| File name: | a7018ff4aaaaebda06615da54ab7d3dcfe06ffda501254eb9654aa27152629bb.exe |
| Full analysis: | https://app.any.run/tasks/4ecbb8ef-322a-4f2e-8ef8-757258d60334 |
| Verdict: | Malicious activity |
| Threats: | Ransomware is a type of malicious software that locks users out of their system or data using different methods to force them to pay a ransom. Most often, such programs encrypt files on an infected machine and demand a fee to be paid in exchange for the decryption key. Additionally, such programs can be used to steal sensitive information from the compromised computer and even conduct DDoS attacks against affected organizations to pressure them into paying. |
| Analysis date: | January 15, 2022, 01:39:24 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/x-dosexec |
| File info: | PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows |
| MD5: | 22367699E131A9D98F842A1003FD193A |
| SHA1: | C275084D65F845B4D957C05B874FADE071193468 |
| SHA256: | A7018FF4AAAAEBDA06615DA54AB7D3DCFE06FFDA501254EB9654AA27152629BB |
| SSDEEP: | 12288:aMA8K777777777777oPAIBeqRJ620hP9EWyuJsP9ZUNF:aEK777777777777o3BeqRJiUjuJF |
MALICIOUS
Starts NET.EXE for service management
- cmd.exe (PID: 1144)
- cmd.exe (PID: 2036)
- cmd.exe (PID: 2008)
- cmd.exe (PID: 3100)
- cmd.exe (PID: 1808)
- cmd.exe (PID: 288)
- cmd.exe (PID: 2080)
- cmd.exe (PID: 2136)
- cmd.exe (PID: 3136)
Renames files like Ransomware
- a7018ff4aaaaebda06615da54ab7d3dcfe06ffda501254eb9654aa27152629bb.exe (PID: 2552)
SUSPICIOUS
Checks supported languages
- a7018ff4aaaaebda06615da54ab7d3dcfe06ffda501254eb9654aa27152629bb.exe (PID: 1980)
- cmd.exe (PID: 3568)
- a7018ff4aaaaebda06615da54ab7d3dcfe06ffda501254eb9654aa27152629bb.exe (PID: 2552)
- cmd.exe (PID: 2696)
- cmd.exe (PID: 2036)
- cmd.exe (PID: 1144)
- cmd.exe (PID: 2008)
- cmd.exe (PID: 3024)
- cmd.exe (PID: 2560)
- cmd.exe (PID: 2440)
- cmd.exe (PID: 3136)
- cmd.exe (PID: 1420)
- cmd.exe (PID: 1348)
- cmd.exe (PID: 1232)
- cmd.exe (PID: 2080)
- cmd.exe (PID: 3100)
- cmd.exe (PID: 2136)
- cmd.exe (PID: 288)
- cmd.exe (PID: 1808)
- cmd.exe (PID: 4016)
- cmd.exe (PID: 3016)
- cmd.exe (PID: 4008)
- cmd.exe (PID: 3508)
- cmd.exe (PID: 240)
- cmd.exe (PID: 3996)
Application launched itself
- a7018ff4aaaaebda06615da54ab7d3dcfe06ffda501254eb9654aa27152629bb.exe (PID: 1980)
- cmd.exe (PID: 3568)
Reads Environment values
- a7018ff4aaaaebda06615da54ab7d3dcfe06ffda501254eb9654aa27152629bb.exe (PID: 1980)
Reads the computer name
- a7018ff4aaaaebda06615da54ab7d3dcfe06ffda501254eb9654aa27152629bb.exe (PID: 1980)
- a7018ff4aaaaebda06615da54ab7d3dcfe06ffda501254eb9654aa27152629bb.exe (PID: 2552)
Changes tracing settings of the file or console
- a7018ff4aaaaebda06615da54ab7d3dcfe06ffda501254eb9654aa27152629bb.exe (PID: 1980)
Starts CMD.EXE for commands execution
- a7018ff4aaaaebda06615da54ab7d3dcfe06ffda501254eb9654aa27152629bb.exe (PID: 1980)
- cmd.exe (PID: 3568)
Uses TASKKILL.EXE to kill process
- cmd.exe (PID: 2696)
- cmd.exe (PID: 2560)
- cmd.exe (PID: 3024)
- cmd.exe (PID: 3136)
- cmd.exe (PID: 2136)
- cmd.exe (PID: 3016)
- cmd.exe (PID: 3508)
- cmd.exe (PID: 3996)
- cmd.exe (PID: 4008)
- cmd.exe (PID: 240)
- cmd.exe (PID: 2008)
Starts SC.EXE for service management
- cmd.exe (PID: 1144)
- cmd.exe (PID: 2440)
- cmd.exe (PID: 1348)
- cmd.exe (PID: 1420)
- cmd.exe (PID: 2080)
- cmd.exe (PID: 1232)
- cmd.exe (PID: 4016)
- cmd.exe (PID: 2136)
- cmd.exe (PID: 2036)
- cmd.exe (PID: 3136)
- cmd.exe (PID: 3024)
Uses TASKKILL.EXE to kill Browsers
- cmd.exe (PID: 3016)
- cmd.exe (PID: 3508)
Creates files like Ransomware instruction
- a7018ff4aaaaebda06615da54ab7d3dcfe06ffda501254eb9654aa27152629bb.exe (PID: 2552)
Creates files in the program directory
- a7018ff4aaaaebda06615da54ab7d3dcfe06ffda501254eb9654aa27152629bb.exe (PID: 2552)
Drops a file with a compile date too recent
- a7018ff4aaaaebda06615da54ab7d3dcfe06ffda501254eb9654aa27152629bb.exe (PID: 2552)
Uses TASKKILL.EXE to kill Office Apps
- cmd.exe (PID: 2560)
INFO
Reads the computer name
- taskkill.exe (PID: 3344)
- sc.exe (PID: 3176)
- net1.exe (PID: 3004)
- sc.exe (PID: 2460)
- sc.exe (PID: 1268)
- net1.exe (PID: 2968)
- taskkill.exe (PID: 2460)
- net1.exe (PID: 3632)
- net1.exe (PID: 932)
- net1.exe (PID: 1416)
- net1.exe (PID: 1312)
- sc.exe (PID: 2168)
- net1.exe (PID: 2584)
- taskkill.exe (PID: 3512)
- net1.exe (PID: 540)
- net1.exe (PID: 2220)
- net1.exe (PID: 3992)
- net1.exe (PID: 1036)
- sc.exe (PID: 3976)
- sc.exe (PID: 1004)
- net1.exe (PID: 2356)
- sc.exe (PID: 116)
- net1.exe (PID: 2616)
- sc.exe (PID: 2796)
- sc.exe (PID: 916)
- net1.exe (PID: 3568)
- net1.exe (PID: 1572)
- sc.exe (PID: 436)
- sc.exe (PID: 3616)
- sc.exe (PID: 1012)
- sc.exe (PID: 1416)
- sc.exe (PID: 3160)
- sc.exe (PID: 572)
- net1.exe (PID: 3956)
- sc.exe (PID: 2464)
- sc.exe (PID: 2088)
- taskkill.exe (PID: 3548)
- net1.exe (PID: 3116)
- sc.exe (PID: 3980)
- sc.exe (PID: 3464)
- net1.exe (PID: 1344)
- net1.exe (PID: 4072)
- sc.exe (PID: 2928)
- sc.exe (PID: 3520)
- sc.exe (PID: 1332)
- sc.exe (PID: 1128)
- sc.exe (PID: 3948)
- sc.exe (PID: 3568)
- sc.exe (PID: 824)
- taskkill.exe (PID: 128)
- sc.exe (PID: 1072)
- sc.exe (PID: 2352)
- sc.exe (PID: 4028)
- net1.exe (PID: 424)
- sc.exe (PID: 420)
- sc.exe (PID: 516)
- net1.exe (PID: 4068)
- sc.exe (PID: 2872)
- sc.exe (PID: 2888)
- sc.exe (PID: 2764)
- sc.exe (PID: 1840)
- sc.exe (PID: 188)
- net1.exe (PID: 2464)
- net1.exe (PID: 3804)
- sc.exe (PID: 3748)
- sc.exe (PID: 2904)
- sc.exe (PID: 2776)
- sc.exe (PID: 2548)
- sc.exe (PID: 2268)
- net1.exe (PID: 3272)
- sc.exe (PID: 3736)
- sc.exe (PID: 1028)
- sc.exe (PID: 2052)
- net1.exe (PID: 472)
- taskkill.exe (PID: 2732)
- sc.exe (PID: 2184)
- net1.exe (PID: 1384)
- sc.exe (PID: 3532)
- sc.exe (PID: 1004)
- sc.exe (PID: 392)
- sc.exe (PID: 2888)
- net1.exe (PID: 1712)
- net1.exe (PID: 4064)
- sc.exe (PID: 2524)
- sc.exe (PID: 3236)
- sc.exe (PID: 2364)
- sc.exe (PID: 2140)
- net1.exe (PID: 932)
- sc.exe (PID: 408)
- sc.exe (PID: 3688)
- net1.exe (PID: 2032)
- sc.exe (PID: 304)
- net1.exe (PID: 3980)
- sc.exe (PID: 2148)
- net1.exe (PID: 580)
- sc.exe (PID: 2684)
- sc.exe (PID: 3692)
- net1.exe (PID: 4060)
- sc.exe (PID: 3560)
- sc.exe (PID: 2112)
- sc.exe (PID: 2488)
- net1.exe (PID: 2804)
- sc.exe (PID: 340)
- sc.exe (PID: 3796)
- net1.exe (PID: 2384)
- sc.exe (PID: 3924)
- net1.exe (PID: 284)
- taskkill.exe (PID: 3488)
- net1.exe (PID: 636)
- sc.exe (PID: 3572)
- sc.exe (PID: 2444)
- net1.exe (PID: 1648)
- taskkill.exe (PID: 1152)
- sc.exe (PID: 340)
- sc.exe (PID: 2476)
- sc.exe (PID: 3540)
- sc.exe (PID: 2340)
- taskkill.exe (PID: 3684)
- sc.exe (PID: 760)
- sc.exe (PID: 3160)
- net1.exe (PID: 3532)
- net1.exe (PID: 3416)
- net1.exe (PID: 3624)
- sc.exe (PID: 2268)
- sc.exe (PID: 3504)
- sc.exe (PID: 2728)
- taskkill.exe (PID: 3020)
- sc.exe (PID: 3512)
- net1.exe (PID: 4068)
- net1.exe (PID: 3464)
- taskkill.exe (PID: 2524)
- sc.exe (PID: 2404)
- taskkill.exe (PID: 3592)
- sc.exe (PID: 3116)
- sc.exe (PID: 3660)
- sc.exe (PID: 2772)
- net1.exe (PID: 2316)
- net1.exe (PID: 3628)
- sc.exe (PID: 4028)
- net1.exe (PID: 2464)
- sc.exe (PID: 2336)
- taskkill.exe (PID: 2928)
- sc.exe (PID: 508)
- net1.exe (PID: 3748)
- net1.exe (PID: 3360)
- sc.exe (PID: 2796)
- sc.exe (PID: 2476)
- sc.exe (PID: 3664)
- net1.exe (PID: 796)
- sc.exe (PID: 3572)
- net1.exe (PID: 3044)
- sc.exe (PID: 3108)
- sc.exe (PID: 2544)
- sc.exe (PID: 3540)
- taskkill.exe (PID: 2620)
- net1.exe (PID: 2476)
- net1.exe (PID: 2984)
- sc.exe (PID: 3552)
- sc.exe (PID: 2500)
- sc.exe (PID: 3664)
- sc.exe (PID: 3048)
- taskkill.exe (PID: 1368)
- sc.exe (PID: 3932)
- net1.exe (PID: 3336)
- net1.exe (PID: 2168)
- net1.exe (PID: 2264)
- net1.exe (PID: 4028)
- sc.exe (PID: 3948)
- sc.exe (PID: 3504)
- sc.exe (PID: 2968)
- net1.exe (PID: 1028)
- sc.exe (PID: 832)
- sc.exe (PID: 3632)
- sc.exe (PID: 3308)
- sc.exe (PID: 3616)
- net1.exe (PID: 508)
- net1.exe (PID: 3716)
- net1.exe (PID: 376)
- sc.exe (PID: 1236)
- sc.exe (PID: 3092)
- net1.exe (PID: 2300)
- net1.exe (PID: 1572)
- sc.exe (PID: 3176)
- net1.exe (PID: 3008)
- net1.exe (PID: 4028)
- taskkill.exe (PID: 2428)
- sc.exe (PID: 2476)
- sc.exe (PID: 2768)
- sc.exe (PID: 188)
- sc.exe (PID: 2196)
- net1.exe (PID: 3512)
- net1.exe (PID: 3572)
- sc.exe (PID: 3336)
- sc.exe (PID: 3144)
- net1.exe (PID: 796)
- net1.exe (PID: 4052)
- sc.exe (PID: 2496)
- sc.exe (PID: 4068)
- net1.exe (PID: 2132)
- sc.exe (PID: 3660)
- sc.exe (PID: 1584)
- sc.exe (PID: 2512)
- net1.exe (PID: 420)
- sc.exe (PID: 3552)
- sc.exe (PID: 3112)
- sc.exe (PID: 3864)
- net1.exe (PID: 2508)
- net1.exe (PID: 3716)
- sc.exe (PID: 448)
- sc.exe (PID: 3896)
- sc.exe (PID: 472)
- net1.exe (PID: 916)
- sc.exe (PID: 3948)
- sc.exe (PID: 3496)
- net1.exe (PID: 3476)
- sc.exe (PID: 4064)
- net1.exe (PID: 2936)
- sc.exe (PID: 1828)
- net1.exe (PID: 420)
- sc.exe (PID: 3972)
- sc.exe (PID: 988)
- sc.exe (PID: 3992)
- net1.exe (PID: 3840)
- sc.exe (PID: 2772)
- sc.exe (PID: 2316)
- net1.exe (PID: 2420)
- sc.exe (PID: 1844)
- sc.exe (PID: 3092)
- sc.exe (PID: 1028)
- taskkill.exe (PID: 2248)
- sc.exe (PID: 2176)
- sc.exe (PID: 3104)
- net1.exe (PID: 3804)
- net1.exe (PID: 3968)
- sc.exe (PID: 2080)
- net1.exe (PID: 2284)
- sc.exe (PID: 2512)
- sc.exe (PID: 3536)
- sc.exe (PID: 1712)
- net1.exe (PID: 2296)
- net1.exe (PID: 3340)
- sc.exe (PID: 3252)
- sc.exe (PID: 1028)
- net1.exe (PID: 3764)
- net1.exe (PID: 2556)
- sc.exe (PID: 3116)
- sc.exe (PID: 3460)
- sc.exe (PID: 840)
- net1.exe (PID: 1144)
- sc.exe (PID: 2924)
- net1.exe (PID: 3688)
- sc.exe (PID: 3344)
- net1.exe (PID: 1416)
- taskkill.exe (PID: 1572)
- taskkill.exe (PID: 832)
- sc.exe (PID: 540)
- taskkill.exe (PID: 2512)
- net1.exe (PID: 760)
- sc.exe (PID: 2604)
- net1.exe (PID: 3416)
- sc.exe (PID: 3388)
- sc.exe (PID: 3064)
- sc.exe (PID: 2356)
- net1.exe (PID: 1384)
- net1.exe (PID: 2052)
- net1.exe (PID: 3392)
- sc.exe (PID: 3176)
- sc.exe (PID: 2748)
- sc.exe (PID: 1856)
- sc.exe (PID: 3160)
- net1.exe (PID: 2084)
- net1.exe (PID: 284)
- sc.exe (PID: 3300)
- sc.exe (PID: 3560)
- sc.exe (PID: 1244)
- net1.exe (PID: 2996)
- net1.exe (PID: 412)
- sc.exe (PID: 1904)
- sc.exe (PID: 2100)
- sc.exe (PID: 2848)
- net1.exe (PID: 340)
- sc.exe (PID: 1128)
- sc.exe (PID: 420)
- sc.exe (PID: 3864)
- sc.exe (PID: 2280)
- sc.exe (PID: 2112)
- sc.exe (PID: 2140)
- sc.exe (PID: 2984)
- net1.exe (PID: 3716)
- net1.exe (PID: 2128)
- taskkill.exe (PID: 1864)
- sc.exe (PID: 1112)
- taskkill.exe (PID: 3804)
- taskkill.exe (PID: 3388)
- sc.exe (PID: 516)
- taskkill.exe (PID: 3500)
- taskkill.exe (PID: 348)
- taskkill.exe (PID: 3580)
- taskkill.exe (PID: 3824)
- taskkill.exe (PID: 2712)
- taskkill.exe (PID: 3452)
- taskkill.exe (PID: 2544)
- sc.exe (PID: 412)
- sc.exe (PID: 3300)
- net1.exe (PID: 3236)
- taskkill.exe (PID: 3176)
- net1.exe (PID: 2336)
- sc.exe (PID: 3812)
- net1.exe (PID: 2676)
- sc.exe (PID: 3540)
- sc.exe (PID: 2148)
- sc.exe (PID: 2068)
- net1.exe (PID: 268)
- sc.exe (PID: 3844)
- sc.exe (PID: 1260)
- sc.exe (PID: 2964)
- net1.exe (PID: 128)
- sc.exe (PID: 1820)
- net1.exe (PID: 1828)
- sc.exe (PID: 2936)
- net1.exe (PID: 2728)
- net1.exe (PID: 3464)
- sc.exe (PID: 1764)
- sc.exe (PID: 1568)
- sc.exe (PID: 3548)
- net1.exe (PID: 376)
- net1.exe (PID: 1572)
- sc.exe (PID: 3648)
- net1.exe (PID: 4072)
- net1.exe (PID: 2220)
- sc.exe (PID: 1584)
- sc.exe (PID: 3636)
- sc.exe (PID: 424)
- sc.exe (PID: 2092)
- net1.exe (PID: 2924)
- sc.exe (PID: 2072)
- net1.exe (PID: 2900)
- net1.exe (PID: 2252)
- net1.exe (PID: 3504)
- net1.exe (PID: 3524)
- sc.exe (PID: 1332)
- sc.exe (PID: 2500)
- sc.exe (PID: 4036)
- taskkill.exe (PID: 2440)
- sc.exe (PID: 2932)
- sc.exe (PID: 2252)
- sc.exe (PID: 3532)
- net1.exe (PID: 3720)
- sc.exe (PID: 1124)
- sc.exe (PID: 3160)
- sc.exe (PID: 1856)
- taskkill.exe (PID: 188)
- net1.exe (PID: 2548)
- net1.exe (PID: 3360)
- net1.exe (PID: 1584)
- sc.exe (PID: 2172)
- sc.exe (PID: 1712)
- sc.exe (PID: 2152)
- net1.exe (PID: 2748)
- sc.exe (PID: 304)
- sc.exe (PID: 2184)
- net1.exe (PID: 3412)
- sc.exe (PID: 116)
- taskkill.exe (PID: 2252)
- sc.exe (PID: 4080)
- sc.exe (PID: 1856)
- sc.exe (PID: 3632)
- net1.exe (PID: 2364)
- net1.exe (PID: 2444)
- sc.exe (PID: 3152)
- net1.exe (PID: 276)
- sc.exe (PID: 988)
- net1.exe (PID: 3680)
- sc.exe (PID: 3044)
- net1.exe (PID: 796)
- sc.exe (PID: 3416)
- sc.exe (PID: 2772)
- sc.exe (PID: 3004)
- net1.exe (PID: 2184)
- net1.exe (PID: 2148)
- sc.exe (PID: 1028)
- net1.exe (PID: 2180)
- sc.exe (PID: 2764)
- sc.exe (PID: 1840)
- net1.exe (PID: 1344)
- sc.exe (PID: 2248)
- sc.exe (PID: 3360)
- taskkill.exe (PID: 2692)
- sc.exe (PID: 3976)
- sc.exe (PID: 2456)
- sc.exe (PID: 3748)
- net1.exe (PID: 1844)
- net1.exe (PID: 3592)
- net1.exe (PID: 3072)
- sc.exe (PID: 2328)
- sc.exe (PID: 1468)
- sc.exe (PID: 796)
- net1.exe (PID: 3104)
- sc.exe (PID: 424)
- taskkill.exe (PID: 472)
- net1.exe (PID: 2904)
- sc.exe (PID: 2356)
- net1.exe (PID: 2772)
- net1.exe (PID: 2728)
- sc.exe (PID: 416)
- taskkill.exe (PID: 4052)
- taskkill.exe (PID: 268)
- sc.exe (PID: 2760)
- sc.exe (PID: 3572)
- taskkill.exe (PID: 1904)
- taskkill.exe (PID: 3736)
- sc.exe (PID: 4036)
- net1.exe (PID: 2464)
- net1.exe (PID: 1564)
- sc.exe (PID: 3540)
- taskkill.exe (PID: 2088)
- sc.exe (PID: 2296)
- net1.exe (PID: 3500)
- net1.exe (PID: 3592)
- net1.exe (PID: 3000)
- sc.exe (PID: 3660)
- net1.exe (PID: 3628)
- taskkill.exe (PID: 796)
- taskkill.exe (PID: 392)
- sc.exe (PID: 1416)
- taskkill.exe (PID: 3764)
- sc.exe (PID: 2972)
- sc.exe (PID: 3528)
- net1.exe (PID: 2096)
- sc.exe (PID: 948)
- sc.exe (PID: 2352)
- taskkill.exe (PID: 2080)
- net1.exe (PID: 2180)
- sc.exe (PID: 1408)
- sc.exe (PID: 516)
- net1.exe (PID: 1996)
- net1.exe (PID: 2356)
- taskkill.exe (PID: 580)
- sc.exe (PID: 3280)
- sc.exe (PID: 1120)
- net1.exe (PID: 4072)
- taskkill.exe (PID: 3524)
- net1.exe (PID: 3592)
- sc.exe (PID: 3112)
- net1.exe (PID: 2468)
- sc.exe (PID: 128)
- taskkill.exe (PID: 2032)
- net1.exe (PID: 2852)
- sc.exe (PID: 3092)
- net1.exe (PID: 1468)
- net1.exe (PID: 3636)
- net1.exe (PID: 3796)
- sc.exe (PID: 2024)
- net1.exe (PID: 344)
- taskkill.exe (PID: 1656)
- taskkill.exe (PID: 2852)
- net1.exe (PID: 2628)
- net1.exe (PID: 1072)
- taskkill.exe (PID: 4080)
- net1.exe (PID: 4044)
- net1.exe (PID: 3520)
- taskkill.exe (PID: 2180)
- net1.exe (PID: 2848)
- net1.exe (PID: 1012)
- net1.exe (PID: 2324)
- net1.exe (PID: 3736)
- net1.exe (PID: 2096)
- taskkill.exe (PID: 2780)
- taskkill.exe (PID: 268)
- taskkill.exe (PID: 3792)
- taskkill.exe (PID: 2296)
- net1.exe (PID: 2512)
- sc.exe (PID: 2280)
- net1.exe (PID: 3876)
- taskkill.exe (PID: 2764)
- taskkill.exe (PID: 424)
- taskkill.exe (PID: 1036)
- taskkill.exe (PID: 344)
- net1.exe (PID: 1996)
- net1.exe (PID: 2196)
- net1.exe (PID: 3400)
- taskkill.exe (PID: 3140)
- net1.exe (PID: 1108)
- net1.exe (PID: 2476)
- net1.exe (PID: 3520)
- net1.exe (PID: 3544)
- taskkill.exe (PID: 2124)
- net1.exe (PID: 2908)
- sc.exe (PID: 2908)
- net1.exe (PID: 404)
- net1.exe (PID: 2160)
- net1.exe (PID: 3020)
- net1.exe (PID: 3116)
- taskkill.exe (PID: 2992)
- net1.exe (PID: 2404)
- net1.exe (PID: 3736)
- net1.exe (PID: 1152)
- net1.exe (PID: 2820)
- net1.exe (PID: 2032)
- net1.exe (PID: 1400)
- net1.exe (PID: 2524)
- net1.exe (PID: 2768)
- net1.exe (PID: 3540)
- taskkill.exe (PID: 3388)
- taskkill.exe (PID: 2332)
- net1.exe (PID: 3824)
- net1.exe (PID: 2676)
- net1.exe (PID: 1312)
- net1.exe (PID: 1764)
- taskkill.exe (PID: 2364)
- net1.exe (PID: 2724)
- taskkill.exe (PID: 2584)
- net1.exe (PID: 2488)
- taskkill.exe (PID: 2980)
- net1.exe (PID: 3000)
- taskkill.exe (PID: 516)
- net1.exe (PID: 540)
- net1.exe (PID: 1764)
- taskkill.exe (PID: 2540)
- net1.exe (PID: 4032)
- taskkill.exe (PID: 1312)
- net1.exe (PID: 2728)
- taskkill.exe (PID: 2088)
- sc.exe (PID: 3540)
- net1.exe (PID: 3452)
- sc.exe (PID: 2852)
- net1.exe (PID: 284)
- taskkill.exe (PID: 3476)
- taskkill.exe (PID: 2512)
- taskkill.exe (PID: 2900)
- taskkill.exe (PID: 4044)
- taskkill.exe (PID: 3152)
- taskkill.exe (PID: 1904)
- taskkill.exe (PID: 2712)
- taskkill.exe (PID: 3044)
- sc.exe (PID: 2184)
- taskkill.exe (PID: 796)
- sc.exe (PID: 1728)
- sc.exe (PID: 1244)
- sc.exe (PID: 3712)
- taskkill.exe (PID: 3764)
- taskkill.exe (PID: 3384)
- taskkill.exe (PID: 3784)
- taskkill.exe (PID: 3140)
- taskkill.exe (PID: 832)
- taskkill.exe (PID: 1764)
- taskkill.exe (PID: 2132)
- taskkill.exe (PID: 3580)
- taskkill.exe (PID: 3964)
- taskkill.exe (PID: 3520)
- taskkill.exe (PID: 288)
- taskkill.exe (PID: 2488)
- taskkill.exe (PID: 772)
- taskkill.exe (PID: 2556)
- taskkill.exe (PID: 1356)
- taskkill.exe (PID: 3672)
- taskkill.exe (PID: 2316)
- taskkill.exe (PID: 3512)
- taskkill.exe (PID: 948)
- taskkill.exe (PID: 2680)
- taskkill.exe (PID: 2572)
- taskkill.exe (PID: 1752)
- taskkill.exe (PID: 2792)
- taskkill.exe (PID: 3300)
- taskkill.exe (PID: 3148)
- taskkill.exe (PID: 2052)
- taskkill.exe (PID: 1840)
- taskkill.exe (PID: 2964)
- taskkill.exe (PID: 3172)
- taskkill.exe (PID: 2688)
- taskkill.exe (PID: 3496)
- taskkill.exe (PID: 2088)
- net1.exe (PID: 2712)
- taskkill.exe (PID: 3640)
- taskkill.exe (PID: 2512)
- taskkill.exe (PID: 3504)
- net1.exe (PID: 1516)
- taskkill.exe (PID: 3516)
- taskkill.exe (PID: 2732)
- taskkill.exe (PID: 2312)
- taskkill.exe (PID: 580)
- net1.exe (PID: 1344)
- net1.exe (PID: 2540)
- net1.exe (PID: 3416)
- taskkill.exe (PID: 988)
- net1.exe (PID: 4016)
- taskkill.exe (PID: 2728)
- net1.exe (PID: 3716)
- taskkill.exe (PID: 1512)
- net1.exe (PID: 1584)
- net1.exe (PID: 2364)
- net1.exe (PID: 2612)
- taskkill.exe (PID: 2176)
- taskkill.exe (PID: 3524)
- taskkill.exe (PID: 2932)
- taskkill.exe (PID: 2820)
- taskkill.exe (PID: 2640)
- taskkill.exe (PID: 2568)
- net1.exe (PID: 3476)
- taskkill.exe (PID: 188)
- taskkill.exe (PID: 4072)
- taskkill.exe (PID: 3652)
- net1.exe (PID: 3812)
- taskkill.exe (PID: 3168)
- taskkill.exe (PID: 2440)
- taskkill.exe (PID: 2380)
- taskkill.exe (PID: 3764)
- taskkill.exe (PID: 2100)
- taskkill.exe (PID: 128)
- taskkill.exe (PID: 1828)
- taskkill.exe (PID: 396)
- taskkill.exe (PID: 1468)
- taskkill.exe (PID: 2688)
- taskkill.exe (PID: 1584)
- taskkill.exe (PID: 1436)
- taskkill.exe (PID: 3008)
- taskkill.exe (PID: 2904)
- taskkill.exe (PID: 2348)
- taskkill.exe (PID: 3976)
- taskkill.exe (PID: 1324)
- taskkill.exe (PID: 3396)
- taskkill.exe (PID: 3968)
- taskkill.exe (PID: 3824)
- taskkill.exe (PID: 3512)
- taskkill.exe (PID: 3792)
- taskkill.exe (PID: 444)
- taskkill.exe (PID: 2728)
- taskkill.exe (PID: 1312)
- taskkill.exe (PID: 1996)
- taskkill.exe (PID: 2880)
- taskkill.exe (PID: 3416)
- taskkill.exe (PID: 2776)
- taskkill.exe (PID: 3840)
- taskkill.exe (PID: 3500)
- taskkill.exe (PID: 2424)
- taskkill.exe (PID: 392)
- taskkill.exe (PID: 2260)
- taskkill.exe (PID: 3652)
- taskkill.exe (PID: 480)
- taskkill.exe (PID: 2476)
- taskkill.exe (PID: 2520)
- taskkill.exe (PID: 3140)
- taskkill.exe (PID: 3956)
- taskkill.exe (PID: 468)
- taskkill.exe (PID: 2984)
- taskkill.exe (PID: 2404)
- taskkill.exe (PID: 3168)
- taskkill.exe (PID: 1580)
- taskkill.exe (PID: 3784)
- taskkill.exe (PID: 2464)
- taskkill.exe (PID: 3564)
- taskkill.exe (PID: 2096)
- taskkill.exe (PID: 760)
- taskkill.exe (PID: 2248)
- taskkill.exe (PID: 1108)
- taskkill.exe (PID: 304)
- taskkill.exe (PID: 3948)
- taskkill.exe (PID: 2424)
- taskkill.exe (PID: 2224)
- taskkill.exe (PID: 3576)
- taskkill.exe (PID: 1864)
- taskkill.exe (PID: 436)
- taskkill.exe (PID: 1368)
- taskkill.exe (PID: 2852)
- taskkill.exe (PID: 1728)
- taskkill.exe (PID: 2264)
- taskkill.exe (PID: 1656)
- taskkill.exe (PID: 3308)
- taskkill.exe (PID: 2252)
- taskkill.exe (PID: 2436)
- taskkill.exe (PID: 3600)
- taskkill.exe (PID: 1584)
- taskkill.exe (PID: 2468)
- taskkill.exe (PID: 916)
- taskkill.exe (PID: 3552)
- taskkill.exe (PID: 3516)
- taskkill.exe (PID: 3576)
- taskkill.exe (PID: 2860)
- taskkill.exe (PID: 1332)
- taskkill.exe (PID: 1244)
- taskkill.exe (PID: 2672)
- taskkill.exe (PID: 2852)
- taskkill.exe (PID: 3796)
- taskkill.exe (PID: 1320)
- taskkill.exe (PID: 2072)
- taskkill.exe (PID: 3768)
- taskkill.exe (PID: 1468)
- taskkill.exe (PID: 3968)
- taskkill.exe (PID: 2352)
- taskkill.exe (PID: 3532)
- taskkill.exe (PID: 2260)
- taskkill.exe (PID: 1584)
- taskkill.exe (PID: 188)
- taskkill.exe (PID: 2528)
- taskkill.exe (PID: 3692)
- taskkill.exe (PID: 2612)
- taskkill.exe (PID: 3380)
- taskkill.exe (PID: 116)
- taskkill.exe (PID: 4092)
- taskkill.exe (PID: 4080)
- taskkill.exe (PID: 2852)
- taskkill.exe (PID: 716)
- taskkill.exe (PID: 952)
- taskkill.exe (PID: 2776)
- taskkill.exe (PID: 3160)
- taskkill.exe (PID: 376)
- taskkill.exe (PID: 516)
- taskkill.exe (PID: 2640)
- taskkill.exe (PID: 396)
- taskkill.exe (PID: 2312)
- taskkill.exe (PID: 2328)
- taskkill.exe (PID: 3840)
- taskkill.exe (PID: 2176)
- taskkill.exe (PID: 2584)
- taskkill.exe (PID: 2420)
- taskkill.exe (PID: 1840)
- taskkill.exe (PID: 1368)
- taskkill.exe (PID: 3132)
- taskkill.exe (PID: 1376)
- taskkill.exe (PID: 276)
- taskkill.exe (PID: 1572)
- taskkill.exe (PID: 2760)
- taskkill.exe (PID: 1324)
- taskkill.exe (PID: 4072)
- taskkill.exe (PID: 756)
- taskkill.exe (PID: 3824)
- taskkill.exe (PID: 1808)
- taskkill.exe (PID: 516)
- taskkill.exe (PID: 1620)
- taskkill.exe (PID: 3108)
- taskkill.exe (PID: 404)
- taskkill.exe (PID: 2976)
- taskkill.exe (PID: 3652)
- taskkill.exe (PID: 2244)
- taskkill.exe (PID: 1616)
- taskkill.exe (PID: 824)
- taskkill.exe (PID: 2888)
- taskkill.exe (PID: 2384)
- taskkill.exe (PID: 2424)
- taskkill.exe (PID: 4092)
- taskkill.exe (PID: 468)
- taskkill.exe (PID: 3148)
- taskkill.exe (PID: 1420)
- taskkill.exe (PID: 3688)
- taskkill.exe (PID: 3680)
- taskkill.exe (PID: 2316)
- taskkill.exe (PID: 2908)
- taskkill.exe (PID: 3784)
- taskkill.exe (PID: 2888)
- taskkill.exe (PID: 3000)
- taskkill.exe (PID: 2600)
- taskkill.exe (PID: 2372)
- taskkill.exe (PID: 2780)
- taskkill.exe (PID: 4072)
- taskkill.exe (PID: 3532)
- taskkill.exe (PID: 2876)
- taskkill.exe (PID: 2880)
- taskkill.exe (PID: 2752)
- taskkill.exe (PID: 2548)
- taskkill.exe (PID: 1148)
- taskkill.exe (PID: 2420)
- taskkill.exe (PID: 3072)
- taskkill.exe (PID: 988)
- taskkill.exe (PID: 2132)
- taskkill.exe (PID: 3336)
- taskkill.exe (PID: 2932)
- taskkill.exe (PID: 2496)
- taskkill.exe (PID: 3864)
- taskkill.exe (PID: 1864)
- taskkill.exe (PID: 3580)
- taskkill.exe (PID: 2560)
- taskkill.exe (PID: 2176)
- taskkill.exe (PID: 2068)
- taskkill.exe (PID: 128)
- taskkill.exe (PID: 3968)
- taskkill.exe (PID: 376)
- taskkill.exe (PID: 908)
- taskkill.exe (PID: 2888)
- taskkill.exe (PID: 2316)
- taskkill.exe (PID: 2696)
- taskkill.exe (PID: 3032)
- taskkill.exe (PID: 2900)
- taskkill.exe (PID: 2752)
- taskkill.exe (PID: 2420)
- taskkill.exe (PID: 4028)
- taskkill.exe (PID: 3512)
- taskkill.exe (PID: 3484)
- taskkill.exe (PID: 1940)
- taskkill.exe (PID: 3028)
- taskkill.exe (PID: 4072)
- taskkill.exe (PID: 2352)
- taskkill.exe (PID: 3272)
- taskkill.exe (PID: 2980)
- taskkill.exe (PID: 2692)
- taskkill.exe (PID: 3956)
- taskkill.exe (PID: 2508)
- taskkill.exe (PID: 756)
- taskkill.exe (PID: 1408)
- taskkill.exe (PID: 1616)
- taskkill.exe (PID: 2284)
- taskkill.exe (PID: 1516)
- taskkill.exe (PID: 3008)
- taskkill.exe (PID: 188)
- taskkill.exe (PID: 3392)
- taskkill.exe (PID: 444)
- taskkill.exe (PID: 2328)
- taskkill.exe (PID: 2520)
- taskkill.exe (PID: 1808)
- taskkill.exe (PID: 3164)
- taskkill.exe (PID: 2628)
- taskkill.exe (PID: 2556)
- taskkill.exe (PID: 3932)
- taskkill.exe (PID: 1332)
- taskkill.exe (PID: 1728)
- taskkill.exe (PID: 1840)
- taskkill.exe (PID: 3576)
- taskkill.exe (PID: 716)
- taskkill.exe (PID: 3844)
- taskkill.exe (PID: 2992)
- taskkill.exe (PID: 2784)
- taskkill.exe (PID: 3000)
- taskkill.exe (PID: 404)
- taskkill.exe (PID: 4092)
- taskkill.exe (PID: 2136)
- taskkill.exe (PID: 2316)
- taskkill.exe (PID: 3392)
- taskkill.exe (PID: 2188)
- taskkill.exe (PID: 1400)
- taskkill.exe (PID: 2888)
- taskkill.exe (PID: 2908)
- taskkill.exe (PID: 1028)
- taskkill.exe (PID: 2692)
- taskkill.exe (PID: 2352)
- taskkill.exe (PID: 2064)
- taskkill.exe (PID: 2248)
- taskkill.exe (PID: 3876)
- taskkill.exe (PID: 3544)
- taskkill.exe (PID: 2640)
- taskkill.exe (PID: 2680)
- taskkill.exe (PID: 2124)
- taskkill.exe (PID: 2996)
- taskkill.exe (PID: 4080)
- taskkill.exe (PID: 2200)
- taskkill.exe (PID: 3516)
- taskkill.exe (PID: 408)
- taskkill.exe (PID: 2184)
- taskkill.exe (PID: 2732)
- taskkill.exe (PID: 2692)
- taskkill.exe (PID: 2468)
- taskkill.exe (PID: 560)
- taskkill.exe (PID: 1244)
- taskkill.exe (PID: 376)
- taskkill.exe (PID: 1572)
- taskkill.exe (PID: 3072)
- taskkill.exe (PID: 2984)
- taskkill.exe (PID: 1012)
- taskkill.exe (PID: 1828)
- taskkill.exe (PID: 3992)
- taskkill.exe (PID: 3276)
- taskkill.exe (PID: 3616)
- taskkill.exe (PID: 3340)
- taskkill.exe (PID: 1004)
- taskkill.exe (PID: 2172)
- taskkill.exe (PID: 2312)
- taskkill.exe (PID: 1232)
- taskkill.exe (PID: 3380)
- taskkill.exe (PID: 2904)
- taskkill.exe (PID: 1904)
- taskkill.exe (PID: 2752)
- taskkill.exe (PID: 3280)
- taskkill.exe (PID: 1844)
- taskkill.exe (PID: 3932)
- taskkill.exe (PID: 3688)
- taskkill.exe (PID: 3336)
- taskkill.exe (PID: 392)
- taskkill.exe (PID: 2180)
- taskkill.exe (PID: 3040)
- taskkill.exe (PID: 2768)
- taskkill.exe (PID: 2120)
- taskkill.exe (PID: 3516)
- taskkill.exe (PID: 4016)
- taskkill.exe (PID: 2652)
- taskkill.exe (PID: 2508)
- taskkill.exe (PID: 1036)
- taskkill.exe (PID: 3564)
- taskkill.exe (PID: 1808)
- taskkill.exe (PID: 3628)
- taskkill.exe (PID: 2796)
- taskkill.exe (PID: 508)
Checks supported languages
- sc.exe (PID: 3176)
- net1.exe (PID: 3004)
- net.exe (PID: 3964)
- net.exe (PID: 3948)
- net1.exe (PID: 932)
- sc.exe (PID: 2460)
- taskkill.exe (PID: 3344)
- net.exe (PID: 1072)
- net.exe (PID: 2880)
- sc.exe (PID: 1268)
- net.exe (PID: 2148)
- net1.exe (PID: 2968)
- taskkill.exe (PID: 2460)
- net.exe (PID: 2156)
- net1.exe (PID: 3632)
- net1.exe (PID: 1416)
- net.exe (PID: 3044)
- taskkill.exe (PID: 3512)
- net.exe (PID: 2140)
- sc.exe (PID: 2168)
- net.exe (PID: 2328)
- net1.exe (PID: 2584)
- net1.exe (PID: 540)
- net1.exe (PID: 2220)
- net1.exe (PID: 1312)
- net1.exe (PID: 3992)
- sc.exe (PID: 3976)
- sc.exe (PID: 1004)
- net.exe (PID: 3160)
- sc.exe (PID: 2796)
- net.exe (PID: 2144)
- sc.exe (PID: 116)
- net1.exe (PID: 2356)
- net1.exe (PID: 2616)
- net.exe (PID: 3092)
- net.exe (PID: 3528)
- net1.exe (PID: 1036)
- net.exe (PID: 1236)
- net.exe (PID: 3164)
- sc.exe (PID: 916)
- net.exe (PID: 2968)
- net1.exe (PID: 3568)
- net1.exe (PID: 1572)
- sc.exe (PID: 436)
- sc.exe (PID: 3616)
- taskkill.exe (PID: 3548)
- sc.exe (PID: 1012)
- net1.exe (PID: 3956)
- net1.exe (PID: 3116)
- net.exe (PID: 3564)
- sc.exe (PID: 2464)
- net.exe (PID: 2284)
- sc.exe (PID: 2088)
- sc.exe (PID: 1416)
- sc.exe (PID: 572)
- sc.exe (PID: 3160)
- taskkill.exe (PID: 128)
- net.exe (PID: 3932)
- sc.exe (PID: 3980)
- net1.exe (PID: 4072)
- net1.exe (PID: 1344)
- sc.exe (PID: 3568)
- sc.exe (PID: 2928)
- sc.exe (PID: 3520)
- sc.exe (PID: 3464)
- sc.exe (PID: 1332)
- sc.exe (PID: 1128)
- net.exe (PID: 2680)
- sc.exe (PID: 3948)
- sc.exe (PID: 516)
- sc.exe (PID: 824)
- sc.exe (PID: 1072)
- sc.exe (PID: 4028)
- net1.exe (PID: 424)
- sc.exe (PID: 420)
- net.exe (PID: 2144)
- net1.exe (PID: 4068)
- sc.exe (PID: 2352)
- net.exe (PID: 1580)
- sc.exe (PID: 2888)
- sc.exe (PID: 2904)
- sc.exe (PID: 1840)
- sc.exe (PID: 188)
- sc.exe (PID: 2872)
- net.exe (PID: 2488)
- sc.exe (PID: 2764)
- net.exe (PID: 2152)
- net1.exe (PID: 3804)
- net1.exe (PID: 2464)
- sc.exe (PID: 3748)
- sc.exe (PID: 2052)
- sc.exe (PID: 2776)
- taskkill.exe (PID: 2732)
- net.exe (PID: 2596)
- sc.exe (PID: 2548)
- sc.exe (PID: 3736)
- sc.exe (PID: 1028)
- sc.exe (PID: 1004)
- net1.exe (PID: 472)
- net1.exe (PID: 3272)
- sc.exe (PID: 2268)
- sc.exe (PID: 2184)
- net1.exe (PID: 1384)
- sc.exe (PID: 3532)
- net.exe (PID: 3400)
- sc.exe (PID: 392)
- net.exe (PID: 3124)
- net.exe (PID: 3340)
- net1.exe (PID: 4064)
- sc.exe (PID: 2364)
- sc.exe (PID: 2524)
- sc.exe (PID: 304)
- sc.exe (PID: 3236)
- net1.exe (PID: 1712)
- net.exe (PID: 664)
- sc.exe (PID: 2888)
- net.exe (PID: 1436)
- net1.exe (PID: 932)
- net.exe (PID: 1752)
- sc.exe (PID: 408)
- sc.exe (PID: 2908)
- sc.exe (PID: 3688)
- net.exe (PID: 3172)
- net1.exe (PID: 2032)
- sc.exe (PID: 2148)
- net1.exe (PID: 3980)
- sc.exe (PID: 2140)
- net.exe (PID: 3552)
- net1.exe (PID: 580)
- sc.exe (PID: 2684)
- net.exe (PID: 3696)
- net.exe (PID: 3144)
- sc.exe (PID: 2112)
- sc.exe (PID: 3692)
- net.exe (PID: 668)
- taskkill.exe (PID: 3488)
- net1.exe (PID: 4060)
- net.exe (PID: 3156)
- sc.exe (PID: 340)
- sc.exe (PID: 2488)
- net1.exe (PID: 2804)
- sc.exe (PID: 3560)
- net.exe (PID: 2500)
- sc.exe (PID: 3924)
- net1.exe (PID: 2384)
- net1.exe (PID: 284)
- sc.exe (PID: 3796)
- net.exe (PID: 2512)
- taskkill.exe (PID: 3684)
- net.exe (PID: 3292)
- net1.exe (PID: 636)
- sc.exe (PID: 3540)
- sc.exe (PID: 3572)
- sc.exe (PID: 2444)
- taskkill.exe (PID: 1152)
- net1.exe (PID: 1648)
- taskkill.exe (PID: 3020)
- net.exe (PID: 3108)
- sc.exe (PID: 760)
- net.exe (PID: 3028)
- sc.exe (PID: 340)
- taskkill.exe (PID: 2524)
- sc.exe (PID: 2340)
- sc.exe (PID: 2476)
- sc.exe (PID: 3160)
- taskkill.exe (PID: 3592)
- net1.exe (PID: 3532)
- net1.exe (PID: 3624)
- net1.exe (PID: 3416)
- sc.exe (PID: 2268)
- sc.exe (PID: 3504)
- net.exe (PID: 2084)
- sc.exe (PID: 3660)
- net1.exe (PID: 3464)
- net.exe (PID: 2604)
- taskkill.exe (PID: 2928)
- net1.exe (PID: 4068)
- sc.exe (PID: 2728)
- sc.exe (PID: 3512)
- net.exe (PID: 1012)
- net1.exe (PID: 2316)
- sc.exe (PID: 2772)
- net.exe (PID: 2680)
- sc.exe (PID: 2404)
- sc.exe (PID: 3116)
- net.exe (PID: 3768)
- sc.exe (PID: 4028)
- sc.exe (PID: 2476)
- net.exe (PID: 2268)
- taskkill.exe (PID: 2620)
- net1.exe (PID: 2464)
- sc.exe (PID: 2336)
- net1.exe (PID: 3628)
- net.exe (PID: 988)
- sc.exe (PID: 508)
- sc.exe (PID: 2796)
- net.exe (PID: 1128)
- sc.exe (PID: 3664)
- net1.exe (PID: 796)
- net1.exe (PID: 3748)
- net1.exe (PID: 3360)
- sc.exe (PID: 3572)
- net1.exe (PID: 3044)
- sc.exe (PID: 3108)
- net.exe (PID: 3264)
- sc.exe (PID: 2544)
- sc.exe (PID: 3540)
- net.exe (PID: 3472)
- net.exe (PID: 2132)
- sc.exe (PID: 3552)
- sc.exe (PID: 2500)
- net1.exe (PID: 2476)
- net1.exe (PID: 2984)
- taskkill.exe (PID: 1368)
- net.exe (PID: 2572)
- net.exe (PID: 1312)
- sc.exe (PID: 3664)
- net1.exe (PID: 4028)
- net.exe (PID: 3748)
- net.exe (PID: 2072)
- net1.exe (PID: 3336)
- net1.exe (PID: 2264)
- sc.exe (PID: 3048)
- sc.exe (PID: 3932)
- sc.exe (PID: 2968)
- net.exe (PID: 3688)
- net.exe (PID: 3520)
- sc.exe (PID: 3504)
- sc.exe (PID: 3616)
- net1.exe (PID: 1028)
- sc.exe (PID: 832)
- sc.exe (PID: 3948)
- net.exe (PID: 3072)
- net.exe (PID: 2836)
- taskkill.exe (PID: 2428)
- sc.exe (PID: 3092)
- net1.exe (PID: 508)
- sc.exe (PID: 3632)
- net1.exe (PID: 3716)
- sc.exe (PID: 3308)
- sc.exe (PID: 1236)
- net.exe (PID: 3980)
- net1.exe (PID: 1572)
- sc.exe (PID: 2768)
- net.exe (PID: 1384)
- net.exe (PID: 1400)
- net1.exe (PID: 2300)
- net1.exe (PID: 376)
- net.exe (PID: 2548)
- sc.exe (PID: 188)
- net1.exe (PID: 3008)
- sc.exe (PID: 3176)
- net1.exe (PID: 4028)
- net.exe (PID: 3500)
- sc.exe (PID: 2476)
- sc.exe (PID: 2196)
- sc.exe (PID: 3336)
- net.exe (PID: 1516)
- sc.exe (PID: 3144)
- net1.exe (PID: 796)
- net1.exe (PID: 3572)
- net1.exe (PID: 3512)
- sc.exe (PID: 3660)
- sc.exe (PID: 2496)
- sc.exe (PID: 1584)
- net1.exe (PID: 4052)
- net.exe (PID: 2664)
- sc.exe (PID: 4068)
- net.exe (PID: 4020)
- net.exe (PID: 3344)
- net1.exe (PID: 2132)
- sc.exe (PID: 2512)
- sc.exe (PID: 3552)
- sc.exe (PID: 3112)
- net.exe (PID: 2712)
- sc.exe (PID: 3864)
- net1.exe (PID: 2508)
- net1.exe (PID: 420)
- sc.exe (PID: 448)
- net.exe (PID: 2396)
- net1.exe (PID: 3716)
- sc.exe (PID: 4064)
- net.exe (PID: 3400)
- sc.exe (PID: 472)
- net.exe (PID: 760)
- net1.exe (PID: 916)
- sc.exe (PID: 3896)
- net.exe (PID: 3660)
- sc.exe (PID: 3948)
- sc.exe (PID: 3496)
- net1.exe (PID: 3476)
- net1.exe (PID: 2936)
- sc.exe (PID: 1828)
- net.exe (PID: 1568)
- sc.exe (PID: 2772)
- net1.exe (PID: 420)
- sc.exe (PID: 988)
- sc.exe (PID: 3992)
- net.exe (PID: 2652)
- net1.exe (PID: 3840)
- sc.exe (PID: 3972)
- net1.exe (PID: 2420)
- sc.exe (PID: 1844)
- sc.exe (PID: 3092)
- sc.exe (PID: 1028)
- net.exe (PID: 3632)
- taskkill.exe (PID: 2248)
- sc.exe (PID: 2316)
- net.exe (PID: 1332)
- net.exe (PID: 3616)
- sc.exe (PID: 2176)
- sc.exe (PID: 3104)
- net.exe (PID: 3476)
- sc.exe (PID: 2080)
- net1.exe (PID: 3968)
- net1.exe (PID: 2284)
- net.exe (PID: 3300)
- sc.exe (PID: 2512)
- net1.exe (PID: 3804)
- net1.exe (PID: 3340)
- sc.exe (PID: 3536)
- sc.exe (PID: 3252)
- net1.exe (PID: 2296)
- sc.exe (PID: 1712)
- sc.exe (PID: 1028)
- net.exe (PID: 1564)
- net1.exe (PID: 2556)
- sc.exe (PID: 3116)
- sc.exe (PID: 3460)
- net.exe (PID: 1260)
- sc.exe (PID: 840)
- net.exe (PID: 2092)
- net1.exe (PID: 3764)
- net.exe (PID: 3464)
- sc.exe (PID: 3344)
- taskkill.exe (PID: 1572)
- net1.exe (PID: 1144)
- taskkill.exe (PID: 832)
- sc.exe (PID: 2924)
- taskkill.exe (PID: 2512)
- net.exe (PID: 2980)
- net1.exe (PID: 3688)
- net.exe (PID: 3896)
- net1.exe (PID: 1416)
- net1.exe (PID: 760)
- sc.exe (PID: 540)
- net.exe (PID: 3652)
- net.exe (PID: 1820)
- sc.exe (PID: 2356)
- net1.exe (PID: 1384)
- sc.exe (PID: 3388)
- sc.exe (PID: 3064)
- net.exe (PID: 2544)
- net1.exe (PID: 3416)
- sc.exe (PID: 2604)
- sc.exe (PID: 3176)
- net1.exe (PID: 3392)
- net.exe (PID: 4000)
- sc.exe (PID: 1856)
- net.exe (PID: 1320)
- sc.exe (PID: 2748)
- net1.exe (PID: 2052)
- net.exe (PID: 3564)
- sc.exe (PID: 3560)
- sc.exe (PID: 3160)
- sc.exe (PID: 1904)
- net1.exe (PID: 284)
- sc.exe (PID: 3300)
- net1.exe (PID: 2084)
- net1.exe (PID: 412)
- net.exe (PID: 2208)
- sc.exe (PID: 420)
- net1.exe (PID: 2996)
- sc.exe (PID: 2100)
- net.exe (PID: 3152)
- sc.exe (PID: 1244)
- net.exe (PID: 3972)
- sc.exe (PID: 1128)
- sc.exe (PID: 2984)
- sc.exe (PID: 2140)
- sc.exe (PID: 3864)
- sc.exe (PID: 2848)
- net1.exe (PID: 340)
- net.exe (PID: 664)
- sc.exe (PID: 2112)
- net1.exe (PID: 2128)
- sc.exe (PID: 1112)
- net.exe (PID: 2396)
- net1.exe (PID: 3716)
- sc.exe (PID: 2280)
- taskkill.exe (PID: 3824)
- taskkill.exe (PID: 1864)
- taskkill.exe (PID: 2712)
- taskkill.exe (PID: 348)
- net.exe (PID: 128)
- taskkill.exe (PID: 3804)
- taskkill.exe (PID: 3388)
- taskkill.exe (PID: 3580)
- taskkill.exe (PID: 3500)
- sc.exe (PID: 516)
- taskkill.exe (PID: 2544)
- taskkill.exe (PID: 3452)
- net.exe (PID: 3864)
- sc.exe (PID: 2148)
- taskkill.exe (PID: 3176)
- net1.exe (PID: 3236)
- sc.exe (PID: 412)
- sc.exe (PID: 3300)
- net.exe (PID: 2324)
- net.exe (PID: 3028)
- sc.exe (PID: 3812)
- net1.exe (PID: 2336)
- net1.exe (PID: 2676)
- sc.exe (PID: 3540)
- sc.exe (PID: 1820)
- sc.exe (PID: 2068)
- net1.exe (PID: 268)
- sc.exe (PID: 3844)
- net.exe (PID: 1036)
- sc.exe (PID: 1260)
- net1.exe (PID: 128)
- net.exe (PID: 1840)
- sc.exe (PID: 2964)
- net.exe (PID: 596)
- sc.exe (PID: 1568)
- net1.exe (PID: 3464)
- net1.exe (PID: 2728)
- net.exe (PID: 396)
- net.exe (PID: 2656)
- sc.exe (PID: 1764)
- net1.exe (PID: 1828)
- sc.exe (PID: 2936)
- net.exe (PID: 3540)
- net1.exe (PID: 376)
- net1.exe (PID: 4072)
- net.exe (PID: 3236)
- net.exe (PID: 3844)
- net1.exe (PID: 1572)
- sc.exe (PID: 3648)
- sc.exe (PID: 3548)
- net.exe (PID: 2332)
- net.exe (PID: 1616)
- sc.exe (PID: 1584)
- net.exe (PID: 3632)
- sc.exe (PID: 3636)
- sc.exe (PID: 424)
- net1.exe (PID: 2220)
- sc.exe (PID: 2092)
- net.exe (PID: 3628)
- sc.exe (PID: 2500)
- sc.exe (PID: 2072)
- net1.exe (PID: 2900)
- net1.exe (PID: 2252)
- net1.exe (PID: 2924)
- net1.exe (PID: 3504)
- net1.exe (PID: 3524)
- sc.exe (PID: 3532)
- net.exe (PID: 3660)
- sc.exe (PID: 4036)
- net.exe (PID: 2152)
- sc.exe (PID: 1332)
- sc.exe (PID: 2252)
- sc.exe (PID: 2932)
- net.exe (PID: 2312)
- net1.exe (PID: 3720)
- sc.exe (PID: 1124)
- taskkill.exe (PID: 2440)
- net.exe (PID: 832)
- net1.exe (PID: 2548)
- taskkill.exe (PID: 188)
- net.exe (PID: 1436)
- net.exe (PID: 2084)
- net1.exe (PID: 3360)
- sc.exe (PID: 3160)
- sc.exe (PID: 1856)
- sc.exe (PID: 2172)
- sc.exe (PID: 1712)
- sc.exe (PID: 2152)
- net1.exe (PID: 2748)
- sc.exe (PID: 304)
- net1.exe (PID: 1584)
- net.exe (PID: 2524)
- sc.exe (PID: 2184)
- sc.exe (PID: 116)
- sc.exe (PID: 4080)
- net.exe (PID: 2992)
- taskkill.exe (PID: 2252)
- net1.exe (PID: 3412)
- net.exe (PID: 3548)
- sc.exe (PID: 1856)
- sc.exe (PID: 3632)
- net.exe (PID: 4068)
- net1.exe (PID: 2364)
- net1.exe (PID: 2444)
- sc.exe (PID: 3152)
- net.exe (PID: 1564)
- net1.exe (PID: 276)
- net1.exe (PID: 796)
- net.exe (PID: 2096)
- net.exe (PID: 2748)
- net1.exe (PID: 3680)
- sc.exe (PID: 3044)
- sc.exe (PID: 988)
- net.exe (PID: 1668)
- net.exe (PID: 2476)
- sc.exe (PID: 1028)
- sc.exe (PID: 3004)
- net1.exe (PID: 2184)
- sc.exe (PID: 3416)
- sc.exe (PID: 2772)
- net.exe (PID: 3736)
- net1.exe (PID: 2148)
- net1.exe (PID: 1344)
- taskkill.exe (PID: 2692)
- net1.exe (PID: 2180)
- sc.exe (PID: 2764)
- sc.exe (PID: 1840)
- sc.exe (PID: 2248)
- net.exe (PID: 2616)
- sc.exe (PID: 3360)
- net.exe (PID: 2604)
- net1.exe (PID: 3592)
- sc.exe (PID: 3976)
- sc.exe (PID: 2456)
- net.exe (PID: 2748)
- sc.exe (PID: 1468)
- sc.exe (PID: 3748)
- net.exe (PID: 2668)
- net1.exe (PID: 1844)
- net1.exe (PID: 3072)
- sc.exe (PID: 2328)
- sc.exe (PID: 796)
- net.exe (PID: 2220)
- taskkill.exe (PID: 4052)
- net1.exe (PID: 3104)
- sc.exe (PID: 424)
- taskkill.exe (PID: 472)
- net.exe (PID: 1376)
- net.exe (PID: 2196)
- net.exe (PID: 1348)
- sc.exe (PID: 2356)
- net1.exe (PID: 2772)
- net1.exe (PID: 2728)
- sc.exe (PID: 416)
- net1.exe (PID: 2904)
- sc.exe (PID: 2760)
- net1.exe (PID: 2464)
- sc.exe (PID: 3572)
- net.exe (PID: 3004)
- taskkill.exe (PID: 1904)
- taskkill.exe (PID: 268)
- net.exe (PID: 404)
- sc.exe (PID: 4036)
- net.exe (PID: 3992)
- taskkill.exe (PID: 3736)
- net1.exe (PID: 3592)
- net1.exe (PID: 1564)
- sc.exe (PID: 3540)
- net.exe (PID: 760)
- sc.exe (PID: 2296)
- sc.exe (PID: 3660)
- taskkill.exe (PID: 796)
- net1.exe (PID: 3500)
- net1.exe (PID: 3000)
- taskkill.exe (PID: 2088)
- taskkill.exe (PID: 3764)
- net1.exe (PID: 3628)
- sc.exe (PID: 2352)
- taskkill.exe (PID: 2080)
- taskkill.exe (PID: 392)
- sc.exe (PID: 1416)
- net.exe (PID: 3980)
- net.exe (PID: 508)
- sc.exe (PID: 2972)
- sc.exe (PID: 3528)
- sc.exe (PID: 948)
- net1.exe (PID: 2180)
- net.exe (PID: 3968)
- net1.exe (PID: 2096)
- sc.exe (PID: 1120)
- net1.exe (PID: 1996)
- net.exe (PID: 3520)
- net.exe (PID: 2360)
- net1.exe (PID: 2356)
- sc.exe (PID: 1408)
- sc.exe (PID: 516)
- net.exe (PID: 3488)
- taskkill.exe (PID: 580)
- sc.exe (PID: 3280)
- net1.exe (PID: 4072)
- taskkill.exe (PID: 3524)
- net.exe (PID: 3576)
- net1.exe (PID: 3592)
- net.exe (PID: 3560)
- net1.exe (PID: 2468)
- sc.exe (PID: 3112)
- net.exe (PID: 1312)
- net.exe (PID: 2156)
- sc.exe (PID: 2024)
- sc.exe (PID: 128)
- net.exe (PID: 2172)
- taskkill.exe (PID: 2032)
- net1.exe (PID: 2852)
- sc.exe (PID: 3092)
- net1.exe (PID: 1468)
- net1.exe (PID: 3636)
- net1.exe (PID: 3796)
- net.exe (PID: 3560)
- net.exe (PID: 2752)
- net1.exe (PID: 1072)
- net1.exe (PID: 344)
- net.exe (PID: 2096)
- taskkill.exe (PID: 1656)
- net1.exe (PID: 2628)
- net.exe (PID: 1580)
- net1.exe (PID: 2848)
- net.exe (PID: 3236)
- taskkill.exe (PID: 4080)
- net.exe (PID: 932)
- taskkill.exe (PID: 2852)
- taskkill.exe (PID: 268)
- net1.exe (PID: 3520)
- net1.exe (PID: 4044)
- taskkill.exe (PID: 2180)
- net.exe (PID: 664)
- net1.exe (PID: 1012)
- net1.exe (PID: 2324)
- net.exe (PID: 3992)
- net.exe (PID: 3896)
- net1.exe (PID: 3736)
- net.exe (PID: 2068)
- net.exe (PID: 1616)
- taskkill.exe (PID: 2780)
- net1.exe (PID: 2096)
- net.exe (PID: 1332)
- taskkill.exe (PID: 3792)
- net1.exe (PID: 3876)
- net.exe (PID: 3692)
- taskkill.exe (PID: 2296)
- taskkill.exe (PID: 2764)
- net1.exe (PID: 2512)
- net.exe (PID: 3360)
- sc.exe (PID: 2280)
- taskkill.exe (PID: 344)
- net1.exe (PID: 1996)
- net.exe (PID: 3956)
- taskkill.exe (PID: 424)
- taskkill.exe (PID: 1036)
- net1.exe (PID: 2196)
- net.exe (PID: 1856)
- taskkill.exe (PID: 3140)
- net1.exe (PID: 1108)
- net.exe (PID: 1584)
- net.exe (PID: 1408)
- net1.exe (PID: 2476)
- net1.exe (PID: 3400)
- net.exe (PID: 1764)
- net.exe (PID: 1436)
- net1.exe (PID: 3544)
- net1.exe (PID: 3520)
- taskkill.exe (PID: 2124)
- net1.exe (PID: 2908)
- net.exe (PID: 3804)
- net1.exe (PID: 3116)
- net1.exe (PID: 404)
- net.exe (PID: 2224)
- net1.exe (PID: 2160)
- net.exe (PID: 2472)
- net.exe (PID: 2100)
- net1.exe (PID: 3020)
- net.exe (PID: 2312)
- net.exe (PID: 3344)
- net1.exe (PID: 2404)
- net1.exe (PID: 3736)
- net.exe (PID: 3388)
- net.exe (PID: 3000)
- net1.exe (PID: 1152)
- net.exe (PID: 2476)
- taskkill.exe (PID: 2992)
- net.exe (PID: 2772)
- net1.exe (PID: 2820)
- net1.exe (PID: 2032)
- net.exe (PID: 1436)
- net1.exe (PID: 1400)
- net1.exe (PID: 2524)
- net1.exe (PID: 2768)
- net.exe (PID: 3680)
- net.exe (PID: 3372)
- net1.exe (PID: 3540)
- net.exe (PID: 1828)
- net1.exe (PID: 1764)
- taskkill.exe (PID: 3388)
- net.exe (PID: 348)
- taskkill.exe (PID: 2332)
- net1.exe (PID: 3824)
- net.exe (PID: 128)
- net1.exe (PID: 2676)
- net.exe (PID: 3560)
- net1.exe (PID: 1312)
- net.exe (PID: 392)
- net.exe (PID: 2092)
- net.exe (PID: 2692)
- taskkill.exe (PID: 2364)
- net1.exe (PID: 2724)
- net.exe (PID: 2796)
- net1.exe (PID: 2488)
- net.exe (PID: 2208)
- taskkill.exe (PID: 2980)
- net1.exe (PID: 540)
- net1.exe (PID: 3000)
- taskkill.exe (PID: 2584)
- taskkill.exe (PID: 516)
- net1.exe (PID: 1764)
- net.exe (PID: 2816)
- taskkill.exe (PID: 2540)
- net1.exe (PID: 4032)
- net.exe (PID: 1968)
- net.exe (PID: 2680)
- taskkill.exe (PID: 1312)
- net1.exe (PID: 2728)
- net.exe (PID: 2740)
- sc.exe (PID: 3540)
- net.exe (PID: 2764)
- taskkill.exe (PID: 3152)
- net1.exe (PID: 3452)
- sc.exe (PID: 2852)
- net1.exe (PID: 284)
- taskkill.exe (PID: 2088)
- taskkill.exe (PID: 3476)
- taskkill.exe (PID: 2512)
- taskkill.exe (PID: 3044)
- taskkill.exe (PID: 1904)
- taskkill.exe (PID: 2712)
- taskkill.exe (PID: 2900)
- taskkill.exe (PID: 4044)
- sc.exe (PID: 2184)
- sc.exe (PID: 3712)
- taskkill.exe (PID: 3764)
- taskkill.exe (PID: 796)
- taskkill.exe (PID: 832)
- sc.exe (PID: 1728)
- sc.exe (PID: 1244)
- taskkill.exe (PID: 3580)
- taskkill.exe (PID: 3784)
- taskkill.exe (PID: 3384)
- taskkill.exe (PID: 3140)
- taskkill.exe (PID: 1764)
- taskkill.exe (PID: 2132)
- net1.exe (PID: 2168)
- taskkill.exe (PID: 288)
- taskkill.exe (PID: 772)
- taskkill.exe (PID: 2680)
- taskkill.exe (PID: 2556)
- taskkill.exe (PID: 1356)
- taskkill.exe (PID: 3520)
- taskkill.exe (PID: 3964)
- taskkill.exe (PID: 2488)
- taskkill.exe (PID: 2792)
- taskkill.exe (PID: 3672)
- taskkill.exe (PID: 2316)
- taskkill.exe (PID: 948)
- taskkill.exe (PID: 2572)
- taskkill.exe (PID: 1752)
- taskkill.exe (PID: 3512)
- net.exe (PID: 304)
- taskkill.exe (PID: 3148)
- taskkill.exe (PID: 2964)
- taskkill.exe (PID: 1840)
- taskkill.exe (PID: 2052)
- taskkill.exe (PID: 3300)
- taskkill.exe (PID: 3496)
- taskkill.exe (PID: 2688)
- taskkill.exe (PID: 2312)
- taskkill.exe (PID: 2088)
- net1.exe (PID: 2712)
- taskkill.exe (PID: 3640)
- taskkill.exe (PID: 3172)
- taskkill.exe (PID: 2512)
- net.exe (PID: 3176)
- taskkill.exe (PID: 2732)
- taskkill.exe (PID: 3516)
- net.exe (PID: 1712)
- net1.exe (PID: 4016)
- taskkill.exe (PID: 3504)
- taskkill.exe (PID: 580)
- net1.exe (PID: 1516)
- taskkill.exe (PID: 988)
- net1.exe (PID: 3416)
- net.exe (PID: 636)
- net.exe (PID: 2120)
- taskkill.exe (PID: 2728)
- net.exe (PID: 1844)
- net1.exe (PID: 1344)
- net.exe (PID: 2620)
- net1.exe (PID: 2540)
- net1.exe (PID: 3716)
- net.exe (PID: 3372)
- net1.exe (PID: 1584)
- taskkill.exe (PID: 1512)
- net.exe (PID: 2796)
- net.exe (PID: 472)
- net1.exe (PID: 2364)
- net.exe (PID: 1260)
- net1.exe (PID: 2612)
- net1.exe (PID: 3476)
- taskkill.exe (PID: 2932)
- taskkill.exe (PID: 3524)
- taskkill.exe (PID: 2176)
- taskkill.exe (PID: 2640)
- taskkill.exe (PID: 2820)
- taskkill.exe (PID: 2568)
- taskkill.exe (PID: 2380)
- taskkill.exe (PID: 4072)
- taskkill.exe (PID: 3652)
- net.exe (PID: 2188)
- net1.exe (PID: 3812)
- taskkill.exe (PID: 3168)
- taskkill.exe (PID: 2440)
- taskkill.exe (PID: 188)
- taskkill.exe (PID: 1828)
- taskkill.exe (PID: 2100)
- taskkill.exe (PID: 2904)
- taskkill.exe (PID: 396)
- taskkill.exe (PID: 1468)
- taskkill.exe (PID: 3764)
- taskkill.exe (PID: 128)
- taskkill.exe (PID: 3396)
- taskkill.exe (PID: 1584)
- taskkill.exe (PID: 1312)
- taskkill.exe (PID: 3008)
- taskkill.exe (PID: 2348)
- taskkill.exe (PID: 3976)
- taskkill.exe (PID: 2688)
- taskkill.exe (PID: 1324)
- taskkill.exe (PID: 1436)
- taskkill.exe (PID: 3824)
- taskkill.exe (PID: 3512)
- taskkill.exe (PID: 3792)
- taskkill.exe (PID: 444)
- taskkill.exe (PID: 2728)
- taskkill.exe (PID: 3840)
- taskkill.exe (PID: 3968)
- taskkill.exe (PID: 2880)
- taskkill.exe (PID: 3416)
- taskkill.exe (PID: 2476)
- taskkill.exe (PID: 2776)
- taskkill.exe (PID: 3500)
- taskkill.exe (PID: 2424)
- taskkill.exe (PID: 1996)
- taskkill.exe (PID: 2260)
- taskkill.exe (PID: 3652)
- taskkill.exe (PID: 3168)
- taskkill.exe (PID: 3140)
- taskkill.exe (PID: 2520)
- taskkill.exe (PID: 392)
- taskkill.exe (PID: 480)
- taskkill.exe (PID: 2404)
- taskkill.exe (PID: 2096)
- taskkill.exe (PID: 1580)
- taskkill.exe (PID: 3784)
- taskkill.exe (PID: 3956)
- taskkill.exe (PID: 468)
- taskkill.exe (PID: 2984)
- taskkill.exe (PID: 2464)
- taskkill.exe (PID: 1108)
- taskkill.exe (PID: 3564)
- taskkill.exe (PID: 304)
- taskkill.exe (PID: 3576)
- taskkill.exe (PID: 760)
- taskkill.exe (PID: 2248)
- taskkill.exe (PID: 1368)
- taskkill.exe (PID: 2224)
- taskkill.exe (PID: 2424)
- taskkill.exe (PID: 3948)
- taskkill.exe (PID: 3308)
- taskkill.exe (PID: 1864)
- taskkill.exe (PID: 436)
- net.exe (PID: 3716)
- taskkill.exe (PID: 1728)
- taskkill.exe (PID: 2852)
- taskkill.exe (PID: 1656)
- taskkill.exe (PID: 2264)
- taskkill.exe (PID: 2252)
- taskkill.exe (PID: 2436)
- taskkill.exe (PID: 3600)
- taskkill.exe (PID: 1332)
- taskkill.exe (PID: 2468)
- taskkill.exe (PID: 3516)
- taskkill.exe (PID: 1320)
- taskkill.exe (PID: 3576)
- taskkill.exe (PID: 2860)
- taskkill.exe (PID: 1584)
- taskkill.exe (PID: 916)
- taskkill.exe (PID: 3552)
- taskkill.exe (PID: 1244)
- taskkill.exe (PID: 2672)
- taskkill.exe (PID: 2260)
- taskkill.exe (PID: 1468)
- taskkill.exe (PID: 3796)
- taskkill.exe (PID: 2072)
- taskkill.exe (PID: 2852)
- taskkill.exe (PID: 3768)
- taskkill.exe (PID: 3968)
- taskkill.exe (PID: 2352)
- taskkill.exe (PID: 3692)
- taskkill.exe (PID: 1584)
- taskkill.exe (PID: 188)
- taskkill.exe (PID: 2528)
- taskkill.exe (PID: 3532)
- taskkill.exe (PID: 716)
- taskkill.exe (PID: 116)
- taskkill.exe (PID: 4092)
- taskkill.exe (PID: 3380)
- taskkill.exe (PID: 4080)
- taskkill.exe (PID: 2852)
- taskkill.exe (PID: 2612)
- taskkill.exe (PID: 396)
- taskkill.exe (PID: 952)
- taskkill.exe (PID: 3160)
- taskkill.exe (PID: 3840)
- taskkill.exe (PID: 2640)
- taskkill.exe (PID: 376)
- taskkill.exe (PID: 2312)
- taskkill.exe (PID: 2328)
- taskkill.exe (PID: 2776)
- taskkill.exe (PID: 516)
- taskkill.exe (PID: 2420)
- taskkill.exe (PID: 3132)
- taskkill.exe (PID: 1840)
- taskkill.exe (PID: 1368)
- taskkill.exe (PID: 1376)
- taskkill.exe (PID: 276)
- taskkill.exe (PID: 2176)
- taskkill.exe (PID: 2584)
- taskkill.exe (PID: 1572)
- taskkill.exe (PID: 2760)
- taskkill.exe (PID: 1324)
- taskkill.exe (PID: 3652)
- taskkill.exe (PID: 756)
- taskkill.exe (PID: 3824)
- taskkill.exe (PID: 1808)
- taskkill.exe (PID: 4072)
- taskkill.exe (PID: 1620)
- taskkill.exe (PID: 3108)
- taskkill.exe (PID: 404)
- taskkill.exe (PID: 2976)
- taskkill.exe (PID: 2244)
- taskkill.exe (PID: 1616)
- taskkill.exe (PID: 516)
- taskkill.exe (PID: 2384)
- taskkill.exe (PID: 4092)
- taskkill.exe (PID: 2424)
- taskkill.exe (PID: 468)
- taskkill.exe (PID: 3148)
- taskkill.exe (PID: 824)
- taskkill.exe (PID: 2888)
- taskkill.exe (PID: 1420)
- taskkill.exe (PID: 3784)
- taskkill.exe (PID: 2780)
- taskkill.exe (PID: 2316)
- taskkill.exe (PID: 508)
- taskkill.exe (PID: 3688)
- taskkill.exe (PID: 2908)
- taskkill.exe (PID: 3680)
- taskkill.exe (PID: 2888)
- taskkill.exe (PID: 2372)
- taskkill.exe (PID: 4072)
- taskkill.exe (PID: 3532)
- taskkill.exe (PID: 2600)
- taskkill.exe (PID: 3000)
- taskkill.exe (PID: 2548)
- taskkill.exe (PID: 2876)
- taskkill.exe (PID: 2880)
- taskkill.exe (PID: 2752)
- taskkill.exe (PID: 2496)
- taskkill.exe (PID: 1148)
- taskkill.exe (PID: 2420)
- taskkill.exe (PID: 3072)
- taskkill.exe (PID: 2132)
- taskkill.exe (PID: 3336)
- taskkill.exe (PID: 2932)
- taskkill.exe (PID: 128)
- taskkill.exe (PID: 3864)
- taskkill.exe (PID: 1864)
- taskkill.exe (PID: 988)
- taskkill.exe (PID: 2176)
- taskkill.exe (PID: 2560)
- taskkill.exe (PID: 2068)
- taskkill.exe (PID: 2696)
- taskkill.exe (PID: 3968)
- taskkill.exe (PID: 376)
- taskkill.exe (PID: 3580)
- taskkill.exe (PID: 908)
- taskkill.exe (PID: 2888)
- taskkill.exe (PID: 2316)
- taskkill.exe (PID: 3032)
- taskkill.exe (PID: 2900)
- taskkill.exe (PID: 2752)
- taskkill.exe (PID: 4028)
- taskkill.exe (PID: 3512)
- taskkill.exe (PID: 4072)
- taskkill.exe (PID: 3484)
- taskkill.exe (PID: 1940)
- taskkill.exe (PID: 3028)
- taskkill.exe (PID: 2420)
- taskkill.exe (PID: 3272)
- taskkill.exe (PID: 2284)
- taskkill.exe (PID: 2692)
- taskkill.exe (PID: 3956)
- taskkill.exe (PID: 2508)
- taskkill.exe (PID: 2352)
- taskkill.exe (PID: 2980)
- taskkill.exe (PID: 756)
- taskkill.exe (PID: 3392)
- taskkill.exe (PID: 1408)
- taskkill.exe (PID: 1616)
- taskkill.exe (PID: 1516)
- taskkill.exe (PID: 3008)
- taskkill.exe (PID: 188)
- taskkill.exe (PID: 2520)
- taskkill.exe (PID: 444)
- taskkill.exe (PID: 1808)
- taskkill.exe (PID: 3164)
- taskkill.exe (PID: 1840)
- taskkill.exe (PID: 2628)
- taskkill.exe (PID: 2556)
- taskkill.exe (PID: 2328)
- taskkill.exe (PID: 716)
- taskkill.exe (PID: 1332)
- taskkill.exe (PID: 3844)
- taskkill.exe (PID: 1728)
- taskkill.exe (PID: 2992)
- taskkill.exe (PID: 3576)
- taskkill.exe (PID: 3932)
- taskkill.exe (PID: 2784)
- taskkill.exe (PID: 4092)
- taskkill.exe (PID: 404)
- taskkill.exe (PID: 2888)
- taskkill.exe (PID: 2136)
- taskkill.exe (PID: 2316)
- taskkill.exe (PID: 3000)
- taskkill.exe (PID: 2692)
- taskkill.exe (PID: 3392)
- taskkill.exe (PID: 2188)
- taskkill.exe (PID: 3544)
- taskkill.exe (PID: 1400)
- taskkill.exe (PID: 2908)
- taskkill.exe (PID: 1028)
- taskkill.exe (PID: 2352)
- taskkill.exe (PID: 2248)
- taskkill.exe (PID: 3876)
- taskkill.exe (PID: 2640)
- taskkill.exe (PID: 2680)
- taskkill.exe (PID: 2064)
- taskkill.exe (PID: 2200)
- taskkill.exe (PID: 2996)
- taskkill.exe (PID: 2124)
- taskkill.exe (PID: 4080)
- taskkill.exe (PID: 376)
- taskkill.exe (PID: 3516)
- taskkill.exe (PID: 408)
- taskkill.exe (PID: 2184)
- taskkill.exe (PID: 560)
- taskkill.exe (PID: 1244)
- taskkill.exe (PID: 1828)
- taskkill.exe (PID: 1572)
- taskkill.exe (PID: 2732)
- taskkill.exe (PID: 2692)
- taskkill.exe (PID: 2468)
- taskkill.exe (PID: 3072)
- taskkill.exe (PID: 3616)
- taskkill.exe (PID: 1012)
- taskkill.exe (PID: 2984)
- taskkill.exe (PID: 2312)
- taskkill.exe (PID: 3992)
- taskkill.exe (PID: 3276)
- taskkill.exe (PID: 2904)
- taskkill.exe (PID: 1004)
- taskkill.exe (PID: 3340)
- taskkill.exe (PID: 2172)
- taskkill.exe (PID: 1844)
- taskkill.exe (PID: 1232)
- taskkill.exe (PID: 3380)
- taskkill.exe (PID: 3336)
- taskkill.exe (PID: 3280)
- taskkill.exe (PID: 2120)
- taskkill.exe (PID: 3688)
- taskkill.exe (PID: 3932)
- taskkill.exe (PID: 1904)
- taskkill.exe (PID: 2752)
- taskkill.exe (PID: 392)
- taskkill.exe (PID: 3040)
- taskkill.exe (PID: 2768)
- taskkill.exe (PID: 1036)
- taskkill.exe (PID: 3516)
- taskkill.exe (PID: 4016)
- taskkill.exe (PID: 2180)
- taskkill.exe (PID: 2652)
- taskkill.exe (PID: 3564)
- taskkill.exe (PID: 1808)
- taskkill.exe (PID: 2508)
- taskkill.exe (PID: 3628)
- taskkill.exe (PID: 2796)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .exe | | | Generic CIL Executable (.NET, Mono, etc.) (82.9) |
|---|---|---|
| .dll | | | Win32 Dynamic Link Library (generic) (7.4) |
| .exe | | | Win32 Executable (generic) (5.1) |
| .exe | | | Generic Win/DOS Executable (2.2) |
| .exe | | | DOS Executable Generic (2.2) |
EXIF
EXE
| AssemblyVersion: | 1.0.0.0 |
|---|---|
| ProductVersion: | 1.0.0.0 |
| ProductName: | ram machine |
| OriginalFileName: | InternalCrossContextDelega.exe |
| LegalTrademarks: | - |
| LegalCopyright: | Copyright © 2015 |
| InternalName: | InternalCrossContextDelega.exe |
| FileVersion: | 1.0.0.0 |
| FileDescription: | ram machine |
| CompanyName: | - |
| Comments: | - |
| CharacterSet: | Unicode |
| LanguageCode: | Neutral |
| FileSubtype: | - |
| ObjectFileType: | Executable application |
| FileOS: | Win32 |
| FileFlags: | (none) |
| FileFlagsMask: | 0x003f |
| ProductVersionNumber: | 1.0.0.0 |
| FileVersionNumber: | 1.0.0.0 |
| Subsystem: | Windows GUI |
| SubsystemVersion: | 4 |
| ImageVersion: | - |
| OSVersion: | 4 |
| EntryPoint: | 0x6b9ee |
| UninitializedDataSize: | - |
| InitializedDataSize: | 6656 |
| CodeSize: | 432640 |
| LinkerVersion: | 48 |
| PEType: | PE32 |
| TimeStamp: | 2022:01:13 17:48:48+01:00 |
| MachineType: | Intel 386 or later, and compatibles |
Summary
| Architecture: | IMAGE_FILE_MACHINE_I386 |
|---|---|
| Subsystem: | IMAGE_SUBSYSTEM_WINDOWS_GUI |
| Compilation Date: | 13-Jan-2022 16:48:48 |
| Comments: | - |
| CompanyName: | - |
| FileDescription: | ram machine |
| FileVersion: | 1.0.0.0 |
| InternalName: | InternalCrossContextDelega.exe |
| LegalCopyright: | Copyright © 2015 |
| LegalTrademarks: | - |
| OriginalFilename: | InternalCrossContextDelega.exe |
| ProductName: | ram machine |
| ProductVersion: | 1.0.0.0 |
| Assembly Version: | 1.0.0.0 |
DOS Header
| Magic number: | MZ |
|---|---|
| Bytes on last page of file: | 0x0090 |
| Pages in file: | 0x0003 |
| Relocations: | 0x0000 |
| Size of header: | 0x0004 |
| Min extra paragraphs: | 0x0000 |
| Max extra paragraphs: | 0xFFFF |
| Initial SS value: | 0x0000 |
| Initial SP value: | 0x00B8 |
| Checksum: | 0x0000 |
| Initial IP value: | 0x0000 |
| Initial CS value: | 0x0000 |
| Overlay number: | 0x0000 |
| OEM identifier: | 0x0000 |
| OEM information: | 0x0000 |
| Address of NE header: | 0x00000080 |
PE Headers
| Signature: | PE |
|---|---|
| Machine: | IMAGE_FILE_MACHINE_I386 |
| Number of sections: | 3 |
| Time date stamp: | 13-Jan-2022 16:48:48 |
| Pointer to Symbol Table: | 0x00000000 |
| Number of symbols: | 0 |
| Size of Optional Header: | 0x00E0 |
| Characteristics: |
|
Sections
Name | Virtual Address | Virtual Size | Raw Size | Charateristics | Entropy |
|---|---|---|---|---|---|
.text | 0x00002000 | 0x000699F4 | 0x00069A00 | IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ | 7.61301 |
.rsrc | 0x0006C000 | 0x00001748 | 0x00001800 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 5.22255 |
.reloc | 0x0006E000 | 0x0000000C | 0x00000200 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ | 0.10191 |
Resources
Title | Entropy | Size | Codepage | Language | Type |
|---|---|---|---|---|---|
1 | 5.00112 | 490 | Latin 1 / Western European | UNKNOWN | RT_MANIFEST |
Imports
mscoree.dll |
Total processes
1 197
Monitored processes
1 139
Malicious processes
25
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 116 | sc config SQLBrowser start=disabled | C:\Windows\system32\sc.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: A tool to aid in developing services for WindowsNT Exit code: 1639 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 116 | sc delete "OSP Service" | C:\Windows\system32\sc.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: A tool to aid in developing services for WindowsNT Exit code: 1060 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 116 | taskkill /IM emagent.exe /F | C:\Windows\system32\taskkill.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Terminates Processes Exit code: 128 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 128 | taskkill /F /IM UFIDA.U8.ECE.UTU.Services.exe | C:\Windows\system32\taskkill.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Terminates Processes Exit code: 128 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 128 | net stop MSExchangeImap4 | C:\Windows\system32\net.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Net Command Exit code: 2 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 128 | C:\Windows\system32\net1 stop MSExchangeIS | C:\Windows\system32\net1.exe | — | net.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Net Command Exit code: 2 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) Modules
| |||||||||||||||
| 128 | sc delete NscAuthService | C:\Windows\system32\sc.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: A tool to aid in developing services for WindowsNT Exit code: 1060 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 128 | net stop NFOTPService | C:\Windows\system32\net.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Net Command Exit code: 2 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 128 | taskkill /IM "phpStudy.exe" /F | C:\Windows\system32\taskkill.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Terminates Processes Exit code: 128 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 128 | taskkill /IM picpick.exe /F | C:\Windows\system32\taskkill.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Terminates Processes Exit code: 128 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
Total events
21 804
Read events
21 784
Write events
20
Delete events
0
Modification events
| (PID) Process: | (1980) a7018ff4aaaaebda06615da54ab7d3dcfe06ffda501254eb9654aa27152629bb.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\RASAPI32 |
| Operation: | write | Name: | EnableFileTracing |
Value: 0 | |||
| (PID) Process: | (1980) a7018ff4aaaaebda06615da54ab7d3dcfe06ffda501254eb9654aa27152629bb.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\RASAPI32 |
| Operation: | write | Name: | EnableConsoleTracing |
Value: 0 | |||
| (PID) Process: | (1980) a7018ff4aaaaebda06615da54ab7d3dcfe06ffda501254eb9654aa27152629bb.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\RASAPI32 |
| Operation: | write | Name: | FileTracingMask |
Value: | |||
| (PID) Process: | (1980) a7018ff4aaaaebda06615da54ab7d3dcfe06ffda501254eb9654aa27152629bb.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\RASAPI32 |
| Operation: | write | Name: | ConsoleTracingMask |
Value: | |||
| (PID) Process: | (1980) a7018ff4aaaaebda06615da54ab7d3dcfe06ffda501254eb9654aa27152629bb.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\RASAPI32 |
| Operation: | write | Name: | MaxFileSize |
Value: 1048576 | |||
| (PID) Process: | (1980) a7018ff4aaaaebda06615da54ab7d3dcfe06ffda501254eb9654aa27152629bb.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\RASAPI32 |
| Operation: | write | Name: | FileDirectory |
Value: %windir%\tracing | |||
| (PID) Process: | (1980) a7018ff4aaaaebda06615da54ab7d3dcfe06ffda501254eb9654aa27152629bb.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\RASMANCS |
| Operation: | write | Name: | EnableFileTracing |
Value: 0 | |||
| (PID) Process: | (1980) a7018ff4aaaaebda06615da54ab7d3dcfe06ffda501254eb9654aa27152629bb.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\RASMANCS |
| Operation: | write | Name: | EnableConsoleTracing |
Value: 0 | |||
| (PID) Process: | (1980) a7018ff4aaaaebda06615da54ab7d3dcfe06ffda501254eb9654aa27152629bb.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\RASMANCS |
| Operation: | write | Name: | FileTracingMask |
Value: | |||
| (PID) Process: | (1980) a7018ff4aaaaebda06615da54ab7d3dcfe06ffda501254eb9654aa27152629bb.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\RASMANCS |
| Operation: | write | Name: | ConsoleTracingMask |
Value: | |||
Executable files
0
Suspicious files
121
Text files
57
Unknown types
10
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 2552 | a7018ff4aaaaebda06615da54ab7d3dcfe06ffda501254eb9654aa27152629bb.exe | C:\Users\admin\.oracle_jre_usage\RECOVERY INFORMATION.txt | text | |
MD5:— | SHA256:— | |||
| 2552 | a7018ff4aaaaebda06615da54ab7d3dcfe06ffda501254eb9654aa27152629bb.exe | C:\$Recycle.Bin\S-1-5-21-1302019708-1500728564-335382590-1000\RECOVERY INFORMATION.txt | text | |
MD5:— | SHA256:— | |||
| 2552 | a7018ff4aaaaebda06615da54ab7d3dcfe06ffda501254eb9654aa27152629bb.exe | C:\Users\admin\Contacts\RECOVERY INFORMATION.txt | text | |
MD5:— | SHA256:— | |||
| 2552 | a7018ff4aaaaebda06615da54ab7d3dcfe06ffda501254eb9654aa27152629bb.exe | C:\Users\admin\Desktop\RECOVERY INFORMATION.txt | text | |
MD5:— | SHA256:— | |||
| 2552 | a7018ff4aaaaebda06615da54ab7d3dcfe06ffda501254eb9654aa27152629bb.exe | C:\Users\admin\Desktop\estateafter.rtf | binary | |
MD5:— | SHA256:— | |||
| 2552 | a7018ff4aaaaebda06615da54ab7d3dcfe06ffda501254eb9654aa27152629bb.exe | C:\Users\admin\.oracle_jre_usage\90737d32e3abaa4.timestamp | binary | |
MD5:— | SHA256:— | |||
| 2552 | a7018ff4aaaaebda06615da54ab7d3dcfe06ffda501254eb9654aa27152629bb.exe | C:\Users\admin\Desktop\incomeapplied.rtf | binary | |
MD5:— | SHA256:— | |||
| 2552 | a7018ff4aaaaebda06615da54ab7d3dcfe06ffda501254eb9654aa27152629bb.exe | C:\Users\admin\Desktop\estateafter.rtf.mallox | binary | |
MD5:— | SHA256:— | |||
| 2552 | a7018ff4aaaaebda06615da54ab7d3dcfe06ffda501254eb9654aa27152629bb.exe | C:\Users\admin\.oracle_jre_usage\90737d32e3abaa4.timestamp.mallox | binary | |
MD5:— | SHA256:— | |||
| 1980 | a7018ff4aaaaebda06615da54ab7d3dcfe06ffda501254eb9654aa27152629bb.exe | C:\Users\admin\AppData\Local\Temp\F.bat | text | |
MD5:41BCAD545AAF08D4617C7241FE36267C | SHA256:9820BAB84C400A37A46DB96D999335BF2FB67623931EAC0A1A3E99AA19A90B87 | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
10
DNS requests
0
Threats
3
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
1980 | a7018ff4aaaaebda06615da54ab7d3dcfe06ffda501254eb9654aa27152629bb.exe | GET | 200 | 91.243.44.32:80 | http://91.243.44.32/F.bat | RU | text | 40.3 Kb | malicious |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
1980 | a7018ff4aaaaebda06615da54ab7d3dcfe06ffda501254eb9654aa27152629bb.exe | 91.243.44.32:80 | — | Foxcloud Llp | RU | malicious |
— | — | 192.168.100.2:445 | — | — | — | whitelisted |
— | — | 192.168.100.2:139 | — | — | — | whitelisted |
DNS requests
Threats
3 ETPRO signatures available at the full report