Analysis
-
max time kernel
36s -
max time network
147s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
25-06-2021 19:07
Static task
static1
Behavioral task
behavioral1
Sample
SvHost-3.exe
Resource
win7v20210410
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
SvHost-3.exe
Resource
win10v20210408
windows10_x64
0 signatures
0 seconds
General
-
Target
SvHost-3.exe
-
Size
1.3MB
-
MD5
6d0cefa5b7f1744aa5dbc041c50b1709
-
SHA1
023fe5cafe7f0b32bfaf1b3549785e4d36a13b63
-
SHA256
c6da46d2abe90035674272a826d1203dde07338e27e3ebefc6335cbedb389019
-
SHA512
fb3bef44b77d7d3b83c42f769236f2c7646f1642d07f3650199d6511a111b31cb917fdc9d776d0e4be5cffb374a162ce4cd09925463b94f9bf8be50501f66631
Score
10/10
Malware Config
Signatures
-
Ouroboros/Zeropadypt
Ransomware family based on open-source CryptoWire.
-
Executes dropped EXE 1 IoCs
pid Process 900 Windows Session Manager.exe -
Modifies Windows Firewall 1 TTPs
-
Drops desktop.ini file(s) 7 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI Windows Session Manager.exe File opened for modification C:\$Recycle.Bin\S-1-5-21-1594587808-2047097707-2163810515-1000\desktop.ini Windows Session Manager.exe File created C:\$Recycle.Bin\S-1-5-21-1594587808-2047097707-2163810515-1000\desktop.ini Windows Session Manager.exe File opened for modification C:\Program Files\desktop.ini Windows Session Manager.exe File created C:\Program Files\desktop.ini Windows Session Manager.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Stationery\Desktop.ini Windows Session Manager.exe File created C:\Program Files\Common Files\microsoft shared\Stationery\Desktop.ini Windows Session Manager.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\config\Modules\org-openide-execution.xml Windows Session Manager.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Trial-pl.xrm-ms Windows Session Manager.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\meta\art\00_musicbrainz.luac Windows Session Manager.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1611.10393.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Place\LTR\contrast-black\LargeTile.scale-125.png Windows Session Manager.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.ZuneVideo_10.16112.11601.0_neutral_resources.scale-200_8wekyb3d8bbwe\Assets\contrast-black\SplashScreen.scale-200_contrast-black.png Windows Session Manager.exe File opened for modification C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Blue Green.xml.[[email protected]][C78F9BD9].Spyro Windows Session Manager.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\Assets\TextureBitmaps\sttionry.jpg Windows Session Manager.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\olh.htm Windows Session Manager.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\msvcp120.dll Windows Session Manager.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msotdaddin.dll.[[email protected]][C78F9BD9].Spyro Windows Session Manager.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\update_tracking\org-netbeans-modules-queries.xml.[[email protected]][C78F9BD9].Spyro Windows Session Manager.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-host-remote.xml.[[email protected]][C78F9BD9].Spyro Windows Session Manager.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019XC2RVL_MAKC2R-ul-oob.xrm-ms Windows Session Manager.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-netbeans-core-output2_zh_CN.jar.[[email protected]][C78F9BD9].Spyro Windows Session Manager.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ar\LC_MESSAGES\vlc.mo Windows Session Manager.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\bg.pak Windows Session Manager.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\DataModel\Cartridges\trdtv2r41.xsl Windows Session Manager.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsSoundRecorder_10.1702.301.0_neutral_split.scale-200_8wekyb3d8bbwe\Assets\VoiceRecorderMedTile.contrast-white_scale-200.png Windows Session Manager.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\Assets\AppPackageAppList.targetsize-30.png Windows Session Manager.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.contrast-black_scale-100.png Windows Session Manager.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSIPC\eu\msipc.dll.mui Windows Session Manager.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\org-netbeans-api-annotations-common.jar.[[email protected]][C78F9BD9].Spyro Windows Session Manager.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jstatd.exe Windows Session Manager.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Trial2-ppd.xrm-ms Windows Session Manager.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\EXPTOOWS.XLA Windows Session Manager.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-timezone-l1-1-0.dll.[[email protected]][C78F9BD9].Spyro Windows Session Manager.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\Welcome.html Windows Session Manager.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\profiler\lib\jfluid-server.jar.[[email protected]][C78F9BD9].Spyro Windows Session Manager.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\RADIAL\RADIAL.ELM Windows Session Manager.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\xmsrv.dll.[[email protected]][C78F9BD9].Spyro Windows Session Manager.exe File opened for modification C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Gill Sans MT.xml.[[email protected]][C78F9BD9].Spyro Windows Session Manager.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\Assets\starttile.dualsim1.sad.scale-200.png Windows Session Manager.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\TEE\fr-FR.PhoneNumber.SMS.model Windows Session Manager.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main.xml Windows Session Manager.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_Trial-pl.xrm-ms Windows Session Manager.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ff\LC_MESSAGES\vlc.mo Windows Session Manager.exe File created C:\Program Files\Microsoft Office\root\Client\vcruntime140.dll.[[email protected]][C78F9BD9].Spyro Windows Session Manager.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\Assets\AppTiles\LiveTile\W1.png Windows Session Manager.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Fonts\private\MSJH.TTC.[[email protected]][C78F9BD9].Spyro Windows Session Manager.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsCamera_2017.125.40.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraSplashScreen.contrast-black_scale-125.png Windows Session Manager.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherIcons\30x30\155.png Windows Session Manager.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\DailyChallenges\Popup\FUE4_Image.png Windows Session Manager.exe File created C:\Program Files\Microsoft Office\root\Integration\C2RManifest.office32ww.msi.16.x-none.xml.[[email protected]][C78F9BD9].Spyro Windows Session Manager.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\asl-v20.txt.[[email protected]][C78F9BD9].Spyro Windows Session Manager.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-netbeans-modules-options-keymap_zh_CN.jar.[[email protected]][C78F9BD9].Spyro Windows Session Manager.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\msoshext.dll.[[email protected]][C78F9BD9].Spyro Windows Session Manager.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.alert.ja_5.5.0.165303.jar Windows Session Manager.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectProDemoR_BypassTrial180-ul-oob.xrm-ms Windows Session Manager.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\MICROSOFT.DATA.RECOMMENDATION.COMMON.DLL.[[email protected]][C78F9BD9].Spyro Windows Session Manager.exe File opened for modification C:\Program Files\Microsoft Office\root\rsod\proofing.msi.16.en-us.boot.tree.dat Windows Session Manager.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSIPC\msipc.dll.[[email protected]][C78F9BD9].Spyro Windows Session Manager.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\SystemX86\mfc140u.dll.[[email protected]][C78F9BD9].Spyro Windows Session Manager.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\vcruntime140.dll.[[email protected]][C78F9BD9].Spyro Windows Session Manager.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ExcelTellMeOnnxModel.bin Windows Session Manager.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected] Windows Session Manager.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\mfc140u.dll.[[email protected]][C78F9BD9].Spyro Windows Session Manager.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\lib\images\cursors\win32_LinkNoDrop32x32.gif.[[email protected]][C78F9BD9].Spyro Windows Session Manager.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\1033\MAPISHELLR.DLL.[[email protected]][C78F9BD9].Spyro Windows Session Manager.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\Assets\3mf.ico Windows Session Manager.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-openide-dialogs_zh_CN.jar Windows Session Manager.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.simpleconfigurator.nl_ja_4.4.0.v20140623020002.jar.[[email protected]][C78F9BD9].Spyro Windows Session Manager.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\org-netbeans-modules-favorites.jar.[[email protected]][C78F9BD9].Spyro Windows Session Manager.exe File opened for modification C:\Program Files\desktop.ini Windows Session Manager.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\mce.dll Windows Session Manager.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
NTFS ADS 3 IoCs
description ioc Process File opened for modification C:\Documents and Settings\zh-TW\8:燘ķt.ex Windows Session Manager.exe File opened for modification C:\Documents and Settings\zh-TW\8:茨Ƈt.ex Windows Session Manager.exe File opened for modification C:\Documents and Settings\zh-TW\8:荰şt.ex Windows Session Manager.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 18 IoCs
pid Process 900 Windows Session Manager.exe 900 Windows Session Manager.exe 900 Windows Session Manager.exe 900 Windows Session Manager.exe 900 Windows Session Manager.exe 900 Windows Session Manager.exe 900 Windows Session Manager.exe 900 Windows Session Manager.exe 900 Windows Session Manager.exe 900 Windows Session Manager.exe 900 Windows Session Manager.exe 900 Windows Session Manager.exe 900 Windows Session Manager.exe 900 Windows Session Manager.exe 900 Windows Session Manager.exe 900 Windows Session Manager.exe 900 Windows Session Manager.exe 900 Windows Session Manager.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 996 wrote to memory of 900 996 SvHost-3.exe 76 PID 996 wrote to memory of 900 996 SvHost-3.exe 76 PID 996 wrote to memory of 900 996 SvHost-3.exe 76 PID 900 wrote to memory of 2020 900 Windows Session Manager.exe 79 PID 900 wrote to memory of 2020 900 Windows Session Manager.exe 79 PID 900 wrote to memory of 2020 900 Windows Session Manager.exe 79 PID 2020 wrote to memory of 3156 2020 cmd.exe 81 PID 2020 wrote to memory of 3156 2020 cmd.exe 81 PID 2020 wrote to memory of 3156 2020 cmd.exe 81 PID 3156 wrote to memory of 412 3156 net.exe 82 PID 3156 wrote to memory of 412 3156 net.exe 82 PID 3156 wrote to memory of 412 3156 net.exe 82 PID 900 wrote to memory of 1196 900 Windows Session Manager.exe 83 PID 900 wrote to memory of 1196 900 Windows Session Manager.exe 83 PID 900 wrote to memory of 1196 900 Windows Session Manager.exe 83 PID 900 wrote to memory of 1648 900 Windows Session Manager.exe 85 PID 900 wrote to memory of 1648 900 Windows Session Manager.exe 85 PID 900 wrote to memory of 1648 900 Windows Session Manager.exe 85 PID 900 wrote to memory of 3912 900 Windows Session Manager.exe 87 PID 900 wrote to memory of 3912 900 Windows Session Manager.exe 87 PID 900 wrote to memory of 3912 900 Windows Session Manager.exe 87 PID 900 wrote to memory of 2216 900 Windows Session Manager.exe 89 PID 900 wrote to memory of 2216 900 Windows Session Manager.exe 89 PID 900 wrote to memory of 2216 900 Windows Session Manager.exe 89 PID 2216 wrote to memory of 4064 2216 cmd.exe 91 PID 2216 wrote to memory of 4064 2216 cmd.exe 91 PID 2216 wrote to memory of 4064 2216 cmd.exe 91 PID 4064 wrote to memory of 2888 4064 net.exe 92 PID 4064 wrote to memory of 2888 4064 net.exe 92 PID 4064 wrote to memory of 2888 4064 net.exe 92 PID 900 wrote to memory of 2920 900 Windows Session Manager.exe 93 PID 900 wrote to memory of 2920 900 Windows Session Manager.exe 93 PID 900 wrote to memory of 2920 900 Windows Session Manager.exe 93 PID 2920 wrote to memory of 1332 2920 cmd.exe 95 PID 2920 wrote to memory of 1332 2920 cmd.exe 95 PID 2920 wrote to memory of 1332 2920 cmd.exe 95 PID 1332 wrote to memory of 2700 1332 net.exe 96 PID 1332 wrote to memory of 2700 1332 net.exe 96 PID 1332 wrote to memory of 2700 1332 net.exe 96 PID 900 wrote to memory of 3116 900 Windows Session Manager.exe 97 PID 900 wrote to memory of 3116 900 Windows Session Manager.exe 97 PID 900 wrote to memory of 3116 900 Windows Session Manager.exe 97 PID 3116 wrote to memory of 2136 3116 cmd.exe 99 PID 3116 wrote to memory of 2136 3116 cmd.exe 99 PID 3116 wrote to memory of 2136 3116 cmd.exe 99 PID 2136 wrote to memory of 3780 2136 net.exe 100 PID 2136 wrote to memory of 3780 2136 net.exe 100 PID 2136 wrote to memory of 3780 2136 net.exe 100 PID 900 wrote to memory of 3920 900 Windows Session Manager.exe 101 PID 900 wrote to memory of 3920 900 Windows Session Manager.exe 101 PID 900 wrote to memory of 3920 900 Windows Session Manager.exe 101 PID 3920 wrote to memory of 2396 3920 cmd.exe 103 PID 3920 wrote to memory of 2396 3920 cmd.exe 103 PID 3920 wrote to memory of 2396 3920 cmd.exe 103 PID 900 wrote to memory of 3180 900 Windows Session Manager.exe 104 PID 900 wrote to memory of 3180 900 Windows Session Manager.exe 104 PID 900 wrote to memory of 3180 900 Windows Session Manager.exe 104 PID 3180 wrote to memory of 2648 3180 cmd.exe 106 PID 3180 wrote to memory of 2648 3180 cmd.exe 106 PID 3180 wrote to memory of 2648 3180 cmd.exe 106 PID 900 wrote to memory of 3520 900 Windows Session Manager.exe 107 PID 900 wrote to memory of 3520 900 Windows Session Manager.exe 107 PID 900 wrote to memory of 3520 900 Windows Session Manager.exe 107 PID 3520 wrote to memory of 3000 3520 cmd.exe 109
Processes
-
C:\Users\Admin\AppData\Local\Temp\SvHost-3.exe"C:\Users\Admin\AppData\Local\Temp\SvHost-3.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:996 -
C:\Users\Admin\AppData\Local\Temp\Windows Session Manager.exe"C:\Users\Admin\AppData\Local\Temp\Windows Session Manager.exe"2⤵
- Executes dropped EXE
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:900 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c net stop MSDTC3⤵
- Suspicious use of WriteProcessMemory
PID:2020 -
C:\Windows\SysWOW64\net.exenet stop MSDTC4⤵
- Suspicious use of WriteProcessMemory
PID:3156 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSDTC5⤵PID:412
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c bcdedit /set {default} bootstatuspolicy ignoreallfailures3⤵PID:1196
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c bcdedit /set {default} recoveryenabled no3⤵PID:1648
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c wbadmin delete catalog -quiet3⤵PID:3912
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c net stop SQLSERVERAGENT3⤵
- Suspicious use of WriteProcessMemory
PID:2216 -
C:\Windows\SysWOW64\net.exenet stop SQLSERVERAGENT4⤵
- Suspicious use of WriteProcessMemory
PID:4064 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SQLSERVERAGENT5⤵PID:2888
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c net stop MSSQLSERVER3⤵
- Suspicious use of WriteProcessMemory
PID:2920 -
C:\Windows\SysWOW64\net.exenet stop MSSQLSERVER4⤵
- Suspicious use of WriteProcessMemory
PID:1332 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQLSERVER5⤵PID:2700
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c net stop vds3⤵
- Suspicious use of WriteProcessMemory
PID:3116 -
C:\Windows\SysWOW64\net.exenet stop vds4⤵
- Suspicious use of WriteProcessMemory
PID:2136 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop vds5⤵PID:3780
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c netsh advfirewall set currentprofile state off3⤵
- Suspicious use of WriteProcessMemory
PID:3920 -
C:\Windows\SysWOW64\netsh.exenetsh advfirewall set currentprofile state off4⤵PID:2396
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c netsh firewall set opmode mode=disable3⤵
- Suspicious use of WriteProcessMemory
PID:3180 -
C:\Windows\SysWOW64\netsh.exenetsh firewall set opmode mode=disable4⤵PID:2648
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c net stop SQLWriter3⤵
- Suspicious use of WriteProcessMemory
PID:3520 -
C:\Windows\SysWOW64\net.exenet stop SQLWriter4⤵PID:3000
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SQLWriter5⤵PID:2128
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c net stop SQLBrowser3⤵PID:1008
-
C:\Windows\SysWOW64\net.exenet stop SQLBrowser4⤵PID:3772
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SQLBrowser5⤵PID:2508
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c net stop MSSQLSERVER3⤵PID:2544
-
C:\Windows\SysWOW64\net.exenet stop MSSQLSERVER4⤵PID:1348
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQLSERVER5⤵PID:2252
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c net stop MSSQL$CONTOSO13⤵PID:1620
-
C:\Windows\SysWOW64\net.exenet stop MSSQL$CONTOSO14⤵PID:496
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQL$CONTOSO15⤵PID:1020
-
-
-
-