 740 avgvcnt.exe 1600 avgvcnt.exe 4736 avgvsm.exe 2224 avgvsm.exe 2576 avgvsca.exe 2300 avgvsca.exe 4528 avsysdb.exe 4408 avsysdb.exe 2724 avmgsec.exe 3680 avmgsec.exe 5840 avmptr.exe 5880 avmptr.exe 2416 avgvsca.exe 5152 avgvsca.exe 6112 avrmnta.exe 5172 avrmnta.exe 5360 avgvmgr.exe 6044 avgvmgr.exe 5672 avgvspc.exe 680 avgvspc.exe 1344 avgvrnd.exe 6036 avgvrnd.exe 6040 avgvmain.exe 932 avgvmain.exe 2724 avgvmgr.exe 5648 avgvmgr.exe 4400 avgvmgr.exe 5548 avgvmgr.exe 3740 avgvcnt.exe 5656 avgvcnt.exe 4836 avgvcmd.exe 5288 avgvcmd.exe 748 avscpd.exe 5472 avscpd.exe 5288 avscang.exe 4100 avscang.exe 2188 avgvcmd.exe 5276 avgvcmd.exe -
Adds Run key to start application 2 TTPs 60 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ctfmon.exe = "ctfmon.exe" avghsta.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ctfmon.exe = "ctfmon.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ctfmon.exe = "ctfmon.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ctfmon.exe = "ctfmon.exe" avgvmgr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ctfmon.exe = "ctfmon.exe" avgvmain.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ctfmon.exe = "ctfmon.exe" avgvcmd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ctfmon.exe = "ctfmon.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ctfmon.exe = "ctfmon.exe" avgvsm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ctfmon.exe = "ctfmon.exe" avmptr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ctfmon.exe = "ctfmon.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ctfmon.exe = "ctfmon.exe" avscang.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ctfmon.exe = "ctfmon.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ctfmon.exe = "ctfmon.exe" avsysdb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ctfmon.exe = "ctfmon.exe" avgvcmd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ctfmon.exe = "ctfmon.exe" avgvspc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ctfmon.exe = "ctfmon.exe" avscpd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ctfmon.exe = "ctfmon.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ctfmon.exe = "ctfmon.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ctfmon.exe = "ctfmon.exe" avrmnta.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ctfmon.exe = "ctfmon.exe" avgvcnt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ctfmon.exe = "ctfmon.exe" avgvmain.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ctfmon.exe = "ctfmon.exe" avgvsca.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ctfmon.exe = "ctfmon.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ctfmon.exe = "ctfmon.exe" avsysdb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ctfmon.exe = "ctfmon.exe" avgvsca.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ctfmon.exe = "ctfmon.exe" avmgsec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ctfmon.exe = "ctfmon.exe" avghsta.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ctfmon.exe = "ctfmon.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ctfmon.exe = "ctfmon.exe" avgvmgr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ctfmon.exe = "ctfmon.exe" avgvcnt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ctfmon.exe = "ctfmon.exe" avgvmain.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ctfmon.exe = "ctfmon.exe" avsysdb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ctfmon.exe = "ctfmon.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ctfmon.exe = "ctfmon.exe" avrmnta.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ctfmon.exe = "ctfmon.exe" avgvmgr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ctfmon.exe = "ctfmon.exe" avscang.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ctfmon.exe = "ctfmon.exe" avruncm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ctfmon.exe = "ctfmon.exe" avgvspc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ctfmon.exe = "ctfmon.exe" avghsta.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ctfmon.exe = "ctfmon.exe" avghsta.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ctfmon.exe = "ctfmon.exe" avgvcnt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ctfmon.exe = "ctfmon.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ctfmon.exe = "ctfmon.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ctfmon.exe = "ctfmon.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ctfmon.exe = "ctfmon.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ctfmon.exe = "ctfmon.exe" 5d02c2dbc14460660b0d3dd2509f078a_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ctfmon.exe = "ctfmon.exe" avgvcmd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ctfmon.exe = "ctfmon.exe" avruncm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ctfmon.exe = "ctfmon.exe" avscpd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ctfmon.exe = "ctfmon.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ctfmon.exe = "ctfmon.exe" avgvsca.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ctfmon.exe = "ctfmon.exe" avgvrnd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ctfmon.exe = "ctfmon.exe" avgvcmd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ctfmon.exe = "ctfmon.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ctfmon.exe = "ctfmon.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ctfmon.exe = "ctfmon.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ctfmon.exe = "ctfmon.exe" avmgsec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ctfmon.exe = "ctfmon.exe" avgvmgr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ctfmon.exe = "ctfmon.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ctfmon.exe = "ctfmon.exe" Process not Found -
Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\avghsta.exe avmgsec.exe File created C:\Windows\SysWOW64\avgvmgr.exe avgvmain.exe File created C:\Windows\SysWOW64\avscpd.exe avgvcmd.exe File created C:\Windows\SysWOW64\avgvmgr.exe avscang.exe File created C:\Windows\SysWOW64\avgvsm.exe Process not Found File created C:\Windows\SysWOW64\avscang.exe Process not Found File created C:\Windows\SysWOW64\avgvmgr.exe Process not Found File created C:\Windows\SysWOW64\avgvcmd.exe Process not Found File opened for modification C:\Windows\SysWOW64\avgvsca.exe avmptr.exe File created C:\Windows\SysWOW64\avghsta.exe avruncm.exe File opened for modification C:\Windows\SysWOW64\avgvcmd.exe Process not Found File created C:\Windows\SysWOW64\avgvmain.exe Process not Found File opened for modification C:\Windows\SysWOW64\avgvcnt.exe avghsta.exe File created C:\Windows\SysWOW64\avmgsec.exe avsysdb.exe File opened for modification C:\Windows\SysWOW64\avgvmgr.exe avscang.exe File opened for modification C:\Windows\SysWOW64\avgvmain.exe Process not Found File opened for modification C:\Windows\SysWOW64\avghsta.exe Process not Found File opened for modification C:\Windows\SysWOW64\avghsta.exe avruncm.exe File created C:\Windows\SysWOW64\avgvspc.exe avghsta.exe File opened for modification C:\Windows\SysWOW64\avgvcmd.exe Process not Found File opened for modification C:\Windows\SysWOW64\avgvcmd.exe Process not Found File created C:\Windows\SysWOW64\avgvsca.exe avmptr.exe File created C:\Windows\SysWOW64\avgvcnt.exe avgvmgr.exe File created C:\Windows\SysWOW64\avgvsca.exe Process not Found File created C:\Windows\SysWOW64\avmptr.exe avmgsec.exe File opened for modification C:\Windows\SysWOW64\avrmnta.exe avgvsca.exe File created C:\Windows\SysWOW64\avgvrnd.exe avgvspc.exe File created C:\Windows\SysWOW64\avgvcmd.exe avgvcnt.exe File opened for modification C:\Windows\SysWOW64\avgvspc.exe Process not Found File created C:\Windows\SysWOW64\avsysdb.exe avghsta.exe File opened for modification C:\Windows\SysWOW64\avgvsm.exe avgvcnt.exe File created C:\Windows\SysWOW64\avsysdb.exe avgvsca.exe File opened for modification C:\Windows\SysWOW64\avscang.exe Process not Found File created C:\Windows\SysWOW64\avgvsm.exe Process not Found File created C:\Windows\SysWOW64\avmgsec.exe avgvsca.exe File opened for modification C:\Windows\SysWOW64\avrmnta.exe avsysdb.exe File opened for modification C:\Windows\SysWOW64\avgvcmd.exe avscang.exe File created C:\Windows\SysWOW64\avruncm.exe avruncm.exe File opened for modification C:\Windows\SysWOW64\avghsta.exe avrmnta.exe File created C:\Windows\SysWOW64\avgvmgr.exe avgvmain.exe File opened for modification C:\Windows\SysWOW64\avgvmain.exe avgvcmd.exe File created C:\Windows\SysWOW64\avgvsca.exe Process not Found File created C:\Windows\SysWOW64\avmgsec.exe Process not Found File created C:\Windows\SysWOW64\avgvspc.exe Process not Found File created C:\Windows\SysWOW64\avgvcnt.exe avghsta.exe File created C:\Windows\SysWOW64\avgvcnt.exe avgvmgr.exe File opened for modification C:\Windows\SysWOW64\avgvmgr.exe avgvmain.exe File created C:\Windows\SysWOW64\avgvmain.exe avgvcmd.exe File opened for modification C:\Windows\SysWOW64\avgvsrd.exe Process not Found File opened for modification C:\Windows\SysWOW64\avghsta.exe avghsta.exe File opened for modification C:\Windows\SysWOW64\avgvsca.exe Process not Found File opened for modification C:\Windows\SysWOW64\avgvsca.exe Process not Found File created C:\Windows\SysWOW64\avgvcmd.exe avsysdb.exe File created C:\Windows\SysWOW64\avgvsca.exe avgvsm.exe File opened for modification C:\Windows\SysWOW64\avgvmain.exe avgvrnd.exe File created C:\Windows\SysWOW64\avghsta.exe avrmnta.exe File created C:\Windows\SysWOW64\avgvsm.exe avgvcnt.exe File opened for modification C:\Windows\SysWOW64\avgvcmd.exe avgvcnt.exe File opened for modification C:\Windows\SysWOW64\avscpd.exe avgvcmd.exe File created C:\Windows\SysWOW64\avghsta.exe avghsta.exe File created C:\Windows\SysWOW64\avscang.exe avgvspc.exe File created C:\Windows\SysWOW64\avgvcmd.exe avscang.exe File opened for modification C:\Windows\SysWOW64\avruncm.exe avgvmain.exe File created C:\Windows\SysWOW64\avsysdb.exe Process not Found -
Suspicious use of SetThreadContext 60 IoCs
description pid Process procid_target PID 3832 set thread context of 3280 3832 5d02c2dbc14460660b0d3dd2509f078a_JaffaCakes118.exe 84 PID 2036 set thread context of 4108 2036 avsysdb.exe 95 PID 4356 set thread context of 4692 4356 avgvcmd.exe 105 PID 3172 set thread context of 3832 3172 avscpd.exe 116 PID 4640 set thread context of 468 4640 avgvsca.exe 129 PID 4408 set thread context of 3844 4408 avmgsec.exe 142 PID 1292 set thread context of 4904 1292 avghsta.exe 156 PID 2032 set thread context of 3336 2032 avsysdb.exe 174 PID 3244 set thread context of 3392 3244 avrmnta.exe 192 PID 4448 set thread context of 1548 4448 avghsta.exe 210 PID 3980 set thread context of 228 3980 avgvcnt.exe 231 PID 4408 set thread context of 1548 4408 avgvcmd.exe 253 PID 2168 set thread context of 4100 2168 avgvmain.exe 279 PID 2940 set thread context of 4624 2940 avgvmgr.exe 300 PID 740 set thread context of 1600 740 avgvcnt.exe 327 PID 4736 set thread context of 2224 4736 avgvsm.exe 351 PID 2576 set thread context of 2300 2576 avgvsca.exe 382 PID 4528 set thread context of 4408 4528 avsysdb.exe 411 PID 2724 set thread context of 3680 2724 avmgsec.exe 443 PID 5840 set thread context of 5880 5840 avmptr.exe 475 PID 2416 set thread context of 5152 2416 avgvsca.exe 511 PID 6112 set thread context of 5172 6112 avrmnta.exe 635 PID 5360 set thread context of 6044 5360 avgvmgr.exe 580 PID 5672 set thread context of 680 5672 avgvspc.exe 617 PID 1344 set thread context of 6036 1344 avgvrnd.exe 652 PID 6040 set thread context of 932 6040 avgvmain.exe 817 PID 2724 set thread context of 5648 2724 avgvmgr.exe 723 PID 4400 set thread context of 5548 4400 avgvmgr.exe 870 PID 3740 set thread context of 5656 3740 avgvcnt.exe 793 PID 4836 set thread context of 5288 4836 avgvcmd.exe 898 PID 748 set thread context of 5472 748 avscpd.exe 867 PID 5288 set thread context of 4100 5288 avscang.exe 1183 PID 2188 set thread context of 5276 2188 avgvcmd.exe 1066 PID 5676 set thread context of 2708 5676 avgvmain.exe 1084 PID 5452 set thread context of 5264 5452 avruncm.exe 1009 PID 2564 set thread context of 4536 2564 avruncm.exe 1260 PID 5488 set thread context of 4184 5488 avghsta.exe 1079 PID 3592 set thread context of 6136 3592 avghsta.exe 1612 PID 3508 set thread context of 6060 3508 avgvspc.exe 1154 PID 5848 set thread context of 3324 5848 avscang.exe 1523 PID 2944 set thread context of 5868 2944 Process not Found 1443 PID 5480 set thread context of 5404 5480 Process not Found 1823 PID 3832 set thread context of 5324 3832 Process not Found 1744 PID 5828 set thread context of 2944 5828 Process not Found 1674 PID 4872 set thread context of 2952 4872 Process not Found 1570 PID 5576 set thread context of 2404 5576 Process not Found 1631 PID 3336 set thread context of 5044 3336 Process not Found 1922 PID 228 set thread context of 3156 228 Process not Found 2254 PID 5144 set thread context of 740 5144 Process not Found 1524 PID 5456 set thread context of 464 5456 Process not Found 2089 PID 3568 set thread context of 4632 3568 Process not Found 1962 PID 516 set thread context of 3928 516 Process not Found 2419 PID 936 set thread context of 5464 936 Process not Found 1666 PID 5028 set thread context of 5224 5028 Process not Found 1854 PID 4736 set thread context of 2092 4736 Process not Found 1739 PID 1292 set thread context of 1408 1292 Process not Found 1775 PID 6140 set thread context of 408 6140 Process not Found 2448 PID 3588 set thread context of 5144 3588 Process not Found 2679 PID 744 set thread context of 5036 744 Process not Found 2494 PID 5824 set thread context of 1864 5824 Process not Found 1920 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 60 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ avruncm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ avgvspc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ avgvrnd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ avgvcnt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ avsysdb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ avscpd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ avgvspc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ avmgsec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ avgvsca.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ avgvsm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ avgvmgr.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ avghsta.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ avghsta.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ avgvcmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ avmgsec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ avgvcmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ 5d02c2dbc14460660b0d3dd2509f078a_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ avscpd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ avgvmain.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ avgvcnt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ avgvmgr.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ avruncm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ avscang.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ avgvsca.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ avrmnta.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ avghsta.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ avgvmain.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ avghsta.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ avsysdb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ avgvcmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ avsysdb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ avrmnta.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ avgvmgr.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ avscang.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ avgvsca.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ avmptr.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ avgvcnt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ avgvcmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ avgvmain.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ avgvmgr.exe -
Runs ping.exe 1 TTPs 64 IoCs
pid Process 5484 Process not Found 4520 Process not Found 5508 Process not Found 4036 PING.EXE 5232 PING.EXE 4488 PING.EXE 2092 Process not Found 5532 Process not Found 3732 Process not Found 5288 Process not Found 1860 PING.EXE 6044 PING.EXE 4776 Process not Found 3612 Process not Found 5344 Process not Found 5160 Process not Found 4564 Process not Found 5296 Process not Found 5472 Process not Found 4016 Process not Found 2540 Process not Found 1516 Process not Found 5316 Process not Found 1708 Process not Found 936 Process not Found 5056 Process not Found 6036 Process not Found 4256 Process not Found 2460 Process not Found 1544 PING.EXE 5940 PING.EXE 4008 PING.EXE 6024 Process not Found 6068 Process not Found 4256 PING.EXE 5672 PING.EXE 5660 Process not Found 3464 Process not Found 4440 Process not Found 5968 PING.EXE 4608 Process not Found 2428 Process not Found 2260 PING.EXE 5936 PING.EXE 4012 Process not Found 5596 Process not Found 2976 Process not Found 3296 Process not Found 4708 Process not Found 2944 Process not Found 5148 Process not Found 5880 Process not Found 5208 Process not Found 408 Process not Found 6004 Process not Found 3244 Process not Found 684 Process not Found 5564 Process not Found 5028 Process not Found 4568 Process not Found 3832 PING.EXE 2280 PING.EXE 3116 PING.EXE 5140 PING.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3280 5d02c2dbc14460660b0d3dd2509f078a_JaffaCakes118.exe 3280 5d02c2dbc14460660b0d3dd2509f078a_JaffaCakes118.exe 4108 avsysdb.exe 4108 avsysdb.exe 4692 avgvcmd.exe 4692 avgvcmd.exe 3832 avscpd.exe 3832 avscpd.exe 468 avgvsca.exe 468 avgvsca.exe 3844 avmgsec.exe 3844 avmgsec.exe 4904 avghsta.exe 4904 avghsta.exe 3336 avsysdb.exe 3336 avsysdb.exe 3392 avrmnta.exe 3392 avrmnta.exe 1548 avghsta.exe 1548 avghsta.exe 228 avgvcnt.exe 228 avgvcnt.exe 1548 avgvcmd.exe 1548 avgvcmd.exe 4100 avgvmain.exe 4100 avgvmain.exe 4624 avgvmgr.exe 4624 avgvmgr.exe 1600 avgvcnt.exe 1600 avgvcnt.exe 2224 avgvsm.exe 2224 avgvsm.exe 2300 avgvsca.exe 2300 avgvsca.exe 4408 avsysdb.exe 4408 avsysdb.exe 3680 avmgsec.exe 3680 avmgsec.exe 5880 avmptr.exe 5880 avmptr.exe 5152 avgvsca.exe 5152 avgvsca.exe 5172 avrmnta.exe 5172 avrmnta.exe 6044 avgvmgr.exe 6044 avgvmgr.exe 680 avgvspc.exe 680 avgvspc.exe 6036 avgvrnd.exe 6036 avgvrnd.exe 932 avgvmain.exe 932 avgvmain.exe 5648 avgvmgr.exe 5648 avgvmgr.exe 5548 avgvmgr.exe 5548 avgvmgr.exe 5656 avgvcnt.exe 5656 avgvcnt.exe 5288 avgvcmd.exe 5288 avgvcmd.exe 5472 avscpd.exe 5472 avscpd.exe 4100 avscang.exe 4100 avscang.exe -
Suspicious use of AdjustPrivilegeToken 59 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 3280 5d02c2dbc14460660b0d3dd2509f078a_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 4108 avsysdb.exe Token: SeIncBasePriorityPrivilege 4692 avgvcmd.exe Token: SeIncBasePriorityPrivilege 3832 avscpd.exe Token: SeIncBasePriorityPrivilege 468 avgvsca.exe Token: SeIncBasePriorityPrivilege 3844 avmgsec.exe Token: SeIncBasePriorityPrivilege 4904 avghsta.exe Token: SeIncBasePriorityPrivilege 3336 avsysdb.exe Token: SeIncBasePriorityPrivilege 3392 avrmnta.exe Token: SeIncBasePriorityPrivilege 1548 avghsta.exe Token: SeIncBasePriorityPrivilege 228 avgvcnt.exe Token: SeIncBasePriorityPrivilege 1548 avgvcmd.exe Token: SeIncBasePriorityPrivilege 4100 avgvmain.exe Token: SeIncBasePriorityPrivilege 4624 avgvmgr.exe Token: SeIncBasePriorityPrivilege 1600 avgvcnt.exe Token: SeIncBasePriorityPrivilege 2224 avgvsm.exe Token: SeIncBasePriorityPrivilege 2300 avgvsca.exe Token: SeIncBasePriorityPrivilege 4408 avsysdb.exe Token: SeIncBasePriorityPrivilege 3680 avmgsec.exe Token: SeIncBasePriorityPrivilege 5880 avmptr.exe Token: SeIncBasePriorityPrivilege 5152 avgvsca.exe Token: SeIncBasePriorityPrivilege 5172 avrmnta.exe Token: SeIncBasePriorityPrivilege 6044 avgvmgr.exe Token: SeIncBasePriorityPrivilege 680 avgvspc.exe Token: SeIncBasePriorityPrivilege 6036 avgvrnd.exe Token: SeIncBasePriorityPrivilege 932 avgvmain.exe Token: SeIncBasePriorityPrivilege 5648 avgvmgr.exe Token: SeIncBasePriorityPrivilege 5548 avgvmgr.exe Token: SeIncBasePriorityPrivilege 5656 avgvcnt.exe Token: SeIncBasePriorityPrivilege 5288 avgvcmd.exe Token: SeIncBasePriorityPrivilege 5472 avscpd.exe Token: SeIncBasePriorityPrivilege 4100 avscang.exe Token: SeIncBasePriorityPrivilege 5276 avgvcmd.exe Token: SeIncBasePriorityPrivilege 2708 avgvmain.exe Token: SeIncBasePriorityPrivilege 5264 avruncm.exe Token: SeIncBasePriorityPrivilege 4536 avruncm.exe Token: SeIncBasePriorityPrivilege 4184 avghsta.exe Token: SeIncBasePriorityPrivilege 6136 avghsta.exe Token: SeIncBasePriorityPrivilege 6060 avgvspc.exe Token: SeIncBasePriorityPrivilege 3324 avscang.exe Token: SeIncBasePriorityPrivilege 5868 Process not Found Token: SeIncBasePriorityPrivilege 5404 Process not Found Token: SeIncBasePriorityPrivilege 5324 Process not Found Token: SeIncBasePriorityPrivilege 2944 Process not Found Token: SeIncBasePriorityPrivilege 2952 Process not Found Token: SeIncBasePriorityPrivilege 2404 Process not Found Token: SeIncBasePriorityPrivilege 5044 Process not Found Token: SeIncBasePriorityPrivilege 3156 Process not Found Token: SeIncBasePriorityPrivilege 740 Process not Found Token: SeIncBasePriorityPrivilege 464 Process not Found Token: SeIncBasePriorityPrivilege 4632 Process not Found Token: SeIncBasePriorityPrivilege 3928 Process not Found Token: SeIncBasePriorityPrivilege 5464 Process not Found Token: SeIncBasePriorityPrivilege 5224 Process not Found Token: SeIncBasePriorityPrivilege 2092 Process not Found Token: SeIncBasePriorityPrivilege 1408 Process not Found Token: SeIncBasePriorityPrivilege 408 Process not Found Token: SeIncBasePriorityPrivilege 5144 Process not Found Token: SeIncBasePriorityPrivilege 5036 Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3832 wrote to memory of 3280 3832 5d02c2dbc14460660b0d3dd2509f078a_JaffaCakes118.exe 84 PID 3832 wrote to memory of 3280 3832 5d02c2dbc14460660b0d3dd2509f078a_JaffaCakes118.exe 84 PID 3832 wrote to memory of 3280 3832 5d02c2dbc14460660b0d3dd2509f078a_JaffaCakes118.exe 84 PID 3832 wrote to memory of 3280 3832 5d02c2dbc14460660b0d3dd2509f078a_JaffaCakes118.exe 84 PID 3832 wrote to memory of 3280 3832 5d02c2dbc14460660b0d3dd2509f078a_JaffaCakes118.exe 84 PID 3832 wrote to memory of 1812 3832 5d02c2dbc14460660b0d3dd2509f078a_JaffaCakes118.exe 86 PID 3832 wrote to memory of 1812 3832 5d02c2dbc14460660b0d3dd2509f078a_JaffaCakes118.exe 86 PID 3832 wrote to memory of 1812 3832 5d02c2dbc14460660b0d3dd2509f078a_JaffaCakes118.exe 86 PID 1812 wrote to memory of 1700 1812 cmd.exe 88 PID 1812 wrote to memory of 1700 1812 cmd.exe 88 PID 1812 wrote to memory of 1700 1812 cmd.exe 88 PID 1812 wrote to memory of 2620 1812 cmd.exe 91 PID 1812 wrote to memory of 2620 1812 cmd.exe 91 PID 1812 wrote to memory of 2620 1812 cmd.exe 91 PID 3280 wrote to memory of 2036 3280 5d02c2dbc14460660b0d3dd2509f078a_JaffaCakes118.exe 92 PID 3280 wrote to memory of 2036 3280 5d02c2dbc14460660b0d3dd2509f078a_JaffaCakes118.exe 92 PID 3280 wrote to memory of 2036 3280 5d02c2dbc14460660b0d3dd2509f078a_JaffaCakes118.exe 92 PID 3280 wrote to memory of 4784 3280 5d02c2dbc14460660b0d3dd2509f078a_JaffaCakes118.exe 93 PID 3280 wrote to memory of 4784 3280 5d02c2dbc14460660b0d3dd2509f078a_JaffaCakes118.exe 93 PID 3280 wrote to memory of 4784 3280 5d02c2dbc14460660b0d3dd2509f078a_JaffaCakes118.exe 93 PID 2036 wrote to memory of 4108 2036 avsysdb.exe 95 PID 2036 wrote to memory of 4108 2036 avsysdb.exe 95 PID 2036 wrote to memory of 4108 2036 avsysdb.exe 95 PID 2036 wrote to memory of 4108 2036 avsysdb.exe 95 PID 2036 wrote to memory of 4108 2036 avsysdb.exe 95 PID 2036 wrote to memory of 4792 2036 avsysdb.exe 96 PID 2036 wrote to memory of 4792 2036 avsysdb.exe 96 PID 2036 wrote to memory of 4792 2036 avsysdb.exe 96 PID 4792 wrote to memory of 468 4792 cmd.exe 98 PID 4792 wrote to memory of 468 4792 cmd.exe 98 PID 4792 wrote to memory of 468 4792 cmd.exe 98 PID 4792 wrote to memory of 4272 4792 cmd.exe 101 PID 4792 wrote to memory of 4272 4792 cmd.exe 101 PID 4792 wrote to memory of 4272 4792 cmd.exe 101 PID 4108 wrote to memory of 4356 4108 avsysdb.exe 102 PID 4108 wrote to memory of 4356 4108 avsysdb.exe 102 PID 4108 wrote to memory of 4356 4108 avsysdb.exe 102 PID 4108 wrote to memory of 2444 4108 avsysdb.exe 103 PID 4108 wrote to memory of 2444 4108 avsysdb.exe 103 PID 4108 wrote to memory of 2444 4108 avsysdb.exe 103 PID 4356 wrote to memory of 4692 4356 avgvcmd.exe 105 PID 4356 wrote to memory of 4692 4356 avgvcmd.exe 105 PID 4356 wrote to memory of 4692 4356 avgvcmd.exe 105 PID 4356 wrote to memory of 4692 4356 avgvcmd.exe 105 PID 4356 wrote to memory of 4692 4356 avgvcmd.exe 105 PID 4356 wrote to memory of 4184 4356 avgvcmd.exe 106 PID 4356 wrote to memory of 4184 4356 avgvcmd.exe 106 PID 4356 wrote to memory of 4184 4356 avgvcmd.exe 106 PID 4184 wrote to memory of 2532 4184 cmd.exe 109 PID 4184 wrote to memory of 2532 4184 cmd.exe 109 PID 4184 wrote to memory of 2532 4184 cmd.exe 109 PID 4792 wrote to memory of 4420 4792 cmd.exe 111 PID 4792 wrote to memory of 4420 4792 cmd.exe 111 PID 4792 wrote to memory of 4420 4792 cmd.exe 111 PID 4184 wrote to memory of 1072 4184 cmd.exe 112 PID 4184 wrote to memory of 1072 4184 cmd.exe 112 PID 4184 wrote to memory of 1072 4184 cmd.exe 112 PID 4692 wrote to memory of 3172 4692 avgvcmd.exe 113 PID 4692 wrote to memory of 3172 4692 avgvcmd.exe 113 PID 4692 wrote to memory of 3172 4692 avgvcmd.exe 113 PID 4692 wrote to memory of 1260 4692 avgvcmd.exe 114 PID 4692 wrote to memory of 1260 4692 avgvcmd.exe 114 PID 4692 wrote to memory of 1260 4692 avgvcmd.exe 114 PID 4792 wrote to memory of 3996 4792 cmd.exe 115
Processes
-
C:\Users\Admin\AppData\Local\Temp\5d02c2dbc14460660b0d3dd2509f078a_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\5d02c2dbc14460660b0d3dd2509f078a_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3832 -
C:\Users\Admin\AppData\Local\Temp\5d02c2dbc14460660b0d3dd2509f078a_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\5d02c2dbc14460660b0d3dd2509f078a_JaffaCakes118.exe"2⤵
- Checks computer location settings
- Adds Run key to start application
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3280 -
C:\Windows\SysWOW64\avsysdb.exe"C:\Windows\system32\avsysdb.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2036 -
C:\Windows\SysWOW64\avsysdb.exe"C:\Windows\SysWOW64\avsysdb.exe"4⤵
- Event Triggered Execution: Image File Execution Options Injection
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4108 -
C:\Windows\SysWOW64\avgvcmd.exe"C:\Windows\system32\avgvcmd.exe"5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4356 -
C:\Windows\SysWOW64\avgvcmd.exe"C:\Windows\SysWOW64\avgvcmd.exe"6⤵
- Event Triggered Execution: Image File Execution Options Injection
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4692 -
C:\Windows\SysWOW64\avscpd.exe"C:\Windows\system32\avscpd.exe"7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3172 -
C:\Windows\SysWOW64\avscpd.exe"C:\Windows\SysWOW64\avscpd.exe"8⤵
- Event Triggered Execution: Image File Execution Options Injection
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3832 -
C:\Windows\SysWOW64\avgvsca.exe"C:\Windows\system32\avgvsca.exe"9⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4640 -
C:\Windows\SysWOW64\avgvsca.exe"C:\Windows\SysWOW64\avgvsca.exe"10⤵
- Event Triggered Execution: Image File Execution Options Injection
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:468 -
C:\Windows\SysWOW64\avmgsec.exe"C:\Windows\system32\avmgsec.exe"11⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4408 -
C:\Windows\SysWOW64\avmgsec.exe"C:\Windows\SysWOW64\avmgsec.exe"12⤵
- Event Triggered Execution: Image File Execution Options Injection
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3844 -
C:\Windows\SysWOW64\avghsta.exe"C:\Windows\system32\avghsta.exe"13⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1292 -
C:\Windows\SysWOW64\avghsta.exe"C:\Windows\SysWOW64\avghsta.exe"14⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4904 -
C:\Windows\SysWOW64\avsysdb.exe"C:\Windows\system32\avsysdb.exe"15⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2032 -
C:\Windows\SysWOW64\avsysdb.exe"C:\Windows\SysWOW64\avsysdb.exe"16⤵
- Event Triggered Execution: Image File Execution Options Injection
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3336 -
C:\Windows\SysWOW64\avrmnta.exe"C:\Windows\system32\avrmnta.exe"17⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3244 -
C:\Windows\SysWOW64\avrmnta.exe"C:\Windows\SysWOW64\avrmnta.exe"18⤵
- Event Triggered Execution: Image File Execution Options Injection
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3392 -
C:\Windows\SysWOW64\avghsta.exe"C:\Windows\system32\avghsta.exe"19⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4448 -
C:\Windows\SysWOW64\avghsta.exe"C:\Windows\SysWOW64\avghsta.exe"20⤵
- Event Triggered Execution: Image File Execution Options Injection
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1548 -
C:\Windows\SysWOW64\avgvcnt.exe"C:\Windows\system32\avgvcnt.exe"21⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3980 -
C:\Windows\SysWOW64\avgvcnt.exe"C:\Windows\SysWOW64\avgvcnt.exe"22⤵
- Event Triggered Execution: Image File Execution Options Injection
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:228 -
C:\Windows\SysWOW64\avgvcmd.exe"C:\Windows\system32\avgvcmd.exe"23⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4408 -
C:\Windows\SysWOW64\avgvcmd.exe"C:\Windows\SysWOW64\avgvcmd.exe"24⤵
- Event Triggered Execution: Image File Execution Options Injection
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1548 -
C:\Windows\SysWOW64\avgvmain.exe"C:\Windows\system32\avgvmain.exe"25⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2168 -
C:\Windows\SysWOW64\avgvmain.exe"C:\Windows\SysWOW64\avgvmain.exe"26⤵
- Event Triggered Execution: Image File Execution Options Injection
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4100 -
C:\Windows\SysWOW64\avgvmgr.exe"C:\Windows\system32\avgvmgr.exe"27⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2940 -
C:\Windows\SysWOW64\avgvmgr.exe"C:\Windows\SysWOW64\avgvmgr.exe"28⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4624 -
C:\Windows\SysWOW64\avgvcnt.exe"C:\Windows\system32\avgvcnt.exe"29⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:740 -
C:\Windows\SysWOW64\avgvcnt.exe"C:\Windows\SysWOW64\avgvcnt.exe"30⤵
- Event Triggered Execution: Image File Execution Options Injection
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1600 -
C:\Windows\SysWOW64\avgvsm.exe"C:\Windows\system32\avgvsm.exe"31⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4736 -
C:\Windows\SysWOW64\avgvsm.exe"C:\Windows\SysWOW64\avgvsm.exe"32⤵
- Event Triggered Execution: Image File Execution Options Injection
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2224 -
C:\Windows\SysWOW64\avgvsca.exe"C:\Windows\system32\avgvsca.exe"33⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2576 -
C:\Windows\SysWOW64\avgvsca.exe"C:\Windows\SysWOW64\avgvsca.exe"34⤵
- Event Triggered Execution: Image File Execution Options Injection
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2300 -
C:\Windows\SysWOW64\avsysdb.exe"C:\Windows\system32\avsysdb.exe"35⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4528 -
C:\Windows\SysWOW64\avsysdb.exe"C:\Windows\SysWOW64\avsysdb.exe"36⤵
- Event Triggered Execution: Image File Execution Options Injection
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4408 -
C:\Windows\SysWOW64\avmgsec.exe"C:\Windows\system32\avmgsec.exe"37⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2724 -
C:\Windows\SysWOW64\avmgsec.exe"C:\Windows\SysWOW64\avmgsec.exe"38⤵
- Event Triggered Execution: Image File Execution Options Injection
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3680 -
C:\Windows\SysWOW64\avmptr.exe"C:\Windows\system32\avmptr.exe"39⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:5840 -
C:\Windows\SysWOW64\avmptr.exe"C:\Windows\SysWOW64\avmptr.exe"40⤵
- Event Triggered Execution: Image File Execution Options Injection
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5880 -
C:\Windows\SysWOW64\avgvsca.exe"C:\Windows\system32\avgvsca.exe"41⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2416 -
C:\Windows\SysWOW64\avgvsca.exe"C:\Windows\SysWOW64\avgvsca.exe"42⤵
- Event Triggered Execution: Image File Execution Options Injection
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5152 -
C:\Windows\SysWOW64\avrmnta.exe"C:\Windows\system32\avrmnta.exe"43⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:6112 -
C:\Windows\SysWOW64\avrmnta.exe"C:\Windows\SysWOW64\avrmnta.exe"44⤵
- Event Triggered Execution: Image File Execution Options Injection
- Executes dropped EXE
- Adds Run key to start application
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5172 -
C:\Windows\SysWOW64\avgvmgr.exe"C:\Windows\system32\avgvmgr.exe"45⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:5360 -
C:\Windows\SysWOW64\avgvmgr.exe"C:\Windows\SysWOW64\avgvmgr.exe"46⤵
- Event Triggered Execution: Image File Execution Options Injection
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:6044 -
C:\Windows\SysWOW64\avgvspc.exe"C:\Windows\system32\avgvspc.exe"47⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:5672 -
C:\Windows\SysWOW64\avgvspc.exe"C:\Windows\SysWOW64\avgvspc.exe"48⤵
- Event Triggered Execution: Image File Execution Options Injection
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:680 -
C:\Windows\SysWOW64\avgvrnd.exe"C:\Windows\system32\avgvrnd.exe"49⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1344 -
C:\Windows\SysWOW64\avgvrnd.exe"C:\Windows\SysWOW64\avgvrnd.exe"50⤵
- Event Triggered Execution: Image File Execution Options Injection
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:6036 -
C:\Windows\SysWOW64\avgvmain.exe"C:\Windows\system32\avgvmain.exe"51⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:6040 -
C:\Windows\SysWOW64\avgvmain.exe"C:\Windows\SysWOW64\avgvmain.exe"52⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:932 -
C:\Windows\SysWOW64\avgvmgr.exe"C:\Windows\system32\avgvmgr.exe"53⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2724 -
C:\Windows\SysWOW64\avgvmgr.exe"C:\Windows\SysWOW64\avgvmgr.exe"54⤵
- Event Triggered Execution: Image File Execution Options Injection
- Executes dropped EXE
- Adds Run key to start application
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5648 -
C:\Windows\SysWOW64\avgvmgr.exe"C:\Windows\system32\avgvmgr.exe"55⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4400 -
C:\Windows\SysWOW64\avgvmgr.exe"C:\Windows\SysWOW64\avgvmgr.exe"56⤵
- Event Triggered Execution: Image File Execution Options Injection
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5548 -
C:\Windows\SysWOW64\avgvcnt.exe"C:\Windows\system32\avgvcnt.exe"57⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3740 -
C:\Windows\SysWOW64\avgvcnt.exe"C:\Windows\SysWOW64\avgvcnt.exe"58⤵
- Event Triggered Execution: Image File Execution Options Injection
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5656 -
C:\Windows\SysWOW64\avgvcmd.exe"C:\Windows\system32\avgvcmd.exe"59⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4836 -
C:\Windows\SysWOW64\avgvcmd.exe"C:\Windows\SysWOW64\avgvcmd.exe"60⤵
- Event Triggered Execution: Image File Execution Options Injection
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5288 -
C:\Windows\SysWOW64\avscpd.exe"C:\Windows\system32\avscpd.exe"61⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:748 -
C:\Windows\SysWOW64\avscpd.exe"C:\Windows\SysWOW64\avscpd.exe"62⤵
- Executes dropped EXE
- Adds Run key to start application
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5472 -
C:\Windows\SysWOW64\avscang.exe"C:\Windows\system32\avscang.exe"63⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:5288 -
C:\Windows\SysWOW64\avscang.exe"C:\Windows\SysWOW64\avscang.exe"64⤵
- Event Triggered Execution: Image File Execution Options Injection
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4100 -
C:\Windows\SysWOW64\avgvcmd.exe"C:\Windows\system32\avgvcmd.exe"65⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2188 -
C:\Windows\SysWOW64\avgvcmd.exe"C:\Windows\SysWOW64\avgvcmd.exe"66⤵
- Event Triggered Execution: Image File Execution Options Injection
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:5276 -
C:\Windows\SysWOW64\avgvmain.exe"C:\Windows\system32\avgvmain.exe"67⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
PID:5676 -
C:\Windows\SysWOW64\avgvmain.exe"C:\Windows\SysWOW64\avgvmain.exe"68⤵
- Event Triggered Execution: Image File Execution Options Injection
- Checks computer location settings
- Adds Run key to start application
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:2708 -
C:\Windows\SysWOW64\avruncm.exe"C:\Windows\system32\avruncm.exe"69⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
PID:5452 -
C:\Windows\SysWOW64\avruncm.exe"C:\Windows\SysWOW64\avruncm.exe"70⤵
- Event Triggered Execution: Image File Execution Options Injection
- Adds Run key to start application
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:5264 -
C:\Windows\SysWOW64\avruncm.exe"C:\Windows\system32\avruncm.exe"71⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
PID:2564 -
C:\Windows\SysWOW64\avruncm.exe"C:\Windows\SysWOW64\avruncm.exe"72⤵
- Event Triggered Execution: Image File Execution Options Injection
- Checks computer location settings
- Adds Run key to start application
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:4536 -
C:\Windows\SysWOW64\avghsta.exe"C:\Windows\system32\avghsta.exe"73⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
PID:5488 -
C:\Windows\SysWOW64\avghsta.exe"C:\Windows\SysWOW64\avghsta.exe"74⤵
- Adds Run key to start application
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:4184 -
C:\Windows\SysWOW64\avghsta.exe"C:\Windows\system32\avghsta.exe"75⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
PID:3592 -
C:\Windows\SysWOW64\avghsta.exe"C:\Windows\SysWOW64\avghsta.exe"76⤵
- Checks computer location settings
- Adds Run key to start application
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:6136 -
C:\Windows\SysWOW64\avgvspc.exe"C:\Windows\system32\avgvspc.exe"77⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
PID:3508 -
C:\Windows\SysWOW64\avgvspc.exe"C:\Windows\SysWOW64\avgvspc.exe"78⤵
- Checks computer location settings
- Adds Run key to start application
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:6060 -
C:\Windows\SysWOW64\avscang.exe"C:\Windows\system32\avscang.exe"79⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
PID:5848 -
C:\Windows\SysWOW64\avscang.exe"C:\Windows\SysWOW64\avscang.exe"80⤵
- Adds Run key to start application
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:3324
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "for /L %a in (1,1,30) do del "C:\Windows\SysWOW64\avscang.exe" && if exist "C:\Windows\SysWOW64\avscang.exe" ping -n 2 0.0.0.0"80⤵PID:5656
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\avgvspc.exe > nul79⤵PID:1308
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "for /L %a in (1,1,30) do del "C:\Windows\SysWOW64\avgvspc.exe" && if exist "C:\Windows\SysWOW64\avgvspc.exe" ping -n 2 0.0.0.0"78⤵PID:3152
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.079⤵PID:5428
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.079⤵PID:4348
-
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\avghsta.exe > nul77⤵PID:1552
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "for /L %a in (1,1,30) do del "C:\Windows\SysWOW64\avghsta.exe" && if exist "C:\Windows\SysWOW64\avghsta.exe" ping -n 2 0.0.0.0"76⤵PID:2072
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV177⤵PID:4932
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.077⤵PID:3600
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.077⤵PID:5504
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.077⤵PID:5440
-
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\avghsta.exe > nul75⤵PID:1508
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "for /L %a in (1,1,30) do del "C:\Windows\SysWOW64\avghsta.exe" && if exist "C:\Windows\SysWOW64\avghsta.exe" ping -n 2 0.0.0.0"74⤵PID:5108
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.075⤵PID:5208
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.075⤵PID:5332
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.075⤵PID:6096
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.075⤵PID:4356
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.075⤵PID:2600
-
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\avruncm.exe > nul73⤵PID:5136
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV174⤵PID:2708
-
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "for /L %a in (1,1,30) do del "C:\Windows\SysWOW64\avruncm.exe" && if exist "C:\Windows\SysWOW64\avruncm.exe" ping -n 2 0.0.0.0"72⤵PID:980
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV173⤵PID:5592
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.073⤵PID:5452
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.073⤵PID:4364
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.073⤵PID:3544
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.073⤵PID:2044
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.073⤵PID:1776
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.073⤵PID:5300
-
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\avruncm.exe > nul71⤵PID:888
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV172⤵PID:2960
-
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "for /L %a in (1,1,30) do del "C:\Windows\SysWOW64\avruncm.exe" && if exist "C:\Windows\SysWOW64\avruncm.exe" ping -n 2 0.0.0.0"70⤵PID:1144
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV171⤵PID:5560
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.071⤵PID:1576
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.071⤵PID:5272
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.071⤵PID:4564
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.071⤵PID:4380
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.071⤵PID:5924
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.071⤵PID:4724
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.071⤵PID:2944
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.071⤵PID:4100
-
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\avgvmain.exe > nul69⤵PID:5676
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "for /L %a in (1,1,30) do del "C:\Windows\SysWOW64\avgvmain.exe" && if exist "C:\Windows\SysWOW64\avgvmain.exe" ping -n 2 0.0.0.0"68⤵PID:5260
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.069⤵PID:5944
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.069⤵PID:2044
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.069⤵PID:5444
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.069⤵PID:4408
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.069⤵PID:4592
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.069⤵PID:5760
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.069⤵PID:5536
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.069⤵PID:3960
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.069⤵PID:60
-
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\avgvcmd.exe > nul67⤵PID:3888
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "for /L %a in (1,1,30) do del "C:\Windows\SysWOW64\avgvcmd.exe" && if exist "C:\Windows\SysWOW64\avgvcmd.exe" ping -n 2 0.0.0.0"66⤵PID:4624
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.067⤵PID:5512
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.067⤵PID:4428
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.067⤵PID:6132
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.067⤵PID:4724
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.067⤵PID:5596
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.067⤵PID:3284
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.067⤵PID:888
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.067⤵PID:2916
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.067⤵PID:5700
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.067⤵
- Runs ping.exe
PID:5140
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.067⤵PID:2236
-
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\avscang.exe > nul65⤵PID:6104
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV166⤵PID:5488
-
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "for /L %a in (1,1,30) do del "C:\Windows\SysWOW64\avscang.exe" && if exist "C:\Windows\SysWOW64\avscang.exe" ping -n 2 0.0.0.0"64⤵PID:5532
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV165⤵PID:4560
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.065⤵PID:5084
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.065⤵PID:1660
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.065⤵PID:5128
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.065⤵PID:1772
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.065⤵PID:1308
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.065⤵PID:5636
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.065⤵PID:3700
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.065⤵PID:4272
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.065⤵PID:5868
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.065⤵PID:1308
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.065⤵PID:632
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.065⤵PID:1500
-
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\avscpd.exe > nul63⤵PID:5660
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "for /L %a in (1,1,30) do del "C:\Windows\SysWOW64\avscpd.exe" && if exist "C:\Windows\SysWOW64\avscpd.exe" ping -n 2 0.0.0.0"62⤵PID:6012
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.063⤵PID:5396
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.063⤵PID:1708
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.063⤵PID:2688
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.063⤵PID:5508
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.063⤵
- Runs ping.exe
PID:3116
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.063⤵PID:1408
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.063⤵PID:228
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.063⤵
- Runs ping.exe
PID:4488
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.063⤵PID:5276
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.063⤵PID:4308
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.063⤵PID:1268
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.063⤵PID:3584
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.063⤵PID:6068
-
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\avgvcmd.exe > nul61⤵PID:4088
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "for /L %a in (1,1,30) do del "C:\Windows\SysWOW64\avgvcmd.exe" && if exist "C:\Windows\SysWOW64\avgvcmd.exe" ping -n 2 0.0.0.0"60⤵PID:5320
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV161⤵PID:4916
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.061⤵PID:5328
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.061⤵
- Runs ping.exe
PID:5940
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.061⤵
- Runs ping.exe
PID:2280
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.061⤵PID:1564
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.061⤵PID:3420
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.061⤵PID:5640
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.061⤵PID:4488
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.061⤵PID:3332
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.061⤵PID:5416
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.061⤵PID:2388
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.061⤵PID:936
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.061⤵PID:5744
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.061⤵PID:2280
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.061⤵PID:976
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.061⤵PID:5740
-
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\avgvcnt.exe > nul59⤵PID:5600
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "for /L %a in (1,1,30) do del "C:\Windows\SysWOW64\avgvcnt.exe" && if exist "C:\Windows\SysWOW64\avgvcnt.exe" ping -n 2 0.0.0.0"58⤵PID:5784
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.059⤵PID:3888
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.059⤵PID:3132
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.059⤵PID:5240
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.059⤵PID:5212
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.059⤵PID:5044
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.059⤵PID:5140
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.059⤵PID:5028
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.059⤵PID:4532
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.059⤵PID:2072
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.059⤵PID:5504
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.059⤵PID:5244
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.059⤵PID:5896
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.059⤵PID:5660
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.059⤵PID:1380
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.059⤵PID:5876
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.059⤵PID:1032
-
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\avgvmgr.exe > nul57⤵PID:3028
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "for /L %a in (1,1,30) do del "C:\Windows\SysWOW64\avgvmgr.exe" && if exist "C:\Windows\SysWOW64\avgvmgr.exe" ping -n 2 0.0.0.0"56⤵PID:5048
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.057⤵PID:4348
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.057⤵PID:5568
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.057⤵PID:4872
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.057⤵PID:5912
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.057⤵PID:5944
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.057⤵PID:5428
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.057⤵PID:5744
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.057⤵PID:1268
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.057⤵PID:4712
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.057⤵PID:3452
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.057⤵PID:4148
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.057⤵PID:2428
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.057⤵PID:2336
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.057⤵PID:5444
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.057⤵PID:6036
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.057⤵PID:5940
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.057⤵PID:5696
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.057⤵PID:320
-
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\avgvmgr.exe > nul55⤵PID:6044
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "for /L %a in (1,1,30) do del "C:\Windows\SysWOW64\avgvmgr.exe" && if exist "C:\Windows\SysWOW64\avgvmgr.exe" ping -n 2 0.0.0.0"54⤵PID:4384
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.055⤵PID:5908
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.055⤵PID:2168
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.055⤵PID:2404
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.055⤵PID:5596
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.055⤵PID:5244
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.055⤵PID:5504
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.055⤵PID:2072
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.055⤵PID:5204
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.055⤵PID:6000
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.055⤵PID:2032
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.055⤵PID:2168
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.055⤵PID:5376
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.055⤵PID:5208
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.055⤵PID:5044
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.055⤵PID:1180
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.055⤵PID:544
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.055⤵PID:1604
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.055⤵PID:404
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.055⤵PID:1904
-
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\avgvmain.exe > nul53⤵PID:748
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "for /L %a in (1,1,30) do del "C:\Windows\SysWOW64\avgvmain.exe" && if exist "C:\Windows\SysWOW64\avgvmain.exe" ping -n 2 0.0.0.0"52⤵PID:4644
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV153⤵PID:6024
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.053⤵PID:5348
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.053⤵PID:3068
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.053⤵PID:6060
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.053⤵PID:5352
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.053⤵PID:5968
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.053⤵PID:5036
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.053⤵PID:5560
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.053⤵PID:5596
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.053⤵PID:5408
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.053⤵PID:4928
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.053⤵PID:5588
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.053⤵PID:5700
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.053⤵PID:5008
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.053⤵PID:5856
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.053⤵PID:644
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.053⤵PID:2008
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.053⤵PID:5636
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.053⤵PID:5820
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.053⤵PID:228
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.053⤵PID:5596
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.053⤵PID:5328
-
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\avgvrnd.exe > nul51⤵PID:4528
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "for /L %a in (1,1,30) do del "C:\Windows\SysWOW64\avgvrnd.exe" && if exist "C:\Windows\SysWOW64\avgvrnd.exe" ping -n 2 0.0.0.0"50⤵PID:5168
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.051⤵PID:5612
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.051⤵PID:5392
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.051⤵PID:6000
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.051⤵PID:6004
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.051⤵PID:5764
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.051⤵PID:6136
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.051⤵PID:5916
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.051⤵PID:1708
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.051⤵PID:4904
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.051⤵PID:2336
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.051⤵PID:4272
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.051⤵PID:5388
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.051⤵PID:2960
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.051⤵PID:6056
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.051⤵PID:3132
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.051⤵PID:4252
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.051⤵PID:1408
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.051⤵
- Runs ping.exe
PID:5968
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.051⤵PID:3064
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.051⤵PID:3332
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.051⤵PID:2912
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.051⤵PID:6080
-
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\avgvspc.exe > nul49⤵PID:6024
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "for /L %a in (1,1,30) do del "C:\Windows\SysWOW64\avgvspc.exe" && if exist "C:\Windows\SysWOW64\avgvspc.exe" ping -n 2 0.0.0.0"48⤵PID:5728
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.049⤵PID:2464
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.049⤵PID:5484
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.049⤵PID:5684
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.049⤵PID:4856
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.049⤵PID:2404
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.049⤵PID:4184
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.049⤵PID:4836
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.049⤵PID:5832
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.049⤵PID:5740
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.049⤵PID:5572
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.049⤵PID:3848
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.049⤵PID:5264
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.049⤵PID:2732
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.049⤵PID:320
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.049⤵PID:5828
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.049⤵PID:5284
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.049⤵PID:5700
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.049⤵
- Runs ping.exe
PID:6044
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.049⤵PID:2032
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.049⤵PID:4500
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.049⤵PID:4396
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.049⤵PID:3272
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.049⤵PID:5388
-
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\avgvmgr.exe > nul47⤵PID:5744
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "for /L %a in (1,1,30) do del "C:\Windows\SysWOW64\avgvmgr.exe" && if exist "C:\Windows\SysWOW64\avgvmgr.exe" ping -n 2 0.0.0.0"46⤵PID:2880
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.047⤵PID:5448
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.047⤵PID:4640
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.047⤵PID:5664
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.047⤵PID:2872
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.047⤵PID:6060
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.047⤵PID:1140
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.047⤵PID:5620
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.047⤵PID:5508
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.047⤵PID:5164
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.047⤵PID:5172
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.047⤵PID:6108
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.047⤵PID:5420
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.047⤵PID:1464
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.047⤵PID:5536
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.047⤵PID:5912
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.047⤵PID:648
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.047⤵PID:5596
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.047⤵PID:5372
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.047⤵PID:5944
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.047⤵PID:4240
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.047⤵PID:1824
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.047⤵PID:6028
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.047⤵PID:5292
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.047⤵PID:932
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.047⤵PID:1464
-
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\avrmnta.exe > nul45⤵PID:3992
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "for /L %a in (1,1,30) do del "C:\Windows\SysWOW64\avrmnta.exe" && if exist "C:\Windows\SysWOW64\avrmnta.exe" ping -n 2 0.0.0.0"44⤵PID:2124
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.045⤵PID:3588
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.045⤵PID:5824
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.045⤵PID:6024
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.045⤵PID:4428
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.045⤵PID:3828
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.045⤵PID:5240
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.045⤵PID:4736
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.045⤵PID:6136
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.045⤵PID:5348
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.045⤵PID:4916
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.045⤵PID:5592
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.045⤵PID:4688
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.045⤵PID:3988
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.045⤵PID:5548
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.045⤵PID:5296
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.045⤵PID:4308
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.045⤵PID:3432
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.045⤵PID:3696
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.045⤵PID:3376
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.045⤵PID:3844
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.045⤵PID:4212
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.045⤵PID:4628
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.045⤵PID:5908
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.045⤵PID:5984
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.045⤵PID:3980
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.045⤵PID:232
-
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\avgvsca.exe > nul43⤵PID:5148
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "for /L %a in (1,1,30) do del "C:\Windows\SysWOW64\avgvsca.exe" && if exist "C:\Windows\SysWOW64\avgvsca.exe" ping -n 2 0.0.0.0"42⤵PID:5632
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.043⤵PID:5232
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.043⤵PID:3184
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.043⤵PID:3732
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.043⤵PID:4856
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.043⤵PID:4240
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.043⤵PID:5172
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.043⤵PID:2404
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.043⤵PID:4184
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.043⤵PID:6028
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.043⤵PID:5336
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.043⤵
- Runs ping.exe
PID:5672
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.043⤵PID:5552
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.043⤵PID:2832
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.043⤵PID:4408
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.043⤵PID:5424
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.043⤵PID:3432
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.043⤵PID:4904
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.043⤵PID:3960
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.043⤵PID:5644
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.043⤵PID:6044
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.043⤵PID:3180
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.043⤵PID:3464
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.043⤵PID:5604
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.043⤵PID:1776
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.043⤵PID:5232
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.043⤵PID:5204
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.043⤵PID:3916
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.043⤵PID:5136
-
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\avmptr.exe > nul41⤵PID:5164
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "for /L %a in (1,1,30) do del "C:\Windows\SysWOW64\avmptr.exe" && if exist "C:\Windows\SysWOW64\avmptr.exe" ping -n 2 0.0.0.0"40⤵PID:5956
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.041⤵PID:6024
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.041⤵PID:2224
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.041⤵PID:5384
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.041⤵PID:5852
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.041⤵PID:4624
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.041⤵PID:2688
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.041⤵PID:5260
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.041⤵PID:5788
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.041⤵PID:1740
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.041⤵PID:5372
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.041⤵PID:2532
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.041⤵PID:3092
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.041⤵PID:5924
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.041⤵PID:5200
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.041⤵PID:3928
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.041⤵PID:4428
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.041⤵PID:5872
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.041⤵PID:1180
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.041⤵
- Runs ping.exe
PID:4008
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.041⤵PID:4016
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.041⤵PID:5212
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.041⤵PID:4348
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.041⤵PID:1336
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.041⤵PID:5304
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.041⤵PID:6104
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.041⤵PID:6004
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.041⤵PID:4252
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.041⤵PID:2356
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.041⤵PID:4872
-
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\avmgsec.exe > nul39⤵PID:5868
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "for /L %a in (1,1,30) do del "C:\Windows\SysWOW64\avmgsec.exe" && if exist "C:\Windows\SysWOW64\avmgsec.exe" ping -n 2 0.0.0.0"38⤵PID:3296
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV139⤵PID:1220
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.039⤵PID:748
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.039⤵PID:5512
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.039⤵PID:2792
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.039⤵PID:3680
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.039⤵PID:5772
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.039⤵PID:3292
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.039⤵PID:4376
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.039⤵PID:3152
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.039⤵PID:2832
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.039⤵PID:4456
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.039⤵PID:5468
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.039⤵PID:5300
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.039⤵PID:5448
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.039⤵PID:5896
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.039⤵PID:5272
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.039⤵PID:2980
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.039⤵PID:2000
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.039⤵PID:6084
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.039⤵PID:4148
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.039⤵PID:5148
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.039⤵PID:1796
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.039⤵PID:5504
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.039⤵PID:5924
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.039⤵PID:5940
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.039⤵PID:5732
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.039⤵PID:5508
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.039⤵PID:6108
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.039⤵PID:3420
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.039⤵PID:5436
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.039⤵PID:1508
-
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\avsysdb.exe > nul37⤵PID:1860
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "for /L %a in (1,1,30) do del "C:\Windows\SysWOW64\avsysdb.exe" && if exist "C:\Windows\SysWOW64\avsysdb.exe" ping -n 2 0.0.0.0"36⤵PID:5088
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV137⤵PID:408
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.037⤵PID:1564
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.037⤵PID:3960
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.037⤵PID:5260
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.037⤵PID:6032
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.037⤵PID:2532
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.037⤵PID:5436
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.037⤵PID:3384
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.037⤵PID:5896
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.037⤵PID:1860
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.037⤵PID:6000
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.037⤵PID:5672
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.037⤵PID:5136
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.037⤵PID:5548
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.037⤵PID:5528
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.037⤵PID:2224
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.037⤵PID:6008
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.037⤵PID:5140
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.037⤵PID:5264
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.037⤵PID:1636
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.037⤵PID:4932
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.037⤵PID:1140
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.037⤵PID:5484
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.037⤵PID:5292
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.037⤵PID:5148
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.037⤵PID:5880
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.037⤵PID:5712
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.037⤵PID:4352
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.037⤵PID:5928
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.037⤵PID:784
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.037⤵PID:5344
-
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\avgvsca.exe > nul35⤵PID:1344
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "for /L %a in (1,1,30) do del "C:\Windows\SysWOW64\avgvsca.exe" && if exist "C:\Windows\SysWOW64\avgvsca.exe" ping -n 2 0.0.0.0"34⤵PID:2468
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.035⤵PID:1872
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.035⤵PID:1576
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.035⤵PID:4856
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.035⤵PID:2668
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.035⤵PID:5560
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.035⤵PID:3028
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.035⤵
- Runs ping.exe
PID:5936
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.035⤵PID:6028
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.035⤵PID:5600
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.035⤵PID:5500
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.035⤵PID:2276
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.035⤵PID:3092
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.035⤵PID:3132
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.035⤵PID:6012
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.035⤵
- Runs ping.exe
PID:5232
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.035⤵PID:2132
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.035⤵PID:2416
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.035⤵PID:5536
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.035⤵PID:1564
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.035⤵PID:6136
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.035⤵PID:5680
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.035⤵PID:1692
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.035⤵PID:5452
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.035⤵PID:5740
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.035⤵PID:3844
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.035⤵PID:3828
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.035⤵PID:5852
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.035⤵PID:5952
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.035⤵PID:5672
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.035⤵PID:2812
-
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\avgvsm.exe > nul33⤵PID:4912
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "for /L %a in (1,1,30) do del "C:\Windows\SysWOW64\avgvsm.exe" && if exist "C:\Windows\SysWOW64\avgvsm.exe" ping -n 2 0.0.0.0"32⤵PID:1476
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.033⤵PID:60
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.033⤵PID:2460
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.033⤵PID:3064
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.033⤵PID:3956
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.033⤵PID:4804
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.033⤵PID:5344
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.033⤵PID:2880
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.033⤵PID:5648
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.033⤵PID:5532
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.033⤵PID:5332
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.033⤵PID:5288
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.033⤵PID:5176
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.033⤵PID:5452
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.033⤵PID:2004
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.033⤵PID:3544
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.033⤵PID:6048
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.033⤵PID:6080
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.033⤵PID:5604
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.033⤵PID:6092
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.033⤵PID:4008
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.033⤵PID:5296
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.033⤵PID:6004
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.033⤵PID:3028
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.033⤵PID:5652
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.033⤵PID:5324
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.033⤵PID:2456
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.033⤵PID:5732
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.033⤵PID:5536
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.033⤵PID:5212
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.033⤵PID:5036
-
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\avgvcnt.exe > nul31⤵PID:2000
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "for /L %a in (1,1,30) do del "C:\Windows\SysWOW64\avgvcnt.exe" && if exist "C:\Windows\SysWOW64\avgvcnt.exe" ping -n 2 0.0.0.0"30⤵PID:936
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.031⤵PID:3452
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.031⤵PID:3996
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.031⤵PID:5044
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.031⤵PID:4836
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.031⤵PID:3884
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.031⤵PID:2348
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.031⤵PID:5184
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.031⤵PID:5768
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.031⤵PID:3956
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.031⤵PID:5344
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.031⤵PID:2004
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.031⤵PID:5720
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.031⤵PID:1408
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.031⤵PID:1164
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.031⤵PID:5548
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.031⤵PID:5900
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.031⤵PID:3960
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.031⤵PID:6092
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.031⤵PID:5172
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.031⤵PID:5624
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.031⤵PID:1880
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.031⤵PID:932
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.031⤵PID:4560
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.031⤵PID:3092
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.031⤵PID:6108
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.031⤵PID:5760
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.031⤵PID:3668
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.031⤵PID:4360
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.031⤵PID:5872
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.031⤵PID:4428
-
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\avgvmgr.exe > nul29⤵PID:2124
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "for /L %a in (1,1,30) do del "C:\Windows\SysWOW64\avgvmgr.exe" && if exist "C:\Windows\SysWOW64\avgvmgr.exe" ping -n 2 0.0.0.0"28⤵PID:888
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.029⤵PID:1564
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.029⤵PID:2620
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.029⤵PID:1428
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.029⤵PID:4860
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.029⤵PID:2456
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.029⤵PID:4972
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.029⤵
- Runs ping.exe
PID:1860
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.029⤵PID:2832
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.029⤵PID:5408
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.029⤵PID:3036
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.029⤵PID:5708
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.029⤵PID:3924
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.029⤵PID:2832
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.029⤵PID:5392
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.029⤵PID:5216
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.029⤵PID:5644
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.029⤵PID:3188
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.029⤵PID:5448
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.029⤵PID:5176
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.029⤵PID:5744
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.029⤵PID:5732
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.029⤵PID:5488
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.029⤵PID:5008
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.029⤵PID:4276
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.029⤵PID:1356
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.029⤵PID:6052
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.029⤵PID:4380
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.029⤵PID:2224
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.029⤵PID:3292
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.029⤵PID:2564
-
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\avgvmain.exe > nul27⤵PID:2832
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "for /L %a in (1,1,30) do del "C:\Windows\SysWOW64\avgvmain.exe" && if exist "C:\Windows\SysWOW64\avgvmain.exe" ping -n 2 0.0.0.0"26⤵PID:976
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.027⤵PID:1208
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.027⤵PID:320
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.027⤵PID:3884
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.027⤵PID:3596
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.027⤵PID:2620
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.027⤵PID:4272
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.027⤵PID:408
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.027⤵PID:368
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.027⤵PID:2588
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.027⤵PID:5212
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.027⤵PID:5912
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.027⤵PID:4416
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.027⤵PID:5336
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.027⤵PID:2032
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.027⤵PID:4792
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.027⤵PID:6068
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.027⤵PID:5896
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.027⤵PID:5768
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.027⤵PID:5524
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.027⤵PID:60
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.027⤵PID:5164
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.027⤵PID:5440
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.027⤵PID:5932
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.027⤵PID:4592
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.027⤵PID:5720
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.027⤵PID:5608
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.027⤵PID:3376
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.027⤵PID:5852
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.027⤵PID:5664
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.027⤵PID:5428
-
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\avgvcmd.exe > nul25⤵PID:3292
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "for /L %a in (1,1,30) do del "C:\Windows\SysWOW64\avgvcmd.exe" && if exist "C:\Windows\SysWOW64\avgvcmd.exe" ping -n 2 0.0.0.0"24⤵PID:1336
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.025⤵PID:2268
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.025⤵PID:4624
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.025⤵PID:3828
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.025⤵PID:4408
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.025⤵PID:2008
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.025⤵PID:4488
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.025⤵PID:2236
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.025⤵PID:5036
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.025⤵
- Runs ping.exe
PID:3832
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.025⤵PID:932
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.025⤵PID:4736
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.025⤵PID:5384
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.025⤵PID:1700
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.025⤵PID:5692
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.025⤵PID:5540
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.025⤵PID:5040
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.025⤵PID:5352
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.025⤵PID:2456
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.025⤵PID:4008
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.025⤵PID:3068
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.025⤵PID:2132
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.025⤵
- Runs ping.exe
PID:4256
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.025⤵PID:5180
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.025⤵PID:392
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.025⤵PID:3988
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.025⤵PID:6012
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.025⤵PID:3596
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.025⤵PID:980
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.025⤵PID:5508
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.025⤵PID:5372
-
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\avgvcnt.exe > nul23⤵PID:1332
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "for /L %a in (1,1,30) do del "C:\Windows\SysWOW64\avgvcnt.exe" && if exist "C:\Windows\SysWOW64\avgvcnt.exe" ping -n 2 0.0.0.0"22⤵PID:4308
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.023⤵PID:3028
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.023⤵PID:1628
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.023⤵PID:4856
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.023⤵PID:2632
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.023⤵PID:5088
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.023⤵PID:2284
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.023⤵PID:3116
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.023⤵PID:2588
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.023⤵PID:1408
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.023⤵PID:1332
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.023⤵PID:3768
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.023⤵PID:1220
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.023⤵PID:4456
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.023⤵PID:5488
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.023⤵PID:3528
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.023⤵PID:5220
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.023⤵PID:5736
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.023⤵PID:1872
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.023⤵PID:1596
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.023⤵PID:2724
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.023⤵PID:2576
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.023⤵PID:3732
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.023⤵PID:4576
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.023⤵PID:2872
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.023⤵PID:5700
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.023⤵PID:4696
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.023⤵PID:5228
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.023⤵PID:3960
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.023⤵PID:4812
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.023⤵PID:6056
-
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\avghsta.exe > nul21⤵PID:4276
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "for /L %a in (1,1,30) do del "C:\Windows\SysWOW64\avghsta.exe" && if exist "C:\Windows\SysWOW64\avghsta.exe" ping -n 2 0.0.0.0"20⤵PID:3332
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.021⤵PID:3960
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.021⤵PID:3244
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.021⤵PID:3592
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.021⤵PID:408
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.021⤵PID:2388
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.021⤵PID:1604
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.021⤵PID:1408
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.021⤵PID:8
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.021⤵PID:1564
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.021⤵PID:3392
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.021⤵PID:1944
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.021⤵PID:1752
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.021⤵PID:4376
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.021⤵PID:4100
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.021⤵PID:5236
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.021⤵PID:5984
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.021⤵PID:3376
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.021⤵PID:5416
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.021⤵PID:4912
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.021⤵PID:5228
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.021⤵PID:6124
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.021⤵PID:5316
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.021⤵PID:5180
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.021⤵PID:5364
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.021⤵PID:1868
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.021⤵PID:5488
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.021⤵PID:5388
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.021⤵PID:5300
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.021⤵PID:5760
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.021⤵PID:4256
-
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\avrmnta.exe > nul19⤵PID:1128
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "for /L %a in (1,1,30) do del "C:\Windows\SysWOW64\avrmnta.exe" && if exist "C:\Windows\SysWOW64\avrmnta.exe" ping -n 2 0.0.0.0"18⤵PID:4532
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.019⤵PID:3092
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.019⤵PID:1508
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.019⤵PID:3596
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.019⤵PID:3884
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.019⤵PID:8
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.019⤵PID:4384
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.019⤵PID:2600
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.019⤵PID:2260
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.019⤵PID:3560
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.019⤵PID:4836
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.019⤵PID:4108
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.019⤵PID:3064
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.019⤵PID:1880
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.019⤵PID:920
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.019⤵PID:2500
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.019⤵PID:5152
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.019⤵PID:5736
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.019⤵PID:1552
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.019⤵PID:2440
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.019⤵PID:4980
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.019⤵PID:5668
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.019⤵PID:5944
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.019⤵PID:5540
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.019⤵PID:6072
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.019⤵PID:4320
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.019⤵PID:5480
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.019⤵PID:6008
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.019⤵PID:4008
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.019⤵PID:1428
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.019⤵PID:4404
-
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\avsysdb.exe > nul17⤵PID:888
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "for /L %a in (1,1,30) do del "C:\Windows\SysWOW64\avsysdb.exe" && if exist "C:\Windows\SysWOW64\avsysdb.exe" ping -n 2 0.0.0.0"16⤵PID:4132
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.017⤵PID:2588
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.017⤵PID:320
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.017⤵PID:4748
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.017⤵PID:2140
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.017⤵PID:1828
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.017⤵PID:3064
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.017⤵PID:544
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.017⤵PID:4256
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.017⤵PID:2952
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.017⤵PID:5052
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.017⤵PID:764
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.017⤵PID:2284
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.017⤵PID:4364
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.017⤵PID:4400
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.017⤵PID:1364
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.017⤵PID:1880
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.017⤵PID:2412
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.017⤵PID:5308
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.017⤵PID:6112
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.017⤵PID:1740
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.017⤵PID:5484
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.017⤵PID:4872
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.017⤵PID:5264
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.017⤵PID:5184
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.017⤵PID:5336
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.017⤵PID:5948
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.017⤵PID:5356
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.017⤵PID:5696
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.017⤵PID:5536
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.017⤵PID:1756
-
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\avghsta.exe > nul15⤵PID:5036
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "for /L %a in (1,1,30) do del "C:\Windows\SysWOW64\avghsta.exe" && if exist "C:\Windows\SysWOW64\avghsta.exe" ping -n 2 0.0.0.0"14⤵PID:4920
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.015⤵PID:1700
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.015⤵PID:2456
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.015⤵PID:2036
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.015⤵PID:2784
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.015⤵PID:3600
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.015⤵PID:4204
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.015⤵PID:3324
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.015⤵PID:4972
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.015⤵PID:1568
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.015⤵PID:4428
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.015⤵PID:1500
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.015⤵PID:4456
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.015⤵PID:1752
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.015⤵PID:2268
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.015⤵PID:1860
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.015⤵PID:4100
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.015⤵PID:3596
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.015⤵PID:228
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.015⤵PID:1564
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.015⤵PID:5336
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.015⤵PID:5172
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.015⤵PID:5668
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.015⤵PID:5492
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.015⤵PID:5156
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.015⤵PID:6004
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.015⤵PID:5624
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.015⤵PID:5604
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.015⤵PID:4348
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.015⤵PID:5352
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.015⤵PID:5732
-
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\avmgsec.exe > nul13⤵PID:2140
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "for /L %a in (1,1,30) do del "C:\Windows\SysWOW64\avmgsec.exe" && if exist "C:\Windows\SysWOW64\avmgsec.exe" ping -n 2 0.0.0.0"12⤵PID:2280
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.013⤵PID:3920
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.013⤵PID:3296
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.013⤵PID:4988
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.013⤵PID:4972
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.013⤵PID:2576
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.013⤵PID:2224
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.013⤵PID:3700
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.013⤵PID:3968
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.013⤵PID:4608
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.013⤵PID:2284
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.013⤵PID:3956
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.013⤵PID:368
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.013⤵PID:2124
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.013⤵PID:3244
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.013⤵
- Runs ping.exe
PID:4036
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.013⤵PID:1208
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.013⤵PID:4736
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.013⤵PID:3384
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.013⤵PID:3116
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.013⤵PID:3560
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.013⤵PID:2276
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.013⤵PID:5584
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.013⤵PID:2456
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.013⤵PID:5304
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.013⤵PID:6120
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.013⤵PID:5652
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.013⤵PID:5536
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.013⤵PID:4464
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.013⤵PID:5388
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.013⤵PID:1872
-
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\avgvsca.exe > nul11⤵PID:4820
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "for /L %a in (1,1,30) do del "C:\Windows\SysWOW64\avgvsca.exe" && if exist "C:\Windows\SysWOW64\avgvsca.exe" ping -n 2 0.0.0.0"10⤵PID:1796
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.011⤵PID:1604
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.011⤵PID:1904
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.011⤵PID:2576
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.011⤵PID:3244
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.011⤵PID:3092
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.011⤵PID:4420
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.011⤵PID:4856
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.011⤵PID:3528
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.011⤵PID:1516
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.011⤵PID:3284
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.011⤵PID:1752
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.011⤵PID:932
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.011⤵PID:4108
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.011⤵PID:2268
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.011⤵PID:936
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.011⤵PID:4428
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.011⤵PID:5076
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.011⤵PID:4748
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.011⤵
- Runs ping.exe
PID:2260
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.011⤵PID:1552
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.011⤵PID:3028
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.011⤵PID:2596
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.011⤵PID:5284
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.011⤵PID:6088
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.011⤵PID:2140
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.011⤵PID:3576
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.011⤵PID:2388
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.011⤵PID:5268
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.011⤵PID:5124
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.011⤵PID:5344
-
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\avscpd.exe > nul9⤵PID:5048
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "for /L %a in (1,1,30) do del "C:\Windows\SysWOW64\avscpd.exe" && if exist "C:\Windows\SysWOW64\avscpd.exe" ping -n 2 0.0.0.0"8⤵PID:5008
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.09⤵PID:1408
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.09⤵PID:3968
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.09⤵PID:3600
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.09⤵PID:1432
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.09⤵PID:1212
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.09⤵PID:1220
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.09⤵PID:4608
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.09⤵PID:2092
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.09⤵PID:3996
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.09⤵PID:4428
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.09⤵
- Runs ping.exe
PID:1544
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.09⤵PID:2124
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.09⤵PID:368
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.09⤵PID:2952
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.09⤵PID:3700
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.09⤵PID:4376
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.09⤵PID:5076
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.09⤵PID:1220
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.09⤵PID:3560
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.09⤵PID:3028
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.09⤵PID:3528
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.09⤵PID:3420
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.09⤵PID:4912
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.09⤵PID:3596
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.09⤵PID:5464
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.09⤵PID:1576
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.09⤵PID:5732
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.09⤵PID:5592
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.09⤵PID:4456
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.09⤵PID:6080
-
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\avgvcmd.exe > nul7⤵PID:1260
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "for /L %a in (1,1,30) do del "C:\Windows\SysWOW64\avgvcmd.exe" && if exist "C:\Windows\SysWOW64\avgvcmd.exe" ping -n 2 0.0.0.0"6⤵
- Suspicious use of WriteProcessMemory
PID:4184 -
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.07⤵PID:2532
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.07⤵PID:1072
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.07⤵PID:2300
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.07⤵PID:3680
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.07⤵PID:2812
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.07⤵PID:1400
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.07⤵PID:920
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.07⤵PID:1604
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.07⤵PID:2832
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.07⤵PID:2300
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.07⤵PID:1220
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.07⤵PID:4528
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.07⤵PID:2748
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.07⤵PID:1344
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.07⤵PID:1600
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.07⤵PID:2000
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.07⤵PID:4872
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.07⤵PID:464
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.07⤵PID:4488
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.07⤵PID:5040
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.07⤵PID:4360
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.07⤵PID:2532
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.07⤵PID:2940
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.07⤵PID:1152
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.07⤵PID:1344
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.07⤵PID:3132
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.07⤵PID:5520
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.07⤵PID:1332
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.07⤵PID:5840
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.07⤵PID:6036
-
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\avsysdb.exe > nul5⤵PID:2444
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "for /L %a in (1,1,30) do del "C:\Windows\SysWOW64\avsysdb.exe" && if exist "C:\Windows\SysWOW64\avsysdb.exe" ping -n 2 0.0.0.0"4⤵
- Suspicious use of WriteProcessMemory
PID:4792 -
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.05⤵PID:468
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.05⤵PID:4272
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.05⤵PID:4420
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.05⤵PID:3996
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.05⤵PID:228
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.05⤵PID:2388
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.05⤵PID:368
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.05⤵PID:1576
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.05⤵PID:2468
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.05⤵PID:2532
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.05⤵PID:2276
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.05⤵PID:3268
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.05⤵PID:4804
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.05⤵PID:5076
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.05⤵PID:3732
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.05⤵PID:748
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.05⤵PID:1604
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.05⤵PID:2412
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.05⤵PID:1516
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.05⤵PID:3596
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.05⤵PID:3392
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.05⤵PID:4624
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.05⤵PID:4276
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.05⤵PID:3336
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.05⤵PID:4856
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.05⤵PID:5044
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.05⤵PID:4488
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.05⤵PID:5432
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.05⤵PID:3280
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.05⤵PID:5180
-
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\5D02C2~1.EXE > nul3⤵PID:4784
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "for /L %a in (1,1,30) do del "C:\Users\Admin\AppData\Local\Temp\5d02c2dbc14460660b0d3dd2509f078a_JaffaCakes118.exe" && if exist "C:\Users\Admin\AppData\Local\Temp\5d02c2dbc14460660b0d3dd2509f078a_JaffaCakes118.exe" ping -n 2 0.0.0.0"2⤵
- Suspicious use of WriteProcessMemory
PID:1812 -
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.03⤵PID:1700
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 0.0.0.03⤵PID:2620
-
-
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca1⤵PID:4792
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Image File Execution Options Injection
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
91KB
MD55d02c2dbc14460660b0d3dd2509f078a
SHA12148d0c47021bfd9c601d415816202dd36f14a1a
SHA25685d49ac2051c839d3df8b3724c74cc41cc198bc380f626af3287480a0a830b18
SHA512676eccb27680a62247bd984be2d948b5b50e0b9e589eb145276494044160e212419d8ea50127038865f5483528f80afd9fc8344e495a1cf12a769adb30a00174