Analysis
-
max time kernel
146s -
max time network
152s -
platform
windows10_x64 -
resource
win10-en-20210920 -
submitted
28-09-2021 09:27
Static task
static1
Behavioral task
behavioral1
Sample
79e41bb5b4edef24742f9e376add4bafdb9cbeb9cb8ae256a36df74694d820b9.bin.sample.exe
Resource
win7-en-20210920
Behavioral task
behavioral2
Sample
79e41bb5b4edef24742f9e376add4bafdb9cbeb9cb8ae256a36df74694d820b9.bin.sample.exe
Resource
win10-en-20210920
General
-
Target
79e41bb5b4edef24742f9e376add4bafdb9cbeb9cb8ae256a36df74694d820b9.bin.sample.exe
-
Size
101KB
-
MD5
19ac3de21c70e04c45c51163137fcbdd
-
SHA1
c2fea43d827c628d4d77a18119e8daadfda2b158
-
SHA256
79e41bb5b4edef24742f9e376add4bafdb9cbeb9cb8ae256a36df74694d820b9
-
SHA512
9f29958b4c875d08347c65b2e952cd1cb8378f4780f7189c3eba7339cbfc8767f5d69cc1ff868543cf81e39b4161eb987d9546c9413fb12f2f3a01a3bfae1208
Malware Config
Signatures
-
Conti Ransomware
Ransomware generally thought to be a successor to Ryuk.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies extensions of user files 6 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
79e41bb5b4edef24742f9e376add4bafdb9cbeb9cb8ae256a36df74694d820b9.bin.sample.exedescription ioc process File renamed C:\Users\Admin\Pictures\PublishApprove.tiff => C:\Users\Admin\Pictures\PublishApprove.tiff.CONTI 79e41bb5b4edef24742f9e376add4bafdb9cbeb9cb8ae256a36df74694d820b9.bin.sample.exe File opened for modification C:\Users\Admin\Pictures\SkipSplit.tiff 79e41bb5b4edef24742f9e376add4bafdb9cbeb9cb8ae256a36df74694d820b9.bin.sample.exe File renamed C:\Users\Admin\Pictures\CheckpointPush.crw => C:\Users\Admin\Pictures\CheckpointPush.crw.CONTI 79e41bb5b4edef24742f9e376add4bafdb9cbeb9cb8ae256a36df74694d820b9.bin.sample.exe File renamed C:\Users\Admin\Pictures\SkipSplit.tiff => C:\Users\Admin\Pictures\SkipSplit.tiff.CONTI 79e41bb5b4edef24742f9e376add4bafdb9cbeb9cb8ae256a36df74694d820b9.bin.sample.exe File renamed C:\Users\Admin\Pictures\SkipDismount.crw => C:\Users\Admin\Pictures\SkipDismount.crw.CONTI 79e41bb5b4edef24742f9e376add4bafdb9cbeb9cb8ae256a36df74694d820b9.bin.sample.exe File opened for modification C:\Users\Admin\Pictures\PublishApprove.tiff 79e41bb5b4edef24742f9e376add4bafdb9cbeb9cb8ae256a36df74694d820b9.bin.sample.exe -
Drops desktop.ini file(s) 24 IoCs
Processes:
79e41bb5b4edef24742f9e376add4bafdb9cbeb9cb8ae256a36df74694d820b9.bin.sample.exedescription ioc process File opened for modification C:\Users\Public\Music\desktop.ini 79e41bb5b4edef24742f9e376add4bafdb9cbeb9cb8ae256a36df74694d820b9.bin.sample.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini 79e41bb5b4edef24742f9e376add4bafdb9cbeb9cb8ae256a36df74694d820b9.bin.sample.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini 79e41bb5b4edef24742f9e376add4bafdb9cbeb9cb8ae256a36df74694d820b9.bin.sample.exe File opened for modification C:\Users\Admin\OneDrive\desktop.ini 79e41bb5b4edef24742f9e376add4bafdb9cbeb9cb8ae256a36df74694d820b9.bin.sample.exe File opened for modification C:\Users\Admin\Videos\desktop.ini 79e41bb5b4edef24742f9e376add4bafdb9cbeb9cb8ae256a36df74694d820b9.bin.sample.exe File opened for modification C:\Users\Public\Desktop\desktop.ini 79e41bb5b4edef24742f9e376add4bafdb9cbeb9cb8ae256a36df74694d820b9.bin.sample.exe File opened for modification C:\Users\Admin\Searches\desktop.ini 79e41bb5b4edef24742f9e376add4bafdb9cbeb9cb8ae256a36df74694d820b9.bin.sample.exe File opened for modification C:\Users\Public\desktop.ini 79e41bb5b4edef24742f9e376add4bafdb9cbeb9cb8ae256a36df74694d820b9.bin.sample.exe File opened for modification C:\Users\Public\Downloads\desktop.ini 79e41bb5b4edef24742f9e376add4bafdb9cbeb9cb8ae256a36df74694d820b9.bin.sample.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini 79e41bb5b4edef24742f9e376add4bafdb9cbeb9cb8ae256a36df74694d820b9.bin.sample.exe File opened for modification C:\Users\Admin\Links\desktop.ini 79e41bb5b4edef24742f9e376add4bafdb9cbeb9cb8ae256a36df74694d820b9.bin.sample.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini 79e41bb5b4edef24742f9e376add4bafdb9cbeb9cb8ae256a36df74694d820b9.bin.sample.exe File opened for modification C:\Users\Admin\Pictures\Saved Pictures\desktop.ini 79e41bb5b4edef24742f9e376add4bafdb9cbeb9cb8ae256a36df74694d820b9.bin.sample.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini 79e41bb5b4edef24742f9e376add4bafdb9cbeb9cb8ae256a36df74694d820b9.bin.sample.exe File opened for modification C:\Users\Public\Videos\desktop.ini 79e41bb5b4edef24742f9e376add4bafdb9cbeb9cb8ae256a36df74694d820b9.bin.sample.exe File opened for modification C:\Users\Public\Pictures\desktop.ini 79e41bb5b4edef24742f9e376add4bafdb9cbeb9cb8ae256a36df74694d820b9.bin.sample.exe File opened for modification C:\Users\Admin\Documents\desktop.ini 79e41bb5b4edef24742f9e376add4bafdb9cbeb9cb8ae256a36df74694d820b9.bin.sample.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini 79e41bb5b4edef24742f9e376add4bafdb9cbeb9cb8ae256a36df74694d820b9.bin.sample.exe File opened for modification C:\Users\Admin\Pictures\Camera Roll\desktop.ini 79e41bb5b4edef24742f9e376add4bafdb9cbeb9cb8ae256a36df74694d820b9.bin.sample.exe File opened for modification C:\Users\Public\Documents\desktop.ini 79e41bb5b4edef24742f9e376add4bafdb9cbeb9cb8ae256a36df74694d820b9.bin.sample.exe File opened for modification C:\Users\Public\Libraries\desktop.ini 79e41bb5b4edef24742f9e376add4bafdb9cbeb9cb8ae256a36df74694d820b9.bin.sample.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini 79e41bb5b4edef24742f9e376add4bafdb9cbeb9cb8ae256a36df74694d820b9.bin.sample.exe File opened for modification C:\Users\Admin\Music\desktop.ini 79e41bb5b4edef24742f9e376add4bafdb9cbeb9cb8ae256a36df74694d820b9.bin.sample.exe File opened for modification C:\Users\Public\AccountPictures\desktop.ini 79e41bb5b4edef24742f9e376add4bafdb9cbeb9cb8ae256a36df74694d820b9.bin.sample.exe -
Enumerates connected drives 3 TTPs 18 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
vssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exedescription ioc process File opened (read-only) \??\D: vssadmin.exe File opened (read-only) \??\e: vssadmin.exe File opened (read-only) \??\g: vssadmin.exe File opened (read-only) \??\H: vssadmin.exe File opened (read-only) \??\D: vssadmin.exe File opened (read-only) \??\e: vssadmin.exe File opened (read-only) \??\g: vssadmin.exe File opened (read-only) \??\H: vssadmin.exe File opened (read-only) \??\E: vssadmin.exe File opened (read-only) \??\f: vssadmin.exe File opened (read-only) \??\F: vssadmin.exe File opened (read-only) \??\F: vssadmin.exe File opened (read-only) \??\h: vssadmin.exe File opened (read-only) \??\E: vssadmin.exe File opened (read-only) \??\f: vssadmin.exe File opened (read-only) \??\G: vssadmin.exe File opened (read-only) \??\G: vssadmin.exe File opened (read-only) \??\h: vssadmin.exe -
Interacts with shadow copies 2 TTPs 14 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exepid process 2700 vssadmin.exe 2912 vssadmin.exe 3936 vssadmin.exe 508 vssadmin.exe 3628 vssadmin.exe 2656 vssadmin.exe 708 vssadmin.exe 4092 vssadmin.exe 1292 vssadmin.exe 1256 vssadmin.exe 1796 vssadmin.exe 1780 vssadmin.exe 2756 vssadmin.exe 3700 vssadmin.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
79e41bb5b4edef24742f9e376add4bafdb9cbeb9cb8ae256a36df74694d820b9.bin.sample.exepid process 2412 79e41bb5b4edef24742f9e376add4bafdb9cbeb9cb8ae256a36df74694d820b9.bin.sample.exe 2412 79e41bb5b4edef24742f9e376add4bafdb9cbeb9cb8ae256a36df74694d820b9.bin.sample.exe 2412 79e41bb5b4edef24742f9e376add4bafdb9cbeb9cb8ae256a36df74694d820b9.bin.sample.exe 2412 79e41bb5b4edef24742f9e376add4bafdb9cbeb9cb8ae256a36df74694d820b9.bin.sample.exe 2412 79e41bb5b4edef24742f9e376add4bafdb9cbeb9cb8ae256a36df74694d820b9.bin.sample.exe 2412 79e41bb5b4edef24742f9e376add4bafdb9cbeb9cb8ae256a36df74694d820b9.bin.sample.exe 2412 79e41bb5b4edef24742f9e376add4bafdb9cbeb9cb8ae256a36df74694d820b9.bin.sample.exe 2412 79e41bb5b4edef24742f9e376add4bafdb9cbeb9cb8ae256a36df74694d820b9.bin.sample.exe 2412 79e41bb5b4edef24742f9e376add4bafdb9cbeb9cb8ae256a36df74694d820b9.bin.sample.exe 2412 79e41bb5b4edef24742f9e376add4bafdb9cbeb9cb8ae256a36df74694d820b9.bin.sample.exe 2412 79e41bb5b4edef24742f9e376add4bafdb9cbeb9cb8ae256a36df74694d820b9.bin.sample.exe 2412 79e41bb5b4edef24742f9e376add4bafdb9cbeb9cb8ae256a36df74694d820b9.bin.sample.exe 2412 79e41bb5b4edef24742f9e376add4bafdb9cbeb9cb8ae256a36df74694d820b9.bin.sample.exe 2412 79e41bb5b4edef24742f9e376add4bafdb9cbeb9cb8ae256a36df74694d820b9.bin.sample.exe 2412 79e41bb5b4edef24742f9e376add4bafdb9cbeb9cb8ae256a36df74694d820b9.bin.sample.exe 2412 79e41bb5b4edef24742f9e376add4bafdb9cbeb9cb8ae256a36df74694d820b9.bin.sample.exe 2412 79e41bb5b4edef24742f9e376add4bafdb9cbeb9cb8ae256a36df74694d820b9.bin.sample.exe 2412 79e41bb5b4edef24742f9e376add4bafdb9cbeb9cb8ae256a36df74694d820b9.bin.sample.exe 2412 79e41bb5b4edef24742f9e376add4bafdb9cbeb9cb8ae256a36df74694d820b9.bin.sample.exe 2412 79e41bb5b4edef24742f9e376add4bafdb9cbeb9cb8ae256a36df74694d820b9.bin.sample.exe 2412 79e41bb5b4edef24742f9e376add4bafdb9cbeb9cb8ae256a36df74694d820b9.bin.sample.exe 2412 79e41bb5b4edef24742f9e376add4bafdb9cbeb9cb8ae256a36df74694d820b9.bin.sample.exe 2412 79e41bb5b4edef24742f9e376add4bafdb9cbeb9cb8ae256a36df74694d820b9.bin.sample.exe 2412 79e41bb5b4edef24742f9e376add4bafdb9cbeb9cb8ae256a36df74694d820b9.bin.sample.exe 2412 79e41bb5b4edef24742f9e376add4bafdb9cbeb9cb8ae256a36df74694d820b9.bin.sample.exe 2412 79e41bb5b4edef24742f9e376add4bafdb9cbeb9cb8ae256a36df74694d820b9.bin.sample.exe 2412 79e41bb5b4edef24742f9e376add4bafdb9cbeb9cb8ae256a36df74694d820b9.bin.sample.exe 2412 79e41bb5b4edef24742f9e376add4bafdb9cbeb9cb8ae256a36df74694d820b9.bin.sample.exe 2412 79e41bb5b4edef24742f9e376add4bafdb9cbeb9cb8ae256a36df74694d820b9.bin.sample.exe 2412 79e41bb5b4edef24742f9e376add4bafdb9cbeb9cb8ae256a36df74694d820b9.bin.sample.exe 2412 79e41bb5b4edef24742f9e376add4bafdb9cbeb9cb8ae256a36df74694d820b9.bin.sample.exe 2412 79e41bb5b4edef24742f9e376add4bafdb9cbeb9cb8ae256a36df74694d820b9.bin.sample.exe 2412 79e41bb5b4edef24742f9e376add4bafdb9cbeb9cb8ae256a36df74694d820b9.bin.sample.exe 2412 79e41bb5b4edef24742f9e376add4bafdb9cbeb9cb8ae256a36df74694d820b9.bin.sample.exe 2412 79e41bb5b4edef24742f9e376add4bafdb9cbeb9cb8ae256a36df74694d820b9.bin.sample.exe 2412 79e41bb5b4edef24742f9e376add4bafdb9cbeb9cb8ae256a36df74694d820b9.bin.sample.exe 2412 79e41bb5b4edef24742f9e376add4bafdb9cbeb9cb8ae256a36df74694d820b9.bin.sample.exe 2412 79e41bb5b4edef24742f9e376add4bafdb9cbeb9cb8ae256a36df74694d820b9.bin.sample.exe 2412 79e41bb5b4edef24742f9e376add4bafdb9cbeb9cb8ae256a36df74694d820b9.bin.sample.exe 2412 79e41bb5b4edef24742f9e376add4bafdb9cbeb9cb8ae256a36df74694d820b9.bin.sample.exe 2412 79e41bb5b4edef24742f9e376add4bafdb9cbeb9cb8ae256a36df74694d820b9.bin.sample.exe 2412 79e41bb5b4edef24742f9e376add4bafdb9cbeb9cb8ae256a36df74694d820b9.bin.sample.exe 2412 79e41bb5b4edef24742f9e376add4bafdb9cbeb9cb8ae256a36df74694d820b9.bin.sample.exe 2412 79e41bb5b4edef24742f9e376add4bafdb9cbeb9cb8ae256a36df74694d820b9.bin.sample.exe 2412 79e41bb5b4edef24742f9e376add4bafdb9cbeb9cb8ae256a36df74694d820b9.bin.sample.exe 2412 79e41bb5b4edef24742f9e376add4bafdb9cbeb9cb8ae256a36df74694d820b9.bin.sample.exe 2412 79e41bb5b4edef24742f9e376add4bafdb9cbeb9cb8ae256a36df74694d820b9.bin.sample.exe 2412 79e41bb5b4edef24742f9e376add4bafdb9cbeb9cb8ae256a36df74694d820b9.bin.sample.exe 2412 79e41bb5b4edef24742f9e376add4bafdb9cbeb9cb8ae256a36df74694d820b9.bin.sample.exe 2412 79e41bb5b4edef24742f9e376add4bafdb9cbeb9cb8ae256a36df74694d820b9.bin.sample.exe 2412 79e41bb5b4edef24742f9e376add4bafdb9cbeb9cb8ae256a36df74694d820b9.bin.sample.exe 2412 79e41bb5b4edef24742f9e376add4bafdb9cbeb9cb8ae256a36df74694d820b9.bin.sample.exe 2412 79e41bb5b4edef24742f9e376add4bafdb9cbeb9cb8ae256a36df74694d820b9.bin.sample.exe 2412 79e41bb5b4edef24742f9e376add4bafdb9cbeb9cb8ae256a36df74694d820b9.bin.sample.exe 2412 79e41bb5b4edef24742f9e376add4bafdb9cbeb9cb8ae256a36df74694d820b9.bin.sample.exe 2412 79e41bb5b4edef24742f9e376add4bafdb9cbeb9cb8ae256a36df74694d820b9.bin.sample.exe 2412 79e41bb5b4edef24742f9e376add4bafdb9cbeb9cb8ae256a36df74694d820b9.bin.sample.exe 2412 79e41bb5b4edef24742f9e376add4bafdb9cbeb9cb8ae256a36df74694d820b9.bin.sample.exe 2412 79e41bb5b4edef24742f9e376add4bafdb9cbeb9cb8ae256a36df74694d820b9.bin.sample.exe 2412 79e41bb5b4edef24742f9e376add4bafdb9cbeb9cb8ae256a36df74694d820b9.bin.sample.exe 2412 79e41bb5b4edef24742f9e376add4bafdb9cbeb9cb8ae256a36df74694d820b9.bin.sample.exe 2412 79e41bb5b4edef24742f9e376add4bafdb9cbeb9cb8ae256a36df74694d820b9.bin.sample.exe 2412 79e41bb5b4edef24742f9e376add4bafdb9cbeb9cb8ae256a36df74694d820b9.bin.sample.exe 2412 79e41bb5b4edef24742f9e376add4bafdb9cbeb9cb8ae256a36df74694d820b9.bin.sample.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
vssvc.exedescription pid process Token: SeBackupPrivilege 3752 vssvc.exe Token: SeRestorePrivilege 3752 vssvc.exe Token: SeAuditPrivilege 3752 vssvc.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
79e41bb5b4edef24742f9e376add4bafdb9cbeb9cb8ae256a36df74694d820b9.bin.sample.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.exedescription pid process target process PID 2412 wrote to memory of 2620 2412 79e41bb5b4edef24742f9e376add4bafdb9cbeb9cb8ae256a36df74694d820b9.bin.sample.exe cmd.exe PID 2412 wrote to memory of 2620 2412 79e41bb5b4edef24742f9e376add4bafdb9cbeb9cb8ae256a36df74694d820b9.bin.sample.exe cmd.exe PID 2412 wrote to memory of 2620 2412 79e41bb5b4edef24742f9e376add4bafdb9cbeb9cb8ae256a36df74694d820b9.bin.sample.exe cmd.exe PID 2620 wrote to memory of 2700 2620 cmd.exe vssadmin.exe PID 2620 wrote to memory of 2700 2620 cmd.exe vssadmin.exe PID 2620 wrote to memory of 2700 2620 cmd.exe vssadmin.exe PID 2412 wrote to memory of 2612 2412 79e41bb5b4edef24742f9e376add4bafdb9cbeb9cb8ae256a36df74694d820b9.bin.sample.exe cmd.exe PID 2412 wrote to memory of 2612 2412 79e41bb5b4edef24742f9e376add4bafdb9cbeb9cb8ae256a36df74694d820b9.bin.sample.exe cmd.exe PID 2412 wrote to memory of 2612 2412 79e41bb5b4edef24742f9e376add4bafdb9cbeb9cb8ae256a36df74694d820b9.bin.sample.exe cmd.exe PID 2612 wrote to memory of 4092 2612 cmd.exe vssadmin.exe PID 2612 wrote to memory of 4092 2612 cmd.exe vssadmin.exe PID 2612 wrote to memory of 4092 2612 cmd.exe vssadmin.exe PID 2412 wrote to memory of 3440 2412 79e41bb5b4edef24742f9e376add4bafdb9cbeb9cb8ae256a36df74694d820b9.bin.sample.exe cmd.exe PID 2412 wrote to memory of 3440 2412 79e41bb5b4edef24742f9e376add4bafdb9cbeb9cb8ae256a36df74694d820b9.bin.sample.exe cmd.exe PID 2412 wrote to memory of 3440 2412 79e41bb5b4edef24742f9e376add4bafdb9cbeb9cb8ae256a36df74694d820b9.bin.sample.exe cmd.exe PID 3440 wrote to memory of 1292 3440 cmd.exe vssadmin.exe PID 3440 wrote to memory of 1292 3440 cmd.exe vssadmin.exe PID 3440 wrote to memory of 1292 3440 cmd.exe vssadmin.exe PID 2412 wrote to memory of 400 2412 79e41bb5b4edef24742f9e376add4bafdb9cbeb9cb8ae256a36df74694d820b9.bin.sample.exe cmd.exe PID 2412 wrote to memory of 400 2412 79e41bb5b4edef24742f9e376add4bafdb9cbeb9cb8ae256a36df74694d820b9.bin.sample.exe cmd.exe PID 2412 wrote to memory of 400 2412 79e41bb5b4edef24742f9e376add4bafdb9cbeb9cb8ae256a36df74694d820b9.bin.sample.exe cmd.exe PID 400 wrote to memory of 1256 400 cmd.exe vssadmin.exe PID 400 wrote to memory of 1256 400 cmd.exe vssadmin.exe PID 400 wrote to memory of 1256 400 cmd.exe vssadmin.exe PID 2412 wrote to memory of 948 2412 79e41bb5b4edef24742f9e376add4bafdb9cbeb9cb8ae256a36df74694d820b9.bin.sample.exe cmd.exe PID 2412 wrote to memory of 948 2412 79e41bb5b4edef24742f9e376add4bafdb9cbeb9cb8ae256a36df74694d820b9.bin.sample.exe cmd.exe PID 2412 wrote to memory of 948 2412 79e41bb5b4edef24742f9e376add4bafdb9cbeb9cb8ae256a36df74694d820b9.bin.sample.exe cmd.exe PID 948 wrote to memory of 2912 948 cmd.exe vssadmin.exe PID 948 wrote to memory of 2912 948 cmd.exe vssadmin.exe PID 948 wrote to memory of 2912 948 cmd.exe vssadmin.exe PID 2412 wrote to memory of 864 2412 79e41bb5b4edef24742f9e376add4bafdb9cbeb9cb8ae256a36df74694d820b9.bin.sample.exe cmd.exe PID 2412 wrote to memory of 864 2412 79e41bb5b4edef24742f9e376add4bafdb9cbeb9cb8ae256a36df74694d820b9.bin.sample.exe cmd.exe PID 2412 wrote to memory of 864 2412 79e41bb5b4edef24742f9e376add4bafdb9cbeb9cb8ae256a36df74694d820b9.bin.sample.exe cmd.exe PID 864 wrote to memory of 3936 864 cmd.exe vssadmin.exe PID 864 wrote to memory of 3936 864 cmd.exe vssadmin.exe PID 864 wrote to memory of 3936 864 cmd.exe vssadmin.exe PID 2412 wrote to memory of 3956 2412 79e41bb5b4edef24742f9e376add4bafdb9cbeb9cb8ae256a36df74694d820b9.bin.sample.exe cmd.exe PID 2412 wrote to memory of 3956 2412 79e41bb5b4edef24742f9e376add4bafdb9cbeb9cb8ae256a36df74694d820b9.bin.sample.exe cmd.exe PID 2412 wrote to memory of 3956 2412 79e41bb5b4edef24742f9e376add4bafdb9cbeb9cb8ae256a36df74694d820b9.bin.sample.exe cmd.exe PID 3956 wrote to memory of 3628 3956 cmd.exe vssadmin.exe PID 3956 wrote to memory of 3628 3956 cmd.exe vssadmin.exe PID 3956 wrote to memory of 3628 3956 cmd.exe vssadmin.exe PID 2412 wrote to memory of 3976 2412 79e41bb5b4edef24742f9e376add4bafdb9cbeb9cb8ae256a36df74694d820b9.bin.sample.exe cmd.exe PID 2412 wrote to memory of 3976 2412 79e41bb5b4edef24742f9e376add4bafdb9cbeb9cb8ae256a36df74694d820b9.bin.sample.exe cmd.exe PID 2412 wrote to memory of 3976 2412 79e41bb5b4edef24742f9e376add4bafdb9cbeb9cb8ae256a36df74694d820b9.bin.sample.exe cmd.exe PID 3976 wrote to memory of 1796 3976 cmd.exe vssadmin.exe PID 3976 wrote to memory of 1796 3976 cmd.exe vssadmin.exe PID 3976 wrote to memory of 1796 3976 cmd.exe vssadmin.exe PID 2412 wrote to memory of 2856 2412 79e41bb5b4edef24742f9e376add4bafdb9cbeb9cb8ae256a36df74694d820b9.bin.sample.exe cmd.exe PID 2412 wrote to memory of 2856 2412 79e41bb5b4edef24742f9e376add4bafdb9cbeb9cb8ae256a36df74694d820b9.bin.sample.exe cmd.exe PID 2412 wrote to memory of 2856 2412 79e41bb5b4edef24742f9e376add4bafdb9cbeb9cb8ae256a36df74694d820b9.bin.sample.exe cmd.exe PID 2856 wrote to memory of 1780 2856 cmd.exe vssadmin.exe PID 2856 wrote to memory of 1780 2856 cmd.exe vssadmin.exe PID 2856 wrote to memory of 1780 2856 cmd.exe vssadmin.exe PID 2412 wrote to memory of 3856 2412 79e41bb5b4edef24742f9e376add4bafdb9cbeb9cb8ae256a36df74694d820b9.bin.sample.exe cmd.exe PID 2412 wrote to memory of 3856 2412 79e41bb5b4edef24742f9e376add4bafdb9cbeb9cb8ae256a36df74694d820b9.bin.sample.exe cmd.exe PID 2412 wrote to memory of 3856 2412 79e41bb5b4edef24742f9e376add4bafdb9cbeb9cb8ae256a36df74694d820b9.bin.sample.exe cmd.exe PID 3856 wrote to memory of 2756 3856 cmd.exe vssadmin.exe PID 3856 wrote to memory of 2756 3856 cmd.exe vssadmin.exe PID 3856 wrote to memory of 2756 3856 cmd.exe vssadmin.exe PID 2412 wrote to memory of 3456 2412 79e41bb5b4edef24742f9e376add4bafdb9cbeb9cb8ae256a36df74694d820b9.bin.sample.exe cmd.exe PID 2412 wrote to memory of 3456 2412 79e41bb5b4edef24742f9e376add4bafdb9cbeb9cb8ae256a36df74694d820b9.bin.sample.exe cmd.exe PID 2412 wrote to memory of 3456 2412 79e41bb5b4edef24742f9e376add4bafdb9cbeb9cb8ae256a36df74694d820b9.bin.sample.exe cmd.exe PID 3456 wrote to memory of 2656 3456 cmd.exe vssadmin.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\79e41bb5b4edef24742f9e376add4bafdb9cbeb9cb8ae256a36df74694d820b9.bin.sample.exe"C:\Users\Admin\AppData\Local\Temp\79e41bb5b4edef24742f9e376add4bafdb9cbeb9cb8ae256a36df74694d820b9.bin.sample.exe"1⤵
- Modifies extensions of user files
- Drops desktop.ini file(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd.exe /c vssadmin Delete Shadows /all /quiet2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\vssadmin.exevssadmin Delete Shadows /all /quiet3⤵
- Interacts with shadow copies
-
C:\Windows\SysWOW64\cmd.execmd.exe /c vssadmin resize shadowstorage /for=c: /on=c: /maxsize=401MB2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\vssadmin.exevssadmin resize shadowstorage /for=c: /on=c: /maxsize=401MB3⤵
- Interacts with shadow copies
-
C:\Windows\SysWOW64\cmd.execmd.exe /c vssadmin resize shadowstorage /for=c: /on=c: /maxsize=unbounded2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\vssadmin.exevssadmin resize shadowstorage /for=c: /on=c: /maxsize=unbounded3⤵
- Interacts with shadow copies
-
C:\Windows\SysWOW64\cmd.execmd.exe /c vssadmin resize shadowstorage /for=d: /on=d: /maxsize=401MB2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\vssadmin.exevssadmin resize shadowstorage /for=d: /on=d: /maxsize=401MB3⤵
- Enumerates connected drives
- Interacts with shadow copies
-
C:\Windows\SysWOW64\cmd.execmd.exe /c vssadmin resize shadowstorage /for=d: /on=d: /maxsize=unbounded2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\vssadmin.exevssadmin resize shadowstorage /for=d: /on=d: /maxsize=unbounded3⤵
- Enumerates connected drives
- Interacts with shadow copies
-
C:\Windows\SysWOW64\cmd.execmd.exe /c vssadmin resize shadowstorage /for=e: /on=e: /maxsize=401MB2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\vssadmin.exevssadmin resize shadowstorage /for=e: /on=e: /maxsize=401MB3⤵
- Enumerates connected drives
- Interacts with shadow copies
-
C:\Windows\SysWOW64\cmd.execmd.exe /c vssadmin resize shadowstorage /for=e: /on=e: /maxsize=unbounded2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\vssadmin.exevssadmin resize shadowstorage /for=e: /on=e: /maxsize=unbounded3⤵
- Enumerates connected drives
- Interacts with shadow copies
-
C:\Windows\SysWOW64\cmd.execmd.exe /c vssadmin resize shadowstorage /for=f: /on=f: /maxsize=401MB2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\vssadmin.exevssadmin resize shadowstorage /for=f: /on=f: /maxsize=401MB3⤵
- Enumerates connected drives
- Interacts with shadow copies
-
C:\Windows\SysWOW64\cmd.execmd.exe /c vssadmin resize shadowstorage /for=f: /on=f: /maxsize=unbounded2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\vssadmin.exevssadmin resize shadowstorage /for=f: /on=f: /maxsize=unbounded3⤵
- Enumerates connected drives
- Interacts with shadow copies
-
C:\Windows\SysWOW64\cmd.execmd.exe /c vssadmin resize shadowstorage /for=g: /on=g: /maxsize=401MB2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\vssadmin.exevssadmin resize shadowstorage /for=g: /on=g: /maxsize=401MB3⤵
- Enumerates connected drives
- Interacts with shadow copies
-
C:\Windows\SysWOW64\cmd.execmd.exe /c vssadmin resize shadowstorage /for=g: /on=g: /maxsize=unbounded2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\vssadmin.exevssadmin resize shadowstorage /for=g: /on=g: /maxsize=unbounded3⤵
- Enumerates connected drives
- Interacts with shadow copies
-
C:\Windows\SysWOW64\cmd.execmd.exe /c vssadmin resize shadowstorage /for=h: /on=h: /maxsize=401MB2⤵
-
C:\Windows\SysWOW64\vssadmin.exevssadmin resize shadowstorage /for=h: /on=h: /maxsize=401MB3⤵
- Enumerates connected drives
- Interacts with shadow copies
-
C:\Windows\SysWOW64\cmd.execmd.exe /c vssadmin resize shadowstorage /for=h: /on=h: /maxsize=unbounded2⤵
-
C:\Windows\SysWOW64\vssadmin.exevssadmin resize shadowstorage /for=h: /on=h: /maxsize=unbounded3⤵
- Enumerates connected drives
- Interacts with shadow copies
-
C:\Windows\SysWOW64\cmd.execmd.exe /c vssadmin Delete Shadows /all /quiet2⤵
-
C:\Windows\SysWOW64\vssadmin.exevssadmin Delete Shadows /all /quiet3⤵
- Interacts with shadow copies
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop "Acronis VSS Provider" /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop "Acronis VSS Provider" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Acronis VSS Provider" /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop "Enterprise Client Service" /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop "Enterprise Client Service" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Enterprise Client Service" /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop "SQLsafe Backup Service" /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop "SQLsafe Backup Service" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "SQLsafe Backup Service" /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop "SQLsafe Filter Service" /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop "SQLsafe Filter Service" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "SQLsafe Filter Service" /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop "Veeam Backup Catalog Data Service" /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop "Veeam Backup Catalog Data Service" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Veeam Backup Catalog Data Service" /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop AcronisAgent /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop AcronisAgent /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop AcronisAgent /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop AcrSch2Svc /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop AcrSch2Svc /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop AcrSch2Svc /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop Antivirus /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop Antivirus /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop Antivirus /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop ARSM /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop ARSM /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop ARSM /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop BackupExecAgentAccelerator /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop BackupExecAgentAccelerator /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop BackupExecAgentAccelerator /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop BackupExecAgentBrowser /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop BackupExecAgentBrowser /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop BackupExecAgentBrowser /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop BackupExecDeviceMediaService /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop BackupExecDeviceMediaService /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop BackupExecDeviceMediaService /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop BackupExecJobEngine /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop BackupExecJobEngine /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop BackupExecJobEngine /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop BackupExecManagementService /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop BackupExecManagementService /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop BackupExecManagementService /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop BackupExecRPCService /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop BackupExecRPCService /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop BackupExecRPCService /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop BackupExecVSSProvider /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop BackupExecVSSProvider /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop BackupExecVSSProvider /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop bedbg /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop bedbg /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop bedbg /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop DCAgent /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop DCAgent /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop DCAgent /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop EPSecurityService /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop EPSecurityService /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop EPSecurityService /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop EPUpdateService /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop EPUpdateService /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop EPUpdateService /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop EraserSvc11710 /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop EraserSvc11710 /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop EraserSvc11710 /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop EsgShKernel /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop EsgShKernel /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop EsgShKernel /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop FA_Scheduler /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop FA_Scheduler /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop FA_Scheduler /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop IISAdmin /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop IISAdmin /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop IISAdmin /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop IMAP4Svc /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop IMAP4Svc /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop IMAP4Svc /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop McShield /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop McShield /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop McShield /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop McTaskManager /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop McTaskManager /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop McTaskManager /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop mfemms /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop mfemms /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop mfemms /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop mfevtp /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop mfevtp /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop mfevtp /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop MMS /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop MMS /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MMS /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop mozyprobackup /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop mozyprobackup /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop mozyprobackup /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop MsDtsServer /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop MsDtsServer /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MsDtsServer /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop MsDtsServer100 /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop MsDtsServer100 /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MsDtsServer100 /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop MsDtsServer110 /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop MsDtsServer110 /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MsDtsServer110 /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop MSExchangeES /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop MSExchangeES /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSExchangeES /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop MSExchangeIS /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop MSExchangeIS /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSExchangeIS /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop MSExchangeMGMT /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop MSExchangeMGMT /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSExchangeMGMT /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop MSExchangeMTA /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop MSExchangeMTA /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSExchangeMTA /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop MSExchangeSA /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop MSExchangeSA /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSExchangeSA /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop MSExchangeSRS /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop MSExchangeSRS /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSExchangeSRS /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop MSOLAP$SQL_2008 /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop MSOLAP$SQL_2008 /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSOLAP$SQL_2008 /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop MSOLAP$SYSTEM_BGC /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop MSOLAP$SYSTEM_BGC /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSOLAP$SYSTEM_BGC /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop MSOLAP$TPS /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop MSOLAP$TPS /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSOLAP$TPS /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop MSOLAP$TPSAMA /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop MSOLAP$TPSAMA /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSOLAP$TPSAMA /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop MSSQL$BKUPEXEC /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop MSSQL$BKUPEXEC /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQL$BKUPEXEC /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop MSSQL$ECWDB2 /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop MSSQL$ECWDB2 /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQL$ECWDB2 /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop MSSQL$PRACTICEMGT /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop MSSQL$PRACTICEMGT /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQL$PRACTICEMGT /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop MSSQL$PRACTTICEBGC /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop MSSQL$PRACTTICEBGC /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQL$PRACTTICEBGC /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop MSSQL$PROFXENGAGEMENT /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop MSSQL$PROFXENGAGEMENT /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQL$PROFXENGAGEMENT /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop MSSQL$SBSMONITORING /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop MSSQL$SBSMONITORING /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQL$SBSMONITORING /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop MSSQL$SHAREPOINT /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop MSSQL$SHAREPOINT /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQL$SHAREPOINT /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop MSSQL$SQL_2008 /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop MSSQL$SQL_2008 /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQL$SQL_2008 /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop MSSQL$SYSTEM_BGC /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop MSSQL$SYSTEM_BGC /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQL$SYSTEM_BGC /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop MSSQL$TPS /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop MSSQL$TPS /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQL$TPS /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop MSSQL$TPSAMA /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop MSSQL$TPSAMA /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQL$TPSAMA /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop MSSQL$VEEAMSQL2008R2 /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop MSSQL$VEEAMSQL2008R2 /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQL$VEEAMSQL2008R2 /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop MSSQL$VEEAMSQL2012 /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop MSSQL$VEEAMSQL2012 /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQL$VEEAMSQL2012 /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop MSSQLFDLauncher /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop MSSQLFDLauncher /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQLFDLauncher /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop MSSQLFDLauncher$PROFXENGAGEMENT /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop MSSQLFDLauncher$PROFXENGAGEMENT /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQLFDLauncher$PROFXENGAGEMENT /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop MSSQLFDLauncher$SBSMONITORING /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop MSSQLFDLauncher$SBSMONITORING /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQLFDLauncher$SBSMONITORING /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop MSSQLFDLauncher$SHAREPOINT /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop MSSQLFDLauncher$SHAREPOINT /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQLFDLauncher$SHAREPOINT /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop MSSQLFDLauncher$SQL_2008 /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop MSSQLFDLauncher$SQL_2008 /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQLFDLauncher$SQL_2008 /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop MSSQLFDLauncher$SYSTEM_BGC /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop MSSQLFDLauncher$SYSTEM_BGC /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQLFDLauncher$SYSTEM_BGC /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop MSSQLFDLauncher$TPS /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop MSSQLFDLauncher$TPS /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQLFDLauncher$TPS /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop MSSQLFDLauncher$TPSAMA /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop MSSQLFDLauncher$TPSAMA /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQLFDLauncher$TPSAMA /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop MSSQLSERVER /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop MSSQLSERVER /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQLSERVER /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop MSSQLServerADHelper100 /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop MSSQLServerADHelper100 /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQLServerADHelper100 /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop MSSQLServerOLAPService /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop MSSQLServerOLAPService /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQLServerOLAPService /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop MySQL57 /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop MySQL57 /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MySQL57 /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop ntrtscan /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop ntrtscan /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop ntrtscan /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop OracleClientCache80 /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop OracleClientCache80 /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop OracleClientCache80 /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop PDVFSService /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop PDVFSService /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop PDVFSService /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop POP3Svc /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop POP3Svc /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop POP3Svc /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop ReportServer /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop ReportServer /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop ReportServer /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop ReportServer$SQL_2008 /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop ReportServer$SQL_2008 /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop ReportServer$SQL_2008 /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop ReportServer$SYSTEM_BGC /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop ReportServer$SYSTEM_BGC /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop ReportServer$SYSTEM_BGC /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop ReportServer$TPS /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop ReportServer$TPS /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop ReportServer$TPS /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop ReportServer$TPSAMA /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop ReportServer$TPSAMA /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop ReportServer$TPSAMA /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop RESvc /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop RESvc /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop RESvc /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop sacsvr /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop sacsvr /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sacsvr /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop SamSs /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop SamSs /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SamSs /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop SAVAdminService /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop SAVAdminService /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SAVAdminService /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop SAVService /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop SAVService /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SAVService /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop SDRSVC /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop SDRSVC /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SDRSVC /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop SepMasterService /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop SepMasterService /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SepMasterService /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop ShMonitor /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop ShMonitor /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop ShMonitor /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop Smcinst /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop Smcinst /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop Smcinst /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop SmcService /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop SmcService /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SmcService /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop SMTPSvc /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop SMTPSvc /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SMTPSvc /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop SQLAgent$BKUPEXEC /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop SQLAgent$BKUPEXEC /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SQLAgent$BKUPEXEC /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop SQLAgent$ECWDB2 /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop SQLAgent$ECWDB2 /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SQLAgent$ECWDB2 /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop SQLAgent$PRACTTICEBGC /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop SQLAgent$PRACTTICEBGC /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SQLAgent$PRACTTICEBGC /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop SQLAgent$PRACTTICEMGT /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop SQLAgent$PRACTTICEMGT /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SQLAgent$PRACTTICEMGT /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop SQLAgent$PROFXENGAGEMENT /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop SQLAgent$PROFXENGAGEMENT /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SQLAgent$PROFXENGAGEMENT /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop SQLAgent$SBSMONITORING /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop SQLAgent$SBSMONITORING /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SQLAgent$SBSMONITORING /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop SQLAgent$SHAREPOINT /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop SQLAgent$SHAREPOINT /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SQLAgent$SHAREPOINT /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop SQLAgent$SQL_2008 /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop SQLAgent$SQL_2008 /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SQLAgent$SQL_2008 /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop SQLAgent$SYSTEM_BGC /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop SQLAgent$SYSTEM_BGC /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SQLAgent$SYSTEM_BGC /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop SQLAgent$TPS /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop SQLAgent$TPS /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SQLAgent$TPS /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop SQLAgent$TPSAMA /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop SQLAgent$TPSAMA /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SQLAgent$TPSAMA /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop SQLAgent$VEEAMSQL2008R2 /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop SQLAgent$VEEAMSQL2008R2 /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SQLAgent$VEEAMSQL2008R2 /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop SQLAgent$VEEAMSQL2012 /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop SQLAgent$VEEAMSQL2012 /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SQLAgent$VEEAMSQL2012 /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop SQLBrowser /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop SQLBrowser /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SQLBrowser /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop SQLSafeOLRService /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop SQLSafeOLRService /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SQLSafeOLRService /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop SQLSERVERAGENT /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop SQLSERVERAGENT /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SQLSERVERAGENT /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop SQLTELEMETRY /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop SQLTELEMETRY /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SQLTELEMETRY /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop SQLTELEMETRY$ECWDB2 /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop SQLTELEMETRY$ECWDB2 /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SQLTELEMETRY$ECWDB2 /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop SQLWriter /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop SQLWriter /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SQLWriter /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop VeeamBackupSvc /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop VeeamBackupSvc /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop VeeamBackupSvc /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop VeeamBrokerSvc /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop VeeamBrokerSvc /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop VeeamBrokerSvc /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop VeeamCatalogSvc /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop VeeamCatalogSvc /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop VeeamCatalogSvc /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop VeeamCloudSvc /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop VeeamCloudSvc /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop VeeamCloudSvc /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop VeeamDeploymentService /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop VeeamDeploymentService /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop VeeamDeploymentService /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop VeeamDeploySvc /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop VeeamDeploySvc /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop VeeamDeploySvc /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop VeeamEnterpriseManagerSvc /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop VeeamEnterpriseManagerSvc /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop VeeamEnterpriseManagerSvc /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop VeeamMountSvc /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop VeeamMountSvc /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop VeeamMountSvc /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop VeeamNFSSvc /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop VeeamNFSSvc /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop VeeamNFSSvc /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop VeeamRESTSvc /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop VeeamRESTSvc /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop VeeamRESTSvc /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop VeeamTransportSvc /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop VeeamTransportSvc /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop VeeamTransportSvc /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop W3Svc /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop W3Svc /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop W3Svc /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop wbengine /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop wbengine /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop wbengine /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop WRSVC /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop WRSVC /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop WRSVC /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop MSSQL$VEEAMSQL2008R2 /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop MSSQL$VEEAMSQL2008R2 /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQL$VEEAMSQL2008R2 /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop SQLAgent$VEEAMSQL2008R2 /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop SQLAgent$VEEAMSQL2008R2 /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SQLAgent$VEEAMSQL2008R2 /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop VeeamHvIntegrationSvc /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop VeeamHvIntegrationSvc /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop VeeamHvIntegrationSvc /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop swi_update /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop swi_update /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop swi_update /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop SQLAgent$CXDB /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop SQLAgent$CXDB /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SQLAgent$CXDB /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop SQLAgent$CITRIX_METAFRAME /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop SQLAgent$CITRIX_METAFRAME /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SQLAgent$CITRIX_METAFRAME /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop "SQL Backups" /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop "SQL Backups" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "SQL Backups" /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop MSSQL$PROD /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop MSSQL$PROD /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQL$PROD /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop "Zoolz 2 Service" /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop "Zoolz 2 Service" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Zoolz 2 Service" /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop MSSQLServerADHelper /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop MSSQLServerADHelper /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQLServerADHelper /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop SQLAgent$PROD /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop SQLAgent$PROD /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SQLAgent$PROD /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop msftesql$PROD /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop msftesql$PROD /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop msftesql$PROD /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop NetMsmqActivator /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop NetMsmqActivator /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop NetMsmqActivator /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop EhttpSrv /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop EhttpSrv /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop EhttpSrv /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop ekrn /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop ekrn /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop ekrn /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop ESHASRV /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop ESHASRV /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop ESHASRV /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop MSSQL$SOPHOS /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop MSSQL$SOPHOS /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQL$SOPHOS /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop SQLAgent$SOPHOS /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop SQLAgent$SOPHOS /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SQLAgent$SOPHOS /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop AVP /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop AVP /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop AVP /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop klnagent /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop klnagent /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop klnagent /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop MSSQL$SQLEXPRESS /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop MSSQL$SQLEXPRESS /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQL$SQLEXPRESS /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop SQLAgent$SQLEXPRESS /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop SQLAgent$SQLEXPRESS /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SQLAgent$SQLEXPRESS /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop wbengine /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop wbengine /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop wbengine /y4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop mfefire /y2⤵
-
C:\Windows\SysWOW64\net.exenet stop mfefire /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop mfefire /y4⤵
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/388-151-0x0000000000000000-mapping.dmp
-
memory/400-121-0x0000000000000000-mapping.dmp
-
memory/420-160-0x0000000000000000-mapping.dmp
-
memory/508-140-0x0000000000000000-mapping.dmp
-
memory/584-164-0x0000000000000000-mapping.dmp
-
memory/640-143-0x0000000000000000-mapping.dmp
-
memory/644-174-0x0000000000000000-mapping.dmp
-
memory/708-142-0x0000000000000000-mapping.dmp
-
memory/860-139-0x0000000000000000-mapping.dmp
-
memory/864-125-0x0000000000000000-mapping.dmp
-
memory/948-123-0x0000000000000000-mapping.dmp
-
memory/1012-161-0x0000000000000000-mapping.dmp
-
memory/1176-165-0x0000000000000000-mapping.dmp
-
memory/1256-122-0x0000000000000000-mapping.dmp
-
memory/1292-120-0x0000000000000000-mapping.dmp
-
memory/1296-167-0x0000000000000000-mapping.dmp
-
memory/1332-163-0x0000000000000000-mapping.dmp
-
memory/1424-144-0x0000000000000000-mapping.dmp
-
memory/1444-141-0x0000000000000000-mapping.dmp
-
memory/1568-169-0x0000000000000000-mapping.dmp
-
memory/1780-132-0x0000000000000000-mapping.dmp
-
memory/1796-130-0x0000000000000000-mapping.dmp
-
memory/1856-177-0x0000000000000000-mapping.dmp
-
memory/1896-137-0x0000000000000000-mapping.dmp
-
memory/1940-178-0x0000000000000000-mapping.dmp
-
memory/2116-149-0x0000000000000000-mapping.dmp
-
memory/2120-147-0x0000000000000000-mapping.dmp
-
memory/2196-171-0x0000000000000000-mapping.dmp
-
memory/2248-168-0x0000000000000000-mapping.dmp
-
memory/2280-172-0x0000000000000000-mapping.dmp
-
memory/2588-153-0x0000000000000000-mapping.dmp
-
memory/2592-152-0x0000000000000000-mapping.dmp
-
memory/2612-117-0x0000000000000000-mapping.dmp
-
memory/2620-159-0x0000000000000000-mapping.dmp
-
memory/2620-115-0x0000000000000000-mapping.dmp
-
memory/2656-136-0x0000000000000000-mapping.dmp
-
memory/2700-157-0x0000000000000000-mapping.dmp
-
memory/2700-116-0x0000000000000000-mapping.dmp
-
memory/2744-155-0x0000000000000000-mapping.dmp
-
memory/2756-134-0x0000000000000000-mapping.dmp
-
memory/2856-131-0x0000000000000000-mapping.dmp
-
memory/2864-176-0x0000000000000000-mapping.dmp
-
memory/2892-166-0x0000000000000000-mapping.dmp
-
memory/2912-124-0x0000000000000000-mapping.dmp
-
memory/2924-158-0x0000000000000000-mapping.dmp
-
memory/3052-175-0x0000000000000000-mapping.dmp
-
memory/3052-148-0x0000000000000000-mapping.dmp
-
memory/3156-150-0x0000000000000000-mapping.dmp
-
memory/3296-173-0x0000000000000000-mapping.dmp
-
memory/3364-162-0x0000000000000000-mapping.dmp
-
memory/3440-119-0x0000000000000000-mapping.dmp
-
memory/3456-135-0x0000000000000000-mapping.dmp
-
memory/3520-154-0x0000000000000000-mapping.dmp
-
memory/3628-128-0x0000000000000000-mapping.dmp
-
memory/3640-170-0x0000000000000000-mapping.dmp
-
memory/3700-138-0x0000000000000000-mapping.dmp
-
memory/3764-146-0x0000000000000000-mapping.dmp
-
memory/3852-156-0x0000000000000000-mapping.dmp
-
memory/3856-133-0x0000000000000000-mapping.dmp
-
memory/3936-126-0x0000000000000000-mapping.dmp
-
memory/3944-145-0x0000000000000000-mapping.dmp
-
memory/3956-127-0x0000000000000000-mapping.dmp
-
memory/3976-129-0x0000000000000000-mapping.dmp
-
memory/4092-118-0x0000000000000000-mapping.dmp