File name:

bill notice 05.2019.rar

Full analysis: https://app.any.run/tasks/f363c1d5-45ed-4b08-ab3c-54f1f5ac1636
Verdict: Malicious activity
Threats:

Remote access trojans (RATs) are a type of malware that enables attackers to establish complete to partial control over infected computers. Such malicious programs often have a modular design, offering a wide range of functionalities for conducting illicit activities on compromised systems. Some of the most common features of RATs include access to the users’ data, webcam, and keystrokes. This malware is often distributed through phishing emails and links.

Malware Trends Tracker     >>>
Analysis date: May 20, 2019, 13:40:07
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
rat
rms
Indicators:
MIME: application/x-rar
File info: RAR archive data, v5
MD5:

0569CA387F8B950E00B99E9ACB612BE9

SHA1:

33D0CDACED6249AA93B4B1B54D2005A907EE563F

SHA256:

BF5E00FA491B76FCCEEA0B8DE133F5C28E20C556FACCE6652E6BCA60FA946746

SSDEEP:

1536:Tr99BZ4Hi14xpjaCvCl7fnrZ0L/gCwKzDQV+o5p5t/1MxxJZ/dd6mEpjKCqvDawE:d9BZ4Hddsl50LpwKzcV+CqxrZWFsawE

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Loads the Task Scheduler COM API

      • OSPPSVC.EXE (PID: 2328)

    • Unusual execution from Microsoft Office

      • EXCEL.EXE (PID: 1824)

    • Executable content was dropped or overwritten

      • EXCEL.EXE (PID: 1824)

    • Loads dropped or rewritten executable

      • cmd.exe (PID: 2472)
      • taskkill.exe (PID: 588)
      • exit.exe (PID: 3824)
      • exit.exe (PID: 2656)
      • taskkill.exe (PID: 2204)
      • cmd.exe (PID: 2632)
      • taskkill.exe (PID: 2844)
      • taskkill.exe (PID: 3068)
      • taskkill.exe (PID: 1668)
      • PING.EXE (PID: 3484)
      • OSPPSVC.EXE (PID: 2328)
      • svchost.exe (PID: 1920)
      • EXCEL.EXE (PID: 1824)
      • winserv.exe (PID: 3128)
      • PING.EXE (PID: 2760)
      • wprgxyeqd79.exe (PID: 3892)
      • rtegre.exe (PID: 3184)
      • veter1605_MAPS_10cr0.exe (PID: 1924)
      • taskkill.exe (PID: 3976)
      • taskkill.exe (PID: 1668)
      • taskkill.exe (PID: 2308)
      • taskkill.exe (PID: 1260)
      • taskkill.exe (PID: 3368)
      • conhost.exe (PID: 1652)
      • WinRAR.exe (PID: 3016)
      • taskkill.exe (PID: 2892)
      • taskkill.exe (PID: 3800)
      • taskkill.exe (PID: 352)
      • taskkill.exe (PID: 3540)
      • taskkill.exe (PID: 796)
      • taskkill.exe (PID: 2284)
      • taskkill.exe (PID: 928)
      • taskkill.exe (PID: 1020)
      • taskkill.exe (PID: 576)
      • taskkill.exe (PID: 2952)
      • taskkill.exe (PID: 3804)
      • taskkill.exe (PID: 3064)
      • taskkill.exe (PID: 3992)
      • taskkill.exe (PID: 3824)
      • taskkill.exe (PID: 4088)
      • taskkill.exe (PID: 3336)
      • taskkill.exe (PID: 3504)
      • taskkill.exe (PID: 3004)
      • taskkill.exe (PID: 3636)
      • wmiprvse.exe (PID: 3848)
      • taskkill.exe (PID: 3728)
      • taskkill.exe (PID: 3680)
      • taskkill.exe (PID: 2832)
      • taskkill.exe (PID: 1768)
      • conhost.exe (PID: 3176)
      • taskkill.exe (PID: 2800)
      • taskkill.exe (PID: 2680)
      • taskkill.exe (PID: 1356)
      • taskkill.exe (PID: 2964)
      • uninstall.exe (PID: 3904)
      • reg.exe (PID: 1484)
      • taskkill.exe (PID: 2980)
      • taskkill.exe (PID: 1928)
      • taskkill.exe (PID: 2224)
      • taskkill.exe (PID: 3916)
      • taskkill.exe (PID: 2504)
      • taskkill.exe (PID: 3024)
      • taskkill.exe (PID: 2836)
      • taskkill.exe (PID: 3988)
      • taskkill.exe (PID: 2824)
      • taskkill.exe (PID: 1672)
      • taskkill.exe (PID: 3336)
      • taskkill.exe (PID: 2732)
      • taskkill.exe (PID: 2888)
      • taskkill.exe (PID: 1244)
      • taskkill.exe (PID: 456)
      • taskkill.exe (PID: 1096)
      • taskkill.exe (PID: 1244)
      • taskkill.exe (PID: 3216)
      • taskkill.exe (PID: 3876)
      • taskkill.exe (PID: 1672)
      • taskkill.exe (PID: 2968)
      • taskkill.exe (PID: 3656)
      • taskkill.exe (PID: 2840)
      • taskkill.exe (PID: 2888)
      • taskkill.exe (PID: 3900)
      • taskkill.exe (PID: 3968)
      • taskkill.exe (PID: 1548)
      • taskkill.exe (PID: 2660)
      • taskkill.exe (PID: 896)
      • taskkill.exe (PID: 1476)
      • taskkill.exe (PID: 2560)
      • taskkill.exe (PID: 2128)
      • taskkill.exe (PID: 3004)
      • taskkill.exe (PID: 3756)
      • taskkill.exe (PID: 2232)
      • taskkill.exe (PID: 3104)
      • taskkill.exe (PID: 2504)
      • taskkill.exe (PID: 3036)
      • taskkill.exe (PID: 2680)
      • taskkill.exe (PID: 928)
      • taskkill.exe (PID: 3308)
      • taskkill.exe (PID: 1836)
      • taskkill.exe (PID: 856)
      • taskkill.exe (PID: 300)
      • taskkill.exe (PID: 2836)
      • taskkill.exe (PID: 3660)
      • taskkill.exe (PID: 3300)
      • taskkill.exe (PID: 3352)
      • taskkill.exe (PID: 796)
      • taskkill.exe (PID: 3952)
      • taskkill.exe (PID: 2300)
      • taskkill.exe (PID: 3216)
      • taskkill.exe (PID: 3440)
      • taskkill.exe (PID: 760)
      • taskkill.exe (PID: 3132)
      • taskkill.exe (PID: 2708)
      • taskkill.exe (PID: 1928)
      • taskkill.exe (PID: 3536)
      • taskkill.exe (PID: 4084)
      • taskkill.exe (PID: 1796)
      • taskkill.exe (PID: 2316)
      • taskkill.exe (PID: 1664)
      • taskkill.exe (PID: 2988)
      • taskkill.exe (PID: 1740)
      • taskkill.exe (PID: 3924)
      • taskkill.exe (PID: 1032)
      • taskkill.exe (PID: 3768)
      • taskkill.exe (PID: 3460)
      • taskkill.exe (PID: 1344)
      • taskkill.exe (PID: 3132)
      • taskkill.exe (PID: 3544)
      • taskkill.exe (PID: 1184)
      • taskkill.exe (PID: 2700)
      • taskkill.exe (PID: 1832)
      • taskkill.exe (PID: 3300)
      • taskkill.exe (PID: 296)
      • taskkill.exe (PID: 3868)
      • taskkill.exe (PID: 1356)
      • taskkill.exe (PID: 3180)
      • taskkill.exe (PID: 3096)
      • taskkill.exe (PID: 2924)
      • taskkill.exe (PID: 2176)
      • taskkill.exe (PID: 3620)
      • taskkill.exe (PID: 1156)
      • taskkill.exe (PID: 540)
      • taskkill.exe (PID: 2900)
      • taskkill.exe (PID: 2968)
      • taskkill.exe (PID: 1532)
      • taskkill.exe (PID: 3708)
      • taskkill.exe (PID: 3244)
      • taskkill.exe (PID: 476)
      • taskkill.exe (PID: 1944)
      • taskkill.exe (PID: 2296)
      • taskkill.exe (PID: 2492)
      • taskkill.exe (PID: 2668)
      • taskkill.exe (PID: 1436)
      • taskkill.exe (PID: 3656)
      • taskkill.exe (PID: 3224)
      • taskkill.exe (PID: 2368)
      • taskkill.exe (PID: 3332)
      • taskkill.exe (PID: 2484)
      • taskkill.exe (PID: 3352)
      • taskkill.exe (PID: 3468)
      • taskkill.exe (PID: 3680)
      • taskkill.exe (PID: 2996)
      • taskkill.exe (PID: 1308)
      • taskkill.exe (PID: 3832)
      • taskkill.exe (PID: 1000)
      • taskkill.exe (PID: 2684)
      • taskkill.exe (PID: 2088)
      • taskkill.exe (PID: 1184)
      • taskkill.exe (PID: 3096)
      • taskkill.exe (PID: 3428)
      • taskkill.exe (PID: 576)
      • taskkill.exe (PID: 916)
      • taskkill.exe (PID: 3068)
      • taskkill.exe (PID: 3260)
      • taskkill.exe (PID: 2376)
      • taskkill.exe (PID: 3708)
      • taskkill.exe (PID: 896)
      • taskkill.exe (PID: 3812)
      • taskkill.exe (PID: 3072)
      • taskkill.exe (PID: 3984)
      • taskkill.exe (PID: 1464)
      • taskkill.exe (PID: 2172)
      • taskkill.exe (PID: 948)
      • taskkill.exe (PID: 2536)
      • taskkill.exe (PID: 3308)
      • taskkill.exe (PID: 3764)
      • taskkill.exe (PID: 292)
      • taskkill.exe (PID: 3408)
      • taskkill.exe (PID: 2560)
      • taskkill.exe (PID: 2524)
      • taskkill.exe (PID: 1064)
      • taskkill.exe (PID: 3692)
      • taskkill.exe (PID: 3960)
      • taskkill.exe (PID: 2548)
      • taskkill.exe (PID: 2192)
      • taskkill.exe (PID: 936)
      • taskkill.exe (PID: 3748)
      • taskkill.exe (PID: 3756)
      • taskkill.exe (PID: 1836)
      • taskkill.exe (PID: 3536)
      • taskkill.exe (PID: 3492)
      • taskkill.exe (PID: 3780)
      • taskkill.exe (PID: 2120)
      • taskkill.exe (PID: 2936)
      • taskkill.exe (PID: 2284)
      • taskkill.exe (PID: 3496)
      • taskkill.exe (PID: 588)
      • taskkill.exe (PID: 948)
      • taskkill.exe (PID: 3412)
      • taskkill.exe (PID: 252)
      • taskkill.exe (PID: 2116)
      • taskkill.exe (PID: 2964)
      • taskkill.exe (PID: 300)
      • taskkill.exe (PID: 3408)
      • taskkill.exe (PID: 3244)
      • taskkill.exe (PID: 3112)
      • taskkill.exe (PID: 2656)
      • taskkill.exe (PID: 2832)
      • taskkill.exe (PID: 2868)
      • taskkill.exe (PID: 2088)
      • taskkill.exe (PID: 3248)
      • taskkill.exe (PID: 3928)
      • taskkill.exe (PID: 2364)
      • taskkill.exe (PID: 2072)
      • taskkill.exe (PID: 1064)
      • taskkill.exe (PID: 1096)
      • taskkill.exe (PID: 2096)
      • taskkill.exe (PID: 4084)
      • taskkill.exe (PID: 3124)
      • taskkill.exe (PID: 292)
      • taskkill.exe (PID: 3436)
      • taskkill.exe (PID: 3868)
      • taskkill.exe (PID: 3224)
      • taskkill.exe (PID: 1964)
      • taskkill.exe (PID: 1696)
      • taskkill.exe (PID: 2684)
      • taskkill.exe (PID: 4088)
      • taskkill.exe (PID: 3424)
      • taskkill.exe (PID: 3864)
      • taskkill.exe (PID: 3984)
      • taskkill.exe (PID: 1728)
      • taskkill.exe (PID: 2468)
      • taskkill.exe (PID: 2372)
      • taskkill.exe (PID: 1012)
      • taskkill.exe (PID: 2980)
      • WerFault.exe (PID: 1108)
      • taskkill.exe (PID: 3552)
      • taskkill.exe (PID: 1388)
      • taskkill.exe (PID: 3460)
      • taskkill.exe (PID: 2132)
      • taskkill.exe (PID: 2200)
      • taskkill.exe (PID: 2068)
      • taskkill.exe (PID: 2692)
      • taskkill.exe (PID: 3160)
      • taskkill.exe (PID: 3424)
      • taskkill.exe (PID: 2572)
      • taskkill.exe (PID: 2308)
      • taskkill.exe (PID: 2712)
      • taskkill.exe (PID: 2000)
      • taskkill.exe (PID: 1276)
      • taskkill.exe (PID: 3860)
      • taskkill.exe (PID: 3808)
      • taskkill.exe (PID: 3468)
      • taskkill.exe (PID: 2532)
      • taskkill.exe (PID: 2640)
      • taskkill.exe (PID: 3540)
      • taskkill.exe (PID: 1964)
      • taskkill.exe (PID: 2436)
      • taskkill.exe (PID: 2264)
      • taskkill.exe (PID: 2060)
      • taskkill.exe (PID: 2844)
      • taskkill.exe (PID: 3376)
      • taskkill.exe (PID: 3628)
      • taskkill.exe (PID: 2204)
      • taskkill.exe (PID: 2180)
      • taskkill.exe (PID: 1260)
      • taskkill.exe (PID: 2956)
      • taskkill.exe (PID: 1644)
      • taskkill.exe (PID: 3292)
      • taskkill.exe (PID: 1592)
      • taskkill.exe (PID: 2516)
      • taskkill.exe (PID: 1000)
      • taskkill.exe (PID: 3732)
      • taskkill.exe (PID: 3732)
      • taskkill.exe (PID: 3348)
      • taskkill.exe (PID: 2436)
      • taskkill.exe (PID: 3584)
      • taskkill.exe (PID: 3000)
      • taskkill.exe (PID: 2368)
      • taskkill.exe (PID: 1100)
      • taskkill.exe (PID: 3852)
      • taskkill.exe (PID: 2812)
      • taskkill.exe (PID: 1796)
      • taskkill.exe (PID: 2104)
      • taskkill.exe (PID: 2808)
      • taskkill.exe (PID: 3796)
      • taskkill.exe (PID: 3908)
      • taskkill.exe (PID: 296)
      • taskkill.exe (PID: 2868)
      • taskkill.exe (PID: 2280)
      • taskkill.exe (PID: 3748)
      • taskkill.exe (PID: 2364)
      • taskkill.exe (PID: 3724)
      • taskkill.exe (PID: 856)
      • taskkill.exe (PID: 2416)
      • taskkill.exe (PID: 2596)
      • taskkill.exe (PID: 3640)
      • taskkill.exe (PID: 3288)
      • taskkill.exe (PID: 3112)
      • taskkill.exe (PID: 3144)
      • taskkill.exe (PID: 2972)
      • taskkill.exe (PID: 2580)
      • taskkill.exe (PID: 1532)
      • taskkill.exe (PID: 2196)
      • taskkill.exe (PID: 900)
      • taskkill.exe (PID: 3040)
      • taskkill.exe (PID: 2916)
      • taskkill.exe (PID: 3104)
      • taskkill.exe (PID: 2764)
      • taskkill.exe (PID: 2800)
      • taskkill.exe (PID: 2120)
      • taskkill.exe (PID: 3060)
      • taskkill.exe (PID: 2552)
      • taskkill.exe (PID: 3360)
      • taskkill.exe (PID: 900)
      • taskkill.exe (PID: 2148)
      • taskkill.exe (PID: 2136)
      • taskkill.exe (PID: 3456)
      • taskkill.exe (PID: 3116)
      • taskkill.exe (PID: 2928)
      • taskkill.exe (PID: 3344)
      • taskkill.exe (PID: 2096)
      • taskkill.exe (PID: 3800)
      • taskkill.exe (PID: 2812)
      • taskkill.exe (PID: 832)
      • taskkill.exe (PID: 3628)
      • taskkill.exe (PID: 3092)
      • taskkill.exe (PID: 280)
      • taskkill.exe (PID: 1336)
      • taskkill.exe (PID: 2460)
      • taskkill.exe (PID: 4092)
      • taskkill.exe (PID: 3064)
      • taskkill.exe (PID: 3212)
      • taskkill.exe (PID: 4072)
      • taskkill.exe (PID: 2876)
      • taskkill.exe (PID: 2828)
      • taskkill.exe (PID: 1436)
      • taskkill.exe (PID: 2420)
      • taskkill.exe (PID: 2488)
      • taskkill.exe (PID: 3772)
      • taskkill.exe (PID: 2148)
      • taskkill.exe (PID: 2268)
      • taskkill.exe (PID: 3832)
      • taskkill.exe (PID: 676)
      • taskkill.exe (PID: 4000)
      • taskkill.exe (PID: 2712)
      • taskkill.exe (PID: 3660)
      • taskkill.exe (PID: 2484)
      • taskkill.exe (PID: 2408)
      • taskkill.exe (PID: 1256)
      • taskkill.exe (PID: 3388)
      • taskkill.exe (PID: 3616)
      • taskkill.exe (PID: 1420)
      • taskkill.exe (PID: 1780)
      • taskkill.exe (PID: 1944)
      • taskkill.exe (PID: 2072)
      • taskkill.exe (PID: 3144)
      • taskkill.exe (PID: 2732)
      • taskkill.exe (PID: 2064)
      • taskkill.exe (PID: 2316)
      • taskkill.exe (PID: 2992)
      • taskkill.exe (PID: 2700)
      • taskkill.exe (PID: 3632)
      • taskkill.exe (PID: 1100)
      • taskkill.exe (PID: 584)
      • taskkill.exe (PID: 3552)
      • taskkill.exe (PID: 2460)
      • taskkill.exe (PID: 2420)
      • taskkill.exe (PID: 2176)
      • taskkill.exe (PID: 2652)
      • taskkill.exe (PID: 1012)
      • taskkill.exe (PID: 2952)
      • taskkill.exe (PID: 2084)
      • taskkill.exe (PID: 540)
      • taskkill.exe (PID: 1420)
      • taskkill.exe (PID: 852)
      • taskkill.exe (PID: 2864)
      • taskkill.exe (PID: 1276)
      • taskkill.exe (PID: 3312)
      • taskkill.exe (PID: 3124)
      • taskkill.exe (PID: 2652)
      • taskkill.exe (PID: 3696)
      • taskkill.exe (PID: 3716)
      • taskkill.exe (PID: 952)
      • taskkill.exe (PID: 3640)
      • taskkill.exe (PID: 3968)
      • taskkill.exe (PID: 2908)
      • taskkill.exe (PID: 3752)
      • taskkill.exe (PID: 2820)
      • taskkill.exe (PID: 1896)
      • taskkill.exe (PID: 2736)
      • taskkill.exe (PID: 1896)
      • taskkill.exe (PID: 3596)
      • taskkill.exe (PID: 2776)
      • taskkill.exe (PID: 3864)
      • taskkill.exe (PID: 3324)
      • taskkill.exe (PID: 3452)
      • taskkill.exe (PID: 3720)
      • taskkill.exe (PID: 2852)
      • taskkill.exe (PID: 2532)
      • taskkill.exe (PID: 3116)
      • taskkill.exe (PID: 2820)
      • taskkill.exe (PID: 2500)
      • taskkill.exe (PID: 2280)
      • taskkill.exe (PID: 2552)
      • taskkill.exe (PID: 3652)
      • taskkill.exe (PID: 3676)
      • taskkill.exe (PID: 3664)
      • taskkill.exe (PID: 2928)
      • taskkill.exe (PID: 764)
      • taskkill.exe (PID: 2404)
      • taskkill.exe (PID: 3056)
      • taskkill.exe (PID: 2668)
      • taskkill.exe (PID: 4072)
      • taskkill.exe (PID: 2060)
      • taskkill.exe (PID: 3324)

    • Application was dropped or rewritten from another process

      • exit.exe (PID: 2656)
      • wprgxyeqd79.exe (PID: 3892)
      • exit.exe (PID: 3824)
      • rtegre.exe (PID: 3184)
      • uninstall.exe (PID: 3904)
      • veter1605_MAPS_10cr0.exe (PID: 1924)
      • winserv.exe (PID: 3128)

    • Changes the autorun value in the registry

      • reg.exe (PID: 1484)

    • RMS RAT was detected

      • winserv.exe (PID: 3128)

  • SUSPICIOUS

    • Starts Microsoft Office Application

      • WinRAR.exe (PID: 3016)

    • Executable content was dropped or overwritten

      • wprgxyeqd79.exe (PID: 3892)
      • cmd.exe (PID: 2472)
      • uninstall.exe (PID: 3904)
      • veter1605_MAPS_10cr0.exe (PID: 1924)

    • Creates files in the program directory

      • uninstall.exe (PID: 3904)

    • Starts CMD.EXE for commands execution

      • exit.exe (PID: 3824)
      • exit.exe (PID: 2656)

    • Uses REG.EXE to modify Windows registry

      • cmd.exe (PID: 2632)

    • Reads Environment values

      • winserv.exe (PID: 3128)

    • Reads the machine GUID from the registry

      • winserv.exe (PID: 3128)

    • Reads Windows Product ID

      • winserv.exe (PID: 3128)

    • Creates files in the user directory

      • winserv.exe (PID: 3128)

    • Uses TASKKILL.EXE to kill process

      • cmd.exe (PID: 2632)

  • INFO

    • Reads Microsoft Office registry keys

      • EXCEL.EXE (PID: 1824)

    • Creates files in the user directory

      • EXCEL.EXE (PID: 1824)

    • Dropped object may contain Bitcoin addresses

      • wprgxyeqd79.exe (PID: 3892)

    • Application was crashed

      • rtegre.exe (PID: 3184)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rar | RAR compressed archive (v5.0) (61.5)
.rar | RAR compressed archive (gen) (38.4)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
459
Monitored processes
428
Malicious processes
10
Suspicious processes
21

Behavior graph

Click at the process to see the details
start drop and start drop and start drop and start drop and start drop and start winrar.exe no specs excel.exe wprgxyeqd79.exe exit.exe no specs cmd.exe ping.exe no specs ping.exe no specs rtegre.exe uninstall.exe veter1605_maps_10cr0.exe exit.exe no specs cmd.exe no specs reg.exe #RMS winserv.exe taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs conhost.exe no specs svchost.exe no specs osppsvc.exe no specs conhost.exe no specs wmiprvse.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs werfault.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
252taskkill /f /im "rundll32.exe" C:\Windows\system32\taskkill.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Terminates Processes
Exit code:
128
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\taskkill.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\version.dll
c:\windows\system32\user32.dll
280taskkill /f /im "rundll32.exe" C:\Windows\system32\taskkill.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Terminates Processes
Exit code:
128
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\taskkill.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\version.dll
c:\windows\system32\user32.dll
292taskkill /f /im "rundll32.exe" C:\Windows\system32\taskkill.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Terminates Processes
Exit code:
128
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\taskkill.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\version.dll
c:\windows\system32\user32.dll
292taskkill /f /im "rundll32.exe" C:\Windows\system32\taskkill.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Terminates Processes
Exit code:
128
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\wbem\fastprox.dll
c:\windows\system32\rpcrtremote.dll
c:\windows\system32\cryptsp.dll
c:\windows\system32\wbemcomn.dll
c:\windows\system32\clbcatq.dll
c:\windows\system32\msctf.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\wkscli.dll
c:\windows\system32\netutils.dll
c:\windows\system32\wtsapi32.dll
296taskkill /f /im "rundll32.exe" C:\Windows\system32\taskkill.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Terminates Processes
Exit code:
128
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\taskkill.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\version.dll
c:\windows\system32\user32.dll
296taskkill /f /im "rundll32.exe" C:\Windows\system32\taskkill.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Terminates Processes
Exit code:
128
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\wbem\fastprox.dll
c:\windows\system32\rpcrtremote.dll
c:\windows\system32\cryptsp.dll
c:\windows\system32\wbemcomn.dll
c:\windows\system32\clbcatq.dll
c:\windows\system32\msctf.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\wkscli.dll
c:\windows\system32\netutils.dll
c:\windows\system32\wtsapi32.dll
300taskkill /f /im "rundll32.exe" C:\Windows\system32\taskkill.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Terminates Processes
Exit code:
128
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\taskkill.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\version.dll
c:\windows\system32\user32.dll
300taskkill /f /im "rundll32.exe" C:\Windows\system32\taskkill.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Terminates Processes
Exit code:
128
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\wbem\fastprox.dll
c:\windows\system32\rpcrtremote.dll
c:\windows\system32\cryptsp.dll
c:\windows\system32\wbemcomn.dll
c:\windows\system32\clbcatq.dll
c:\windows\system32\msctf.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\wkscli.dll
c:\windows\system32\netutils.dll
c:\windows\system32\wtsapi32.dll
352taskkill /f /im "rundll32.exe" C:\Windows\system32\taskkill.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Terminates Processes
Exit code:
128
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\taskkill.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\version.dll
c:\windows\system32\user32.dll
456taskkill /f /im "rundll32.exe" C:\Windows\system32\taskkill.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Terminates Processes
Exit code:
128
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\taskkill.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\version.dll
c:\windows\system32\user32.dll
Total events
2 658
Read events
2 582
Write events
69
Delete events
7

Modification events

(PID) Process:(3016) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(3016) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(3016) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\62\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3016) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\bill notice 05.2019.rar
(PID) Process:(3016) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(3016) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(3016) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(3016) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(3016) WinRAR.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000000000000F01FEC\Usage
Operation:writeName:EXCELFiles
Value:
1320419345
(PID) Process:(1824) EXCEL.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\StartupItems
Operation:writeName:x45
Value:
7834350020070000010000000000000000000000
Executable files
11
Suspicious files
3
Text files
5
Unknown types
1

Dropped files

PID
Process
Filename
Type
1824EXCEL.EXEC:\Users\admin\AppData\Local\Temp\CVR2478.tmp.cvr —
MD5:—
SHA256:—
3892wprgxyeqd79.exeC:\Users\admin\AppData\Local\Temp\kernel.dllexecutable
MD5:—
SHA256:—
1824EXCEL.EXEC:\Users\Public\wprgxyeqd79.exeexecutable
MD5:—
SHA256:—
3892wprgxyeqd79.exeC:\Users\admin\AppData\Local\Temp\i.cmdtext
MD5:—
SHA256:—
1824EXCEL.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\H6QNMHE9\pasmmm[1].exeexecutable
MD5:—
SHA256:—
3016WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DIa3016.12620\bill notice 05.2019.xlsdocument
MD5:—
SHA256:—
3904uninstall.exeC:\ProgramData\Windows Anytime Upgrade\i.cmdtext
MD5:—
SHA256:—
2472cmd.exeC:\Users\admin\AppData\Local\Temp\uninstall.exeexecutable
MD5:—
SHA256:—
3892wprgxyeqd79.exeC:\Users\admin\AppData\Local\Temp\exit.exeexecutable
MD5:—
SHA256:—
3892wprgxyeqd79.exeC:\Users\admin\AppData\Local\Temp\veter1605_MAPS_10cr0.exeexecutable
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
7
TCP/UDP connections
13
DNS requests
7
Threats
28

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3184
rtegre.exe
GET
—
104.218.63.76:80
http://104.218.63.76/tor/server/fp/5ed7e5eec5fe07ee7eef8005519adb175e24b6db
CA
—
—
suspicious
3184
rtegre.exe
GET
—
198.50.211.194:80
http://198.50.211.194/tor/server/fp/bc30e810ffd274b3a2c454047e56e599a9c86497
PA
—
—
malicious
3184
rtegre.exe
GET
—
204.13.164.118:80
http://204.13.164.118/tor/status-vote/current/consensus
US
—
—
suspicious
3184
rtegre.exe
GET
—
212.186.71.38:80
http://212.186.71.38/tor/server/fp/3687fec7e73f61ac66f7ae251e7dee6bbd8c0252
AT
—
—
suspicious
3184
rtegre.exe
GET
—
104.223.45.150:80
http://104.223.45.150/tor/server/fp/592031cfdba17dd46e1e365e6c60ad1f81655033
US
—
—
suspicious
3184
rtegre.exe
GET
—
51.255.206.74:80
http://51.255.206.74/tor/server/fp/bc30e810ffd274b3a2c454047e56e599a9c86497
FR
—
—
suspicious
3184
rtegre.exe
GET
—
66.111.2.131:9030
http://66.111.2.131:9030/tor/status-vote/current/consensus
US
—
—
suspicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1824
EXCEL.EXE
47.245.58.124:443
kentona.su
—
US
suspicious
3128
winserv.exe
217.12.201.159:5655
—
ITL Company
NL
suspicious
3184
rtegre.exe
204.13.164.118:80
—
Riseup Networks
US
suspicious
3184
rtegre.exe
198.50.211.194:80
—
OVH SAS
PA
malicious
3184
rtegre.exe
66.111.2.131:9030
—
The New York Internet Company
US
suspicious
3184
rtegre.exe
54.243.198.12:443
api.ipify.org
Amazon.com, Inc.
US
malicious
3184
rtegre.exe
51.255.206.74:80
—
OVH SAS
FR
suspicious
3184
rtegre.exe
94.140.116.189:443
—
Makonix SIA
LV
suspicious
3184
rtegre.exe
129.6.15.28:13
time-a.nist.gov
National Bureau of Standards
US
unknown
3184
rtegre.exe
212.186.71.38:80
—
Liberty Global Operations B.V.
AT
suspicious

DNS requests

Domain
IP
Reputation
kentona.su
  • 47.245.58.124
malicious
www.cloudflare.com
  • 104.17.210.9
  • 104.17.209.9
whitelisted
api.ipify.org
  • 54.243.198.12
  • 54.235.124.112
  • 23.21.121.219
  • 54.204.36.156
  • 50.19.247.198
  • 107.22.215.20
  • 54.225.171.237
  • 50.16.229.140
shared
time-a.nist.gov
  • 129.6.15.28
whitelisted
dns.msftncsi.com
  • 131.107.255.255
shared

Threats

PID
Process
Class
Message
1048
svchost.exe
Potentially Bad Traffic
ET DNS Query for .su TLD (Soviet Union) Often Malware Related
3184
rtegre.exe
Misc Attack
ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 333
3184
rtegre.exe
Misc Attack
ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 550
3184
rtegre.exe
Misc activity
SUSPICIOUS [PTsecurity] ipify.org External IP Check
3184
rtegre.exe
Misc activity
SUSPICIOUS [PTsecurity] ipify.org External IP Check
3184
rtegre.exe
Misc activity
SUSPICIOUS [PTsecurity] ipify.org External IP Check
3184
rtegre.exe
Misc activity
SUSPICIOUS [PTsecurity] ipify.org External IP Check
3184
rtegre.exe
Misc activity
SUSPICIOUS [PTsecurity] ipify.org External IP Check
3184
rtegre.exe
Misc activity
SUSPICIOUS [PTsecurity] ipify.org External IP Check
3184
rtegre.exe
Misc activity
SUSPICIOUS [PTsecurity] ipify.org External IP Check
3 ETPRO signatures available at the full report
Process
Message
winserv.exe
Error WTSQueryUserToken #1314
winserv.exe
20-05-2019_14:40:45:132#T:Error #20 @2
winserv.exe
20-05-2019_14:41:20:710#T:Msg Size: 104
winserv.exe
20-05-2019_14:41:20:710#T:Msg code: 3
winserv.exe
20-05-2019_14:41:20:710#T:MSG_KEEP_ALIVE
winserv.exe
MSG_KEEP_ALIVE
winserv.exe
20-05-2019_14:41:43:898#T:Msg Size: 104
winserv.exe
20-05-2019_14:41:43:898#T:Msg code: 3
winserv.exe
20-05-2019_14:41:43:898#T:MSG_KEEP_ALIVE
winserv.exe
MSG_KEEP_ALIVE
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
bill notice 05.2019.rar