Malware Analysis Report

2024-10-24 18:32

Sample ID 210928-jxyqtsbba6
Target 456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample
SHA256 456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e
Tags
conti ransomware
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e

Threat Level: Known bad

The file 456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample was found to be: Known bad.

Malicious Activity Summary

conti ransomware

Conti Ransomware

Deletes shadow copies

Modifies extensions of user files

Drops desktop.ini file(s)

Enumerates connected drives

Drops file in Windows directory

Interacts with shadow copies

Suspicious behavior: EnumeratesProcesses

Modifies data under HKEY_USERS

Runs net.exe

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2021-09-28 08:03

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2021-09-28 08:03

Reported

2021-09-28 08:06

Platform

win7v20210408

Max time kernel

157s

Max time network

62s

Command Line

"C:\Users\Admin\AppData\Local\Temp\456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe"

Signatures

Conti Ransomware

ransomware conti

Deletes shadow copies

ransomware

Modifies extensions of user files

ransomware
Description Indicator Process Target
File renamed C:\Users\Admin\Pictures\MountSwitch.raw => C:\Users\Admin\Pictures\MountSwitch.raw.CONTI C:\Users\Admin\AppData\Local\Temp\456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe N/A
File renamed C:\Users\Admin\Pictures\PushRedo.png => C:\Users\Admin\Pictures\PushRedo.png.CONTI C:\Users\Admin\AppData\Local\Temp\456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe N/A
File renamed C:\Users\Admin\Pictures\RegisterRead.png => C:\Users\Admin\Pictures\RegisterRead.png.CONTI C:\Users\Admin\AppData\Local\Temp\456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe N/A
File renamed C:\Users\Admin\Pictures\ResizeComplete.crw => C:\Users\Admin\Pictures\ResizeComplete.crw.CONTI C:\Users\Admin\AppData\Local\Temp\456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe N/A
File renamed C:\Users\Admin\Pictures\UninstallBlock.crw => C:\Users\Admin\Pictures\UninstallBlock.crw.CONTI C:\Users\Admin\AppData\Local\Temp\456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe N/A

Drops desktop.ini file(s)

Description Indicator Process Target
File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini C:\Users\Admin\AppData\Local\Temp\456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe N/A
File opened for modification C:\Users\Admin\Links\desktop.ini C:\Users\Admin\AppData\Local\Temp\456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe N/A
File opened for modification C:\Users\Admin\Music\desktop.ini C:\Users\Admin\AppData\Local\Temp\456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe N/A
File opened for modification C:\Users\Admin\Pictures\desktop.ini C:\Users\Admin\AppData\Local\Temp\456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe N/A
File opened for modification C:\Users\Admin\Saved Games\desktop.ini C:\Users\Admin\AppData\Local\Temp\456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe N/A
File opened for modification C:\Users\Public\Documents\desktop.ini C:\Users\Admin\AppData\Local\Temp\456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe N/A
File opened for modification C:\Users\Public\Downloads\desktop.ini C:\Users\Admin\AppData\Local\Temp\456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe N/A
File opened for modification C:\Users\Public\Pictures\desktop.ini C:\Users\Admin\AppData\Local\Temp\456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe N/A
File opened for modification C:\Users\Public\Videos\desktop.ini C:\Users\Admin\AppData\Local\Temp\456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe N/A
File opened for modification C:\Users\Public\Recorded TV\Sample Media\desktop.ini C:\Users\Admin\AppData\Local\Temp\456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe N/A
File opened for modification C:\Users\Admin\Contacts\desktop.ini C:\Users\Admin\AppData\Local\Temp\456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe N/A
File opened for modification C:\Users\Admin\Downloads\desktop.ini C:\Users\Admin\AppData\Local\Temp\456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe N/A
File opened for modification C:\Users\Admin\Searches\desktop.ini C:\Users\Admin\AppData\Local\Temp\456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe N/A
File opened for modification C:\Users\Public\desktop.ini C:\Users\Admin\AppData\Local\Temp\456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe N/A
File opened for modification C:\Users\Public\Music\Sample Music\desktop.ini C:\Users\Admin\AppData\Local\Temp\456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe N/A
File opened for modification C:\Users\Public\Pictures\Sample Pictures\desktop.ini C:\Users\Admin\AppData\Local\Temp\456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe N/A
File opened for modification C:\Users\Admin\Desktop\desktop.ini C:\Users\Admin\AppData\Local\Temp\456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe N/A
File opened for modification C:\Users\Admin\Favorites\desktop.ini C:\Users\Admin\AppData\Local\Temp\456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe N/A
File opened for modification C:\Users\Admin\Favorites\Links for United States\desktop.ini C:\Users\Admin\AppData\Local\Temp\456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe N/A
File opened for modification C:\Users\Admin\Videos\desktop.ini C:\Users\Admin\AppData\Local\Temp\456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe N/A
File opened for modification C:\Users\Public\Music\desktop.ini C:\Users\Admin\AppData\Local\Temp\456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe N/A
File opened for modification C:\Users\Admin\Documents\desktop.ini C:\Users\Admin\AppData\Local\Temp\456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe N/A
File opened for modification C:\Users\Public\Desktop\desktop.ini C:\Users\Admin\AppData\Local\Temp\456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe N/A
File opened for modification C:\Users\Public\Libraries\desktop.ini C:\Users\Admin\AppData\Local\Temp\456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe N/A
File opened for modification C:\Users\Public\Recorded TV\desktop.ini C:\Users\Admin\AppData\Local\Temp\456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe N/A
File opened for modification C:\Users\Public\Videos\Sample Videos\desktop.ini C:\Users\Admin\AppData\Local\Temp\456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\F: C:\Windows\SysWOW64\vssadmin.exe N/A
File opened (read-only) \??\F: C:\Windows\SysWOW64\vssadmin.exe N/A
File opened (read-only) \??\e: C:\Windows\SysWOW64\vssadmin.exe N/A
File opened (read-only) \??\E: C:\Windows\SysWOW64\vssadmin.exe N/A
File opened (read-only) \??\e: C:\Windows\SysWOW64\vssadmin.exe N/A
File opened (read-only) \??\E: C:\Windows\SysWOW64\vssadmin.exe N/A
File opened (read-only) \??\f: C:\Windows\SysWOW64\vssadmin.exe N/A
File opened (read-only) \??\H: C:\Windows\SysWOW64\vssadmin.exe N/A
File opened (read-only) \??\D: C:\Windows\SysWOW64\vssadmin.exe N/A
File opened (read-only) \??\f: C:\Windows\SysWOW64\vssadmin.exe N/A
File opened (read-only) \??\G: C:\Windows\SysWOW64\vssadmin.exe N/A
File opened (read-only) \??\h: C:\Windows\SysWOW64\vssadmin.exe N/A
File opened (read-only) \??\D: C:\Windows\SysWOW64\vssadmin.exe N/A
File opened (read-only) \??\h: C:\Windows\SysWOW64\vssadmin.exe N/A
File opened (read-only) \??\H: C:\Windows\SysWOW64\vssadmin.exe N/A
File opened (read-only) \??\g: C:\Windows\SysWOW64\vssadmin.exe N/A

Runs net.exe

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1816 wrote to memory of 2004 N/A C:\Users\Admin\AppData\Local\Temp\456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe C:\Windows\SysWOW64\cmd.exe
PID 1816 wrote to memory of 2004 N/A C:\Users\Admin\AppData\Local\Temp\456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe C:\Windows\SysWOW64\cmd.exe
PID 1816 wrote to memory of 2004 N/A C:\Users\Admin\AppData\Local\Temp\456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe C:\Windows\SysWOW64\cmd.exe
PID 1816 wrote to memory of 2004 N/A C:\Users\Admin\AppData\Local\Temp\456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe C:\Windows\SysWOW64\cmd.exe
PID 2004 wrote to memory of 2040 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\vssadmin.exe
PID 2004 wrote to memory of 2040 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\vssadmin.exe
PID 2004 wrote to memory of 2040 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\vssadmin.exe
PID 2004 wrote to memory of 2040 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\vssadmin.exe
PID 1816 wrote to memory of 1408 N/A C:\Users\Admin\AppData\Local\Temp\456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe C:\Windows\SysWOW64\cmd.exe
PID 1816 wrote to memory of 1408 N/A C:\Users\Admin\AppData\Local\Temp\456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe C:\Windows\SysWOW64\cmd.exe
PID 1816 wrote to memory of 1408 N/A C:\Users\Admin\AppData\Local\Temp\456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe C:\Windows\SysWOW64\cmd.exe
PID 1816 wrote to memory of 1408 N/A C:\Users\Admin\AppData\Local\Temp\456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe C:\Windows\SysWOW64\cmd.exe
PID 1408 wrote to memory of 836 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\vssadmin.exe
PID 1408 wrote to memory of 836 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\vssadmin.exe
PID 1408 wrote to memory of 836 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\vssadmin.exe
PID 1408 wrote to memory of 836 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\vssadmin.exe
PID 1816 wrote to memory of 1984 N/A C:\Users\Admin\AppData\Local\Temp\456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe C:\Windows\SysWOW64\cmd.exe
PID 1816 wrote to memory of 1984 N/A C:\Users\Admin\AppData\Local\Temp\456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe C:\Windows\SysWOW64\cmd.exe
PID 1816 wrote to memory of 1984 N/A C:\Users\Admin\AppData\Local\Temp\456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe C:\Windows\SysWOW64\cmd.exe
PID 1816 wrote to memory of 1984 N/A C:\Users\Admin\AppData\Local\Temp\456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe C:\Windows\SysWOW64\cmd.exe
PID 1984 wrote to memory of 1976 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\vssadmin.exe
PID 1984 wrote to memory of 1976 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\vssadmin.exe
PID 1984 wrote to memory of 1976 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\vssadmin.exe
PID 1984 wrote to memory of 1976 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\vssadmin.exe
PID 1816 wrote to memory of 800 N/A C:\Users\Admin\AppData\Local\Temp\456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe C:\Windows\SysWOW64\cmd.exe
PID 1816 wrote to memory of 800 N/A C:\Users\Admin\AppData\Local\Temp\456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe C:\Windows\SysWOW64\cmd.exe
PID 1816 wrote to memory of 800 N/A C:\Users\Admin\AppData\Local\Temp\456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe C:\Windows\SysWOW64\cmd.exe
PID 1816 wrote to memory of 800 N/A C:\Users\Admin\AppData\Local\Temp\456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe C:\Windows\SysWOW64\cmd.exe
PID 800 wrote to memory of 1384 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\vssadmin.exe
PID 800 wrote to memory of 1384 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\vssadmin.exe
PID 800 wrote to memory of 1384 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\vssadmin.exe
PID 800 wrote to memory of 1384 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\vssadmin.exe
PID 1816 wrote to memory of 1916 N/A C:\Users\Admin\AppData\Local\Temp\456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe C:\Windows\SysWOW64\cmd.exe
PID 1816 wrote to memory of 1916 N/A C:\Users\Admin\AppData\Local\Temp\456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe C:\Windows\SysWOW64\cmd.exe
PID 1816 wrote to memory of 1916 N/A C:\Users\Admin\AppData\Local\Temp\456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe C:\Windows\SysWOW64\cmd.exe
PID 1816 wrote to memory of 1916 N/A C:\Users\Admin\AppData\Local\Temp\456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe C:\Windows\SysWOW64\cmd.exe
PID 1916 wrote to memory of 1752 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\vssadmin.exe
PID 1916 wrote to memory of 1752 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\vssadmin.exe
PID 1916 wrote to memory of 1752 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\vssadmin.exe
PID 1916 wrote to memory of 1752 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\vssadmin.exe
PID 1816 wrote to memory of 1952 N/A C:\Users\Admin\AppData\Local\Temp\456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe C:\Windows\SysWOW64\cmd.exe
PID 1816 wrote to memory of 1952 N/A C:\Users\Admin\AppData\Local\Temp\456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe C:\Windows\SysWOW64\cmd.exe
PID 1816 wrote to memory of 1952 N/A C:\Users\Admin\AppData\Local\Temp\456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe C:\Windows\SysWOW64\cmd.exe
PID 1816 wrote to memory of 1952 N/A C:\Users\Admin\AppData\Local\Temp\456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe C:\Windows\SysWOW64\cmd.exe
PID 1952 wrote to memory of 568 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\vssadmin.exe
PID 1952 wrote to memory of 568 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\vssadmin.exe
PID 1952 wrote to memory of 568 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\vssadmin.exe
PID 1952 wrote to memory of 568 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\vssadmin.exe
PID 1816 wrote to memory of 1700 N/A C:\Users\Admin\AppData\Local\Temp\456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe C:\Windows\SysWOW64\cmd.exe
PID 1816 wrote to memory of 1700 N/A C:\Users\Admin\AppData\Local\Temp\456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe C:\Windows\SysWOW64\cmd.exe
PID 1816 wrote to memory of 1700 N/A C:\Users\Admin\AppData\Local\Temp\456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe C:\Windows\SysWOW64\cmd.exe
PID 1816 wrote to memory of 1700 N/A C:\Users\Admin\AppData\Local\Temp\456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe C:\Windows\SysWOW64\cmd.exe
PID 1700 wrote to memory of 1696 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\vssadmin.exe
PID 1700 wrote to memory of 1696 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\vssadmin.exe
PID 1700 wrote to memory of 1696 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\vssadmin.exe
PID 1700 wrote to memory of 1696 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\vssadmin.exe
PID 1816 wrote to memory of 1764 N/A C:\Users\Admin\AppData\Local\Temp\456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe C:\Windows\SysWOW64\cmd.exe
PID 1816 wrote to memory of 1764 N/A C:\Users\Admin\AppData\Local\Temp\456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe C:\Windows\SysWOW64\cmd.exe
PID 1816 wrote to memory of 1764 N/A C:\Users\Admin\AppData\Local\Temp\456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe C:\Windows\SysWOW64\cmd.exe
PID 1816 wrote to memory of 1764 N/A C:\Users\Admin\AppData\Local\Temp\456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe C:\Windows\SysWOW64\cmd.exe
PID 1764 wrote to memory of 852 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\vssadmin.exe
PID 1764 wrote to memory of 852 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\vssadmin.exe
PID 1764 wrote to memory of 852 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\vssadmin.exe
PID 1764 wrote to memory of 852 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\vssadmin.exe

Processes

C:\Users\Admin\AppData\Local\Temp\456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe

"C:\Users\Admin\AppData\Local\Temp\456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c vssadmin Delete Shadows /all /quiet

C:\Windows\SysWOW64\vssadmin.exe

vssadmin Delete Shadows /all /quiet

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c vssadmin resize shadowstorage /for=c: /on=c: /maxsize=401MB

C:\Windows\SysWOW64\vssadmin.exe

vssadmin resize shadowstorage /for=c: /on=c: /maxsize=401MB

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c vssadmin resize shadowstorage /for=c: /on=c: /maxsize=unbounded

C:\Windows\SysWOW64\vssadmin.exe

vssadmin resize shadowstorage /for=c: /on=c: /maxsize=unbounded

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c vssadmin resize shadowstorage /for=d: /on=d: /maxsize=401MB

C:\Windows\SysWOW64\vssadmin.exe

vssadmin resize shadowstorage /for=d: /on=d: /maxsize=401MB

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c vssadmin resize shadowstorage /for=d: /on=d: /maxsize=unbounded

C:\Windows\SysWOW64\vssadmin.exe

vssadmin resize shadowstorage /for=d: /on=d: /maxsize=unbounded

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c vssadmin resize shadowstorage /for=e: /on=e: /maxsize=401MB

C:\Windows\SysWOW64\vssadmin.exe

vssadmin resize shadowstorage /for=e: /on=e: /maxsize=401MB

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c vssadmin resize shadowstorage /for=e: /on=e: /maxsize=unbounded

C:\Windows\SysWOW64\vssadmin.exe

vssadmin resize shadowstorage /for=e: /on=e: /maxsize=unbounded

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c vssadmin resize shadowstorage /for=f: /on=f: /maxsize=401MB

C:\Windows\SysWOW64\vssadmin.exe

vssadmin resize shadowstorage /for=f: /on=f: /maxsize=401MB

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c vssadmin resize shadowstorage /for=f: /on=f: /maxsize=unbounded

C:\Windows\SysWOW64\vssadmin.exe

vssadmin resize shadowstorage /for=f: /on=f: /maxsize=unbounded

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c vssadmin resize shadowstorage /for=g: /on=g: /maxsize=401MB

C:\Windows\SysWOW64\vssadmin.exe

vssadmin resize shadowstorage /for=g: /on=g: /maxsize=401MB

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c vssadmin resize shadowstorage /for=g: /on=g: /maxsize=unbounded

C:\Windows\SysWOW64\vssadmin.exe

vssadmin resize shadowstorage /for=g: /on=g: /maxsize=unbounded

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c vssadmin resize shadowstorage /for=h: /on=h: /maxsize=401MB

C:\Windows\SysWOW64\vssadmin.exe

vssadmin resize shadowstorage /for=h: /on=h: /maxsize=401MB

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c vssadmin resize shadowstorage /for=h: /on=h: /maxsize=unbounded

C:\Windows\SysWOW64\vssadmin.exe

vssadmin resize shadowstorage /for=h: /on=h: /maxsize=unbounded

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c vssadmin Delete Shadows /all /quiet

C:\Windows\SysWOW64\vssadmin.exe

vssadmin Delete Shadows /all /quiet

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop "Acronis VSS Provider" /y

C:\Windows\SysWOW64\net.exe

net stop "Acronis VSS Provider" /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop "Acronis VSS Provider" /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop "Enterprise Client Service" /y

C:\Windows\SysWOW64\net.exe

net stop "Enterprise Client Service" /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop "Enterprise Client Service" /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop "SQLsafe Backup Service" /y

C:\Windows\SysWOW64\net.exe

net stop "SQLsafe Backup Service" /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop "SQLsafe Backup Service" /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop "SQLsafe Filter Service" /y

C:\Windows\SysWOW64\net.exe

net stop "SQLsafe Filter Service" /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop "SQLsafe Filter Service" /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop "Veeam Backup Catalog Data Service" /y

C:\Windows\SysWOW64\net.exe

net stop "Veeam Backup Catalog Data Service" /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop "Veeam Backup Catalog Data Service" /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop AcronisAgent /y

C:\Windows\SysWOW64\net.exe

net stop AcronisAgent /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop AcronisAgent /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop AcrSch2Svc /y

C:\Windows\SysWOW64\net.exe

net stop AcrSch2Svc /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop AcrSch2Svc /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop Antivirus /y

C:\Windows\SysWOW64\net.exe

net stop Antivirus /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop Antivirus /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop ARSM /y

C:\Windows\SysWOW64\net.exe

net stop ARSM /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop ARSM /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop BackupExecAgentAccelerator /y

C:\Windows\SysWOW64\net.exe

net stop BackupExecAgentAccelerator /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop BackupExecAgentAccelerator /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop BackupExecAgentBrowser /y

C:\Windows\SysWOW64\net.exe

net stop BackupExecAgentBrowser /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop BackupExecAgentBrowser /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop BackupExecDeviceMediaService /y

C:\Windows\SysWOW64\net.exe

net stop BackupExecDeviceMediaService /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop BackupExecDeviceMediaService /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop BackupExecJobEngine /y

C:\Windows\SysWOW64\net.exe

net stop BackupExecJobEngine /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop BackupExecJobEngine /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop BackupExecManagementService /y

C:\Windows\SysWOW64\net.exe

net stop BackupExecManagementService /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop BackupExecManagementService /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop BackupExecRPCService /y

C:\Windows\SysWOW64\net.exe

net stop BackupExecRPCService /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop BackupExecRPCService /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop BackupExecVSSProvider /y

C:\Windows\SysWOW64\net.exe

net stop BackupExecVSSProvider /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop BackupExecVSSProvider /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop bedbg /y

C:\Windows\SysWOW64\net.exe

net stop bedbg /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop bedbg /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop DCAgent /y

C:\Windows\SysWOW64\net.exe

net stop DCAgent /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop DCAgent /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop EPSecurityService /y

C:\Windows\SysWOW64\net.exe

net stop EPSecurityService /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop EPSecurityService /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop EPUpdateService /y

C:\Windows\SysWOW64\net.exe

net stop EPUpdateService /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop EPUpdateService /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop EraserSvc11710 /y

C:\Windows\SysWOW64\net.exe

net stop EraserSvc11710 /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop EraserSvc11710 /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop EsgShKernel /y

C:\Windows\SysWOW64\net.exe

net stop EsgShKernel /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop EsgShKernel /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop FA_Scheduler /y

C:\Windows\SysWOW64\net.exe

net stop FA_Scheduler /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop FA_Scheduler /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop IISAdmin /y

C:\Windows\SysWOW64\net.exe

net stop IISAdmin /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop IISAdmin /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop IMAP4Svc /y

C:\Windows\SysWOW64\net.exe

net stop IMAP4Svc /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop IMAP4Svc /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop McShield /y

C:\Windows\SysWOW64\net.exe

net stop McShield /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop McShield /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop McTaskManager /y

C:\Windows\SysWOW64\net.exe

net stop McTaskManager /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop McTaskManager /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop mfemms /y

C:\Windows\SysWOW64\net.exe

net stop mfemms /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop mfemms /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop mfevtp /y

C:\Windows\SysWOW64\net.exe

net stop mfevtp /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop mfevtp /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop MMS /y

C:\Windows\SysWOW64\net.exe

net stop MMS /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop MMS /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop mozyprobackup /y

C:\Windows\SysWOW64\net.exe

net stop mozyprobackup /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop mozyprobackup /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop MsDtsServer /y

C:\Windows\SysWOW64\net.exe

net stop MsDtsServer /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop MsDtsServer /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop MsDtsServer100 /y

C:\Windows\SysWOW64\net.exe

net stop MsDtsServer100 /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop MsDtsServer100 /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop MsDtsServer110 /y

C:\Windows\SysWOW64\net.exe

net stop MsDtsServer110 /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop MsDtsServer110 /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop MSExchangeES /y

C:\Windows\SysWOW64\net.exe

net stop MSExchangeES /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop MSExchangeES /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop MSExchangeIS /y

C:\Windows\SysWOW64\net.exe

net stop MSExchangeIS /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop MSExchangeIS /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop MSExchangeMGMT /y

C:\Windows\SysWOW64\net.exe

net stop MSExchangeMGMT /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop MSExchangeMGMT /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop MSExchangeMTA /y

C:\Windows\SysWOW64\net.exe

net stop MSExchangeMTA /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop MSExchangeMTA /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop MSExchangeSA /y

C:\Windows\SysWOW64\net.exe

net stop MSExchangeSA /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop MSExchangeSA /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop MSExchangeSRS /y

C:\Windows\SysWOW64\net.exe

net stop MSExchangeSRS /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop MSExchangeSRS /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop MSOLAP$SQL_2008 /y

C:\Windows\SysWOW64\net.exe

net stop MSOLAP$SQL_2008 /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop MSOLAP$SQL_2008 /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop MSOLAP$SYSTEM_BGC /y

C:\Windows\SysWOW64\net.exe

net stop MSOLAP$SYSTEM_BGC /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop MSOLAP$SYSTEM_BGC /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop MSOLAP$TPS /y

C:\Windows\SysWOW64\net.exe

net stop MSOLAP$TPS /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop MSOLAP$TPS /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop MSOLAP$TPSAMA /y

C:\Windows\SysWOW64\net.exe

net stop MSOLAP$TPSAMA /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop MSOLAP$TPSAMA /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop MSSQL$BKUPEXEC /y

C:\Windows\SysWOW64\net.exe

net stop MSSQL$BKUPEXEC /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop MSSQL$BKUPEXEC /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop MSSQL$ECWDB2 /y

C:\Windows\SysWOW64\net.exe

net stop MSSQL$ECWDB2 /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop MSSQL$ECWDB2 /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop MSSQL$PRACTICEMGT /y

C:\Windows\SysWOW64\net.exe

net stop MSSQL$PRACTICEMGT /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop MSSQL$PRACTICEMGT /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop MSSQL$PRACTTICEBGC /y

C:\Windows\SysWOW64\net.exe

net stop MSSQL$PRACTTICEBGC /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop MSSQL$PRACTTICEBGC /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop MSSQL$PROFXENGAGEMENT /y

C:\Windows\SysWOW64\net.exe

net stop MSSQL$PROFXENGAGEMENT /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop MSSQL$PROFXENGAGEMENT /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop MSSQL$SBSMONITORING /y

C:\Windows\SysWOW64\net.exe

net stop MSSQL$SBSMONITORING /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop MSSQL$SBSMONITORING /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop MSSQL$SHAREPOINT /y

C:\Windows\SysWOW64\net.exe

net stop MSSQL$SHAREPOINT /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop MSSQL$SHAREPOINT /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop MSSQL$SQL_2008 /y

C:\Windows\SysWOW64\net.exe

net stop MSSQL$SQL_2008 /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop MSSQL$SQL_2008 /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop MSSQL$SYSTEM_BGC /y

C:\Windows\SysWOW64\net.exe

net stop MSSQL$SYSTEM_BGC /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop MSSQL$SYSTEM_BGC /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop MSSQL$TPS /y

C:\Windows\SysWOW64\net.exe

net stop MSSQL$TPS /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop MSSQL$TPS /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop MSSQL$TPSAMA /y

C:\Windows\SysWOW64\net.exe

net stop MSSQL$TPSAMA /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop MSSQL$TPSAMA /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop MSSQL$VEEAMSQL2008R2 /y

C:\Windows\SysWOW64\net.exe

net stop MSSQL$VEEAMSQL2008R2 /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop MSSQL$VEEAMSQL2008R2 /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop MSSQL$VEEAMSQL2012 /y

C:\Windows\SysWOW64\net.exe

net stop MSSQL$VEEAMSQL2012 /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop MSSQL$VEEAMSQL2012 /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop MSSQLFDLauncher /y

C:\Windows\SysWOW64\net.exe

net stop MSSQLFDLauncher /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop MSSQLFDLauncher /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop MSSQLFDLauncher$PROFXENGAGEMENT /y

C:\Windows\SysWOW64\net.exe

net stop MSSQLFDLauncher$PROFXENGAGEMENT /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop MSSQLFDLauncher$PROFXENGAGEMENT /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop MSSQLFDLauncher$SBSMONITORING /y

C:\Windows\SysWOW64\net.exe

net stop MSSQLFDLauncher$SBSMONITORING /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop MSSQLFDLauncher$SBSMONITORING /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop MSSQLFDLauncher$SHAREPOINT /y

C:\Windows\SysWOW64\net.exe

net stop MSSQLFDLauncher$SHAREPOINT /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop MSSQLFDLauncher$SHAREPOINT /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop MSSQLFDLauncher$SQL_2008 /y

C:\Windows\SysWOW64\net.exe

net stop MSSQLFDLauncher$SQL_2008 /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop MSSQLFDLauncher$SQL_2008 /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop MSSQLFDLauncher$SYSTEM_BGC /y

C:\Windows\SysWOW64\net.exe

net stop MSSQLFDLauncher$SYSTEM_BGC /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop MSSQLFDLauncher$SYSTEM_BGC /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop MSSQLFDLauncher$TPS /y

C:\Windows\SysWOW64\net.exe

net stop MSSQLFDLauncher$TPS /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop MSSQLFDLauncher$TPS /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop MSSQLFDLauncher$TPSAMA /y

C:\Windows\SysWOW64\net.exe

net stop MSSQLFDLauncher$TPSAMA /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop MSSQLFDLauncher$TPSAMA /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop MSSQLSERVER /y

C:\Windows\SysWOW64\net.exe

net stop MSSQLSERVER /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop MSSQLSERVER /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop MSSQLServerADHelper100 /y

C:\Windows\SysWOW64\net.exe

net stop MSSQLServerADHelper100 /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop MSSQLServerADHelper100 /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop MSSQLServerOLAPService /y

C:\Windows\SysWOW64\net.exe

net stop MSSQLServerOLAPService /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop MSSQLServerOLAPService /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop MySQL57 /y

C:\Windows\SysWOW64\net.exe

net stop MySQL57 /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop MySQL57 /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop ntrtscan /y

C:\Windows\SysWOW64\net.exe

net stop ntrtscan /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop ntrtscan /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop OracleClientCache80 /y

C:\Windows\SysWOW64\net.exe

net stop OracleClientCache80 /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop OracleClientCache80 /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop PDVFSService /y

C:\Windows\SysWOW64\net.exe

net stop PDVFSService /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop PDVFSService /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop POP3Svc /y

C:\Windows\SysWOW64\net.exe

net stop POP3Svc /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop POP3Svc /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop ReportServer /y

C:\Windows\SysWOW64\net.exe

net stop ReportServer /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop ReportServer /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop ReportServer$SQL_2008 /y

C:\Windows\SysWOW64\net.exe

net stop ReportServer$SQL_2008 /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop ReportServer$SQL_2008 /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop ReportServer$SYSTEM_BGC /y

C:\Windows\SysWOW64\net.exe

net stop ReportServer$SYSTEM_BGC /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop ReportServer$SYSTEM_BGC /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop ReportServer$TPS /y

C:\Windows\SysWOW64\net.exe

net stop ReportServer$TPS /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop ReportServer$TPS /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop ReportServer$TPSAMA /y

C:\Windows\SysWOW64\net.exe

net stop ReportServer$TPSAMA /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop ReportServer$TPSAMA /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop RESvc /y

C:\Windows\SysWOW64\net.exe

net stop RESvc /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop RESvc /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop sacsvr /y

C:\Windows\SysWOW64\net.exe

net stop sacsvr /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop sacsvr /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop SamSs /y

C:\Windows\SysWOW64\net.exe

net stop SamSs /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop SamSs /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop SAVAdminService /y

C:\Windows\SysWOW64\net.exe

net stop SAVAdminService /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop SAVAdminService /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop SAVService /y

C:\Windows\SysWOW64\net.exe

net stop SAVService /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop SAVService /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop SDRSVC /y

C:\Windows\SysWOW64\net.exe

net stop SDRSVC /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop SDRSVC /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop SepMasterService /y

C:\Windows\SysWOW64\net.exe

net stop SepMasterService /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop SepMasterService /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop ShMonitor /y

C:\Windows\SysWOW64\net.exe

net stop ShMonitor /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop ShMonitor /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop Smcinst /y

C:\Windows\SysWOW64\net.exe

net stop Smcinst /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop Smcinst /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop SmcService /y

C:\Windows\SysWOW64\net.exe

net stop SmcService /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop SmcService /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop SMTPSvc /y

C:\Windows\SysWOW64\net.exe

net stop SMTPSvc /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop SMTPSvc /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop SQLAgent$BKUPEXEC /y

C:\Windows\SysWOW64\net.exe

net stop SQLAgent$BKUPEXEC /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop SQLAgent$BKUPEXEC /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop SQLAgent$ECWDB2 /y

C:\Windows\SysWOW64\net.exe

net stop SQLAgent$ECWDB2 /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop SQLAgent$ECWDB2 /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop SQLAgent$PRACTTICEBGC /y

C:\Windows\SysWOW64\net.exe

net stop SQLAgent$PRACTTICEBGC /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop SQLAgent$PRACTTICEBGC /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop SQLAgent$PRACTTICEMGT /y

C:\Windows\SysWOW64\net.exe

net stop SQLAgent$PRACTTICEMGT /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop SQLAgent$PRACTTICEMGT /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop SQLAgent$PROFXENGAGEMENT /y

C:\Windows\SysWOW64\net.exe

net stop SQLAgent$PROFXENGAGEMENT /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop SQLAgent$PROFXENGAGEMENT /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop SQLAgent$SBSMONITORING /y

C:\Windows\SysWOW64\net.exe

net stop SQLAgent$SBSMONITORING /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop SQLAgent$SBSMONITORING /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop SQLAgent$SHAREPOINT /y

C:\Windows\SysWOW64\net.exe

net stop SQLAgent$SHAREPOINT /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop SQLAgent$SHAREPOINT /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop SQLAgent$SQL_2008 /y

C:\Windows\SysWOW64\net.exe

net stop SQLAgent$SQL_2008 /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop SQLAgent$SQL_2008 /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop SQLAgent$SYSTEM_BGC /y

C:\Windows\SysWOW64\net.exe

net stop SQLAgent$SYSTEM_BGC /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop SQLAgent$SYSTEM_BGC /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop SQLAgent$TPS /y

C:\Windows\SysWOW64\net.exe

net stop SQLAgent$TPS /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop SQLAgent$TPS /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop SQLAgent$TPSAMA /y

C:\Windows\SysWOW64\net.exe

net stop SQLAgent$TPSAMA /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop SQLAgent$TPSAMA /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop SQLAgent$VEEAMSQL2008R2 /y

C:\Windows\SysWOW64\net.exe

net stop SQLAgent$VEEAMSQL2008R2 /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop SQLAgent$VEEAMSQL2008R2 /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop SQLAgent$VEEAMSQL2012 /y

C:\Windows\SysWOW64\net.exe

net stop SQLAgent$VEEAMSQL2012 /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop SQLAgent$VEEAMSQL2012 /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop SQLBrowser /y

C:\Windows\SysWOW64\net.exe

net stop SQLBrowser /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop SQLBrowser /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop SQLSafeOLRService /y

C:\Windows\SysWOW64\net.exe

net stop SQLSafeOLRService /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop SQLSafeOLRService /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop SQLSERVERAGENT /y

C:\Windows\SysWOW64\net.exe

net stop SQLSERVERAGENT /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop SQLSERVERAGENT /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop SQLTELEMETRY /y

C:\Windows\SysWOW64\net.exe

net stop SQLTELEMETRY /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop SQLTELEMETRY /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop SQLTELEMETRY$ECWDB2 /y

C:\Windows\SysWOW64\net.exe

net stop SQLTELEMETRY$ECWDB2 /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop SQLTELEMETRY$ECWDB2 /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop SQLWriter /y

C:\Windows\SysWOW64\net.exe

net stop SQLWriter /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop SQLWriter /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop VeeamBackupSvc /y

C:\Windows\SysWOW64\net.exe

net stop VeeamBackupSvc /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop VeeamBackupSvc /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop VeeamBrokerSvc /y

C:\Windows\SysWOW64\net.exe

net stop VeeamBrokerSvc /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop VeeamBrokerSvc /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop VeeamCatalogSvc /y

C:\Windows\SysWOW64\net.exe

net stop VeeamCatalogSvc /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop VeeamCatalogSvc /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop VeeamCloudSvc /y

C:\Windows\SysWOW64\net.exe

net stop VeeamCloudSvc /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop VeeamCloudSvc /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop VeeamDeploymentService /y

C:\Windows\SysWOW64\net.exe

net stop VeeamDeploymentService /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop VeeamDeploymentService /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop VeeamDeploySvc /y

C:\Windows\SysWOW64\net.exe

net stop VeeamDeploySvc /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop VeeamDeploySvc /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop VeeamEnterpriseManagerSvc /y

C:\Windows\SysWOW64\net.exe

net stop VeeamEnterpriseManagerSvc /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop VeeamEnterpriseManagerSvc /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop VeeamMountSvc /y

C:\Windows\SysWOW64\net.exe

net stop VeeamMountSvc /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop VeeamMountSvc /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop VeeamNFSSvc /y

C:\Windows\SysWOW64\net.exe

net stop VeeamNFSSvc /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop VeeamNFSSvc /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop VeeamRESTSvc /y

C:\Windows\SysWOW64\net.exe

net stop VeeamRESTSvc /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop VeeamRESTSvc /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop VeeamTransportSvc /y

C:\Windows\SysWOW64\net.exe

net stop VeeamTransportSvc /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop VeeamTransportSvc /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop W3Svc /y

C:\Windows\SysWOW64\net.exe

net stop W3Svc /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop W3Svc /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop wbengine /y

C:\Windows\SysWOW64\net.exe

net stop wbengine /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop wbengine /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop WRSVC /y

C:\Windows\SysWOW64\net.exe

net stop WRSVC /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop WRSVC /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop MSSQL$VEEAMSQL2008R2 /y

C:\Windows\SysWOW64\net.exe

net stop MSSQL$VEEAMSQL2008R2 /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop MSSQL$VEEAMSQL2008R2 /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop SQLAgent$VEEAMSQL2008R2 /y

C:\Windows\SysWOW64\net.exe

net stop SQLAgent$VEEAMSQL2008R2 /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop SQLAgent$VEEAMSQL2008R2 /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop VeeamHvIntegrationSvc /y

C:\Windows\SysWOW64\net.exe

net stop VeeamHvIntegrationSvc /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop VeeamHvIntegrationSvc /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop swi_update /y

C:\Windows\SysWOW64\net.exe

net stop swi_update /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop swi_update /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop SQLAgent$CXDB /y

C:\Windows\SysWOW64\net.exe

net stop SQLAgent$CXDB /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop SQLAgent$CXDB /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop SQLAgent$CITRIX_METAFRAME /y

C:\Windows\SysWOW64\net.exe

net stop SQLAgent$CITRIX_METAFRAME /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop SQLAgent$CITRIX_METAFRAME /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop "SQL Backups" /y

C:\Windows\SysWOW64\net.exe

net stop "SQL Backups" /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop "SQL Backups" /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop MSSQL$PROD /y

C:\Windows\SysWOW64\net.exe

net stop MSSQL$PROD /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop MSSQL$PROD /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop "Zoolz 2 Service" /y

C:\Windows\SysWOW64\net.exe

net stop "Zoolz 2 Service" /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop "Zoolz 2 Service" /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop MSSQLServerADHelper /y

C:\Windows\SysWOW64\net.exe

net stop MSSQLServerADHelper /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop MSSQLServerADHelper /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop SQLAgent$PROD /y

C:\Windows\SysWOW64\net.exe

net stop SQLAgent$PROD /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop SQLAgent$PROD /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop msftesql$PROD /y

C:\Windows\SysWOW64\net.exe

net stop msftesql$PROD /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop msftesql$PROD /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop NetMsmqActivator /y

C:\Windows\SysWOW64\net.exe

net stop NetMsmqActivator /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop NetMsmqActivator /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop EhttpSrv /y

C:\Windows\SysWOW64\net.exe

net stop EhttpSrv /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop EhttpSrv /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop ekrn /y

C:\Windows\SysWOW64\net.exe

net stop ekrn /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop ekrn /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop ESHASRV /y

C:\Windows\SysWOW64\net.exe

net stop ESHASRV /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop ESHASRV /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop MSSQL$SOPHOS /y

C:\Windows\SysWOW64\net.exe

net stop MSSQL$SOPHOS /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop MSSQL$SOPHOS /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop SQLAgent$SOPHOS /y

C:\Windows\SysWOW64\net.exe

net stop SQLAgent$SOPHOS /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop SQLAgent$SOPHOS /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop AVP /y

C:\Windows\SysWOW64\net.exe

net stop AVP /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop AVP /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop klnagent /y

C:\Windows\SysWOW64\net.exe

net stop klnagent /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop klnagent /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop MSSQL$SQLEXPRESS /y

C:\Windows\SysWOW64\net.exe

net stop MSSQL$SQLEXPRESS /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop MSSQL$SQLEXPRESS /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop SQLAgent$SQLEXPRESS /y

C:\Windows\SysWOW64\net.exe

net stop SQLAgent$SQLEXPRESS /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop SQLAgent$SQLEXPRESS /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop wbengine /y

C:\Windows\SysWOW64\net.exe

net stop wbengine /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop wbengine /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop mfefire /y

C:\Windows\SysWOW64\net.exe

net stop mfefire /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop mfefire /y

Network

N/A

Files

memory/1816-60-0x0000000074D91000-0x0000000074D93000-memory.dmp

memory/2004-61-0x0000000000000000-mapping.dmp

memory/2040-62-0x0000000000000000-mapping.dmp

memory/1408-63-0x0000000000000000-mapping.dmp

memory/836-64-0x0000000000000000-mapping.dmp

memory/1984-65-0x0000000000000000-mapping.dmp

memory/1976-66-0x0000000000000000-mapping.dmp

memory/800-67-0x0000000000000000-mapping.dmp

memory/1384-68-0x0000000000000000-mapping.dmp

memory/1916-69-0x0000000000000000-mapping.dmp

memory/1752-70-0x0000000000000000-mapping.dmp

memory/1952-71-0x0000000000000000-mapping.dmp

memory/568-72-0x0000000000000000-mapping.dmp

memory/1700-73-0x0000000000000000-mapping.dmp

memory/1696-74-0x0000000000000000-mapping.dmp

memory/1764-75-0x0000000000000000-mapping.dmp

memory/852-76-0x0000000000000000-mapping.dmp

memory/1656-77-0x0000000000000000-mapping.dmp

memory/932-78-0x0000000000000000-mapping.dmp

memory/744-79-0x0000000000000000-mapping.dmp

memory/996-80-0x0000000000000000-mapping.dmp

memory/2012-81-0x0000000000000000-mapping.dmp

memory/1316-82-0x0000000000000000-mapping.dmp

memory/2044-83-0x0000000000000000-mapping.dmp

memory/1324-84-0x0000000000000000-mapping.dmp

memory/1320-85-0x0000000000000000-mapping.dmp

memory/268-86-0x0000000000000000-mapping.dmp

memory/1984-87-0x0000000000000000-mapping.dmp

memory/1664-88-0x0000000000000000-mapping.dmp

memory/800-89-0x0000000000000000-mapping.dmp

memory/1888-90-0x0000000000000000-mapping.dmp

memory/1760-91-0x0000000000000000-mapping.dmp

memory/1752-92-0x0000000000000000-mapping.dmp

memory/1708-93-0x0000000000000000-mapping.dmp

memory/1704-94-0x0000000000000000-mapping.dmp

memory/1780-95-0x0000000000000000-mapping.dmp

memory/1716-96-0x0000000000000000-mapping.dmp

memory/272-97-0x0000000000000000-mapping.dmp

memory/1308-98-0x0000000000000000-mapping.dmp

memory/1700-99-0x0000000000000000-mapping.dmp

memory/788-100-0x0000000000000000-mapping.dmp

memory/1528-101-0x0000000000000000-mapping.dmp

memory/852-102-0x0000000000000000-mapping.dmp

memory/276-103-0x0000000000000000-mapping.dmp

memory/1876-104-0x0000000000000000-mapping.dmp

memory/1032-105-0x0000000000000000-mapping.dmp

memory/932-106-0x0000000000000000-mapping.dmp

memory/1868-107-0x0000000000000000-mapping.dmp

memory/2032-108-0x0000000000000000-mapping.dmp

memory/1724-109-0x0000000000000000-mapping.dmp

memory/1036-110-0x0000000000000000-mapping.dmp

memory/1204-111-0x0000000000000000-mapping.dmp

memory/2016-112-0x0000000000000000-mapping.dmp

memory/1120-113-0x0000000000000000-mapping.dmp

memory/1208-114-0x0000000000000000-mapping.dmp

memory/1464-115-0x0000000000000000-mapping.dmp

memory/1996-116-0x0000000000000000-mapping.dmp

memory/516-117-0x0000000000000000-mapping.dmp

memory/1992-118-0x0000000000000000-mapping.dmp

memory/1976-119-0x0000000000000000-mapping.dmp

memory/268-120-0x0000000000000000-mapping.dmp

memory/2020-121-0x0000000000000000-mapping.dmp

memory/544-122-0x0000000000000000-mapping.dmp

memory/556-123-0x0000000000000000-mapping.dmp

memory/1980-124-0x0000000000000000-mapping.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2021-09-28 08:03

Reported

2021-09-28 08:06

Platform

win10v20210408

Max time kernel

162s

Max time network

104s

Command Line

"C:\Users\Admin\AppData\Local\Temp\456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe"

Signatures

Conti Ransomware

ransomware conti

Deletes shadow copies

ransomware

Modifies extensions of user files

ransomware
Description Indicator Process Target
File renamed C:\Users\Admin\Pictures\DismountMount.tif => C:\Users\Admin\Pictures\DismountMount.tif.CONTI C:\Users\Admin\AppData\Local\Temp\456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe N/A
File renamed C:\Users\Admin\Pictures\SearchUnpublish.raw => C:\Users\Admin\Pictures\SearchUnpublish.raw.CONTI C:\Users\Admin\AppData\Local\Temp\456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe N/A
File renamed C:\Users\Admin\Pictures\ImportInvoke.tif => C:\Users\Admin\Pictures\ImportInvoke.tif.CONTI C:\Users\Admin\AppData\Local\Temp\456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe N/A
File renamed C:\Users\Admin\Pictures\LimitReceive.raw => C:\Users\Admin\Pictures\LimitReceive.raw.CONTI C:\Users\Admin\AppData\Local\Temp\456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe N/A
File renamed C:\Users\Admin\Pictures\WritePush.crw => C:\Users\Admin\Pictures\WritePush.crw.CONTI C:\Users\Admin\AppData\Local\Temp\456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe N/A

Drops desktop.ini file(s)

Description Indicator Process Target
File opened for modification C:\Users\Public\Pictures\desktop.ini C:\Users\Admin\AppData\Local\Temp\456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe N/A
File opened for modification C:\Users\Admin\Saved Games\desktop.ini C:\Users\Admin\AppData\Local\Temp\456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe N/A
File opened for modification C:\Users\Public\Videos\desktop.ini C:\Users\Admin\AppData\Local\Temp\456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe N/A
File opened for modification C:\Users\Admin\OneDrive\desktop.ini C:\Users\Admin\AppData\Local\Temp\456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe N/A
File opened for modification C:\Users\Admin\Pictures\desktop.ini C:\Users\Admin\AppData\Local\Temp\456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe N/A
File opened for modification C:\Users\Admin\Pictures\Saved Pictures\desktop.ini C:\Users\Admin\AppData\Local\Temp\456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe N/A
File opened for modification C:\Users\Admin\Searches\desktop.ini C:\Users\Admin\AppData\Local\Temp\456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe N/A
File opened for modification C:\Users\Admin\Videos\desktop.ini C:\Users\Admin\AppData\Local\Temp\456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe N/A
File opened for modification C:\Users\Public\Libraries\desktop.ini C:\Users\Admin\AppData\Local\Temp\456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe N/A
File opened for modification C:\Users\Admin\Documents\desktop.ini C:\Users\Admin\AppData\Local\Temp\456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe N/A
File opened for modification C:\Users\Admin\Downloads\desktop.ini C:\Users\Admin\AppData\Local\Temp\456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe N/A
File opened for modification C:\Users\Admin\Music\desktop.ini C:\Users\Admin\AppData\Local\Temp\456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe N/A
File opened for modification C:\Users\Public\AccountPictures\desktop.ini C:\Users\Admin\AppData\Local\Temp\456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe N/A
File opened for modification C:\Users\Public\Desktop\desktop.ini C:\Users\Admin\AppData\Local\Temp\456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe N/A
File opened for modification C:\Users\Public\desktop.ini C:\Users\Admin\AppData\Local\Temp\456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe N/A
File opened for modification C:\Users\Public\Documents\desktop.ini C:\Users\Admin\AppData\Local\Temp\456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe N/A
File opened for modification C:\Users\Public\Downloads\desktop.ini C:\Users\Admin\AppData\Local\Temp\456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe N/A
File opened for modification C:\Users\Admin\Desktop\desktop.ini C:\Users\Admin\AppData\Local\Temp\456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe N/A
File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini C:\Users\Admin\AppData\Local\Temp\456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe N/A
File opened for modification C:\Users\Public\Music\desktop.ini C:\Users\Admin\AppData\Local\Temp\456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe N/A
File opened for modification C:\Users\Admin\Links\desktop.ini C:\Users\Admin\AppData\Local\Temp\456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe N/A
File opened for modification C:\Users\Admin\Pictures\Camera Roll\desktop.ini C:\Users\Admin\AppData\Local\Temp\456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe N/A
File opened for modification C:\Users\Admin\Contacts\desktop.ini C:\Users\Admin\AppData\Local\Temp\456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe N/A
File opened for modification C:\Users\Admin\Favorites\desktop.ini C:\Users\Admin\AppData\Local\Temp\456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\D: C:\Windows\SysWOW64\vssadmin.exe N/A
File opened (read-only) \??\F: C:\Windows\SysWOW64\vssadmin.exe N/A
File opened (read-only) \??\F: C:\Windows\SysWOW64\vssadmin.exe N/A
File opened (read-only) \??\g: C:\Windows\SysWOW64\vssadmin.exe N/A
File opened (read-only) \??\H: C:\Windows\SysWOW64\vssadmin.exe N/A
File opened (read-only) \??\e: C:\Windows\SysWOW64\vssadmin.exe N/A
File opened (read-only) \??\f: C:\Windows\SysWOW64\vssadmin.exe N/A
File opened (read-only) \??\H: C:\Windows\SysWOW64\vssadmin.exe N/A
File opened (read-only) \??\h: C:\Windows\SysWOW64\vssadmin.exe N/A
File opened (read-only) \??\E: C:\Windows\SysWOW64\vssadmin.exe N/A
File opened (read-only) \??\f: C:\Windows\SysWOW64\vssadmin.exe N/A
File opened (read-only) \??\g: C:\Windows\SysWOW64\vssadmin.exe N/A
File opened (read-only) \??\G: C:\Windows\SysWOW64\vssadmin.exe N/A
File opened (read-only) \??\h: C:\Windows\SysWOW64\vssadmin.exe N/A
File opened (read-only) \??\D: C:\Windows\SysWOW64\vssadmin.exe N/A
File opened (read-only) \??\e: C:\Windows\SysWOW64\vssadmin.exe N/A
File opened (read-only) \??\E: C:\Windows\SysWOW64\vssadmin.exe N/A
File opened (read-only) \??\G: C:\Windows\SysWOW64\vssadmin.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\Debug\ESE.TXT C:\Windows\System32\svchost.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\OnDemandInterfaceCache C:\Windows\System32\svchost.exe N/A

Runs net.exe

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 856 wrote to memory of 1116 N/A C:\Users\Admin\AppData\Local\Temp\456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe C:\Windows\SysWOW64\cmd.exe
PID 856 wrote to memory of 1116 N/A C:\Users\Admin\AppData\Local\Temp\456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe C:\Windows\SysWOW64\cmd.exe
PID 856 wrote to memory of 1116 N/A C:\Users\Admin\AppData\Local\Temp\456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe C:\Windows\SysWOW64\cmd.exe
PID 1116 wrote to memory of 1320 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\vssadmin.exe
PID 1116 wrote to memory of 1320 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\vssadmin.exe
PID 1116 wrote to memory of 1320 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\vssadmin.exe
PID 856 wrote to memory of 1796 N/A C:\Users\Admin\AppData\Local\Temp\456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe C:\Windows\SysWOW64\cmd.exe
PID 856 wrote to memory of 1796 N/A C:\Users\Admin\AppData\Local\Temp\456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe C:\Windows\SysWOW64\cmd.exe
PID 856 wrote to memory of 1796 N/A C:\Users\Admin\AppData\Local\Temp\456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe C:\Windows\SysWOW64\cmd.exe
PID 1796 wrote to memory of 2008 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\vssadmin.exe
PID 1796 wrote to memory of 2008 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\vssadmin.exe
PID 1796 wrote to memory of 2008 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\vssadmin.exe
PID 856 wrote to memory of 2196 N/A C:\Users\Admin\AppData\Local\Temp\456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe C:\Windows\SysWOW64\cmd.exe
PID 856 wrote to memory of 2196 N/A C:\Users\Admin\AppData\Local\Temp\456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe C:\Windows\SysWOW64\cmd.exe
PID 856 wrote to memory of 2196 N/A C:\Users\Admin\AppData\Local\Temp\456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe C:\Windows\SysWOW64\cmd.exe
PID 2196 wrote to memory of 2480 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\vssadmin.exe
PID 2196 wrote to memory of 2480 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\vssadmin.exe
PID 2196 wrote to memory of 2480 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\vssadmin.exe
PID 856 wrote to memory of 3276 N/A C:\Users\Admin\AppData\Local\Temp\456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe C:\Windows\SysWOW64\cmd.exe
PID 856 wrote to memory of 3276 N/A C:\Users\Admin\AppData\Local\Temp\456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe C:\Windows\SysWOW64\cmd.exe
PID 856 wrote to memory of 3276 N/A C:\Users\Admin\AppData\Local\Temp\456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe C:\Windows\SysWOW64\cmd.exe
PID 3276 wrote to memory of 2884 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\vssadmin.exe
PID 3276 wrote to memory of 2884 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\vssadmin.exe
PID 3276 wrote to memory of 2884 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\vssadmin.exe
PID 856 wrote to memory of 3836 N/A C:\Users\Admin\AppData\Local\Temp\456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe C:\Windows\SysWOW64\cmd.exe
PID 856 wrote to memory of 3836 N/A C:\Users\Admin\AppData\Local\Temp\456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe C:\Windows\SysWOW64\cmd.exe
PID 856 wrote to memory of 3836 N/A C:\Users\Admin\AppData\Local\Temp\456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe C:\Windows\SysWOW64\cmd.exe
PID 3836 wrote to memory of 3976 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\vssadmin.exe
PID 3836 wrote to memory of 3976 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\vssadmin.exe
PID 3836 wrote to memory of 3976 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\vssadmin.exe
PID 856 wrote to memory of 4024 N/A C:\Users\Admin\AppData\Local\Temp\456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe C:\Windows\SysWOW64\cmd.exe
PID 856 wrote to memory of 4024 N/A C:\Users\Admin\AppData\Local\Temp\456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe C:\Windows\SysWOW64\cmd.exe
PID 856 wrote to memory of 4024 N/A C:\Users\Admin\AppData\Local\Temp\456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe C:\Windows\SysWOW64\cmd.exe
PID 4024 wrote to memory of 3956 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\vssadmin.exe
PID 4024 wrote to memory of 3956 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\vssadmin.exe
PID 4024 wrote to memory of 3956 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\vssadmin.exe
PID 856 wrote to memory of 2720 N/A C:\Users\Admin\AppData\Local\Temp\456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe C:\Windows\SysWOW64\cmd.exe
PID 856 wrote to memory of 2720 N/A C:\Users\Admin\AppData\Local\Temp\456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe C:\Windows\SysWOW64\cmd.exe
PID 856 wrote to memory of 2720 N/A C:\Users\Admin\AppData\Local\Temp\456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe C:\Windows\SysWOW64\cmd.exe
PID 2720 wrote to memory of 1948 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\vssadmin.exe
PID 2720 wrote to memory of 1948 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\vssadmin.exe
PID 2720 wrote to memory of 1948 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\vssadmin.exe
PID 856 wrote to memory of 3148 N/A C:\Users\Admin\AppData\Local\Temp\456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe C:\Windows\SysWOW64\cmd.exe
PID 856 wrote to memory of 3148 N/A C:\Users\Admin\AppData\Local\Temp\456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe C:\Windows\SysWOW64\cmd.exe
PID 856 wrote to memory of 3148 N/A C:\Users\Admin\AppData\Local\Temp\456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe C:\Windows\SysWOW64\cmd.exe
PID 3148 wrote to memory of 2224 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\vssadmin.exe
PID 3148 wrote to memory of 2224 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\vssadmin.exe
PID 3148 wrote to memory of 2224 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\vssadmin.exe
PID 856 wrote to memory of 584 N/A C:\Users\Admin\AppData\Local\Temp\456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe C:\Windows\SysWOW64\cmd.exe
PID 856 wrote to memory of 584 N/A C:\Users\Admin\AppData\Local\Temp\456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe C:\Windows\SysWOW64\cmd.exe
PID 856 wrote to memory of 584 N/A C:\Users\Admin\AppData\Local\Temp\456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe C:\Windows\SysWOW64\cmd.exe
PID 584 wrote to memory of 2840 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\vssadmin.exe
PID 584 wrote to memory of 2840 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\vssadmin.exe
PID 584 wrote to memory of 2840 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\vssadmin.exe
PID 856 wrote to memory of 1072 N/A C:\Users\Admin\AppData\Local\Temp\456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe C:\Windows\SysWOW64\cmd.exe
PID 856 wrote to memory of 1072 N/A C:\Users\Admin\AppData\Local\Temp\456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe C:\Windows\SysWOW64\cmd.exe
PID 856 wrote to memory of 1072 N/A C:\Users\Admin\AppData\Local\Temp\456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe C:\Windows\SysWOW64\cmd.exe
PID 1072 wrote to memory of 720 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\vssadmin.exe
PID 1072 wrote to memory of 720 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\vssadmin.exe
PID 1072 wrote to memory of 720 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\vssadmin.exe
PID 856 wrote to memory of 2232 N/A C:\Users\Admin\AppData\Local\Temp\456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe C:\Windows\SysWOW64\cmd.exe
PID 856 wrote to memory of 2232 N/A C:\Users\Admin\AppData\Local\Temp\456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe C:\Windows\SysWOW64\cmd.exe
PID 856 wrote to memory of 2232 N/A C:\Users\Admin\AppData\Local\Temp\456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe C:\Windows\SysWOW64\cmd.exe
PID 2232 wrote to memory of 1200 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\vssadmin.exe

Processes

C:\Users\Admin\AppData\Local\Temp\456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe

"C:\Users\Admin\AppData\Local\Temp\456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c vssadmin Delete Shadows /all /quiet

C:\Windows\SysWOW64\vssadmin.exe

vssadmin Delete Shadows /all /quiet

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c vssadmin resize shadowstorage /for=c: /on=c: /maxsize=401MB

C:\Windows\SysWOW64\vssadmin.exe

vssadmin resize shadowstorage /for=c: /on=c: /maxsize=401MB

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c vssadmin resize shadowstorage /for=c: /on=c: /maxsize=unbounded

C:\Windows\SysWOW64\vssadmin.exe

vssadmin resize shadowstorage /for=c: /on=c: /maxsize=unbounded

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c vssadmin resize shadowstorage /for=d: /on=d: /maxsize=401MB

C:\Windows\SysWOW64\vssadmin.exe

vssadmin resize shadowstorage /for=d: /on=d: /maxsize=401MB

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c vssadmin resize shadowstorage /for=d: /on=d: /maxsize=unbounded

C:\Windows\SysWOW64\vssadmin.exe

vssadmin resize shadowstorage /for=d: /on=d: /maxsize=unbounded

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c vssadmin resize shadowstorage /for=e: /on=e: /maxsize=401MB

C:\Windows\SysWOW64\vssadmin.exe

vssadmin resize shadowstorage /for=e: /on=e: /maxsize=401MB

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c vssadmin resize shadowstorage /for=e: /on=e: /maxsize=unbounded

C:\Windows\SysWOW64\vssadmin.exe

vssadmin resize shadowstorage /for=e: /on=e: /maxsize=unbounded

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c vssadmin resize shadowstorage /for=f: /on=f: /maxsize=401MB

C:\Windows\SysWOW64\vssadmin.exe

vssadmin resize shadowstorage /for=f: /on=f: /maxsize=401MB

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c vssadmin resize shadowstorage /for=f: /on=f: /maxsize=unbounded

C:\Windows\SysWOW64\vssadmin.exe

vssadmin resize shadowstorage /for=f: /on=f: /maxsize=unbounded

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c vssadmin resize shadowstorage /for=g: /on=g: /maxsize=401MB

C:\Windows\SysWOW64\vssadmin.exe

vssadmin resize shadowstorage /for=g: /on=g: /maxsize=401MB

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c vssadmin resize shadowstorage /for=g: /on=g: /maxsize=unbounded

C:\Windows\SysWOW64\vssadmin.exe

vssadmin resize shadowstorage /for=g: /on=g: /maxsize=unbounded

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c vssadmin resize shadowstorage /for=h: /on=h: /maxsize=401MB

C:\Windows\SysWOW64\vssadmin.exe

vssadmin resize shadowstorage /for=h: /on=h: /maxsize=401MB

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c vssadmin resize shadowstorage /for=h: /on=h: /maxsize=unbounded

C:\Windows\SysWOW64\vssadmin.exe

vssadmin resize shadowstorage /for=h: /on=h: /maxsize=unbounded

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c vssadmin Delete Shadows /all /quiet

C:\Windows\SysWOW64\vssadmin.exe

vssadmin Delete Shadows /all /quiet

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop "Acronis VSS Provider" /y

C:\Windows\SysWOW64\net.exe

net stop "Acronis VSS Provider" /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop "Acronis VSS Provider" /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop "Enterprise Client Service" /y

C:\Windows\SysWOW64\net.exe

net stop "Enterprise Client Service" /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop "Enterprise Client Service" /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop "SQLsafe Backup Service" /y

C:\Windows\SysWOW64\net.exe

net stop "SQLsafe Backup Service" /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop "SQLsafe Backup Service" /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop "SQLsafe Filter Service" /y

C:\Windows\SysWOW64\net.exe

net stop "SQLsafe Filter Service" /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop "SQLsafe Filter Service" /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop "Veeam Backup Catalog Data Service" /y

C:\Windows\SysWOW64\net.exe

net stop "Veeam Backup Catalog Data Service" /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop "Veeam Backup Catalog Data Service" /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop AcronisAgent /y

C:\Windows\SysWOW64\net.exe

net stop AcronisAgent /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop AcronisAgent /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop AcrSch2Svc /y

C:\Windows\SysWOW64\net.exe

net stop AcrSch2Svc /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop AcrSch2Svc /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop Antivirus /y

C:\Windows\SysWOW64\net.exe

net stop Antivirus /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop Antivirus /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop ARSM /y

C:\Windows\SysWOW64\net.exe

net stop ARSM /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop ARSM /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop BackupExecAgentAccelerator /y

C:\Windows\SysWOW64\net.exe

net stop BackupExecAgentAccelerator /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop BackupExecAgentAccelerator /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop BackupExecAgentBrowser /y

C:\Windows\SysWOW64\net.exe

net stop BackupExecAgentBrowser /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop BackupExecAgentBrowser /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop BackupExecDeviceMediaService /y

C:\Windows\SysWOW64\net.exe

net stop BackupExecDeviceMediaService /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop BackupExecDeviceMediaService /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop BackupExecJobEngine /y

C:\Windows\SysWOW64\net.exe

net stop BackupExecJobEngine /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop BackupExecJobEngine /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop BackupExecManagementService /y

C:\Windows\SysWOW64\net.exe

net stop BackupExecManagementService /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop BackupExecManagementService /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop BackupExecRPCService /y

C:\Windows\SysWOW64\net.exe

net stop BackupExecRPCService /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop BackupExecRPCService /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop BackupExecVSSProvider /y

C:\Windows\SysWOW64\net.exe

net stop BackupExecVSSProvider /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop BackupExecVSSProvider /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop bedbg /y

C:\Windows\SysWOW64\net.exe

net stop bedbg /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop bedbg /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop DCAgent /y

C:\Windows\SysWOW64\net.exe

net stop DCAgent /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop DCAgent /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop EPSecurityService /y

C:\Windows\SysWOW64\net.exe

net stop EPSecurityService /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop EPSecurityService /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop EPUpdateService /y

C:\Windows\SysWOW64\net.exe

net stop EPUpdateService /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop EPUpdateService /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop EraserSvc11710 /y

C:\Windows\SysWOW64\net.exe

net stop EraserSvc11710 /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop EraserSvc11710 /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop EsgShKernel /y

C:\Windows\SysWOW64\net.exe

net stop EsgShKernel /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop EsgShKernel /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop FA_Scheduler /y

C:\Windows\SysWOW64\net.exe

net stop FA_Scheduler /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop FA_Scheduler /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop IISAdmin /y

C:\Windows\SysWOW64\net.exe

net stop IISAdmin /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop IISAdmin /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop IMAP4Svc /y

C:\Windows\SysWOW64\net.exe

net stop IMAP4Svc /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop IMAP4Svc /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop McShield /y

C:\Windows\SysWOW64\net.exe

net stop McShield /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop McShield /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop McTaskManager /y

C:\Windows\SysWOW64\net.exe

net stop McTaskManager /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop McTaskManager /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop mfemms /y

C:\Windows\SysWOW64\net.exe

net stop mfemms /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop mfemms /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop mfevtp /y

C:\Windows\SysWOW64\net.exe

net stop mfevtp /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop mfevtp /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop MMS /y

C:\Windows\SysWOW64\net.exe

net stop MMS /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop MMS /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop mozyprobackup /y

C:\Windows\SysWOW64\net.exe

net stop mozyprobackup /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop mozyprobackup /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop MsDtsServer /y

C:\Windows\SysWOW64\net.exe

net stop MsDtsServer /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop MsDtsServer /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop MsDtsServer100 /y

C:\Windows\SysWOW64\net.exe

net stop MsDtsServer100 /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop MsDtsServer100 /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop MsDtsServer110 /y

C:\Windows\SysWOW64\net.exe

net stop MsDtsServer110 /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop MsDtsServer110 /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop MSExchangeES /y

C:\Windows\SysWOW64\net.exe

net stop MSExchangeES /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop MSExchangeES /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop MSExchangeIS /y

C:\Windows\SysWOW64\net.exe

net stop MSExchangeIS /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop MSExchangeIS /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop MSExchangeMGMT /y

C:\Windows\SysWOW64\net.exe

net stop MSExchangeMGMT /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop MSExchangeMGMT /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop MSExchangeMTA /y

C:\Windows\SysWOW64\net.exe

net stop MSExchangeMTA /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop MSExchangeMTA /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop MSExchangeSA /y

C:\Windows\SysWOW64\net.exe

net stop MSExchangeSA /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop MSExchangeSA /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop MSExchangeSRS /y

C:\Windows\SysWOW64\net.exe

net stop MSExchangeSRS /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop MSExchangeSRS /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop MSOLAP$SQL_2008 /y

C:\Windows\SysWOW64\net.exe

net stop MSOLAP$SQL_2008 /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop MSOLAP$SQL_2008 /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop MSOLAP$SYSTEM_BGC /y

C:\Windows\SysWOW64\net.exe

net stop MSOLAP$SYSTEM_BGC /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop MSOLAP$SYSTEM_BGC /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop MSOLAP$TPS /y

C:\Windows\SysWOW64\net.exe

net stop MSOLAP$TPS /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop MSOLAP$TPS /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop MSOLAP$TPSAMA /y

C:\Windows\SysWOW64\net.exe

net stop MSOLAP$TPSAMA /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop MSOLAP$TPSAMA /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop MSSQL$BKUPEXEC /y

C:\Windows\SysWOW64\net.exe

net stop MSSQL$BKUPEXEC /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop MSSQL$BKUPEXEC /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop MSSQL$ECWDB2 /y

C:\Windows\SysWOW64\net.exe

net stop MSSQL$ECWDB2 /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop MSSQL$ECWDB2 /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop MSSQL$PRACTICEMGT /y

C:\Windows\SysWOW64\net.exe

net stop MSSQL$PRACTICEMGT /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop MSSQL$PRACTICEMGT /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop MSSQL$PRACTTICEBGC /y

C:\Windows\SysWOW64\net.exe

net stop MSSQL$PRACTTICEBGC /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop MSSQL$PRACTTICEBGC /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop MSSQL$PROFXENGAGEMENT /y

C:\Windows\SysWOW64\net.exe

net stop MSSQL$PROFXENGAGEMENT /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop MSSQL$PROFXENGAGEMENT /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop MSSQL$SBSMONITORING /y

C:\Windows\SysWOW64\net.exe

net stop MSSQL$SBSMONITORING /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop MSSQL$SBSMONITORING /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop MSSQL$SHAREPOINT /y

C:\Windows\SysWOW64\net.exe

net stop MSSQL$SHAREPOINT /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop MSSQL$SHAREPOINT /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop MSSQL$SQL_2008 /y

C:\Windows\SysWOW64\net.exe

net stop MSSQL$SQL_2008 /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop MSSQL$SQL_2008 /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop MSSQL$SYSTEM_BGC /y

C:\Windows\SysWOW64\net.exe

net stop MSSQL$SYSTEM_BGC /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop MSSQL$SYSTEM_BGC /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop MSSQL$TPS /y

C:\Windows\SysWOW64\net.exe

net stop MSSQL$TPS /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop MSSQL$TPS /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop MSSQL$TPSAMA /y

C:\Windows\SysWOW64\net.exe

net stop MSSQL$TPSAMA /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop MSSQL$TPSAMA /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop MSSQL$VEEAMSQL2008R2 /y

C:\Windows\SysWOW64\net.exe

net stop MSSQL$VEEAMSQL2008R2 /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop MSSQL$VEEAMSQL2008R2 /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop MSSQL$VEEAMSQL2012 /y

C:\Windows\SysWOW64\net.exe

net stop MSSQL$VEEAMSQL2012 /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop MSSQL$VEEAMSQL2012 /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop MSSQLFDLauncher /y

C:\Windows\SysWOW64\net.exe

net stop MSSQLFDLauncher /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop MSSQLFDLauncher /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop MSSQLFDLauncher$PROFXENGAGEMENT /y

C:\Windows\SysWOW64\net.exe

net stop MSSQLFDLauncher$PROFXENGAGEMENT /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop MSSQLFDLauncher$PROFXENGAGEMENT /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop MSSQLFDLauncher$SBSMONITORING /y

C:\Windows\SysWOW64\net.exe

net stop MSSQLFDLauncher$SBSMONITORING /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop MSSQLFDLauncher$SBSMONITORING /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop MSSQLFDLauncher$SHAREPOINT /y

C:\Windows\SysWOW64\net.exe

net stop MSSQLFDLauncher$SHAREPOINT /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop MSSQLFDLauncher$SHAREPOINT /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop MSSQLFDLauncher$SQL_2008 /y

C:\Windows\SysWOW64\net.exe

net stop MSSQLFDLauncher$SQL_2008 /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop MSSQLFDLauncher$SQL_2008 /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop MSSQLFDLauncher$SYSTEM_BGC /y

C:\Windows\SysWOW64\net.exe

net stop MSSQLFDLauncher$SYSTEM_BGC /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop MSSQLFDLauncher$SYSTEM_BGC /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop MSSQLFDLauncher$TPS /y

C:\Windows\SysWOW64\net.exe

net stop MSSQLFDLauncher$TPS /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop MSSQLFDLauncher$TPS /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop MSSQLFDLauncher$TPSAMA /y

C:\Windows\SysWOW64\net.exe

net stop MSSQLFDLauncher$TPSAMA /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop MSSQLFDLauncher$TPSAMA /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop MSSQLSERVER /y

C:\Windows\SysWOW64\net.exe

net stop MSSQLSERVER /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop MSSQLSERVER /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop MSSQLServerADHelper100 /y

C:\Windows\SysWOW64\net.exe

net stop MSSQLServerADHelper100 /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop MSSQLServerADHelper100 /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop MSSQLServerOLAPService /y

C:\Windows\SysWOW64\net.exe

net stop MSSQLServerOLAPService /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop MSSQLServerOLAPService /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop MySQL57 /y

C:\Windows\SysWOW64\net.exe

net stop MySQL57 /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop MySQL57 /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop ntrtscan /y

C:\Windows\SysWOW64\net.exe

net stop ntrtscan /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop ntrtscan /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop OracleClientCache80 /y

C:\Windows\SysWOW64\net.exe

net stop OracleClientCache80 /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop OracleClientCache80 /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop PDVFSService /y

C:\Windows\SysWOW64\net.exe

net stop PDVFSService /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop PDVFSService /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop POP3Svc /y

C:\Windows\SysWOW64\net.exe

net stop POP3Svc /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop POP3Svc /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop ReportServer /y

C:\Windows\SysWOW64\net.exe

net stop ReportServer /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop ReportServer /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop ReportServer$SQL_2008 /y

C:\Windows\SysWOW64\net.exe

net stop ReportServer$SQL_2008 /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop ReportServer$SQL_2008 /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop ReportServer$SYSTEM_BGC /y

C:\Windows\SysWOW64\net.exe

net stop ReportServer$SYSTEM_BGC /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop ReportServer$SYSTEM_BGC /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop ReportServer$TPS /y

C:\Windows\SysWOW64\net.exe

net stop ReportServer$TPS /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop ReportServer$TPS /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop ReportServer$TPSAMA /y

C:\Windows\SysWOW64\net.exe

net stop ReportServer$TPSAMA /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop ReportServer$TPSAMA /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop RESvc /y

C:\Windows\SysWOW64\net.exe

net stop RESvc /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop RESvc /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop sacsvr /y

C:\Windows\SysWOW64\net.exe

net stop sacsvr /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop sacsvr /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop SamSs /y

C:\Windows\SysWOW64\net.exe

net stop SamSs /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop SamSs /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop SAVAdminService /y

C:\Windows\SysWOW64\net.exe

net stop SAVAdminService /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop SAVAdminService /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop SAVService /y

C:\Windows\SysWOW64\net.exe

net stop SAVService /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop SAVService /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop SDRSVC /y

C:\Windows\SysWOW64\net.exe

net stop SDRSVC /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop SDRSVC /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop SepMasterService /y

C:\Windows\SysWOW64\net.exe

net stop SepMasterService /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop SepMasterService /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop ShMonitor /y

C:\Windows\SysWOW64\net.exe

net stop ShMonitor /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop ShMonitor /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop Smcinst /y

C:\Windows\SysWOW64\net.exe

net stop Smcinst /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop Smcinst /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop SmcService /y

C:\Windows\SysWOW64\net.exe

net stop SmcService /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop SmcService /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop SMTPSvc /y

C:\Windows\SysWOW64\net.exe

net stop SMTPSvc /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop SMTPSvc /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop SQLAgent$BKUPEXEC /y

C:\Windows\SysWOW64\net.exe

net stop SQLAgent$BKUPEXEC /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop SQLAgent$BKUPEXEC /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop SQLAgent$ECWDB2 /y

C:\Windows\SysWOW64\net.exe

net stop SQLAgent$ECWDB2 /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop SQLAgent$ECWDB2 /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop SQLAgent$PRACTTICEBGC /y

C:\Windows\SysWOW64\net.exe

net stop SQLAgent$PRACTTICEBGC /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop SQLAgent$PRACTTICEBGC /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop SQLAgent$PRACTTICEMGT /y

C:\Windows\SysWOW64\net.exe

net stop SQLAgent$PRACTTICEMGT /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop SQLAgent$PRACTTICEMGT /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop SQLAgent$PROFXENGAGEMENT /y

C:\Windows\SysWOW64\net.exe

net stop SQLAgent$PROFXENGAGEMENT /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop SQLAgent$PROFXENGAGEMENT /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop SQLAgent$SBSMONITORING /y

C:\Windows\SysWOW64\net.exe

net stop SQLAgent$SBSMONITORING /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop SQLAgent$SBSMONITORING /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop SQLAgent$SHAREPOINT /y

C:\Windows\SysWOW64\net.exe

net stop SQLAgent$SHAREPOINT /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop SQLAgent$SHAREPOINT /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop SQLAgent$SQL_2008 /y

C:\Windows\SysWOW64\net.exe

net stop SQLAgent$SQL_2008 /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop SQLAgent$SQL_2008 /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop SQLAgent$SYSTEM_BGC /y

C:\Windows\SysWOW64\net.exe

net stop SQLAgent$SYSTEM_BGC /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop SQLAgent$SYSTEM_BGC /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop SQLAgent$TPS /y

C:\Windows\SysWOW64\net.exe

net stop SQLAgent$TPS /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop SQLAgent$TPS /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop SQLAgent$TPSAMA /y

C:\Windows\SysWOW64\net.exe

net stop SQLAgent$TPSAMA /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop SQLAgent$TPSAMA /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop SQLAgent$VEEAMSQL2008R2 /y

C:\Windows\SysWOW64\net.exe

net stop SQLAgent$VEEAMSQL2008R2 /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop SQLAgent$VEEAMSQL2008R2 /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop SQLAgent$VEEAMSQL2012 /y

C:\Windows\SysWOW64\net.exe

net stop SQLAgent$VEEAMSQL2012 /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop SQLAgent$VEEAMSQL2012 /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop SQLBrowser /y

C:\Windows\SysWOW64\net.exe

net stop SQLBrowser /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop SQLBrowser /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop SQLSafeOLRService /y

C:\Windows\SysWOW64\net.exe

net stop SQLSafeOLRService /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop SQLSafeOLRService /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop SQLSERVERAGENT /y

C:\Windows\SysWOW64\net.exe

net stop SQLSERVERAGENT /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop SQLSERVERAGENT /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop SQLTELEMETRY /y

C:\Windows\SysWOW64\net.exe

net stop SQLTELEMETRY /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop SQLTELEMETRY /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop SQLTELEMETRY$ECWDB2 /y

C:\Windows\SysWOW64\net.exe

net stop SQLTELEMETRY$ECWDB2 /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop SQLTELEMETRY$ECWDB2 /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop SQLWriter /y

C:\Windows\SysWOW64\net.exe

net stop SQLWriter /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop SQLWriter /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop VeeamBackupSvc /y

C:\Windows\SysWOW64\net.exe

net stop VeeamBackupSvc /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop VeeamBackupSvc /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop VeeamBrokerSvc /y

C:\Windows\SysWOW64\net.exe

net stop VeeamBrokerSvc /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop VeeamBrokerSvc /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop VeeamCatalogSvc /y

C:\Windows\SysWOW64\net.exe

net stop VeeamCatalogSvc /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop VeeamCatalogSvc /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop VeeamCloudSvc /y

C:\Windows\SysWOW64\net.exe

net stop VeeamCloudSvc /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop VeeamCloudSvc /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop VeeamDeploymentService /y

C:\Windows\SysWOW64\net.exe

net stop VeeamDeploymentService /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop VeeamDeploymentService /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop VeeamDeploySvc /y

C:\Windows\SysWOW64\net.exe

net stop VeeamDeploySvc /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop VeeamDeploySvc /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop VeeamEnterpriseManagerSvc /y

C:\Windows\SysWOW64\net.exe

net stop VeeamEnterpriseManagerSvc /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop VeeamEnterpriseManagerSvc /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop VeeamMountSvc /y

C:\Windows\SysWOW64\net.exe

net stop VeeamMountSvc /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop VeeamMountSvc /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop VeeamNFSSvc /y

C:\Windows\SysWOW64\net.exe

net stop VeeamNFSSvc /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop VeeamNFSSvc /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop VeeamRESTSvc /y

C:\Windows\SysWOW64\net.exe

net stop VeeamRESTSvc /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop VeeamRESTSvc /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop VeeamTransportSvc /y

C:\Windows\SysWOW64\net.exe

net stop VeeamTransportSvc /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop VeeamTransportSvc /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop W3Svc /y

C:\Windows\SysWOW64\net.exe

net stop W3Svc /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop W3Svc /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop wbengine /y

C:\Windows\SysWOW64\net.exe

net stop wbengine /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop wbengine /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop WRSVC /y

C:\Windows\SysWOW64\net.exe

net stop WRSVC /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop WRSVC /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop MSSQL$VEEAMSQL2008R2 /y

C:\Windows\SysWOW64\net.exe

net stop MSSQL$VEEAMSQL2008R2 /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop MSSQL$VEEAMSQL2008R2 /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop SQLAgent$VEEAMSQL2008R2 /y

C:\Windows\SysWOW64\net.exe

net stop SQLAgent$VEEAMSQL2008R2 /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop SQLAgent$VEEAMSQL2008R2 /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop VeeamHvIntegrationSvc /y

C:\Windows\SysWOW64\net.exe

net stop VeeamHvIntegrationSvc /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop VeeamHvIntegrationSvc /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop swi_update /y

C:\Windows\SysWOW64\net.exe

net stop swi_update /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop swi_update /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop SQLAgent$CXDB /y

C:\Windows\SysWOW64\net.exe

net stop SQLAgent$CXDB /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop SQLAgent$CXDB /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop SQLAgent$CITRIX_METAFRAME /y

C:\Windows\SysWOW64\net.exe

net stop SQLAgent$CITRIX_METAFRAME /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop SQLAgent$CITRIX_METAFRAME /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop "SQL Backups" /y

C:\Windows\SysWOW64\net.exe

net stop "SQL Backups" /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop "SQL Backups" /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop MSSQL$PROD /y

C:\Windows\SysWOW64\net.exe

net stop MSSQL$PROD /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop MSSQL$PROD /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop "Zoolz 2 Service" /y

C:\Windows\SysWOW64\net.exe

net stop "Zoolz 2 Service" /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop "Zoolz 2 Service" /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop MSSQLServerADHelper /y

C:\Windows\SysWOW64\net.exe

net stop MSSQLServerADHelper /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop MSSQLServerADHelper /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop SQLAgent$PROD /y

C:\Windows\SysWOW64\net.exe

net stop SQLAgent$PROD /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop SQLAgent$PROD /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop msftesql$PROD /y

C:\Windows\SysWOW64\net.exe

net stop msftesql$PROD /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop msftesql$PROD /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop NetMsmqActivator /y

C:\Windows\SysWOW64\net.exe

net stop NetMsmqActivator /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop NetMsmqActivator /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop EhttpSrv /y

C:\Windows\SysWOW64\net.exe

net stop EhttpSrv /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop EhttpSrv /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop ekrn /y

C:\Windows\SysWOW64\net.exe

net stop ekrn /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop ekrn /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop ESHASRV /y

C:\Windows\SysWOW64\net.exe

net stop ESHASRV /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop ESHASRV /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop MSSQL$SOPHOS /y

C:\Windows\SysWOW64\net.exe

net stop MSSQL$SOPHOS /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop MSSQL$SOPHOS /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop SQLAgent$SOPHOS /y

C:\Windows\SysWOW64\net.exe

net stop SQLAgent$SOPHOS /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop SQLAgent$SOPHOS /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop AVP /y

C:\Windows\SysWOW64\net.exe

net stop AVP /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop AVP /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop klnagent /y

C:\Windows\SysWOW64\net.exe

net stop klnagent /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop klnagent /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop MSSQL$SQLEXPRESS /y

C:\Windows\SysWOW64\net.exe

net stop MSSQL$SQLEXPRESS /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop MSSQL$SQLEXPRESS /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop SQLAgent$SQLEXPRESS /y

C:\Windows\SysWOW64\net.exe

net stop SQLAgent$SQLEXPRESS /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop SQLAgent$SQLEXPRESS /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop wbengine /y

C:\Windows\SysWOW64\net.exe

net stop wbengine /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop wbengine /y

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c net stop mfefire /y

C:\Windows\SysWOW64\net.exe

net stop mfefire /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop mfefire /y

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k netsvcs -s BITS

Network

Country Destination Domain Proto
N/A 10.10.0.1:445 tcp
N/A 10.10.0.11:445 tcp
N/A 10.10.0.37:445 tcp
N/A 10.10.0.13:445 tcp
N/A 10.10.0.1:139 tcp
N/A 10.10.0.13:139 tcp
N/A 10.10.0.11:139 tcp
N/A 10.10.0.37:139 tcp

Files

memory/1116-114-0x0000000000000000-mapping.dmp

memory/1320-115-0x0000000000000000-mapping.dmp

memory/1796-116-0x0000000000000000-mapping.dmp

memory/2008-117-0x0000000000000000-mapping.dmp

memory/2196-118-0x0000000000000000-mapping.dmp

memory/2480-119-0x0000000000000000-mapping.dmp

memory/3276-120-0x0000000000000000-mapping.dmp

memory/2884-121-0x0000000000000000-mapping.dmp

memory/3836-122-0x0000000000000000-mapping.dmp

memory/3976-123-0x0000000000000000-mapping.dmp

memory/4024-124-0x0000000000000000-mapping.dmp

memory/3956-125-0x0000000000000000-mapping.dmp

memory/2720-126-0x0000000000000000-mapping.dmp

memory/1948-127-0x0000000000000000-mapping.dmp

memory/3148-128-0x0000000000000000-mapping.dmp

memory/2224-129-0x0000000000000000-mapping.dmp

memory/584-130-0x0000000000000000-mapping.dmp

memory/2840-131-0x0000000000000000-mapping.dmp

memory/1072-132-0x0000000000000000-mapping.dmp

memory/720-133-0x0000000000000000-mapping.dmp

memory/2232-134-0x0000000000000000-mapping.dmp

memory/1200-135-0x0000000000000000-mapping.dmp

memory/1340-136-0x0000000000000000-mapping.dmp

memory/1236-137-0x0000000000000000-mapping.dmp

memory/1592-138-0x0000000000000000-mapping.dmp

memory/1860-139-0x0000000000000000-mapping.dmp

memory/2584-140-0x0000000000000000-mapping.dmp

memory/2356-141-0x0000000000000000-mapping.dmp

memory/3776-142-0x0000000000000000-mapping.dmp

memory/2872-143-0x0000000000000000-mapping.dmp

memory/4016-144-0x0000000000000000-mapping.dmp

memory/3788-145-0x0000000000000000-mapping.dmp

memory/3892-146-0x0000000000000000-mapping.dmp

memory/3664-147-0x0000000000000000-mapping.dmp

memory/400-148-0x0000000000000000-mapping.dmp

memory/3356-149-0x0000000000000000-mapping.dmp

memory/2968-150-0x0000000000000000-mapping.dmp

memory/648-151-0x0000000000000000-mapping.dmp

memory/3860-152-0x0000000000000000-mapping.dmp

memory/1800-153-0x0000000000000000-mapping.dmp

memory/3960-154-0x0000000000000000-mapping.dmp

memory/1812-155-0x0000000000000000-mapping.dmp

memory/2152-156-0x0000000000000000-mapping.dmp

memory/1236-157-0x0000000000000000-mapping.dmp

memory/2588-158-0x0000000000000000-mapping.dmp

memory/1860-159-0x0000000000000000-mapping.dmp

memory/2368-160-0x0000000000000000-mapping.dmp

memory/2852-161-0x0000000000000000-mapping.dmp

memory/2196-162-0x0000000000000000-mapping.dmp

memory/3784-163-0x0000000000000000-mapping.dmp

memory/3964-164-0x0000000000000000-mapping.dmp

memory/4012-165-0x0000000000000000-mapping.dmp

memory/2884-166-0x0000000000000000-mapping.dmp

memory/3048-167-0x0000000000000000-mapping.dmp

memory/3756-168-0x0000000000000000-mapping.dmp

memory/1948-169-0x0000000000000000-mapping.dmp

memory/2844-170-0x0000000000000000-mapping.dmp

memory/2976-171-0x0000000000000000-mapping.dmp

memory/1004-172-0x0000000000000000-mapping.dmp

memory/1368-173-0x0000000000000000-mapping.dmp

memory/3860-174-0x0000000000000000-mapping.dmp

memory/3168-175-0x0000000000000000-mapping.dmp

memory/1824-176-0x0000000000000000-mapping.dmp

memory/1252-177-0x0000000000000000-mapping.dmp

C:\ProgramData\Microsoft\Network\Downloader\edb.chk

MD5 5bba4cdbcd6422e4d2e1045d6bb5de0e
SHA1 3f5c4982b50e258f45a237a16c1ff257477b968f
SHA256 d27ae73eae337efd0568872ecf59307632ded681e36450c21b0e1a75f586c3bc
SHA512 8bef18b2e403738e58380bee8644cb482c664088e1966a815bf18c365a21749f5a99e2e67b123253c93ee5f80b2e23b47b19dcee5dc334db6d346f4152ba209b