Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
158s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
26/07/2024, 06:30
Static task
static1
Behavioral task
behavioral1
Sample
72efb8ce495abcc5d0513eca8d5cd07a_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
72efb8ce495abcc5d0513eca8d5cd07a_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
72efb8ce495abcc5d0513eca8d5cd07a_JaffaCakes118.exe
-
Size
19KB
-
MD5
72efb8ce495abcc5d0513eca8d5cd07a
-
SHA1
5a4653a620a54e229acdc9774e122d201292564c
-
SHA256
8b8e66d39c2aef111ec17621167dc32c20635e09080bb2340a76fb5a779a60da
-
SHA512
74259b52f6761413816e1755708bcde23e730e93f3c828aff68112632df1ddea927faa91927314485c78f5fe2f4b3c15ef7735900877e70fcdce9774fe6876a6
-
SSDEEP
192:rjBPHGypoknDzNDL8EwD1yxDhsC+FpYKkvyFWjcCDi:rjx5XJL8EqoxNZ+FpY/Kwjre
Malware Config
Signatures
-
Modifies Windows Firewall 2 TTPs 1 IoCs
pid Process 2456 netsh.exe -
Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 3588 sc.exe -
Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 72efb8ce495abcc5d0513eca8d5cd07a_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe -
Kills process with taskkill 64 IoCs
pid Process 3660 taskkill.exe 3060 taskkill.exe 388 taskkill.exe 3644 taskkill.exe 2184 taskkill.exe 4460 taskkill.exe 1448 taskkill.exe 4380 taskkill.exe 1232 taskkill.exe 3628 taskkill.exe 2040 taskkill.exe 2164 taskkill.exe 2648 taskkill.exe 4568 taskkill.exe 4936 taskkill.exe 3556 taskkill.exe 3572 taskkill.exe 1468 taskkill.exe 2988 taskkill.exe 4020 taskkill.exe 3532 taskkill.exe 5012 taskkill.exe 1404 taskkill.exe 4228 taskkill.exe 2776 taskkill.exe 3768 taskkill.exe 4688 taskkill.exe 4312 taskkill.exe 1136 taskkill.exe 2100 taskkill.exe 1608 taskkill.exe 5000 taskkill.exe 4880 taskkill.exe 2548 taskkill.exe 3672 taskkill.exe 1308 taskkill.exe 1008 taskkill.exe 4704 taskkill.exe 3196 taskkill.exe 4432 taskkill.exe 1568 taskkill.exe 3972 taskkill.exe 752 taskkill.exe 920 taskkill.exe 1716 taskkill.exe 4000 taskkill.exe 5076 taskkill.exe 1472 taskkill.exe 2084 taskkill.exe 1028 taskkill.exe 2716 taskkill.exe 552 taskkill.exe 2744 taskkill.exe 4204 taskkill.exe 2896 taskkill.exe 4072 taskkill.exe 1124 taskkill.exe 4956 taskkill.exe 956 taskkill.exe 3772 taskkill.exe 2040 taskkill.exe 2548 taskkill.exe 324 taskkill.exe 208 taskkill.exe -
Runs net.exe
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 1008 taskkill.exe Token: SeDebugPrivilege 4312 taskkill.exe Token: SeDebugPrivilege 4968 taskkill.exe Token: SeDebugPrivilege 4148 taskkill.exe Token: SeDebugPrivilege 3556 taskkill.exe Token: SeDebugPrivilege 4880 taskkill.exe Token: SeDebugPrivilege 1124 taskkill.exe Token: SeDebugPrivilege 3660 taskkill.exe Token: SeDebugPrivilege 4380 taskkill.exe Token: SeDebugPrivilege 3972 taskkill.exe Token: SeDebugPrivilege 3572 taskkill.exe Token: SeDebugPrivilege 752 taskkill.exe Token: SeDebugPrivilege 920 taskkill.exe Token: SeDebugPrivilege 4496 taskkill.exe Token: SeDebugPrivilege 1404 taskkill.exe Token: SeDebugPrivilege 2548 taskkill.exe Token: SeDebugPrivilege 4072 taskkill.exe Token: SeDebugPrivilege 2164 taskkill.exe Token: SeDebugPrivilege 1136 taskkill.exe Token: SeDebugPrivilege 4228 taskkill.exe Token: SeDebugPrivilege 4956 taskkill.exe Token: SeDebugPrivilege 552 taskkill.exe Token: SeDebugPrivilege 3672 taskkill.exe Token: SeDebugPrivilege 2100 taskkill.exe Token: SeDebugPrivilege 1716 taskkill.exe Token: SeDebugPrivilege 3196 taskkill.exe Token: SeDebugPrivilege 1472 taskkill.exe Token: SeDebugPrivilege 1608 taskkill.exe Token: SeDebugPrivilege 2744 taskkill.exe Token: SeDebugPrivilege 956 taskkill.exe Token: SeDebugPrivilege 1232 taskkill.exe Token: SeDebugPrivilege 3644 taskkill.exe Token: SeDebugPrivilege 4344 taskkill.exe Token: SeDebugPrivilege 2648 taskkill.exe Token: SeDebugPrivilege 3628 taskkill.exe Token: SeDebugPrivilege 2184 taskkill.exe Token: SeDebugPrivilege 4460 taskkill.exe Token: SeDebugPrivilege 2776 taskkill.exe Token: SeDebugPrivilege 3772 taskkill.exe Token: SeDebugPrivilege 2040 taskkill.exe Token: SeDebugPrivilege 2084 taskkill.exe Token: SeDebugPrivilege 4568 taskkill.exe Token: SeDebugPrivilege 2548 taskkill.exe Token: SeDebugPrivilege 4072 taskkill.exe Token: SeDebugPrivilege 1448 taskkill.exe Token: SeDebugPrivilege 1028 taskkill.exe Token: SeDebugPrivilege 4936 taskkill.exe Token: SeDebugPrivilege 1468 taskkill.exe Token: SeDebugPrivilege 2716 taskkill.exe Token: SeDebugPrivilege 4432 taskkill.exe Token: SeDebugPrivilege 3060 taskkill.exe Token: SeDebugPrivilege 4204 taskkill.exe Token: SeDebugPrivilege 1308 taskkill.exe Token: SeDebugPrivilege 2896 taskkill.exe Token: SeDebugPrivilege 324 taskkill.exe Token: SeDebugPrivilege 208 taskkill.exe Token: SeDebugPrivilege 624 taskkill.exe Token: SeDebugPrivilege 3768 taskkill.exe Token: SeDebugPrivilege 4000 taskkill.exe Token: SeDebugPrivilege 764 taskkill.exe Token: SeDebugPrivilege 5076 taskkill.exe Token: SeDebugPrivilege 656 taskkill.exe Token: SeDebugPrivilege 5000 taskkill.exe Token: SeDebugPrivilege 4020 taskkill.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3104 wrote to memory of 3548 3104 72efb8ce495abcc5d0513eca8d5cd07a_JaffaCakes118.exe 85 PID 3104 wrote to memory of 3548 3104 72efb8ce495abcc5d0513eca8d5cd07a_JaffaCakes118.exe 85 PID 3104 wrote to memory of 3548 3104 72efb8ce495abcc5d0513eca8d5cd07a_JaffaCakes118.exe 85 PID 3548 wrote to memory of 3448 3548 cmd.exe 86 PID 3548 wrote to memory of 3448 3548 cmd.exe 86 PID 3548 wrote to memory of 3448 3548 cmd.exe 86 PID 3448 wrote to memory of 3672 3448 net.exe 87 PID 3448 wrote to memory of 3672 3448 net.exe 87 PID 3448 wrote to memory of 3672 3448 net.exe 87 PID 3104 wrote to memory of 3000 3104 72efb8ce495abcc5d0513eca8d5cd07a_JaffaCakes118.exe 88 PID 3104 wrote to memory of 3000 3104 72efb8ce495abcc5d0513eca8d5cd07a_JaffaCakes118.exe 88 PID 3104 wrote to memory of 3000 3104 72efb8ce495abcc5d0513eca8d5cd07a_JaffaCakes118.exe 88 PID 3000 wrote to memory of 2456 3000 cmd.exe 89 PID 3000 wrote to memory of 2456 3000 cmd.exe 89 PID 3000 wrote to memory of 2456 3000 cmd.exe 89 PID 3104 wrote to memory of 1108 3104 72efb8ce495abcc5d0513eca8d5cd07a_JaffaCakes118.exe 91 PID 3104 wrote to memory of 1108 3104 72efb8ce495abcc5d0513eca8d5cd07a_JaffaCakes118.exe 91 PID 3104 wrote to memory of 1108 3104 72efb8ce495abcc5d0513eca8d5cd07a_JaffaCakes118.exe 91 PID 1108 wrote to memory of 1140 1108 cmd.exe 92 PID 1108 wrote to memory of 1140 1108 cmd.exe 92 PID 1108 wrote to memory of 1140 1108 cmd.exe 92 PID 1140 wrote to memory of 1752 1140 net.exe 93 PID 1140 wrote to memory of 1752 1140 net.exe 93 PID 1140 wrote to memory of 1752 1140 net.exe 93 PID 3104 wrote to memory of 2528 3104 72efb8ce495abcc5d0513eca8d5cd07a_JaffaCakes118.exe 94 PID 3104 wrote to memory of 2528 3104 72efb8ce495abcc5d0513eca8d5cd07a_JaffaCakes118.exe 94 PID 3104 wrote to memory of 2528 3104 72efb8ce495abcc5d0513eca8d5cd07a_JaffaCakes118.exe 94 PID 2528 wrote to memory of 3248 2528 cmd.exe 95 PID 2528 wrote to memory of 3248 2528 cmd.exe 95 PID 2528 wrote to memory of 3248 2528 cmd.exe 95 PID 3248 wrote to memory of 4952 3248 net.exe 96 PID 3248 wrote to memory of 4952 3248 net.exe 96 PID 3248 wrote to memory of 4952 3248 net.exe 96 PID 3104 wrote to memory of 2324 3104 72efb8ce495abcc5d0513eca8d5cd07a_JaffaCakes118.exe 97 PID 3104 wrote to memory of 2324 3104 72efb8ce495abcc5d0513eca8d5cd07a_JaffaCakes118.exe 97 PID 3104 wrote to memory of 2324 3104 72efb8ce495abcc5d0513eca8d5cd07a_JaffaCakes118.exe 97 PID 2324 wrote to memory of 3588 2324 cmd.exe 98 PID 2324 wrote to memory of 3588 2324 cmd.exe 98 PID 2324 wrote to memory of 3588 2324 cmd.exe 98 PID 3104 wrote to memory of 3004 3104 72efb8ce495abcc5d0513eca8d5cd07a_JaffaCakes118.exe 99 PID 3104 wrote to memory of 3004 3104 72efb8ce495abcc5d0513eca8d5cd07a_JaffaCakes118.exe 99 PID 3104 wrote to memory of 3004 3104 72efb8ce495abcc5d0513eca8d5cd07a_JaffaCakes118.exe 99 PID 3004 wrote to memory of 1008 3004 cmd.exe 100 PID 3004 wrote to memory of 1008 3004 cmd.exe 100 PID 3004 wrote to memory of 1008 3004 cmd.exe 100 PID 3104 wrote to memory of 4180 3104 72efb8ce495abcc5d0513eca8d5cd07a_JaffaCakes118.exe 103 PID 3104 wrote to memory of 4180 3104 72efb8ce495abcc5d0513eca8d5cd07a_JaffaCakes118.exe 103 PID 3104 wrote to memory of 4180 3104 72efb8ce495abcc5d0513eca8d5cd07a_JaffaCakes118.exe 103 PID 4180 wrote to memory of 4312 4180 cmd.exe 104 PID 4180 wrote to memory of 4312 4180 cmd.exe 104 PID 4180 wrote to memory of 4312 4180 cmd.exe 104 PID 3104 wrote to memory of 1232 3104 72efb8ce495abcc5d0513eca8d5cd07a_JaffaCakes118.exe 105 PID 3104 wrote to memory of 1232 3104 72efb8ce495abcc5d0513eca8d5cd07a_JaffaCakes118.exe 105 PID 3104 wrote to memory of 1232 3104 72efb8ce495abcc5d0513eca8d5cd07a_JaffaCakes118.exe 105 PID 1232 wrote to memory of 4968 1232 cmd.exe 106 PID 1232 wrote to memory of 4968 1232 cmd.exe 106 PID 1232 wrote to memory of 4968 1232 cmd.exe 106 PID 3104 wrote to memory of 4604 3104 72efb8ce495abcc5d0513eca8d5cd07a_JaffaCakes118.exe 107 PID 3104 wrote to memory of 4604 3104 72efb8ce495abcc5d0513eca8d5cd07a_JaffaCakes118.exe 107 PID 3104 wrote to memory of 4604 3104 72efb8ce495abcc5d0513eca8d5cd07a_JaffaCakes118.exe 107 PID 4604 wrote to memory of 4148 4604 cmd.exe 108 PID 4604 wrote to memory of 4148 4604 cmd.exe 108 PID 4604 wrote to memory of 4148 4604 cmd.exe 108 PID 3104 wrote to memory of 3904 3104 72efb8ce495abcc5d0513eca8d5cd07a_JaffaCakes118.exe 110
Processes
-
C:\Users\Admin\AppData\Local\Temp\72efb8ce495abcc5d0513eca8d5cd07a_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\72efb8ce495abcc5d0513eca8d5cd07a_JaffaCakes118.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3104 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c @net stop wscsvc >nul2⤵
- Suspicious use of WriteProcessMemory
PID:3548 -
C:\Windows\SysWOW64\net.exenet stop wscsvc3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3448 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop wscsvc4⤵
- System Location Discovery: System Language Discovery
PID:3672
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c @netsh firewall set opmode mode = disable >nul2⤵
- Suspicious use of WriteProcessMemory
PID:3000 -
C:\Windows\SysWOW64\netsh.exenetsh firewall set opmode mode = disable3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:2456
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c @net stop SharedAccess >nul2⤵
- Suspicious use of WriteProcessMemory
PID:1108 -
C:\Windows\SysWOW64\net.exenet stop SharedAccess3⤵
- Suspicious use of WriteProcessMemory
PID:1140 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SharedAccess4⤵PID:1752
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c @net stop wscsvc >nul2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2528 -
C:\Windows\SysWOW64\net.exenet stop wscsvc3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3248 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop wscsvc4⤵PID:4952
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c @sc config wscsvc start= disabled2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2324 -
C:\Windows\SysWOW64\sc.exesc config wscsvc start= disabled3⤵
- Launches sc.exe
PID:3588
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c @taskkill /f /im avgcc.exe >nul2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3004 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im avgcc.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1008
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c @taskkill /f /im avgcc.exe >nul2⤵
- Suspicious use of WriteProcessMemory
PID:4180 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im avgcc.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4312
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c @taskkill /f /im avgamsvr.exe >nul2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1232 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im avgamsvr.exe3⤵
- Suspicious use of AdjustPrivilegeToken
PID:4968
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c @taskkill /f /im avgupsvc.exe >nul2⤵
- Suspicious use of WriteProcessMemory
PID:4604 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im avgupsvc.exe3⤵
- Suspicious use of AdjustPrivilegeToken
PID:4148
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c @taskkill /f /im avgw.exe >nul2⤵PID:3904
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im avgw.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3556
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c @taskkill /f /im avgcc32.exe >nul2⤵
- System Location Discovery: System Language Discovery
PID:868 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im avgcc32.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4880
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c @taskkill /f /im avgctrl.exe >nul2⤵
- System Location Discovery: System Language Discovery
PID:4820 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im avgctrl.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1124
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c @taskkill /f /im avgserv.exe >nul2⤵
- System Location Discovery: System Language Discovery
PID:1848 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im avgserv.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3660
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c @taskkill /f /im avgserv9.exe >nul2⤵PID:4460
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im avgserv9.exe3⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4380
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c @taskkill /f /im avgserv9schedapp.exe >nul2⤵PID:2776
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im avgserv9schedapp.exe3⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3972
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c @taskkill /f /im avgw.exe >nul2⤵PID:3772
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im avgw.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3572
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c @taskkill /f /im avgemc.exe >nul2⤵PID:2040
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im avgemc.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:752
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c @taskkill /f /im ashwebsv.exe >nul2⤵PID:1020
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im ashwebsv.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:920
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c @taskkill /f /im ashdisp.exe >nul2⤵PID:2848
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im ashdisp.exe3⤵
- Suspicious use of AdjustPrivilegeToken
PID:4496
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c @taskkill /f /im ashmaisv.exe >nul2⤵PID:2824
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im ashmaisv.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1404
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c @taskkill /f /im ashserv.exe >nul2⤵
- System Location Discovery: System Language Discovery
PID:4060 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im ashserv.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2548
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c @taskkill /f /im aswUpdSv.exe >nul2⤵PID:2584
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im aswUpdSv.exe3⤵
- Suspicious use of AdjustPrivilegeToken
PID:4072
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c @taskkill /f /im ashwebsv.exe >nul2⤵PID:4080
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im ashwebsv.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2164
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c @taskkill /f /im savscan.exe >nul2⤵
- System Location Discovery: System Language Discovery
PID:4644 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im savscan.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1136
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c @taskkill /f /im symwsc.exe >nul2⤵PID:1776
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im symwsc.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4228
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c @taskkill /f /im norton.exe >nul2⤵PID:3040
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im norton.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4956
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c @taskkill /f /im Norton Auto-Protect.exe >nul2⤵PID:2716
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im Norton Auto-Protect.exe3⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
PID:4704
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c @taskkill /f /im norton_av.exe >nul2⤵
- System Location Discovery: System Language Discovery
PID:4444 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im norton_av.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:552
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c @taskkill /f /im norton_av.exe >nul2⤵PID:3060
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im norton_av.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3672
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c @taskkill /f /im nortonav.exe >nul2⤵PID:4204
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im nortonav.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2100
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c @taskkill /f /im ccsetmgr.exe >nul2⤵PID:1308
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im ccsetmgr.exe3⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1716
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c @taskkill /f /im ccevtmgr.exe >nul2⤵
- System Location Discovery: System Language Discovery
PID:2896 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im ccevtmgr.exe3⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3196
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c @taskkill /f /im ashwebsv.exe >nul2⤵PID:4908
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im ashwebsv.exe3⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1472
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c @taskkill /f /im ashwebsv.exe >nul2⤵PID:208
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im ashwebsv.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1608
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c @taskkill /f /im ashdisp.exe >nul2⤵
- System Location Discovery: System Language Discovery
PID:624 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im ashdisp.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2744
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c @taskkill /f /im ashmaisv.exe >nul2⤵
- System Location Discovery: System Language Discovery
PID:3184 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im ashmaisv.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:956
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c @taskkill /f /im ashserv.exe >nul2⤵PID:2884
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im ashserv.exe3⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1232
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c @taskkill /f /im aswUpdSv.exe >nul2⤵PID:2032
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im aswUpdSv.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3644
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c @taskkill /f /im ashwebsv.exe >nul2⤵
- System Location Discovery: System Language Discovery
PID:3564 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im ashwebsv.exe3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4344
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c @taskkill /f /im avadmin.exe >nul2⤵PID:1652
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im avadmin.exe3⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2648
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c @taskkill /f /im avcenter.exe >nul2⤵PID:3728
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im avcenter.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3628
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c @taskkill /f /im avgnt.exe >nul2⤵PID:4004
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im avgnt.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2184
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c @taskkill /f /im avguard.exe >nul2⤵
- System Location Discovery: System Language Discovery
PID:4380 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im avguard.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4460
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c @taskkill /f /im avnotify.exe >nul2⤵
- System Location Discovery: System Language Discovery
PID:3972 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im avnotify.exe3⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2776
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c @taskkill /f /im avscan.exe >nul2⤵PID:3572
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im avscan.exe3⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3772
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c @taskkill /f /im guardgui.exe >nul2⤵PID:752
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im guardgui.exe3⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2040
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c @taskkill /f /im nod32krn.exe >nul2⤵PID:2640
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im nod32krn.exe3⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2084
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c @taskkill /f /im nod32kui.exe >nul2⤵
- System Location Discovery: System Language Discovery
PID:4496 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im nod32kui.exe3⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4568
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c @taskkill /f /im clamscan.exe >nul2⤵PID:4888
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im clamscan.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2548
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c @taskkill /f /im clamTray.exe >nul2⤵PID:4812
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im clamTray.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4072
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c @taskkill /f /im clamWin.exe >nul2⤵PID:1520
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im clamWin.exe3⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1448
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c @taskkill /f /im freshclam.exe >nul2⤵PID:996
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im freshclam.exe3⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1028
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c @taskkill /f /im oladdin.exe >nul2⤵PID:5012
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im oladdin.exe3⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4936
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c @taskkill /f /im sigtool.exe >nul2⤵PID:548
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im sigtool.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1468
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c @taskkill /f /im w9xpopen.exe >nul2⤵PID:4704
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im w9xpopen.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2716
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c @taskkill /f /im Wclose.exe >nul2⤵PID:4068
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im Wclose.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4432
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c @taskkill /f /im cmgrdian.exe >nul2⤵PID:3672
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im cmgrdian.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3060
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c @taskkill /f /im oladdin.exe >nul2⤵PID:2100
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im oladdin.exe3⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4204
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c @taskkill /f /im alogserv.exe >nul2⤵PID:1716
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im alogserv.exe3⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1308
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c @taskkill /f /im mcshield.exe >nul2⤵PID:3196
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im mcshield.exe3⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2896
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c @taskkill /f /im vshwin32.exe >nul2⤵PID:1472
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im vshwin32.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:324
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c @taskkill /f /im avconsol.exe >nul2⤵
- System Location Discovery: System Language Discovery
PID:3588 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im avconsol.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:208
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c @taskkill /f /im vsstat.exe >nul2⤵
- System Location Discovery: System Language Discovery
PID:2744 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im vsstat.exe3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:624
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c @taskkill /f /im vsstat.exe >nul2⤵
- System Location Discovery: System Language Discovery
PID:2496 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im vsstat.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3768
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c @taskkill /f /im avsynmgr.exe >nul2⤵
- System Location Discovery: System Language Discovery
PID:2252 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im avsynmgr.exe3⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4000
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c @taskkill /f /im avcenter.exe >nul2⤵PID:4160
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im avcenter.exe3⤵
- Suspicious use of AdjustPrivilegeToken
PID:764
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c @taskkill /f /im avcmd.exe >nul2⤵PID:1980
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im avcmd.exe3⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:5076
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c @taskkill /f /im avconfig.exe >nul2⤵PID:864
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im avconfig.exe3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:656
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c @taskkill /f /im avguard.exe >nul2⤵
- System Location Discovery: System Language Discovery
PID:4380 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im avguard.exe3⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:5000
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c @taskkill /f /im avgnt.exe >nul2⤵
- System Location Discovery: System Language Discovery
PID:888 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im avgnt.exe3⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4020
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c @taskkill /f /im avnotify.exe >nul2⤵
- System Location Discovery: System Language Discovery
PID:5024 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im avnotify.exe3⤵
- Kills process with taskkill
PID:2040
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c @taskkill /f /im avscan.exe >nul2⤵
- System Location Discovery: System Language Discovery
PID:1020 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im avscan.exe3⤵
- Kills process with taskkill
PID:388
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c @taskkill /f /im guardgui.exe >nul2⤵
- System Location Discovery: System Language Discovery
PID:3540 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im guardgui.exe3⤵PID:4568
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c @taskkill /f /im licmgr.exe >nul2⤵PID:3484
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im licmgr.exe3⤵
- Kills process with taskkill
PID:1568
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c @taskkill /f /im sched.exe >nul2⤵
- System Location Discovery: System Language Discovery
PID:3916 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im sched.exe3⤵
- Kills process with taskkill
PID:3532
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c @taskkill /f /im preupd.exe >nul2⤵
- System Location Discovery: System Language Discovery
PID:3908 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im preupd.exe3⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
PID:2988
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c @taskkill /f /im MsMpEng.exe >nul2⤵
- System Location Discovery: System Language Discovery
PID:4600 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im MsMpEng.exe3⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
PID:4688
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c @taskkill /f /im MSASCui.exe >nul2⤵
- System Location Discovery: System Language Discovery
PID:4464 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im MSASCui.exe3⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
PID:5012
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Create or Modify System Process
2Windows Service
2Event Triggered Execution
1Netsh Helper DLL
1Privilege Escalation
Create or Modify System Process
2Windows Service
2Event Triggered Execution
1Netsh Helper DLL
1