574b02890cf382dd0571e15ae8888e80ac37124813136ea17c68491c3699e488

Analysis

max time kernel
150s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
19/08/2024, 11:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

aa65483e4d8cd10c7ce8bacc309bc0b1JaffaCakes118.exe
Size

103KB
MD5

aa65483e4d8cd10c7ce8bacc309bc0b1
SHA1

5e4b25626f3606a6ea7669074659fb544441bf81
SHA256

574b02890cf382dd0571e15ae8888e80ac37124813136ea17c68491c3699e488
SHA512

740e226540a9dec5c75876295c80ff587d0cd4a123dedc7f77728488a706ed3bf0c39381f1ea8977e6a9e6cf3211a42f778d51e5be8c50416616d174fe8ae9a6
SSDEEP

1536:dl7ZhWzeiygbFdmg1h55r1JpHdXyjTqfvQi5Xz/RFnrHCLo/D+RLjajKBaMTZ+yE:dVZhAeiygbrVyjmntzTkG+RXtaMt5CUg

Score

8^/10

defense_evasion discovery persistence

Malware Config

Signatures

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 28 IoCs

persistence

Image File Execution Options Injection

T1546.012

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ctfmon.exe	avmptr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ctfmon.exe	avgvsyt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ctfmon.exe\Debugger = "avgvspec.exe"	avrmnta.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ctfmon.exe\Debugger = "avgvscno.exe"	avmptr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ctfmon.exe	avrmnta.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ctfmon.exe	avgvspec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ctfmon.exe	aa65483e4d8cd10c7ce8bacc309bc0b1JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ctfmon.exe	avgvsyt.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ctfmon.exe	avruncom.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ctfmon.exe	avgvspec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ctfmon.exe\Debugger = "avmptr.exe"	avgvspec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ctfmon.exe	avmptr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ctfmon.exe	avgvscno.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ctfmon.exe\Debugger = "avmptr.exe"	avgvscno.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ctfmon.exe\Debugger = "avmptr.exe"	aa65483e4d8cd10c7ce8bacc309bc0b1JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ctfmon.exe\Debugger = "avghostn.exe"	avmptr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ctfmon.exe	avgvcmd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ctfmon.exe	avrmnta.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ctfmon.exe\Debugger = "avruncom.exe"	avgvsyt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ctfmon.exe\Debugger = "avruncom.exe"	avgvspec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ctfmon.exe	avghostn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ctfmon.exe\Debugger = "avgvsyt.exe"	avgvsyt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ctfmon.exe\Debugger = "avgvspec.exe"	avruncom.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ctfmon.exe\Debugger = "avgvcmd.exe"	avghostn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ctfmon.exe\Debugger = "avrmnta.exe"	avgvcmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ctfmon.exe\Debugger = "avrmnta.exe"	avmptr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ctfmon.exe\Debugger = "avgvsyt.exe"	avrmnta.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ctfmon.exe	avmptr.exe

Checks computer location settings 2 TTPs 29 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Control Panel\International\Geo\Nation	avgvspec.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Control Panel\International\Geo\Nation	avghostn.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Control Panel\International\Geo\Nation	avgvcmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Control Panel\International\Geo\Nation	avmptr.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Control Panel\International\Geo\Nation	avrmnta.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Control Panel\International\Geo\Nation	avrmnta.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Control Panel\International\Geo\Nation	avgvscno.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Control Panel\International\Geo\Nation	avgvsyt.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Control Panel\International\Geo\Nation	avruncom.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Control Panel\International\Geo\Nation	aa65483e4d8cd10c7ce8bacc309bc0b1JaffaCakes118.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Control Panel\International\Geo\Nation	avgvscno.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Control Panel\International\Geo\Nation	avrmnta.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Control Panel\International\Geo\Nation	avruncom.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Control Panel\International\Geo\Nation	avmptr.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Control Panel\International\Geo\Nation	avmptr.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Control Panel\International\Geo\Nation	avgvcmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Control Panel\International\Geo\Nation	avruncom.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Control Panel\International\Geo\Nation	avgvspec.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Control Panel\International\Geo\Nation	aa65483e4d8cd10c7ce8bacc309bc0b1JaffaCakes118.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Control Panel\International\Geo\Nation	avmptr.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Control Panel\International\Geo\Nation	avmptr.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Control Panel\International\Geo\Nation	avgvsyt.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Control Panel\International\Geo\Nation	avgvsyt.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Control Panel\International\Geo\Nation	avghostn.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Control Panel\International\Geo\Nation	avgvspec.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Control Panel\International\Geo\Nation	avgvsyt.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Control Panel\International\Geo\Nation	avgvspec.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Control Panel\International\Geo\Nation	avrmnta.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Control Panel\International\Geo\Nation	avmptr.exe

Executes dropped EXE 28 IoCs

pid	Process
1324	avmptr.exe
4200	avmptr.exe
2208	avghostn.exe
2552	avghostn.exe
4776	avgvcmd.exe
1388	avgvcmd.exe
680	avrmnta.exe
1672	avrmnta.exe
4544	avgvspec.exe
2180	avgvspec.exe
2100	avmptr.exe
220	avmptr.exe
764	avgvscno.exe
4916	avgvscno.exe
1312	avmptr.exe
3324	avmptr.exe
3616	avrmnta.exe
4928	avrmnta.exe
2528	avgvsyt.exe
1564	avgvsyt.exe
1884	avgvsyt.exe
1244	avgvsyt.exe
4816	avruncom.exe
3532	avruncom.exe
3648	avgvspec.exe
1280	avgvspec.exe
3332	avruncom.exe
4704	avruncom.exe

Adds Run key to start application 2 TTPs 14 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ctfmon.exe = "ctfmon.exe"	avghostn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ctfmon.exe = "ctfmon.exe"	avgvsyt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ctfmon.exe = "ctfmon.exe"	avgvsyt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ctfmon.exe = "ctfmon.exe"	aa65483e4d8cd10c7ce8bacc309bc0b1JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ctfmon.exe = "ctfmon.exe"	avmptr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ctfmon.exe = "ctfmon.exe"	avgvscno.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ctfmon.exe = "ctfmon.exe"	avrmnta.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ctfmon.exe = "ctfmon.exe"	avgvspec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ctfmon.exe = "ctfmon.exe"	avgvcmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ctfmon.exe = "ctfmon.exe"	avrmnta.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ctfmon.exe = "ctfmon.exe"	avmptr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ctfmon.exe = "ctfmon.exe"	avruncom.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ctfmon.exe = "ctfmon.exe"	avgvspec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ctfmon.exe = "ctfmon.exe"	avmptr.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Drops file in System32 directory 28 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\avrmnta.exe	avmptr.exe
File opened for modification	C:\Windows\SysWOW64\avmptr.exe	aa65483e4d8cd10c7ce8bacc309bc0b1JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\avgvspec.exe	avrmnta.exe
File created	C:\Windows\SysWOW64\avmptr.exe	avgvspec.exe
File opened for modification	C:\Windows\SysWOW64\avgvsyt.exe	avgvsyt.exe
File opened for modification	C:\Windows\SysWOW64\avruncom.exe	avgvsyt.exe
File opened for modification	C:\Windows\SysWOW64\avghostn.exe	avmptr.exe
File created	C:\Windows\SysWOW64\avgvcmd.exe	avghostn.exe
File opened for modification	C:\Windows\SysWOW64\avmptr.exe	avgvscno.exe
File opened for modification	C:\Windows\SysWOW64\avrmnta.exe	avgvcmd.exe
File created	C:\Windows\SysWOW64\avgvscno.exe	avmptr.exe
File created	C:\Windows\SysWOW64\avruncom.exe	avgvsyt.exe
File created	C:\Windows\SysWOW64\avmptr.exe	aa65483e4d8cd10c7ce8bacc309bc0b1JaffaCakes118.exe
File created	C:\Windows\SysWOW64\avghostn.exe	avmptr.exe
File opened for modification	C:\Windows\SysWOW64\avgvcmd.exe	avghostn.exe
File created	C:\Windows\SysWOW64\avrmnta.exe	avmptr.exe
File opened for modification	C:\Windows\SysWOW64\avgvspec.exe	avruncom.exe
File created	C:\Windows\SysWOW64\avruncom.exe	avgvspec.exe
File created	C:\Windows\SysWOW64\avrmnta.exe	avgvcmd.exe
File opened for modification	C:\Windows\SysWOW64\avmptr.exe	avgvspec.exe
File created	C:\Windows\SysWOW64\avmptr.exe	avgvscno.exe
File created	C:\Windows\SysWOW64\avgvspec.exe	avruncom.exe
File opened for modification	C:\Windows\SysWOW64\avruncom.exe	avgvspec.exe
File opened for modification	C:\Windows\SysWOW64\avgvscno.exe	avmptr.exe
File created	C:\Windows\SysWOW64\avgvsyt.exe	avrmnta.exe
File created	C:\Windows\SysWOW64\avgvsyt.exe	avgvsyt.exe
File created	C:\Windows\SysWOW64\avgvspec.exe	avrmnta.exe
File opened for modification	C:\Windows\SysWOW64\avgvsyt.exe	avrmnta.exe

Suspicious use of SetThreadContext 15 IoCs

description	pid	Process	procid_target
PID 3440 set thread context of 2496	3440	aa65483e4d8cd10c7ce8bacc309bc0b1JaffaCakes118.exe	97
PID 1324 set thread context of 4200	1324	avmptr.exe	115
PID 2208 set thread context of 2552	2208	avghostn.exe	131
PID 4776 set thread context of 1388	4776	avgvcmd.exe	158
PID 680 set thread context of 1672	680	avrmnta.exe	193
PID 4544 set thread context of 2180	4544	avgvspec.exe	230
PID 2100 set thread context of 220	2100	avmptr.exe	266
PID 764 set thread context of 4916	764	avgvscno.exe	304
PID 1312 set thread context of 3324	1312	avmptr.exe	339
PID 3616 set thread context of 4928	3616	avrmnta.exe	375
PID 2528 set thread context of 1564	2528	avgvsyt.exe	419
PID 1884 set thread context of 1244	1884	avgvsyt.exe	456
PID 4816 set thread context of 3532	4816	avruncom.exe	490
PID 3648 set thread context of 1280	3648	avgvspec.exe	529
PID 3332 set thread context of 4704	3332	avruncom.exe	566

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aa65483e4d8cd10c7ce8bacc309bc0b1JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	avmptr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	avghostn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	avgvsyt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	avgvspec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	avgvcmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 64 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
3992	cmd.exe
532	PING.EXE
2084	PING.EXE
4188	PING.EXE
1344	PING.EXE
1072	PING.EXE
4784	PING.EXE
536	PING.EXE
2100	PING.EXE
2552	PING.EXE
3364	PING.EXE
3932	PING.EXE
4496	PING.EXE
4444	PING.EXE
848	PING.EXE
2288	PING.EXE
1796	PING.EXE
2680	PING.EXE
3004	PING.EXE
4108	PING.EXE
4356	PING.EXE
4072	PING.EXE
3572	PING.EXE
1244	cmd.exe
4904	PING.EXE
1976	PING.EXE
2804	PING.EXE
5096	PING.EXE
3040	PING.EXE
1688	PING.EXE
1304	PING.EXE
1592	cmd.exe
2348	PING.EXE
1944	PING.EXE
2124	PING.EXE
1396	PING.EXE
2180	PING.EXE
4836	PING.EXE
4952	PING.EXE
1704	PING.EXE
2932	PING.EXE
4080	PING.EXE
3584	PING.EXE
2976	PING.EXE
4016	PING.EXE
2448	PING.EXE
4428	PING.EXE
2040	PING.EXE
4968	PING.EXE
4784	PING.EXE
2004	PING.EXE
776	PING.EXE
2240	PING.EXE
2316	PING.EXE
4496	PING.EXE
220	PING.EXE
1896	PING.EXE
1156	PING.EXE
8	PING.EXE
4792	PING.EXE
3776	PING.EXE
1796	PING.EXE
4972	PING.EXE
4852	PING.EXE

Modifies registry class 14 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	avmptr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	avgvscno.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	avghostn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	avmptr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	avrmnta.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	avgvsyt.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	avruncom.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	avmptr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	avgvcmd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	avgvspec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	avgvspec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	aa65483e4d8cd10c7ce8bacc309bc0b1JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	avrmnta.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	avgvsyt.exe

Runs ping.exe 1 TTPs 64 IoCs

Remote System Discovery

T1018

pid	Process
3040	PING.EXE
1796	PING.EXE
536	PING.EXE
888	PING.EXE
2288	PING.EXE
1964	PING.EXE
1104	PING.EXE
4348	PING.EXE
2084	PING.EXE
1016	PING.EXE
2100	PING.EXE
1648	PING.EXE
848	PING.EXE
4636	PING.EXE
4188	PING.EXE
4044	PING.EXE
4716	PING.EXE
4480	PING.EXE
2604	PING.EXE
4888	PING.EXE
3884	PING.EXE
3584	PING.EXE
4188	PING.EXE
4640	PING.EXE
4356	PING.EXE
2456	PING.EXE
952	PING.EXE
4980	PING.EXE
4800	PING.EXE
2272	PING.EXE
2552	PING.EXE
1244	PING.EXE
1688	PING.EXE
400	PING.EXE
1704	PING.EXE
1944	PING.EXE
4968	PING.EXE
4636	PING.EXE
3748	PING.EXE
2084	PING.EXE
1512	PING.EXE
3884	PING.EXE
1344	PING.EXE
4992	PING.EXE
3880	PING.EXE
1376	PING.EXE
4988	PING.EXE
4912	PING.EXE
1124	PING.EXE
1312	PING.EXE
4640	PING.EXE
4904	PING.EXE
1932	PING.EXE
3004	PING.EXE
2456	PING.EXE
4576	PING.EXE
2176	PING.EXE
2976	PING.EXE
3748	PING.EXE
1396	PING.EXE
4952	PING.EXE
4980	PING.EXE
1948	PING.EXE
1800	PING.EXE

Suspicious behavior: EnumeratesProcesses 30 IoCs

pid	Process
2496	aa65483e4d8cd10c7ce8bacc309bc0b1JaffaCakes118.exe
2496	aa65483e4d8cd10c7ce8bacc309bc0b1JaffaCakes118.exe
4200	avmptr.exe
4200	avmptr.exe
2552	avghostn.exe
2552	avghostn.exe
1388	avgvcmd.exe
1388	avgvcmd.exe
1672	avrmnta.exe
1672	avrmnta.exe
2180	avgvspec.exe
2180	avgvspec.exe
220	avmptr.exe
220	avmptr.exe
4916	avgvscno.exe
4916	avgvscno.exe
3324	avmptr.exe
3324	avmptr.exe
4928	avrmnta.exe
4928	avrmnta.exe
1564	avgvsyt.exe
1564	avgvsyt.exe
1244	avgvsyt.exe
1244	avgvsyt.exe
3532	avruncom.exe
3532	avruncom.exe
1280	avgvspec.exe
1280	avgvspec.exe
4704	avruncom.exe
4704	avruncom.exe

Suspicious use of AdjustPrivilegeToken 14 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2496	aa65483e4d8cd10c7ce8bacc309bc0b1JaffaCakes118.exe
Token: SeIncBasePriorityPrivilege	4200	avmptr.exe
Token: SeIncBasePriorityPrivilege	2552	avghostn.exe
Token: SeIncBasePriorityPrivilege	1388	avgvcmd.exe
Token: SeIncBasePriorityPrivilege	1672	avrmnta.exe
Token: SeIncBasePriorityPrivilege	2180	avgvspec.exe
Token: SeIncBasePriorityPrivilege	220	avmptr.exe
Token: SeIncBasePriorityPrivilege	4916	avgvscno.exe
Token: SeIncBasePriorityPrivilege	3324	avmptr.exe
Token: SeIncBasePriorityPrivilege	4928	avrmnta.exe
Token: SeIncBasePriorityPrivilege	1564	avgvsyt.exe
Token: SeIncBasePriorityPrivilege	1244	avgvsyt.exe
Token: SeIncBasePriorityPrivilege	3532	avruncom.exe
Token: SeIncBasePriorityPrivilege	1280	avgvspec.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3440 wrote to memory of 2496	3440	aa65483e4d8cd10c7ce8bacc309bc0b1JaffaCakes118.exe	97
PID 3440 wrote to memory of 2496	3440	aa65483e4d8cd10c7ce8bacc309bc0b1JaffaCakes118.exe	97
PID 3440 wrote to memory of 2496	3440	aa65483e4d8cd10c7ce8bacc309bc0b1JaffaCakes118.exe	97
PID 3440 wrote to memory of 2496	3440	aa65483e4d8cd10c7ce8bacc309bc0b1JaffaCakes118.exe	97
PID 3440 wrote to memory of 2496	3440	aa65483e4d8cd10c7ce8bacc309bc0b1JaffaCakes118.exe	97
PID 3440 wrote to memory of 4912	3440	aa65483e4d8cd10c7ce8bacc309bc0b1JaffaCakes118.exe	98
PID 3440 wrote to memory of 4912	3440	aa65483e4d8cd10c7ce8bacc309bc0b1JaffaCakes118.exe	98
PID 3440 wrote to memory of 4912	3440	aa65483e4d8cd10c7ce8bacc309bc0b1JaffaCakes118.exe	98
PID 4912 wrote to memory of 2816	4912	cmd.exe	100
PID 4912 wrote to memory of 2816	4912	cmd.exe	100
PID 4912 wrote to memory of 2816	4912	cmd.exe	100
PID 4912 wrote to memory of 536	4912	cmd.exe	103
PID 4912 wrote to memory of 536	4912	cmd.exe	103
PID 4912 wrote to memory of 536	4912	cmd.exe	103
PID 4912 wrote to memory of 4496	4912	cmd.exe	105
PID 4912 wrote to memory of 4496	4912	cmd.exe	105
PID 4912 wrote to memory of 4496	4912	cmd.exe	105
PID 4912 wrote to memory of 1932	4912	cmd.exe	106
PID 4912 wrote to memory of 1932	4912	cmd.exe	106
PID 4912 wrote to memory of 1932	4912	cmd.exe	106
PID 4912 wrote to memory of 4072	4912	cmd.exe	108
PID 4912 wrote to memory of 4072	4912	cmd.exe	108
PID 4912 wrote to memory of 4072	4912	cmd.exe	108
PID 4912 wrote to memory of 2004	4912	cmd.exe	109
PID 4912 wrote to memory of 2004	4912	cmd.exe	109
PID 4912 wrote to memory of 2004	4912	cmd.exe	109
PID 2496 wrote to memory of 1324	2496	aa65483e4d8cd10c7ce8bacc309bc0b1JaffaCakes118.exe	112
PID 2496 wrote to memory of 1324	2496	aa65483e4d8cd10c7ce8bacc309bc0b1JaffaCakes118.exe	112
PID 2496 wrote to memory of 1324	2496	aa65483e4d8cd10c7ce8bacc309bc0b1JaffaCakes118.exe	112
PID 2496 wrote to memory of 2916	2496	aa65483e4d8cd10c7ce8bacc309bc0b1JaffaCakes118.exe	113
PID 2496 wrote to memory of 2916	2496	aa65483e4d8cd10c7ce8bacc309bc0b1JaffaCakes118.exe	113
PID 2496 wrote to memory of 2916	2496	aa65483e4d8cd10c7ce8bacc309bc0b1JaffaCakes118.exe	113
PID 1324 wrote to memory of 4200	1324	avmptr.exe	115
PID 1324 wrote to memory of 4200	1324	avmptr.exe	115
PID 1324 wrote to memory of 4200	1324	avmptr.exe	115
PID 1324 wrote to memory of 4200	1324	avmptr.exe	115
PID 1324 wrote to memory of 4200	1324	avmptr.exe	115
PID 1324 wrote to memory of 1592	1324	avmptr.exe	116
PID 1324 wrote to memory of 1592	1324	avmptr.exe	116
PID 1324 wrote to memory of 1592	1324	avmptr.exe	116
PID 1592 wrote to memory of 2832	1592	cmd.exe	118
PID 1592 wrote to memory of 2832	1592	cmd.exe	118
PID 1592 wrote to memory of 2832	1592	cmd.exe	118
PID 1592 wrote to memory of 4016	1592	cmd.exe	119
PID 1592 wrote to memory of 4016	1592	cmd.exe	119
PID 1592 wrote to memory of 4016	1592	cmd.exe	119
PID 1592 wrote to memory of 888	1592	cmd.exe	120
PID 1592 wrote to memory of 888	1592	cmd.exe	120
PID 1592 wrote to memory of 888	1592	cmd.exe	120
PID 1592 wrote to memory of 1344	1592	cmd.exe	121
PID 1592 wrote to memory of 1344	1592	cmd.exe	121
PID 1592 wrote to memory of 1344	1592	cmd.exe	121
PID 1592 wrote to memory of 4480	1592	cmd.exe	122
PID 1592 wrote to memory of 4480	1592	cmd.exe	122
PID 1592 wrote to memory of 4480	1592	cmd.exe	122
PID 1592 wrote to memory of 4784	1592	cmd.exe	123
PID 1592 wrote to memory of 4784	1592	cmd.exe	123
PID 1592 wrote to memory of 4784	1592	cmd.exe	123
PID 4200 wrote to memory of 2208	4200	avmptr.exe	124
PID 4200 wrote to memory of 2208	4200	avmptr.exe	124
PID 4200 wrote to memory of 2208	4200	avmptr.exe	124
PID 4200 wrote to memory of 1688	4200	avmptr.exe	125
PID 4200 wrote to memory of 1688	4200	avmptr.exe	125
PID 4200 wrote to memory of 1688	4200	avmptr.exe	125

C:\Users\Admin\AppData\Local\Temp\aa65483e4d8cd10c7ce8bacc309bc0b1JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\aa65483e4d8cd10c7ce8bacc309bc0b1JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3440
- C:\Users\Admin\AppData\Local\Temp\aa65483e4d8cd10c7ce8bacc309bc0b1JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\aa65483e4d8cd10c7ce8bacc309bc0b1JaffaCakes118.exe"
  2⤵
  - Event Triggered Execution: Image File Execution Options Injection
  - Checks computer location settings
  - Adds Run key to start application
  - Drops file in System32 directory
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2496
- - C:\Windows\SysWOW64\avmptr.exe
    "C:\Windows\system32\avmptr.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:1324
  - - C:\Windows\SysWOW64\avmptr.exe
      "C:\Windows\SysWOW64\avmptr.exe"
      4⤵
      Event Triggered Execution: Image File Execution Options Injection
      Checks computer location settings
      Executes dropped EXE
      Adds Run key to start application
      Drops file in System32 directory
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4200
    - - C:\Windows\SysWOW64\avghostn.exe
        
        "C:\Windows\system32\avghostn.exe"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:2208
      - C:\Windows\SysWOW64\avghostn.exe
        
        "C:\Windows\SysWOW64\avghostn.exe"
        6⤵
        Event Triggered Execution: Image File Execution Options Injection
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2552
        
        C:\Windows\SysWOW64\avgvcmd.exe
        
        "C:\Windows\system32\avgvcmd.exe"
        7⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:4776
        
        C:\Windows\SysWOW64\avgvcmd.exe
        
        "C:\Windows\SysWOW64\avgvcmd.exe"
        8⤵
        Event Triggered Execution: Image File Execution Options Injection
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1388
        
        C:\Windows\SysWOW64\avrmnta.exe
        
        "C:\Windows\system32\avrmnta.exe"
        9⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:680
        
        C:\Windows\SysWOW64\avrmnta.exe
        
        "C:\Windows\SysWOW64\avrmnta.exe"
        10⤵
        Event Triggered Execution: Image File Execution Options Injection
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1672
        
        C:\Windows\SysWOW64\avgvspec.exe
        
        "C:\Windows\system32\avgvspec.exe"
        11⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:4544
        
        C:\Windows\SysWOW64\avgvspec.exe
        
        "C:\Windows\SysWOW64\avgvspec.exe"
        12⤵
        Event Triggered Execution: Image File Execution Options Injection
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2180
        
        C:\Windows\SysWOW64\avmptr.exe
        
        "C:\Windows\system32\avmptr.exe"
        13⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:2100
        
        C:\Windows\SysWOW64\avmptr.exe
        
        "C:\Windows\SysWOW64\avmptr.exe"
        14⤵
        Event Triggered Execution: Image File Execution Options Injection
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:220
        
        C:\Windows\SysWOW64\avgvscno.exe
        
        "C:\Windows\system32\avgvscno.exe"
        15⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:764
        
        C:\Windows\SysWOW64\avgvscno.exe
        
        "C:\Windows\SysWOW64\avgvscno.exe"
        16⤵
        Event Triggered Execution: Image File Execution Options Injection
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4916
        
        C:\Windows\SysWOW64\avmptr.exe
        
        "C:\Windows\system32\avmptr.exe"
        17⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:1312
        
        C:\Windows\SysWOW64\avmptr.exe
        
        "C:\Windows\SysWOW64\avmptr.exe"
        18⤵
        Event Triggered Execution: Image File Execution Options Injection
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3324
        
        C:\Windows\SysWOW64\avrmnta.exe
        
        "C:\Windows\system32\avrmnta.exe"
        19⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:3616
        
        C:\Windows\SysWOW64\avrmnta.exe
        
        "C:\Windows\SysWOW64\avrmnta.exe"
        20⤵
        Event Triggered Execution: Image File Execution Options Injection
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4928
        
        C:\Windows\SysWOW64\avgvsyt.exe
        
        "C:\Windows\system32\avgvsyt.exe"
        21⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:2528
        
        C:\Windows\SysWOW64\avgvsyt.exe
        
        "C:\Windows\SysWOW64\avgvsyt.exe"
        22⤵
        Event Triggered Execution: Image File Execution Options Injection
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1564
        
        C:\Windows\SysWOW64\avgvsyt.exe
        
        "C:\Windows\system32\avgvsyt.exe"
        23⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:1884
        
        C:\Windows\SysWOW64\avgvsyt.exe
        
        "C:\Windows\SysWOW64\avgvsyt.exe"
        24⤵
        Event Triggered Execution: Image File Execution Options Injection
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1244
        
        C:\Windows\SysWOW64\avruncom.exe
        
        "C:\Windows\system32\avruncom.exe"
        25⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:4816
        
        C:\Windows\SysWOW64\avruncom.exe
        
        "C:\Windows\SysWOW64\avruncom.exe"
        26⤵
        Event Triggered Execution: Image File Execution Options Injection
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3532
        
        C:\Windows\SysWOW64\avgvspec.exe
        
        "C:\Windows\system32\avgvspec.exe"
        27⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:3648
        
        C:\Windows\SysWOW64\avgvspec.exe
        
        "C:\Windows\SysWOW64\avgvspec.exe"
        28⤵
        Event Triggered Execution: Image File Execution Options Injection
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1280
        
        C:\Windows\SysWOW64\avruncom.exe
        
        "C:\Windows\system32\avruncom.exe"
        29⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:3332
        
        C:\Windows\SysWOW64\avruncom.exe
        
        "C:\Windows\SysWOW64\avruncom.exe"
        30⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:4704
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "for /L %a in (1,1,30) do del "C:\Windows\SysWOW64\avruncom.exe" && if exist "C:\Windows\SysWOW64\avruncom.exe" ping -n 2 0.0.0.0"
        30⤵
        
        PID:2448
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        31⤵
        System Location Discovery: System Language Discovery
        
        PID:880
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\avgvspec.exe > nul
        29⤵
        
        PID:4556
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "for /L %a in (1,1,30) do del "C:\Windows\SysWOW64\avgvspec.exe" && if exist "C:\Windows\SysWOW64\avgvspec.exe" ping -n 2 0.0.0.0"
        28⤵
        System Location Discovery: System Language Discovery
        
        PID:60
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        29⤵
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:2932
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        29⤵
        System Location Discovery: System Language Discovery
        
        PID:1388
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        29⤵
        
        PID:4352
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        29⤵
        
        PID:4248
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        29⤵
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:1304
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        29⤵
        
        PID:1648
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        29⤵
        System Location Discovery: System Language Discovery
        
        PID:2680
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        29⤵
        
        PID:1896
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        29⤵
        System Location Discovery: System Language Discovery
        
        PID:3776
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        29⤵
        System Location Discovery: System Language Discovery
        
        PID:2652
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        29⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2976
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\avruncom.exe > nul
        27⤵
        System Location Discovery: System Language Discovery
        
        PID:4332
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "for /L %a in (1,1,30) do del "C:\Windows\SysWOW64\avruncom.exe" && if exist "C:\Windows\SysWOW64\avruncom.exe" ping -n 2 0.0.0.0"
        26⤵
        
        PID:1544
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        27⤵
        
        PID:3816
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        27⤵
        
        PID:3776
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        27⤵
        
        PID:4572
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        27⤵
        
        PID:2652
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        27⤵
        
        PID:2448
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        27⤵
        System Location Discovery: System Language Discovery
        
        PID:4652
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        27⤵
        System Location Discovery: System Language Discovery
        
        PID:1780
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        27⤵
        
        PID:3780
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        27⤵
        
        PID:1068
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        27⤵
        
        PID:2312
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        27⤵
        
        PID:5096
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        27⤵
        
        PID:2384
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        27⤵
        Runs ping.exe
        
        PID:1704
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        27⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4188
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        27⤵
        
        PID:1780
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        27⤵
        System Location Discovery: System Language Discovery
        Runs ping.exe
        
        PID:1948
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        27⤵
        Runs ping.exe
        
        PID:4044
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        27⤵
        
        PID:848
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        27⤵
        System Location Discovery: System Language Discovery
        
        PID:1040
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        27⤵
        
        PID:1600
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\avgvsyt.exe > nul
        25⤵
        
        PID:2016
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "for /L %a in (1,1,30) do del "C:\Windows\SysWOW64\avgvsyt.exe" && if exist "C:\Windows\SysWOW64\avgvsyt.exe" ping -n 2 0.0.0.0"
        24⤵
        
        PID:1088
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        25⤵
        Runs ping.exe
        
        PID:1796
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        25⤵
        
        PID:3584
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        25⤵
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:1072
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        25⤵
        
        PID:3544
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        25⤵
        
        PID:800
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        25⤵
        
        PID:4736
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        25⤵
        
        PID:928
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        25⤵
        
        PID:3088
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        25⤵
        
        PID:4348
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        25⤵
        
        PID:1792
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        25⤵
        Runs ping.exe
        
        PID:4980
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        25⤵
        System Location Discovery: System Language Discovery
        
        PID:2552
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        25⤵
        
        PID:2316
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        25⤵
        
        PID:4952
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        25⤵
        
        PID:3932
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        25⤵
        
        PID:4472
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        25⤵
        
        PID:3380
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        25⤵
        
        PID:4140
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        25⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:848
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        25⤵
        Runs ping.exe
        
        PID:4636
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        25⤵
        Runs ping.exe
        
        PID:1016
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        25⤵
        System Location Discovery: System Language Discovery
        
        PID:4564
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        25⤵
        
        PID:3040
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        25⤵
        
        PID:3748
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        25⤵
        
        PID:3380
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        25⤵
        
        PID:2040
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        25⤵
        
        PID:1816
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        25⤵
        
        PID:5092
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        25⤵
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:2316
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        25⤵
        
        PID:4956
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\avgvsyt.exe > nul
        23⤵
        
        PID:1284
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "for /L %a in (1,1,30) do del "C:\Windows\SysWOW64\avgvsyt.exe" && if exist "C:\Windows\SysWOW64\avgvsyt.exe" ping -n 2 0.0.0.0"
        22⤵
        
        PID:1784
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        23⤵
        
        PID:1744
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        23⤵
        Runs ping.exe
        
        PID:1800
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        23⤵
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:4904
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        23⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:2240
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        23⤵
        
        PID:1032
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        23⤵
        
        PID:1004
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        23⤵
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:1976
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        23⤵
        
        PID:3312
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        23⤵
        
        PID:2756
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        23⤵
        
        PID:2516
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        23⤵
        
        PID:400
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        23⤵
        
        PID:8
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        23⤵
        
        PID:2100
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        23⤵
        
        PID:1892
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        23⤵
        
        PID:2552
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        23⤵
        System Location Discovery: System Language Discovery
        
        PID:3404
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        23⤵
        
        PID:1396
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        23⤵
        
        PID:4480
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        23⤵
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:4784
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        23⤵
        
        PID:4044
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        23⤵
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:4356
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        23⤵
        
        PID:624
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        23⤵
        
        PID:180
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        23⤵
        
        PID:4312
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        23⤵
        
        PID:2016
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        23⤵
        
        PID:2792
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        23⤵
        Runs ping.exe
        
        PID:1648
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        23⤵
        
        PID:1920
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        23⤵
        System Location Discovery: System Language Discovery
        
        PID:800
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        23⤵
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:4496
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\avrmnta.exe > nul
        21⤵
        
        PID:3540
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "for /L %a in (1,1,30) do del "C:\Windows\SysWOW64\avrmnta.exe" && if exist "C:\Windows\SysWOW64\avrmnta.exe" ping -n 2 0.0.0.0"
        20⤵
        
        PID:2124
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        21⤵
        
        PID:1648
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        21⤵
        
        PID:4736
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        21⤵
        
        PID:3540
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        21⤵
        
        PID:888
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        21⤵
        
        PID:5092
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        21⤵
        System Location Discovery: System Language Discovery
        
        PID:2180
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        21⤵
        
        PID:4916
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        21⤵
        
        PID:4980
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        21⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1688
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        21⤵
        
        PID:4816
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        21⤵
        
        PID:3648
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        21⤵
        
        PID:1796
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        21⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3584
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        21⤵
        
        PID:1072
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        21⤵
        System Location Discovery: System Language Discovery
        
        PID:2356
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        21⤵
        
        PID:1156
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        21⤵
        
        PID:5024
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        21⤵
        
        PID:60
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        21⤵
        
        PID:1068
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        21⤵
        Runs ping.exe
        
        PID:2176
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        21⤵
        
        PID:720
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        21⤵
        
        PID:4380
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        21⤵
        Runs ping.exe
        
        PID:1376
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        21⤵
        
        PID:1004
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        21⤵
        
        PID:624
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        21⤵
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:1704
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        21⤵
        
        PID:1672
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        21⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2084
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        21⤵
        
        PID:4680
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        21⤵
        
        PID:3752
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\avmptr.exe > nul
        19⤵
        System Location Discovery: System Language Discovery
        
        PID:1816
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "for /L %a in (1,1,30) do del "C:\Windows\SysWOW64\avmptr.exe" && if exist "C:\Windows\SysWOW64\avmptr.exe" ping -n 2 0.0.0.0"
        18⤵
        System Location Discovery: System Language Discovery
        
        PID:1972
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        19⤵
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:2124
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        19⤵
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:776
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        19⤵
        
        PID:1088
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        19⤵
        
        PID:4792
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        19⤵
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:4836
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        19⤵
        
        PID:4584
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        19⤵
        
        PID:4880
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        19⤵
        
        PID:4940
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        19⤵
        System Location Discovery: System Language Discovery
        
        PID:2876
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        19⤵
        Runs ping.exe
        
        PID:4904
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        19⤵
        
        PID:2804
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        19⤵
        
        PID:2528
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        19⤵
        
        PID:4924
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        19⤵
        
        PID:800
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        19⤵
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:5096
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        19⤵
        
        PID:4764
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        19⤵
        
        PID:1520
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        19⤵
        
        PID:2552
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        19⤵
        
        PID:4800
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        19⤵
        
        PID:1388
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        19⤵
        
        PID:1312
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        19⤵
        Runs ping.exe
        
        PID:400
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        19⤵
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:8
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        19⤵
        
        PID:3572
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        19⤵
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:4792
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        19⤵
        
        PID:1016
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        19⤵
        
        PID:5092
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        19⤵
        System Location Discovery: System Language Discovery
        
        PID:2804
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        19⤵
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:1344
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        19⤵
        Runs ping.exe
        
        PID:4188
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\avgvscno.exe > nul
        17⤵
        
        PID:4972
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "for /L %a in (1,1,30) do del "C:\Windows\SysWOW64\avgvscno.exe" && if exist "C:\Windows\SysWOW64\avgvscno.exe" ping -n 2 0.0.0.0"
        16⤵
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:1244
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        17⤵
        
        PID:4224
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        17⤵
        Runs ping.exe
        
        PID:2084
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        17⤵
        Runs ping.exe
        
        PID:4888
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        17⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:1896
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        17⤵
        Runs ping.exe
        
        PID:1512
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        17⤵
        Runs ping.exe
        
        PID:2456
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        17⤵
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:4108
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        17⤵
        
        PID:3784
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        17⤵
        
        PID:2004
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        17⤵
        Runs ping.exe
        
        PID:4576
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        17⤵
        
        PID:1388
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        17⤵
        Runs ping.exe
        
        PID:1944
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        17⤵
        Runs ping.exe
        
        PID:4348
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        17⤵
        Runs ping.exe
        
        PID:3884
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        17⤵
        
        PID:2656
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        17⤵
        
        PID:1040
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        17⤵
        
        PID:3776
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        17⤵
        
        PID:4324
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        17⤵
        
        PID:4848
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        17⤵
        
        PID:4016
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        17⤵
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:3932
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        17⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3040
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        17⤵
        System Location Discovery: System Language Discovery
        
        PID:1004
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        17⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4952
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        17⤵
        
        PID:3032
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        17⤵
        System Location Discovery: System Language Discovery
        
        PID:3544
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        17⤵
        
        PID:4168
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        17⤵
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:4080
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        17⤵
        
        PID:2408
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        17⤵
        System Location Discovery: System Language Discovery
        
        PID:4852
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\avmptr.exe > nul
        15⤵
        
        PID:4792
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "for /L %a in (1,1,30) do del "C:\Windows\SysWOW64\avmptr.exe" && if exist "C:\Windows\SysWOW64\avmptr.exe" ping -n 2 0.0.0.0"
        14⤵
        
        PID:404
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        15⤵
        Runs ping.exe
        
        PID:1312
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        15⤵
        System Location Discovery: System Language Discovery
        Runs ping.exe
        
        PID:1104
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        15⤵
        
        PID:1696
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        15⤵
        
        PID:1744
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        15⤵
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:1796
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        15⤵
        
        PID:4780
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        15⤵
        
        PID:800
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        15⤵
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:4972
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        15⤵
        
        PID:3236
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        15⤵
        
        PID:1964
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        15⤵
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:4852
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        15⤵
        
        PID:1732
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        15⤵
        
        PID:4016
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        15⤵
        
        PID:4736
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        15⤵
        
        PID:4792
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        15⤵
        System Location Discovery: System Language Discovery
        
        PID:2120
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        15⤵
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:4444
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        15⤵
        
        PID:1068
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        15⤵
        System Location Discovery: System Language Discovery
        
        PID:3152
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        15⤵
        
        PID:4332
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        15⤵
        
        PID:3364
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        15⤵
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:1156
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        15⤵
        
        PID:2460
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        15⤵
        
        PID:3560
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        15⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1396
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        15⤵
        Runs ping.exe
        
        PID:4800
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        15⤵
        
        PID:3184
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        15⤵
        System Location Discovery: System Language Discovery
        
        PID:1660
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        15⤵
        
        PID:1312
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        15⤵
        
        PID:1344
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\avgvspec.exe > nul
        13⤵
        System Location Discovery: System Language Discovery
        
        PID:2876
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "for /L %a in (1,1,30) do del "C:\Windows\SysWOW64\avgvspec.exe" && if exist "C:\Windows\SysWOW64\avgvspec.exe" ping -n 2 0.0.0.0"
        12⤵
        
        PID:1648
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        13⤵
        
        PID:4256
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        13⤵
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:220
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        13⤵
        Runs ping.exe
        
        PID:4356
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        13⤵
        
        PID:880
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        13⤵
        
        PID:1964
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        13⤵
        Runs ping.exe
        
        PID:1244
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        13⤵
        Runs ping.exe
        
        PID:4636
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        13⤵
        
        PID:3360
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        13⤵
        System Location Discovery: System Language Discovery
        
        PID:4256
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        13⤵
        Runs ping.exe
        
        PID:2456
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        13⤵
        System Location Discovery: System Language Discovery
        
        PID:4972
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        13⤵
        
        PID:4940
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        13⤵
        
        PID:2180
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        13⤵
        
        PID:2444
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        13⤵
        System Location Discovery: System Language Discovery
        
        PID:2124
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        13⤵
        
        PID:1496
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        13⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3004
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        13⤵
        Runs ping.exe
        
        PID:3748
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        13⤵
        
        PID:1104
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        13⤵
        System Location Discovery: System Language Discovery
        Runs ping.exe
        
        PID:4640
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        13⤵
        
        PID:632
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        13⤵
        
        PID:2176
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        13⤵
        
        PID:4976
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        13⤵
        
        PID:1708
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        13⤵
        Runs ping.exe
        
        PID:3884
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        13⤵
        
        PID:1040
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        13⤵
        
        PID:1816
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        13⤵
        Runs ping.exe
        
        PID:4980
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        13⤵
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:2180
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        13⤵
        
        PID:2044
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\avrmnta.exe > nul
        11⤵
        
        PID:952
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "for /L %a in (1,1,30) do del "C:\Windows\SysWOW64\avrmnta.exe" && if exist "C:\Windows\SysWOW64\avrmnta.exe" ping -n 2 0.0.0.0"
        10⤵
        
        PID:1660
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        11⤵
        
        PID:4988
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        11⤵
        System Location Discovery: System Language Discovery
        
        PID:2876
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        11⤵
        
        PID:3364
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        11⤵
        System Location Discovery: System Language Discovery
        
        PID:1648
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        11⤵
        
        PID:1332
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        11⤵
        Runs ping.exe
        
        PID:1124
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        11⤵
        System Location Discovery: System Language Discovery
        Runs ping.exe
        
        PID:4480
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        11⤵
        
        PID:1516
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        11⤵
        System Location Discovery: System Language Discovery
        
        PID:1744
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        11⤵
        
        PID:2208
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        11⤵
        
        PID:1388
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        11⤵
        
        PID:404
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        11⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2552
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        11⤵
        
        PID:848
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        11⤵
        
        PID:2628
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        11⤵
        System Location Discovery: System Language Discovery
        
        PID:2560
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        11⤵
        System Location Discovery: System Language Discovery
        
        PID:4332
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        11⤵
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:1944
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        11⤵
        Runs ping.exe
        
        PID:2604
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        11⤵
        
        PID:3004
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        11⤵
        System Location Discovery: System Language Discovery
        
        PID:3236
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        11⤵
        
        PID:2360
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        11⤵
        
        PID:720
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        11⤵
        
        PID:4636
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        11⤵
        
        PID:4976
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        11⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:2680
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        11⤵
        
        PID:1312
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        11⤵
        System Location Discovery: System Language Discovery
        Runs ping.exe
        
        PID:952
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        11⤵
        
        PID:4384
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        11⤵
        System Location Discovery: System Language Discovery
        
        PID:720
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\avgvcmd.exe > nul
        9⤵
        
        PID:1304
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "for /L %a in (1,1,30) do del "C:\Windows\SysWOW64\avgvcmd.exe" && if exist "C:\Windows\SysWOW64\avgvcmd.exe" ping -n 2 0.0.0.0"
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:536
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        9⤵
        
        PID:1780
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        9⤵
        
        PID:3880
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        9⤵
        
        PID:2552
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        9⤵
        
        PID:3060
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        9⤵
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:2040
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        9⤵
        
        PID:2208
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        9⤵
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:2804
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        9⤵
        
        PID:2516
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        9⤵
        
        PID:5088
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        9⤵
        
        PID:2916
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        9⤵
        
        PID:4904
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        9⤵
        
        PID:4548
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        9⤵
        
        PID:3784
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        9⤵
        
        PID:4256
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        9⤵
        
        PID:3544
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        9⤵
        
        PID:4980
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        9⤵
        
        PID:3916
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        9⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2100
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        9⤵
        
        PID:3156
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        9⤵
        Runs ping.exe
        
        PID:4968
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        9⤵
        
        PID:1084
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        9⤵
        Runs ping.exe
        
        PID:3880
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:2320
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        9⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:2004
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        9⤵
        
        PID:4988
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        9⤵
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:1796
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        9⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:3364
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        9⤵
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:4968
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:4348
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        9⤵
        Runs ping.exe
        
        PID:3748
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\avghostn.exe > nul
        7⤵
        
        PID:1708
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "for /L %a in (1,1,30) do del "C:\Windows\SysWOW64\avghostn.exe" && if exist "C:\Windows\SysWOW64\avghostn.exe" ping -n 2 0.0.0.0"
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:3992
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4828
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        7⤵
        
        PID:2240
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        7⤵
        
        PID:3784
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        7⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2288
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        7⤵
        
        PID:2604
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        7⤵
        
        PID:1180
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        7⤵
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:4428
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        7⤵
        Runs ping.exe
        
        PID:4988
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        7⤵
        
        PID:2180
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        7⤵
        
        PID:3648
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        7⤵
        
        PID:3004
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        7⤵
        
        PID:3560
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        7⤵
        Runs ping.exe
        
        PID:4912
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        7⤵
        
        PID:3480
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        7⤵
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:3776
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        7⤵
        
        PID:1160
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4308
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        7⤵
        
        PID:1688
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        7⤵
        
        PID:2384
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        7⤵
        
        PID:1636
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        7⤵
        Runs ping.exe
        
        PID:2272
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        7⤵
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:532
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        7⤵
        
        PID:4340
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        7⤵
        
        PID:4016
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        7⤵
        
        PID:1032
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        7⤵
        
        PID:2284
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        7⤵
        
        PID:632
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        7⤵
        
        PID:4828
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        7⤵
        
        PID:1296
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        7⤵
        
        PID:1344
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\avmptr.exe > nul
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1688
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c "for /L %a in (1,1,30) do del "C:\Windows\SysWOW64\avmptr.exe" && if exist "C:\Windows\SysWOW64\avmptr.exe" ping -n 2 0.0.0.0"
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Suspicious use of WriteProcessMemory
      PID:1592
    - - C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2832
    - - C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        5⤵
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:4016
    - - C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        5⤵
        Runs ping.exe
        
        PID:888
    - - C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        5⤵
        Runs ping.exe
        
        PID:1344
    - - C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        5⤵
        
        PID:4480
    - - C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        5⤵
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:4784
    - - C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1672
    - - C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        5⤵
        
        PID:1660
    - - C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        5⤵
        
        PID:1452
    - - C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        5⤵
        Runs ping.exe
        
        PID:4716
    - - C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        5⤵
        
        PID:2816
    - - C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        5⤵
        
        PID:2804
    - - C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        5⤵
        
        PID:1468
    - - C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        5⤵
        Runs ping.exe
        
        PID:4992
    - - C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        5⤵
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:2448
    - - C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        5⤵
        
        PID:4580
    - - C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        5⤵
        System Location Discovery: System Language Discovery
        Runs ping.exe
        
        PID:1964
    - - C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        5⤵
        
        PID:720
    - - C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        5⤵
        
        PID:1324
    - - C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        5⤵
        
        PID:1344
    - - C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        5⤵
        
        PID:2004
    - - C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        5⤵
        
        PID:2360
    - - C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        5⤵
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:2348
    - - C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        5⤵
        
        PID:2252
    - - C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4340
    - - C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        5⤵
        
        PID:8
    - - C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        5⤵
        Runs ping.exe
        
        PID:4640
    - - C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        5⤵
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:3572
    - - C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        5⤵
        
        PID:2576
    - - C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 0.0.0.0
        5⤵
        
        PID:4392
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\AA6548~1.EXE > nul
    3⤵
    PID:2916
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c "for /L %a in (1,1,30) do del "C:\Users\Admin\AppData\Local\Temp\aa65483e4d8cd10c7ce8bacc309bc0b1JaffaCakes118.exe" && if exist "C:\Users\Admin\AppData\Local\Temp\aa65483e4d8cd10c7ce8bacc309bc0b1JaffaCakes118.exe" ping -n 2 0.0.0.0"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4912
- - C:\Windows\SysWOW64\PING.EXE
    ping -n 2 0.0.0.0
    3⤵
    PID:2816
- - C:\Windows\SysWOW64\PING.EXE
    ping -n 2 0.0.0.0
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:536
- - C:\Windows\SysWOW64\PING.EXE
    ping -n 2 0.0.0.0
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:4496
- - C:\Windows\SysWOW64\PING.EXE
    ping -n 2 0.0.0.0
    3⤵
    - Runs ping.exe
    PID:1932
- - C:\Windows\SysWOW64\PING.EXE
    ping -n 2 0.0.0.0
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:4072
- - C:\Windows\SysWOW64\PING.EXE
    ping -n 2 0.0.0.0
    3⤵
    PID:2004

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4412,i,1602949858158667699,12464335823361976127,262144 --variations-seed-version --mojo-platform-channel-handle=4448 /prefetch:8
1⤵
PID:2556

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\avmptr.exe

Filesize
103KB

MD5
aa65483e4d8cd10c7ce8bacc309bc0b1

SHA1
5e4b25626f3606a6ea7669074659fb544441bf81

SHA256
574b02890cf382dd0571e15ae8888e80ac37124813136ea17c68491c3699e488

SHA512
740e226540a9dec5c75876295c80ff587d0cd4a123dedc7f77728488a706ed3bf0c39381f1ea8977e6a9e6cf3211a42f778d51e5be8c50416616d174fe8ae9a6

Download Submit
memory/2496-0-0x0000000001000000-0x0000000001012000-memory.dmp

Filesize
72KB

Download
memory/2496-2-0x0000000001000000-0x0000000001012000-memory.dmp

Filesize
72KB

Download
memory/2496-36-0x0000000001000000-0x0000000001012000-memory.dmp

Filesize
72KB

Download
memory/2552-75-0x0000000001000000-0x0000000001012000-memory.dmp

Filesize
72KB

Download
memory/4200-39-0x0000000001000000-0x0000000001012000-memory.dmp

Filesize
72KB

Download