Analysis
-
max time kernel
77s -
max time network
23s -
platform
windows7_x64 -
resource
win7-en-20210920 -
submitted
28-09-2021 09:27
Static task
static1
Behavioral task
behavioral1
Sample
79e41bb5b4edef24742f9e376add4bafdb9cbeb9cb8ae256a36df74694d820b9.bin.sample.exe
Resource
win7-en-20210920
Behavioral task
behavioral2
Sample
79e41bb5b4edef24742f9e376add4bafdb9cbeb9cb8ae256a36df74694d820b9.bin.sample.exe
Resource
win10-en-20210920
General
-
Target
79e41bb5b4edef24742f9e376add4bafdb9cbeb9cb8ae256a36df74694d820b9.bin.sample.exe
-
Size
101KB
-
MD5
19ac3de21c70e04c45c51163137fcbdd
-
SHA1
c2fea43d827c628d4d77a18119e8daadfda2b158
-
SHA256
79e41bb5b4edef24742f9e376add4bafdb9cbeb9cb8ae256a36df74694d820b9
-
SHA512
9f29958b4c875d08347c65b2e952cd1cb8378f4780f7189c3eba7339cbfc8767f5d69cc1ff868543cf81e39b4161eb987d9546c9413fb12f2f3a01a3bfae1208
Malware Config
Signatures
-
Conti Ransomware
Ransomware generally thought to be a successor to Ryuk.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies extensions of user files 1 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
79e41bb5b4edef24742f9e376add4bafdb9cbeb9cb8ae256a36df74694d820b9.bin.sample.exedescription ioc process File renamed C:\Users\Admin\Pictures\ShowUnprotect.crw => C:\Users\Admin\Pictures\ShowUnprotect.crw.CONTI 79e41bb5b4edef24742f9e376add4bafdb9cbeb9cb8ae256a36df74694d820b9.bin.sample.exe -
Drops desktop.ini file(s) 26 IoCs
Processes:
79e41bb5b4edef24742f9e376add4bafdb9cbeb9cb8ae256a36df74694d820b9.bin.sample.exedescription ioc process File opened for modification C:\Users\Public\Downloads\desktop.ini 79e41bb5b4edef24742f9e376add4bafdb9cbeb9cb8ae256a36df74694d820b9.bin.sample.exe File opened for modification C:\Users\Public\Libraries\desktop.ini 79e41bb5b4edef24742f9e376add4bafdb9cbeb9cb8ae256a36df74694d820b9.bin.sample.exe File opened for modification C:\Users\Public\Music\desktop.ini 79e41bb5b4edef24742f9e376add4bafdb9cbeb9cb8ae256a36df74694d820b9.bin.sample.exe File opened for modification C:\Users\Public\Pictures\desktop.ini 79e41bb5b4edef24742f9e376add4bafdb9cbeb9cb8ae256a36df74694d820b9.bin.sample.exe File opened for modification C:\Users\Public\Videos\desktop.ini 79e41bb5b4edef24742f9e376add4bafdb9cbeb9cb8ae256a36df74694d820b9.bin.sample.exe File opened for modification C:\Users\Public\Recorded TV\Sample Media\desktop.ini 79e41bb5b4edef24742f9e376add4bafdb9cbeb9cb8ae256a36df74694d820b9.bin.sample.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini 79e41bb5b4edef24742f9e376add4bafdb9cbeb9cb8ae256a36df74694d820b9.bin.sample.exe File opened for modification C:\Users\Admin\Links\desktop.ini 79e41bb5b4edef24742f9e376add4bafdb9cbeb9cb8ae256a36df74694d820b9.bin.sample.exe File opened for modification C:\Users\Admin\Searches\desktop.ini 79e41bb5b4edef24742f9e376add4bafdb9cbeb9cb8ae256a36df74694d820b9.bin.sample.exe File opened for modification C:\Users\Public\desktop.ini 79e41bb5b4edef24742f9e376add4bafdb9cbeb9cb8ae256a36df74694d820b9.bin.sample.exe File opened for modification C:\Users\Public\Music\Sample Music\desktop.ini 79e41bb5b4edef24742f9e376add4bafdb9cbeb9cb8ae256a36df74694d820b9.bin.sample.exe File opened for modification C:\Users\Public\Pictures\Sample Pictures\desktop.ini 79e41bb5b4edef24742f9e376add4bafdb9cbeb9cb8ae256a36df74694d820b9.bin.sample.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini 79e41bb5b4edef24742f9e376add4bafdb9cbeb9cb8ae256a36df74694d820b9.bin.sample.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini 79e41bb5b4edef24742f9e376add4bafdb9cbeb9cb8ae256a36df74694d820b9.bin.sample.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini 79e41bb5b4edef24742f9e376add4bafdb9cbeb9cb8ae256a36df74694d820b9.bin.sample.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini 79e41bb5b4edef24742f9e376add4bafdb9cbeb9cb8ae256a36df74694d820b9.bin.sample.exe File opened for modification C:\Users\Admin\Videos\desktop.ini 79e41bb5b4edef24742f9e376add4bafdb9cbeb9cb8ae256a36df74694d820b9.bin.sample.exe File opened for modification C:\Users\Public\Desktop\desktop.ini 79e41bb5b4edef24742f9e376add4bafdb9cbeb9cb8ae256a36df74694d820b9.bin.sample.exe File opened for modification C:\Users\Public\Documents\desktop.ini 79e41bb5b4edef24742f9e376add4bafdb9cbeb9cb8ae256a36df74694d820b9.bin.sample.exe File opened for modification C:\Users\Public\Recorded TV\desktop.ini 79e41bb5b4edef24742f9e376add4bafdb9cbeb9cb8ae256a36df74694d820b9.bin.sample.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini 79e41bb5b4edef24742f9e376add4bafdb9cbeb9cb8ae256a36df74694d820b9.bin.sample.exe File opened for modification C:\Users\Admin\Documents\desktop.ini 79e41bb5b4edef24742f9e376add4bafdb9cbeb9cb8ae256a36df74694d820b9.bin.sample.exe File opened for modification C:\Users\Public\Videos\Sample Videos\desktop.ini 79e41bb5b4edef24742f9e376add4bafdb9cbeb9cb8ae256a36df74694d820b9.bin.sample.exe File opened for modification C:\Users\Admin\Music\desktop.ini 79e41bb5b4edef24742f9e376add4bafdb9cbeb9cb8ae256a36df74694d820b9.bin.sample.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini 79e41bb5b4edef24742f9e376add4bafdb9cbeb9cb8ae256a36df74694d820b9.bin.sample.exe File opened for modification C:\Users\Admin\Favorites\Links for United States\desktop.ini 79e41bb5b4edef24742f9e376add4bafdb9cbeb9cb8ae256a36df74694d820b9.bin.sample.exe -
Enumerates connected drives 3 TTPs 18 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
vssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exedescription ioc process File opened (read-only) \??\E: vssadmin.exe File opened (read-only) \??\g: vssadmin.exe File opened (read-only) \??\h: vssadmin.exe File opened (read-only) \??\G: vssadmin.exe File opened (read-only) \??\H: vssadmin.exe File opened (read-only) \??\D: vssadmin.exe File opened (read-only) \??\D: vssadmin.exe File opened (read-only) \??\f: vssadmin.exe File opened (read-only) \??\F: vssadmin.exe File opened (read-only) \??\f: vssadmin.exe File opened (read-only) \??\g: vssadmin.exe File opened (read-only) \??\G: vssadmin.exe File opened (read-only) \??\H: vssadmin.exe File opened (read-only) \??\e: vssadmin.exe File opened (read-only) \??\E: vssadmin.exe File opened (read-only) \??\e: vssadmin.exe File opened (read-only) \??\F: vssadmin.exe File opened (read-only) \??\h: vssadmin.exe -
Interacts with shadow copies 2 TTPs 14 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exepid process 864 vssadmin.exe 1728 vssadmin.exe 472 vssadmin.exe 1828 vssadmin.exe 1944 vssadmin.exe 788 vssadmin.exe 1680 vssadmin.exe 1760 vssadmin.exe 964 vssadmin.exe 1884 vssadmin.exe 820 vssadmin.exe 852 vssadmin.exe 1488 vssadmin.exe 620 vssadmin.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
79e41bb5b4edef24742f9e376add4bafdb9cbeb9cb8ae256a36df74694d820b9.bin.sample.exepid process 1540 79e41bb5b4edef24742f9e376add4bafdb9cbeb9cb8ae256a36df74694d820b9.bin.sample.exe 1540 79e41bb5b4edef24742f9e376add4bafdb9cbeb9cb8ae256a36df74694d820b9.bin.sample.exe 1540 79e41bb5b4edef24742f9e376add4bafdb9cbeb9cb8ae256a36df74694d820b9.bin.sample.exe 1540 79e41bb5b4edef24742f9e376add4bafdb9cbeb9cb8ae256a36df74694d820b9.bin.sample.exe 1540 79e41bb5b4edef24742f9e376add4bafdb9cbeb9cb8ae256a36df74694d820b9.bin.sample.exe 1540 79e41bb5b4edef24742f9e376add4bafdb9cbeb9cb8ae256a36df74694d820b9.bin.sample.exe 1540 79e41bb5b4edef24742f9e376add4bafdb9cbeb9cb8ae256a36df74694d820b9.bin.sample.exe 1540 79e41bb5b4edef24742f9e376add4bafdb9cbeb9cb8ae256a36df74694d820b9.bin.sample.exe 1540 79e41bb5b4edef24742f9e376add4bafdb9cbeb9cb8ae256a36df74694d820b9.bin.sample.exe 1540 79e41bb5b4edef24742f9e376add4bafdb9cbeb9cb8ae256a36df74694d820b9.bin.sample.exe 1540 79e41bb5b4edef24742f9e376add4bafdb9cbeb9cb8ae256a36df74694d820b9.bin.sample.exe 1540 79e41bb5b4edef24742f9e376add4bafdb9cbeb9cb8ae256a36df74694d820b9.bin.sample.exe 1540 79e41bb5b4edef24742f9e376add4bafdb9cbeb9cb8ae256a36df74694d820b9.bin.sample.exe 1540 79e41bb5b4edef24742f9e376add4bafdb9cbeb9cb8ae256a36df74694d820b9.bin.sample.exe 1540 79e41bb5b4edef24742f9e376add4bafdb9cbeb9cb8ae256a36df74694d820b9.bin.sample.exe 1540 79e41bb5b4edef24742f9e376add4bafdb9cbeb9cb8ae256a36df74694d820b9.bin.sample.exe 1540 79e41bb5b4edef24742f9e376add4bafdb9cbeb9cb8ae256a36df74694d820b9.bin.sample.exe 1540 79e41bb5b4edef24742f9e376add4bafdb9cbeb9cb8ae256a36df74694d820b9.bin.sample.exe 1540 79e41bb5b4edef24742f9e376add4bafdb9cbeb9cb8ae256a36df74694d820b9.bin.sample.exe 1540 79e41bb5b4edef24742f9e376add4bafdb9cbeb9cb8ae256a36df74694d820b9.bin.sample.exe 1540 79e41bb5b4edef24742f9e376add4bafdb9cbeb9cb8ae256a36df74694d820b9.bin.sample.exe 1540 79e41bb5b4edef24742f9e376add4bafdb9cbeb9cb8ae256a36df74694d820b9.bin.sample.exe 1540 79e41bb5b4edef24742f9e376add4bafdb9cbeb9cb8ae256a36df74694d820b9.bin.sample.exe 1540 79e41bb5b4edef24742f9e376add4bafdb9cbeb9cb8ae256a36df74694d820b9.bin.sample.exe 1540 79e41bb5b4edef24742f9e376add4bafdb9cbeb9cb8ae256a36df74694d820b9.bin.sample.exe 1540 79e41bb5b4edef24742f9e376add4bafdb9cbeb9cb8ae256a36df74694d820b9.bin.sample.exe 1540 79e41bb5b4edef24742f9e376add4bafdb9cbeb9cb8ae256a36df74694d820b9.bin.sample.exe 1540 79e41bb5b4edef24742f9e376add4bafdb9cbeb9cb8ae256a36df74694d820b9.bin.sample.exe 1540 79e41bb5b4edef24742f9e376add4bafdb9cbeb9cb8ae256a36df74694d820b9.bin.sample.exe 1540 79e41bb5b4edef24742f9e376add4bafdb9cbeb9cb8ae256a36df74694d820b9.bin.sample.exe 1540 79e41bb5b4edef24742f9e376add4bafdb9cbeb9cb8ae256a36df74694d820b9.bin.sample.exe 1540 79e41bb5b4edef24742f9e376add4bafdb9cbeb9cb8ae256a36df74694d820b9.bin.sample.exe 1540 79e41bb5b4edef24742f9e376add4bafdb9cbeb9cb8ae256a36df74694d820b9.bin.sample.exe 1540 79e41bb5b4edef24742f9e376add4bafdb9cbeb9cb8ae256a36df74694d820b9.bin.sample.exe 1540 79e41bb5b4edef24742f9e376add4bafdb9cbeb9cb8ae256a36df74694d820b9.bin.sample.exe 1540 79e41bb5b4edef24742f9e376add4bafdb9cbeb9cb8ae256a36df74694d820b9.bin.sample.exe 1540 79e41bb5b4edef24742f9e376add4bafdb9cbeb9cb8ae256a36df74694d820b9.bin.sample.exe 1540 79e41bb5b4edef24742f9e376add4bafdb9cbeb9cb8ae256a36df74694d820b9.bin.sample.exe 1540 79e41bb5b4edef24742f9e376add4bafdb9cbeb9cb8ae256a36df74694d820b9.bin.sample.exe 1540 79e41bb5b4edef24742f9e376add4bafdb9cbeb9cb8ae256a36df74694d820b9.bin.sample.exe 1540 79e41bb5b4edef24742f9e376add4bafdb9cbeb9cb8ae256a36df74694d820b9.bin.sample.exe 1540 79e41bb5b4edef24742f9e376add4bafdb9cbeb9cb8ae256a36df74694d820b9.bin.sample.exe 1540 79e41bb5b4edef24742f9e376add4bafdb9cbeb9cb8ae256a36df74694d820b9.bin.sample.exe 1540 79e41bb5b4edef24742f9e376add4bafdb9cbeb9cb8ae256a36df74694d820b9.bin.sample.exe 1540 79e41bb5b4edef24742f9e376add4bafdb9cbeb9cb8ae256a36df74694d820b9.bin.sample.exe 1540 79e41bb5b4edef24742f9e376add4bafdb9cbeb9cb8ae256a36df74694d820b9.bin.sample.exe 1540 79e41bb5b4edef24742f9e376add4bafdb9cbeb9cb8ae256a36df74694d820b9.bin.sample.exe 1540 79e41bb5b4edef24742f9e376add4bafdb9cbeb9cb8ae256a36df74694d820b9.bin.sample.exe 1540 79e41bb5b4edef24742f9e376add4bafdb9cbeb9cb8ae256a36df74694d820b9.bin.sample.exe 1540 79e41bb5b4edef24742f9e376add4bafdb9cbeb9cb8ae256a36df74694d820b9.bin.sample.exe 1540 79e41bb5b4edef24742f9e376add4bafdb9cbeb9cb8ae256a36df74694d820b9.bin.sample.exe 1540 79e41bb5b4edef24742f9e376add4bafdb9cbeb9cb8ae256a36df74694d820b9.bin.sample.exe 1540 79e41bb5b4edef24742f9e376add4bafdb9cbeb9cb8ae256a36df74694d820b9.bin.sample.exe 1540 79e41bb5b4edef24742f9e376add4bafdb9cbeb9cb8ae256a36df74694d820b9.bin.sample.exe 1540 79e41bb5b4edef24742f9e376add4bafdb9cbeb9cb8ae256a36df74694d820b9.bin.sample.exe 1540 79e41bb5b4edef24742f9e376add4bafdb9cbeb9cb8ae256a36df74694d820b9.bin.sample.exe 1540 79e41bb5b4edef24742f9e376add4bafdb9cbeb9cb8ae256a36df74694d820b9.bin.sample.exe 1540 79e41bb5b4edef24742f9e376add4bafdb9cbeb9cb8ae256a36df74694d820b9.bin.sample.exe 1540 79e41bb5b4edef24742f9e376add4bafdb9cbeb9cb8ae256a36df74694d820b9.bin.sample.exe 1540 79e41bb5b4edef24742f9e376add4bafdb9cbeb9cb8ae256a36df74694d820b9.bin.sample.exe 1540 79e41bb5b4edef24742f9e376add4bafdb9cbeb9cb8ae256a36df74694d820b9.bin.sample.exe 1540 79e41bb5b4edef24742f9e376add4bafdb9cbeb9cb8ae256a36df74694d820b9.bin.sample.exe 1540 79e41bb5b4edef24742f9e376add4bafdb9cbeb9cb8ae256a36df74694d820b9.bin.sample.exe 1540 79e41bb5b4edef24742f9e376add4bafdb9cbeb9cb8ae256a36df74694d820b9.bin.sample.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
vssvc.exedescription pid process Token: SeBackupPrivilege 744 vssvc.exe Token: SeRestorePrivilege 744 vssvc.exe Token: SeAuditPrivilege 744 vssvc.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
79e41bb5b4edef24742f9e376add4bafdb9cbeb9cb8ae256a36df74694d820b9.bin.sample.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.exedescription pid process target process PID 1540 wrote to memory of 1512 1540 79e41bb5b4edef24742f9e376add4bafdb9cbeb9cb8ae256a36df74694d820b9.bin.sample.exe cmd.exe PID 1540 wrote to memory of 1512 1540 79e41bb5b4edef24742f9e376add4bafdb9cbeb9cb8ae256a36df74694d820b9.bin.sample.exe cmd.exe PID 1540 wrote to memory of 1512 1540 79e41bb5b4edef24742f9e376add4bafdb9cbeb9cb8ae256a36df74694d820b9.bin.sample.exe cmd.exe PID 1540 wrote to memory of 1512 1540 79e41bb5b4edef24742f9e376add4bafdb9cbeb9cb8ae256a36df74694d820b9.bin.sample.exe cmd.exe PID 1512 wrote to memory of 964 1512 cmd.exe vssadmin.exe PID 1512 wrote to memory of 964 1512 cmd.exe vssadmin.exe PID 1512 wrote to memory of 964 1512 cmd.exe vssadmin.exe PID 1512 wrote to memory of 964 1512 cmd.exe vssadmin.exe PID 1540 wrote to memory of 1140 1540 79e41bb5b4edef24742f9e376add4bafdb9cbeb9cb8ae256a36df74694d820b9.bin.sample.exe cmd.exe PID 1540 wrote to memory of 1140 1540 79e41bb5b4edef24742f9e376add4bafdb9cbeb9cb8ae256a36df74694d820b9.bin.sample.exe cmd.exe PID 1540 wrote to memory of 1140 1540 79e41bb5b4edef24742f9e376add4bafdb9cbeb9cb8ae256a36df74694d820b9.bin.sample.exe cmd.exe PID 1540 wrote to memory of 1140 1540 79e41bb5b4edef24742f9e376add4bafdb9cbeb9cb8ae256a36df74694d820b9.bin.sample.exe cmd.exe PID 1140 wrote to memory of 1884 1140 cmd.exe vssadmin.exe PID 1140 wrote to memory of 1884 1140 cmd.exe vssadmin.exe PID 1140 wrote to memory of 1884 1140 cmd.exe vssadmin.exe PID 1140 wrote to memory of 1884 1140 cmd.exe vssadmin.exe PID 1540 wrote to memory of 656 1540 79e41bb5b4edef24742f9e376add4bafdb9cbeb9cb8ae256a36df74694d820b9.bin.sample.exe cmd.exe PID 1540 wrote to memory of 656 1540 79e41bb5b4edef24742f9e376add4bafdb9cbeb9cb8ae256a36df74694d820b9.bin.sample.exe cmd.exe PID 1540 wrote to memory of 656 1540 79e41bb5b4edef24742f9e376add4bafdb9cbeb9cb8ae256a36df74694d820b9.bin.sample.exe cmd.exe PID 1540 wrote to memory of 656 1540 79e41bb5b4edef24742f9e376add4bafdb9cbeb9cb8ae256a36df74694d820b9.bin.sample.exe cmd.exe PID 656 wrote to memory of 864 656 cmd.exe vssadmin.exe PID 656 wrote to memory of 864 656 cmd.exe vssadmin.exe PID 656 wrote to memory of 864 656 cmd.exe vssadmin.exe PID 656 wrote to memory of 864 656 cmd.exe vssadmin.exe PID 1540 wrote to memory of 1220 1540 79e41bb5b4edef24742f9e376add4bafdb9cbeb9cb8ae256a36df74694d820b9.bin.sample.exe cmd.exe PID 1540 wrote to memory of 1220 1540 79e41bb5b4edef24742f9e376add4bafdb9cbeb9cb8ae256a36df74694d820b9.bin.sample.exe cmd.exe PID 1540 wrote to memory of 1220 1540 79e41bb5b4edef24742f9e376add4bafdb9cbeb9cb8ae256a36df74694d820b9.bin.sample.exe cmd.exe PID 1540 wrote to memory of 1220 1540 79e41bb5b4edef24742f9e376add4bafdb9cbeb9cb8ae256a36df74694d820b9.bin.sample.exe cmd.exe PID 1220 wrote to memory of 820 1220 cmd.exe vssadmin.exe PID 1220 wrote to memory of 820 1220 cmd.exe vssadmin.exe PID 1220 wrote to memory of 820 1220 cmd.exe vssadmin.exe PID 1220 wrote to memory of 820 1220 cmd.exe vssadmin.exe PID 1540 wrote to memory of 1648 1540 79e41bb5b4edef24742f9e376add4bafdb9cbeb9cb8ae256a36df74694d820b9.bin.sample.exe cmd.exe PID 1540 wrote to memory of 1648 1540 79e41bb5b4edef24742f9e376add4bafdb9cbeb9cb8ae256a36df74694d820b9.bin.sample.exe cmd.exe PID 1540 wrote to memory of 1648 1540 79e41bb5b4edef24742f9e376add4bafdb9cbeb9cb8ae256a36df74694d820b9.bin.sample.exe cmd.exe PID 1540 wrote to memory of 1648 1540 79e41bb5b4edef24742f9e376add4bafdb9cbeb9cb8ae256a36df74694d820b9.bin.sample.exe cmd.exe PID 1648 wrote to memory of 852 1648 cmd.exe vssadmin.exe PID 1648 wrote to memory of 852 1648 cmd.exe vssadmin.exe PID 1648 wrote to memory of 852 1648 cmd.exe vssadmin.exe PID 1648 wrote to memory of 852 1648 cmd.exe vssadmin.exe PID 1540 wrote to memory of 1960 1540 79e41bb5b4edef24742f9e376add4bafdb9cbeb9cb8ae256a36df74694d820b9.bin.sample.exe cmd.exe PID 1540 wrote to memory of 1960 1540 79e41bb5b4edef24742f9e376add4bafdb9cbeb9cb8ae256a36df74694d820b9.bin.sample.exe cmd.exe PID 1540 wrote to memory of 1960 1540 79e41bb5b4edef24742f9e376add4bafdb9cbeb9cb8ae256a36df74694d820b9.bin.sample.exe cmd.exe PID 1540 wrote to memory of 1960 1540 79e41bb5b4edef24742f9e376add4bafdb9cbeb9cb8ae256a36df74694d820b9.bin.sample.exe cmd.exe PID 1960 wrote to memory of 1828 1960 cmd.exe vssadmin.exe PID 1960 wrote to memory of 1828 1960 cmd.exe vssadmin.exe PID 1960 wrote to memory of 1828 1960 cmd.exe vssadmin.exe PID 1960 wrote to memory of 1828 1960 cmd.exe vssadmin.exe PID 1540 wrote to memory of 1492 1540 79e41bb5b4edef24742f9e376add4bafdb9cbeb9cb8ae256a36df74694d820b9.bin.sample.exe cmd.exe PID 1540 wrote to memory of 1492 1540 79e41bb5b4edef24742f9e376add4bafdb9cbeb9cb8ae256a36df74694d820b9.bin.sample.exe cmd.exe PID 1540 wrote to memory of 1492 1540 79e41bb5b4edef24742f9e376add4bafdb9cbeb9cb8ae256a36df74694d820b9.bin.sample.exe cmd.exe PID 1540 wrote to memory of 1492 1540 79e41bb5b4edef24742f9e376add4bafdb9cbeb9cb8ae256a36df74694d820b9.bin.sample.exe cmd.exe PID 1492 wrote to memory of 1680 1492 cmd.exe vssadmin.exe PID 1492 wrote to memory of 1680 1492 cmd.exe vssadmin.exe PID 1492 wrote to memory of 1680 1492 cmd.exe vssadmin.exe PID 1492 wrote to memory of 1680 1492 cmd.exe vssadmin.exe PID 1540 wrote to memory of 1632 1540 79e41bb5b4edef24742f9e376add4bafdb9cbeb9cb8ae256a36df74694d820b9.bin.sample.exe cmd.exe PID 1540 wrote to memory of 1632 1540 79e41bb5b4edef24742f9e376add4bafdb9cbeb9cb8ae256a36df74694d820b9.bin.sample.exe cmd.exe PID 1540 wrote to memory of 1632 1540 79e41bb5b4edef24742f9e376add4bafdb9cbeb9cb8ae256a36df74694d820b9.bin.sample.exe cmd.exe PID 1540 wrote to memory of 1632 1540 79e41bb5b4edef24742f9e376add4bafdb9cbeb9cb8ae256a36df74694d820b9.bin.sample.exe cmd.exe PID 1632 wrote to memory of 1944 1632 cmd.exe vssadmin.exe PID 1632 wrote to memory of 1944 1632 cmd.exe vssadmin.exe PID 1632 wrote to memory of 1944 1632 cmd.exe vssadmin.exe PID 1632 wrote to memory of 1944 1632 cmd.exe vssadmin.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\79e41bb5b4edef24742f9e376add4bafdb9cbeb9cb8ae256a36df74694d820b9.bin.sample.exe"C:\Users\Admin\AppData\Local\Temp\79e41bb5b4edef24742f9e376add4bafdb9cbeb9cb8ae256a36df74694d820b9.bin.sample.exe"1⤵
- Modifies extensions of user files
- Drops desktop.ini file(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd.exe /c vssadmin Delete Shadows /all /quiet2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\vssadmin.exevssadmin Delete Shadows /all /quiet3⤵
- Interacts with shadow copies
-
C:\Windows\SysWOW64\cmd.execmd.exe /c vssadmin resize shadowstorage /for=c: /on=c: /maxsize=401MB2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\vssadmin.exevssadmin resize shadowstorage /for=c: /on=c: /maxsize=401MB3⤵
- Interacts with shadow copies
-
C:\Windows\SysWOW64\cmd.execmd.exe /c vssadmin resize shadowstorage /for=c: /on=c: /maxsize=unbounded2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\vssadmin.exevssadmin resize shadowstorage /for=c: /on=c: /maxsize=unbounded3⤵
- Interacts with shadow copies
-
C:\Windows\SysWOW64\cmd.execmd.exe /c vssadmin resize shadowstorage /for=d: /on=d: /maxsize=401MB2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\vssadmin.exevssadmin resize shadowstorage /for=d: /on=d: /maxsize=401MB3⤵
- Enumerates connected drives
- Interacts with shadow copies
-
C:\Windows\SysWOW64\cmd.execmd.exe /c vssadmin resize shadowstorage /for=d: /on=d: /maxsize=unbounded2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\vssadmin.exevssadmin resize shadowstorage /for=d: /on=d: /maxsize=unbounded3⤵
- Enumerates connected drives
- Interacts with shadow copies
-
C:\Windows\SysWOW64\cmd.execmd.exe /c vssadmin resize shadowstorage /for=e: /on=e: /maxsize=401MB2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\vssadmin.exevssadmin resize shadowstorage /for=e: /on=e: /maxsize=401MB3⤵
- Enumerates connected drives
- Interacts with shadow copies
-
C:\Windows\SysWOW64\cmd.execmd.exe /c vssadmin resize shadowstorage /for=e: /on=e: /maxsize=unbounded2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\vssadmin.exevssadmin resize shadowstorage /for=e: /on=e: /maxsize=unbounded3⤵
- Enumerates connected drives
- Interacts with shadow copies
-
C:\Windows\SysWOW64\cmd.execmd.exe /c vssadmin resize shadowstorage /for=f: /on=f: /maxsize=401MB2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\vssadmin.exevssadmin resize shadowstorage /for=f: /on=f: /maxsize=401MB3⤵
- Enumerates connected drives
- Interacts with shadow copies
-
C:\Windows\SysWOW64\cmd.execmd.exe /c vssadmin resize shadowstorage /for=f: /on=f: /maxsize=unbounded2⤵
-
C:\Windows\SysWOW64\vssadmin.exevssadmin resize shadowstorage /for=f: /on=f: /maxsize=unbounded3⤵
- Enumerates connected drives
- Interacts with shadow copies
-
C:\Windows\SysWOW64\cmd.execmd.exe /c vssadmin resize shadowstorage /for=g: /on=g: /maxsize=401MB2⤵
-
C:\Windows\SysWOW64\vssadmin.exevssadmin resize shadowstorage /for=g: /on=g: /maxsize=401MB3⤵
- Enumerates connected drives
- Interacts with shadow copies
-
C:\Windows\SysWOW64\cmd.execmd.exe /c vssadmin resize shadowstorage /for=g: /on=g: /maxsize=unbounded2⤵
-
C:\Windows\SysWOW64\vssadmin.exevssadmin resize shadowstorage /for=g: /on=g: /maxsize=unbounded3⤵
- Enumerates connected drives
- Interacts with shadow copies
-
C:\Windows\SysWOW64\cmd.execmd.exe /c vssadmin resize shadowstorage /for=h: /on=h: /maxsize=401MB2⤵
-
C:\Windows\SysWOW64\vssadmin.exevssadmin resize shadowstorage /for=h: /on=h: /maxsize=401MB3⤵
- Enumerates connected drives
- Interacts with shadow copies
-
C:\Windows\SysWOW64\cmd.execmd.exe /c vssadmin resize shadowstorage /for=h: /on=h: /maxsize=unbounded2⤵
-
C:\Windows\SysWOW64\vssadmin.exevssadmin resize shadowstorage /for=h: /on=h: /maxsize=unbounded3⤵
- Enumerates connected drives
- Interacts with shadow copies
-
C:\Windows\SysWOW64\cmd.execmd.exe /c vssadmin Delete Shadows /all /quiet2⤵
-
C:\Windows\SysWOW64\vssadmin.exevssadmin Delete Shadows /all /quiet3⤵
- Interacts with shadow copies
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop "Acronis VSS Provider" /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop "Acronis VSS Provider" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Acronis VSS Provider" /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop "Enterprise Client Service" /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop "Enterprise Client Service" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Enterprise Client Service" /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop "SQLsafe Backup Service" /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop "SQLsafe Backup Service" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "SQLsafe Backup Service" /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop "SQLsafe Filter Service" /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop "SQLsafe Filter Service" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "SQLsafe Filter Service" /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop "Veeam Backup Catalog Data Service" /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop "Veeam Backup Catalog Data Service" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Veeam Backup Catalog Data Service" /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop AcronisAgent /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop AcronisAgent /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop AcronisAgent /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop AcrSch2Svc /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop AcrSch2Svc /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop AcrSch2Svc /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop Antivirus /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop Antivirus /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop Antivirus /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop ARSM /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop ARSM /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop ARSM /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop BackupExecAgentAccelerator /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop BackupExecAgentAccelerator /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop BackupExecAgentAccelerator /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop BackupExecAgentBrowser /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop BackupExecAgentBrowser /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop BackupExecAgentBrowser /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop BackupExecDeviceMediaService /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop BackupExecDeviceMediaService /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop BackupExecDeviceMediaService /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop BackupExecJobEngine /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop BackupExecJobEngine /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop BackupExecJobEngine /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop BackupExecManagementService /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop BackupExecManagementService /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop BackupExecManagementService /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop BackupExecRPCService /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop BackupExecRPCService /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop BackupExecRPCService /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop BackupExecVSSProvider /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop BackupExecVSSProvider /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop BackupExecVSSProvider /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop bedbg /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop bedbg /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop bedbg /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop DCAgent /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop DCAgent /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop DCAgent /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop EPSecurityService /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop EPSecurityService /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop EPSecurityService /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop EPUpdateService /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop EPUpdateService /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop EPUpdateService /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop EraserSvc11710 /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop EraserSvc11710 /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop EraserSvc11710 /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop EsgShKernel /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop EsgShKernel /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop EsgShKernel /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop FA_Scheduler /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop FA_Scheduler /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop FA_Scheduler /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop IISAdmin /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop IISAdmin /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop IISAdmin /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop IMAP4Svc /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop IMAP4Svc /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop IMAP4Svc /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop McShield /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop McShield /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop McShield /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop McTaskManager /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop McTaskManager /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop McTaskManager /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop mfemms /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop mfemms /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop mfemms /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop mfevtp /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop mfevtp /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop mfevtp /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop MMS /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop MMS /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MMS /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop mozyprobackup /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop mozyprobackup /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop mozyprobackup /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop MsDtsServer /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop MsDtsServer /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MsDtsServer /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop MsDtsServer100 /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop MsDtsServer100 /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MsDtsServer100 /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop MsDtsServer110 /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop MsDtsServer110 /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MsDtsServer110 /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop MSExchangeES /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop MSExchangeES /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSExchangeES /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop MSExchangeIS /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop MSExchangeIS /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSExchangeIS /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop MSExchangeMGMT /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop MSExchangeMGMT /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSExchangeMGMT /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop MSExchangeMTA /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop MSExchangeMTA /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSExchangeMTA /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop MSExchangeSA /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop MSExchangeSA /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSExchangeSA /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop MSExchangeSRS /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop MSExchangeSRS /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSExchangeSRS /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop MSOLAP$SQL_2008 /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop MSOLAP$SQL_2008 /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSOLAP$SQL_2008 /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop MSOLAP$SYSTEM_BGC /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop MSOLAP$SYSTEM_BGC /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSOLAP$SYSTEM_BGC /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop MSOLAP$TPS /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop MSOLAP$TPS /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSOLAP$TPS /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop MSOLAP$TPSAMA /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop MSOLAP$TPSAMA /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSOLAP$TPSAMA /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop MSSQL$BKUPEXEC /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop MSSQL$BKUPEXEC /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQL$BKUPEXEC /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop MSSQL$ECWDB2 /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop MSSQL$ECWDB2 /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQL$ECWDB2 /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop MSSQL$PRACTICEMGT /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop MSSQL$PRACTICEMGT /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQL$PRACTICEMGT /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop MSSQL$PRACTTICEBGC /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop MSSQL$PRACTTICEBGC /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQL$PRACTTICEBGC /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop MSSQL$PROFXENGAGEMENT /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop MSSQL$PROFXENGAGEMENT /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQL$PROFXENGAGEMENT /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop MSSQL$SBSMONITORING /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop MSSQL$SBSMONITORING /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQL$SBSMONITORING /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop MSSQL$SHAREPOINT /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop MSSQL$SHAREPOINT /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQL$SHAREPOINT /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop MSSQL$SQL_2008 /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop MSSQL$SQL_2008 /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQL$SQL_2008 /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop MSSQL$SYSTEM_BGC /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop MSSQL$SYSTEM_BGC /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQL$SYSTEM_BGC /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop MSSQL$TPS /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop MSSQL$TPS /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQL$TPS /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop MSSQL$TPSAMA /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop MSSQL$TPSAMA /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQL$TPSAMA /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop MSSQL$VEEAMSQL2008R2 /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop MSSQL$VEEAMSQL2008R2 /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQL$VEEAMSQL2008R2 /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop MSSQL$VEEAMSQL2012 /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop MSSQL$VEEAMSQL2012 /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQL$VEEAMSQL2012 /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop MSSQLFDLauncher /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop MSSQLFDLauncher /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQLFDLauncher /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop MSSQLFDLauncher$PROFXENGAGEMENT /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop MSSQLFDLauncher$PROFXENGAGEMENT /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQLFDLauncher$PROFXENGAGEMENT /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop MSSQLFDLauncher$SBSMONITORING /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop MSSQLFDLauncher$SBSMONITORING /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQLFDLauncher$SBSMONITORING /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop MSSQLFDLauncher$SHAREPOINT /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop MSSQLFDLauncher$SHAREPOINT /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQLFDLauncher$SHAREPOINT /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop MSSQLFDLauncher$SQL_2008 /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop MSSQLFDLauncher$SQL_2008 /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQLFDLauncher$SQL_2008 /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop MSSQLFDLauncher$SYSTEM_BGC /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop MSSQLFDLauncher$SYSTEM_BGC /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQLFDLauncher$SYSTEM_BGC /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop MSSQLFDLauncher$TPS /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop MSSQLFDLauncher$TPS /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQLFDLauncher$TPS /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop MSSQLFDLauncher$TPSAMA /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop MSSQLFDLauncher$TPSAMA /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQLFDLauncher$TPSAMA /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop MSSQLSERVER /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop MSSQLSERVER /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQLSERVER /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop MSSQLServerADHelper100 /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop MSSQLServerADHelper100 /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQLServerADHelper100 /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop MSSQLServerOLAPService /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop MSSQLServerOLAPService /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQLServerOLAPService /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop MySQL57 /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop MySQL57 /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MySQL57 /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop ntrtscan /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop ntrtscan /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop ntrtscan /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop OracleClientCache80 /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop OracleClientCache80 /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop OracleClientCache80 /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop PDVFSService /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop PDVFSService /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop PDVFSService /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop POP3Svc /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop POP3Svc /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop POP3Svc /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop ReportServer /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop ReportServer /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop ReportServer /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop ReportServer$SQL_2008 /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop ReportServer$SQL_2008 /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop ReportServer$SQL_2008 /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop ReportServer$SYSTEM_BGC /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop ReportServer$SYSTEM_BGC /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop ReportServer$SYSTEM_BGC /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop ReportServer$TPS /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop ReportServer$TPS /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop ReportServer$TPS /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop ReportServer$TPSAMA /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop ReportServer$TPSAMA /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop ReportServer$TPSAMA /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop RESvc /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop RESvc /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop RESvc /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop sacsvr /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop sacsvr /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sacsvr /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop SamSs /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop SamSs /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SamSs /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop SAVAdminService /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop SAVAdminService /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SAVAdminService /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop SAVService /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop SAVService /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SAVService /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop SDRSVC /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop SDRSVC /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SDRSVC /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop SepMasterService /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop SepMasterService /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SepMasterService /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop ShMonitor /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop ShMonitor /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop ShMonitor /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop Smcinst /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop Smcinst /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop Smcinst /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop SmcService /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop SmcService /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SmcService /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop SMTPSvc /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop SMTPSvc /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SMTPSvc /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop SQLAgent$BKUPEXEC /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop SQLAgent$BKUPEXEC /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SQLAgent$BKUPEXEC /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop SQLAgent$ECWDB2 /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop SQLAgent$ECWDB2 /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SQLAgent$ECWDB2 /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop SQLAgent$PRACTTICEBGC /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop SQLAgent$PRACTTICEBGC /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SQLAgent$PRACTTICEBGC /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop SQLAgent$PRACTTICEMGT /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop SQLAgent$PRACTTICEMGT /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SQLAgent$PRACTTICEMGT /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop SQLAgent$PROFXENGAGEMENT /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop SQLAgent$PROFXENGAGEMENT /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SQLAgent$PROFXENGAGEMENT /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop SQLAgent$SBSMONITORING /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop SQLAgent$SBSMONITORING /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SQLAgent$SBSMONITORING /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop SQLAgent$SHAREPOINT /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop SQLAgent$SHAREPOINT /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SQLAgent$SHAREPOINT /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop SQLAgent$SQL_2008 /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop SQLAgent$SQL_2008 /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SQLAgent$SQL_2008 /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop SQLAgent$SYSTEM_BGC /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop SQLAgent$SYSTEM_BGC /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SQLAgent$SYSTEM_BGC /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop SQLAgent$TPS /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop SQLAgent$TPS /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SQLAgent$TPS /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop SQLAgent$TPSAMA /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop SQLAgent$TPSAMA /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SQLAgent$TPSAMA /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop SQLAgent$VEEAMSQL2008R2 /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop SQLAgent$VEEAMSQL2008R2 /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SQLAgent$VEEAMSQL2008R2 /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop SQLAgent$VEEAMSQL2012 /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop SQLAgent$VEEAMSQL2012 /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SQLAgent$VEEAMSQL2012 /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop SQLBrowser /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop SQLBrowser /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SQLBrowser /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop SQLSafeOLRService /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop SQLSafeOLRService /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SQLSafeOLRService /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop SQLSERVERAGENT /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop SQLSERVERAGENT /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SQLSERVERAGENT /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop SQLTELEMETRY /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop SQLTELEMETRY /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SQLTELEMETRY /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop SQLTELEMETRY$ECWDB2 /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop SQLTELEMETRY$ECWDB2 /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SQLTELEMETRY$ECWDB2 /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop SQLWriter /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop SQLWriter /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SQLWriter /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop VeeamBackupSvc /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop VeeamBackupSvc /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop VeeamBackupSvc /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop VeeamBrokerSvc /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop VeeamBrokerSvc /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop VeeamBrokerSvc /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop VeeamCatalogSvc /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop VeeamCatalogSvc /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop VeeamCatalogSvc /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop VeeamCloudSvc /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop VeeamCloudSvc /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop VeeamCloudSvc /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop VeeamDeploymentService /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop VeeamDeploymentService /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop VeeamDeploymentService /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop VeeamDeploySvc /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop VeeamDeploySvc /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop VeeamDeploySvc /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop VeeamEnterpriseManagerSvc /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop VeeamEnterpriseManagerSvc /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop VeeamEnterpriseManagerSvc /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop VeeamMountSvc /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop VeeamMountSvc /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop VeeamMountSvc /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop VeeamNFSSvc /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop VeeamNFSSvc /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop VeeamNFSSvc /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop VeeamRESTSvc /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop VeeamRESTSvc /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop VeeamRESTSvc /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop VeeamTransportSvc /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop VeeamTransportSvc /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop VeeamTransportSvc /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop W3Svc /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop W3Svc /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop W3Svc /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop wbengine /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop wbengine /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop wbengine /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop WRSVC /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop WRSVC /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop WRSVC /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop MSSQL$VEEAMSQL2008R2 /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop MSSQL$VEEAMSQL2008R2 /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQL$VEEAMSQL2008R2 /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop SQLAgent$VEEAMSQL2008R2 /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop SQLAgent$VEEAMSQL2008R2 /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SQLAgent$VEEAMSQL2008R2 /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop VeeamHvIntegrationSvc /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop VeeamHvIntegrationSvc /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop VeeamHvIntegrationSvc /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop swi_update /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop swi_update /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop swi_update /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop SQLAgent$CXDB /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop SQLAgent$CXDB /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SQLAgent$CXDB /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop SQLAgent$CITRIX_METAFRAME /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop SQLAgent$CITRIX_METAFRAME /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SQLAgent$CITRIX_METAFRAME /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop "SQL Backups" /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop "SQL Backups" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "SQL Backups" /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop MSSQL$PROD /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop MSSQL$PROD /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQL$PROD /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop "Zoolz 2 Service" /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop "Zoolz 2 Service" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Zoolz 2 Service" /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop MSSQLServerADHelper /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop MSSQLServerADHelper /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQLServerADHelper /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop SQLAgent$PROD /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop SQLAgent$PROD /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SQLAgent$PROD /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop msftesql$PROD /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop msftesql$PROD /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop msftesql$PROD /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop NetMsmqActivator /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop NetMsmqActivator /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop NetMsmqActivator /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop EhttpSrv /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop EhttpSrv /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop EhttpSrv /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop ekrn /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop ekrn /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop ekrn /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop ESHASRV /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop ESHASRV /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop ESHASRV /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop MSSQL$SOPHOS /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop MSSQL$SOPHOS /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQL$SOPHOS /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop SQLAgent$SOPHOS /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop SQLAgent$SOPHOS /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SQLAgent$SOPHOS /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop AVP /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop AVP /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop AVP /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop klnagent /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop klnagent /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop klnagent /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop MSSQL$SQLEXPRESS /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop MSSQL$SQLEXPRESS /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQL$SQLEXPRESS /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop SQLAgent$SQLEXPRESS /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop SQLAgent$SQLEXPRESS /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SQLAgent$SQLEXPRESS /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop wbengine /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop wbengine /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop wbengine /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop mfefire /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop mfefire /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop mfefire /y4⤵
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/472-77-0x0000000000000000-mapping.dmp
-
memory/544-108-0x0000000000000000-mapping.dmp
-
memory/568-106-0x0000000000000000-mapping.dmp
-
memory/576-105-0x0000000000000000-mapping.dmp
-
memory/592-112-0x0000000000000000-mapping.dmp
-
memory/612-85-0x0000000000000000-mapping.dmp
-
memory/620-79-0x0000000000000000-mapping.dmp
-
memory/656-58-0x0000000000000000-mapping.dmp
-
memory/656-111-0x0000000000000000-mapping.dmp
-
memory/756-82-0x0000000000000000-mapping.dmp
-
memory/756-117-0x0000000000000000-mapping.dmp
-
memory/788-75-0x0000000000000000-mapping.dmp
-
memory/820-61-0x0000000000000000-mapping.dmp
-
memory/852-63-0x0000000000000000-mapping.dmp
-
memory/864-59-0x0000000000000000-mapping.dmp
-
memory/864-110-0x0000000000000000-mapping.dmp
-
memory/888-78-0x0000000000000000-mapping.dmp
-
memory/948-107-0x0000000000000000-mapping.dmp
-
memory/964-55-0x0000000000000000-mapping.dmp
-
memory/1044-86-0x0000000000000000-mapping.dmp
-
memory/1140-56-0x0000000000000000-mapping.dmp
-
memory/1152-109-0x0000000000000000-mapping.dmp
-
memory/1168-103-0x0000000000000000-mapping.dmp
-
memory/1172-98-0x0000000000000000-mapping.dmp
-
memory/1192-115-0x0000000000000000-mapping.dmp
-
memory/1220-60-0x0000000000000000-mapping.dmp
-
memory/1312-95-0x0000000000000000-mapping.dmp
-
memory/1324-84-0x0000000000000000-mapping.dmp
-
memory/1328-92-0x0000000000000000-mapping.dmp
-
memory/1488-73-0x0000000000000000-mapping.dmp
-
memory/1492-66-0x0000000000000000-mapping.dmp
-
memory/1508-80-0x0000000000000000-mapping.dmp
-
memory/1508-114-0x0000000000000000-mapping.dmp
-
memory/1512-54-0x0000000000000000-mapping.dmp
-
memory/1532-74-0x0000000000000000-mapping.dmp
-
memory/1540-53-0x0000000075A71000-0x0000000075A73000-memory.dmpFilesize
8KB
-
memory/1560-87-0x0000000000000000-mapping.dmp
-
memory/1588-88-0x0000000000000000-mapping.dmp
-
memory/1612-72-0x0000000000000000-mapping.dmp
-
memory/1632-93-0x0000000000000000-mapping.dmp
-
memory/1632-68-0x0000000000000000-mapping.dmp
-
memory/1648-62-0x0000000000000000-mapping.dmp
-
memory/1680-67-0x0000000000000000-mapping.dmp
-
memory/1692-70-0x0000000000000000-mapping.dmp
-
memory/1720-100-0x0000000000000000-mapping.dmp
-
memory/1728-71-0x0000000000000000-mapping.dmp
-
memory/1728-96-0x0000000000000000-mapping.dmp
-
memory/1732-97-0x0000000000000000-mapping.dmp
-
memory/1740-94-0x0000000000000000-mapping.dmp
-
memory/1752-104-0x0000000000000000-mapping.dmp
-
memory/1760-81-0x0000000000000000-mapping.dmp
-
memory/1784-99-0x0000000000000000-mapping.dmp
-
memory/1812-101-0x0000000000000000-mapping.dmp
-
memory/1820-113-0x0000000000000000-mapping.dmp
-
memory/1824-90-0x0000000000000000-mapping.dmp
-
memory/1828-65-0x0000000000000000-mapping.dmp
-
memory/1832-91-0x0000000000000000-mapping.dmp
-
memory/1836-102-0x0000000000000000-mapping.dmp
-
memory/1868-89-0x0000000000000000-mapping.dmp
-
memory/1880-76-0x0000000000000000-mapping.dmp
-
memory/1884-57-0x0000000000000000-mapping.dmp
-
memory/1944-69-0x0000000000000000-mapping.dmp
-
memory/1952-116-0x0000000000000000-mapping.dmp
-
memory/1956-83-0x0000000000000000-mapping.dmp
-
memory/1960-64-0x0000000000000000-mapping.dmp