Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
3s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
12/02/2024, 00:44
Static task
static1
Behavioral task
behavioral1
Sample
95cd7ebc8e12f8ca394f533fdfd67ac9.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
95cd7ebc8e12f8ca394f533fdfd67ac9.exe
Resource
win10v2004-20231222-en
General
-
Target
95cd7ebc8e12f8ca394f533fdfd67ac9.exe
-
Size
35KB
-
MD5
95cd7ebc8e12f8ca394f533fdfd67ac9
-
SHA1
1a7467933b00644f844067cb627a58222d604ca9
-
SHA256
03fca051767713a7d1fcb66497f64b534612430a418daed34650cf35eb9ac0ed
-
SHA512
f6df5f1ea8739c42bb785173ff506bb95bcab60db493313ce20ad7a101557a8b214f450a9888dd9ec446c5d80d35e7a4e23116c4633f085c0cc6603a6ef16373
-
SSDEEP
768:+uUt234jCHtykF68AoJw7WXRmJEpyZlSHo465SzE:RQ2ojsckAZKoJEpyOobSzE
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2384 MAWWEM.exe 2092 MAWWEM.exe 2616 MAWWEM.exe 2620 MAWWEM.exe 2460 MAWWEM.exe 2960 MAWWEM.exe 1624 MAWWEM.exe 2804 MAWWEM.exe 764 MAWWEM.exe 1628 MAWWEM.exe 268 MAWWEM.exe 1500 MAWWEM.exe 1224 MAWWEM.exe 2660 MAWWEM.exe 2892 MAWWEM.exe 956 MAWWEM.exe 2872 MAWWEM.exe 2908 MAWWEM.exe 1580 MAWWEM.exe 3060 MAWWEM.exe 860 MAWWEM.exe 2592 MAWWEM.exe 3052 MAWWEM.exe 1920 MAWWEM.exe 2396 MAWWEM.exe 2548 MAWWEM.exe 1764 MAWWEM.exe 1584 MAWWEM.exe 600 MAWWEM.exe 876 MAWWEM.exe 1548 MAWWEM.exe 1544 MAWWEM.exe 3024 MAWWEM.exe 2288 MAWWEM.exe 812 MAWWEM.exe 1612 MAWWEM.exe 2816 MAWWEM.exe 3000 MAWWEM.exe 2004 MAWWEM.exe 2388 MAWWEM.exe 2560 MAWWEM.exe 456 MAWWEM.exe 1960 MAWWEM.exe 1056 MAWWEM.exe 2216 MAWWEM.exe 2996 MAWWEM.exe 2976 MAWWEM.exe 2940 MAWWEM.exe 692 MAWWEM.exe 2468 MAWWEM.exe 1792 MAWWEM.exe 2424 MAWWEM.exe 3064 MAWWEM.exe 1508 MAWWEM.exe 704 MAWWEM.exe 3112 MAWWEM.exe 3188 MAWWEM.exe 3236 MAWWEM.exe 3296 MAWWEM.exe 3372 MAWWEM.exe 3420 MAWWEM.exe 3488 MAWWEM.exe 3548 MAWWEM.exe 3612 MAWWEM.exe -
Loads dropped DLL 64 IoCs
pid Process 1936 95cd7ebc8e12f8ca394f533fdfd67ac9.exe 1936 95cd7ebc8e12f8ca394f533fdfd67ac9.exe 2384 MAWWEM.exe 2384 MAWWEM.exe 2092 MAWWEM.exe 2092 MAWWEM.exe 2616 MAWWEM.exe 2616 MAWWEM.exe 2620 MAWWEM.exe 2620 MAWWEM.exe 2460 MAWWEM.exe 2460 MAWWEM.exe 2960 MAWWEM.exe 2960 MAWWEM.exe 1624 MAWWEM.exe 1624 MAWWEM.exe 2804 MAWWEM.exe 2804 MAWWEM.exe 764 MAWWEM.exe 764 MAWWEM.exe 1628 MAWWEM.exe 1628 MAWWEM.exe 268 MAWWEM.exe 268 MAWWEM.exe 1500 MAWWEM.exe 1500 MAWWEM.exe 1224 MAWWEM.exe 1224 MAWWEM.exe 2660 MAWWEM.exe 2660 MAWWEM.exe 2892 MAWWEM.exe 2892 MAWWEM.exe 956 MAWWEM.exe 956 MAWWEM.exe 2872 MAWWEM.exe 2872 MAWWEM.exe 2908 MAWWEM.exe 2908 MAWWEM.exe 1580 MAWWEM.exe 1580 MAWWEM.exe 3060 MAWWEM.exe 3060 MAWWEM.exe 860 MAWWEM.exe 860 MAWWEM.exe 2592 MAWWEM.exe 2592 MAWWEM.exe 3052 MAWWEM.exe 3052 MAWWEM.exe 1920 MAWWEM.exe 1920 MAWWEM.exe 2396 MAWWEM.exe 2396 MAWWEM.exe 2548 MAWWEM.exe 2548 MAWWEM.exe 1764 MAWWEM.exe 1764 MAWWEM.exe 1584 MAWWEM.exe 1584 MAWWEM.exe 600 MAWWEM.exe 600 MAWWEM.exe 876 MAWWEM.exe 876 MAWWEM.exe 1548 MAWWEM.exe 1548 MAWWEM.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\MAWWEM.exe MAWWEM.exe File created C:\Windows\SysWOW64\MAWWEM.exe MAWWEM.exe File created C:\Windows\SysWOW64\MAWWEM.exe MAWWEM.exe File opened for modification C:\Windows\SysWOW64\MsHx.dll MAWWEM.exe File created C:\Windows\SysWOW64\MAWWEM.exe MAWWEM.exe File created C:\Windows\SysWOW64\MAWWEM.exe MAWWEM.exe File opened for modification C:\Windows\SysWOW64\MsHx.dll MAWWEM.exe File opened for modification C:\Windows\SysWOW64\MsHx.dll MAWWEM.exe File opened for modification C:\Windows\SysWOW64\MsHx.dll MAWWEM.exe File opened for modification C:\Windows\SysWOW64\MsHx.dll MAWWEM.exe File created C:\Windows\SysWOW64\MAWWEM.exe MAWWEM.exe File created C:\Windows\SysWOW64\MAWWEM.exe MAWWEM.exe File created C:\Windows\SysWOW64\MAWWEM.exe MAWWEM.exe File opened for modification C:\Windows\SysWOW64\MsHx.dll MAWWEM.exe File opened for modification C:\Windows\SysWOW64\MsHx.dll MAWWEM.exe File opened for modification C:\Windows\SysWOW64\MsHx.dll MAWWEM.exe File created C:\Windows\SysWOW64\MAWWEM.exe MAWWEM.exe File created C:\Windows\SysWOW64\MAWWEM.exe MAWWEM.exe File opened for modification C:\Windows\SysWOW64\MsHx.dll MAWWEM.exe File created C:\Windows\SysWOW64\MAWWEM.exe MAWWEM.exe File opened for modification C:\Windows\SysWOW64\MsHx.dll MAWWEM.exe File opened for modification C:\Windows\SysWOW64\MsHx.dll MAWWEM.exe File opened for modification C:\Windows\SysWOW64\MsHx.dll MAWWEM.exe File created C:\Windows\SysWOW64\MAWWEM.exe MAWWEM.exe File opened for modification C:\Windows\SysWOW64\MsHx.dll MAWWEM.exe File opened for modification C:\Windows\SysWOW64\MsHx.dll MAWWEM.exe File opened for modification C:\Windows\SysWOW64\MsHx.dll MAWWEM.exe File created C:\Windows\SysWOW64\MAWWEM.exe MAWWEM.exe File opened for modification C:\Windows\SysWOW64\MsHx.dll MAWWEM.exe File created C:\Windows\SysWOW64\MAWWEM.exe MAWWEM.exe File opened for modification C:\Windows\SysWOW64\MsHx.dll MAWWEM.exe File created C:\Windows\SysWOW64\MAWWEM.exe MAWWEM.exe File opened for modification C:\Windows\SysWOW64\MsHx.dll MAWWEM.exe File opened for modification C:\Windows\SysWOW64\MsHx.dll MAWWEM.exe File opened for modification C:\Windows\SysWOW64\MsHx.dll MAWWEM.exe File created C:\Windows\SysWOW64\MAWWEM.exe MAWWEM.exe File created C:\Windows\SysWOW64\MAWWEM.exe MAWWEM.exe File created C:\Windows\SysWOW64\MAWWEM.exe MAWWEM.exe File created C:\Windows\SysWOW64\MAWWEM.exe MAWWEM.exe File created C:\Windows\SysWOW64\MAWWEM.exe MAWWEM.exe File opened for modification C:\Windows\SysWOW64\MsHx.dll MAWWEM.exe File created C:\Windows\SysWOW64\MAWWEM.exe MAWWEM.exe File created C:\Windows\SysWOW64\MAWWEM.exe MAWWEM.exe File created C:\Windows\SysWOW64\MAWWEM.exe MAWWEM.exe File created C:\Windows\SysWOW64\MAWWEM.exe MAWWEM.exe File created C:\Windows\SysWOW64\MAWWEM.exe MAWWEM.exe File created C:\Windows\SysWOW64\MAWWEM.exe MAWWEM.exe File opened for modification C:\Windows\SysWOW64\MsHx.dll MAWWEM.exe File created C:\Windows\SysWOW64\MAWWEM.exe MAWWEM.exe File opened for modification C:\Windows\SysWOW64\MsHx.dll MAWWEM.exe File created C:\Windows\SysWOW64\MAWWEM.exe MAWWEM.exe File opened for modification C:\Windows\SysWOW64\MsHx.dll MAWWEM.exe File opened for modification C:\Windows\SysWOW64\MsHx.dll MAWWEM.exe File opened for modification C:\Windows\SysWOW64\MsHx.dll MAWWEM.exe File opened for modification C:\Windows\SysWOW64\MsHx.dll MAWWEM.exe File created C:\Windows\SysWOW64\MAWWEM.exe MAWWEM.exe File created C:\Windows\SysWOW64\MAWWEM.exe MAWWEM.exe File opened for modification C:\Windows\SysWOW64\MsHx.dll MAWWEM.exe File created C:\Windows\SysWOW64\MAWWEM.exe MAWWEM.exe File opened for modification C:\Windows\SysWOW64\MsHx.dll MAWWEM.exe File created C:\Windows\SysWOW64\MAWWEM.exe MAWWEM.exe File opened for modification C:\Windows\SysWOW64\MsHx.dll MAWWEM.exe File opened for modification C:\Windows\SysWOW64\MsHx.dll MAWWEM.exe File opened for modification C:\Windows\SysWOW64\MsHx.dll MAWWEM.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Runs net.exe
-
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1936 wrote to memory of 2184 1936 95cd7ebc8e12f8ca394f533fdfd67ac9.exe 28 PID 1936 wrote to memory of 2184 1936 95cd7ebc8e12f8ca394f533fdfd67ac9.exe 28 PID 1936 wrote to memory of 2184 1936 95cd7ebc8e12f8ca394f533fdfd67ac9.exe 28 PID 1936 wrote to memory of 2184 1936 95cd7ebc8e12f8ca394f533fdfd67ac9.exe 28 PID 1936 wrote to memory of 2384 1936 95cd7ebc8e12f8ca394f533fdfd67ac9.exe 30 PID 1936 wrote to memory of 2384 1936 95cd7ebc8e12f8ca394f533fdfd67ac9.exe 30 PID 1936 wrote to memory of 2384 1936 95cd7ebc8e12f8ca394f533fdfd67ac9.exe 30 PID 1936 wrote to memory of 2384 1936 95cd7ebc8e12f8ca394f533fdfd67ac9.exe 30 PID 2184 wrote to memory of 2156 2184 net.exe 31 PID 2184 wrote to memory of 2156 2184 net.exe 31 PID 2184 wrote to memory of 2156 2184 net.exe 31 PID 2184 wrote to memory of 2156 2184 net.exe 31 PID 2384 wrote to memory of 860 2384 MAWWEM.exe 32 PID 2384 wrote to memory of 860 2384 MAWWEM.exe 32 PID 2384 wrote to memory of 860 2384 MAWWEM.exe 32 PID 2384 wrote to memory of 860 2384 MAWWEM.exe 32 PID 2384 wrote to memory of 2092 2384 MAWWEM.exe 34 PID 2384 wrote to memory of 2092 2384 MAWWEM.exe 34 PID 2384 wrote to memory of 2092 2384 MAWWEM.exe 34 PID 2384 wrote to memory of 2092 2384 MAWWEM.exe 34 PID 860 wrote to memory of 2664 860 net.exe 35 PID 860 wrote to memory of 2664 860 net.exe 35 PID 860 wrote to memory of 2664 860 net.exe 35 PID 860 wrote to memory of 2664 860 net.exe 35 PID 2092 wrote to memory of 2692 2092 MAWWEM.exe 36 PID 2092 wrote to memory of 2692 2092 MAWWEM.exe 36 PID 2092 wrote to memory of 2692 2092 MAWWEM.exe 36 PID 2092 wrote to memory of 2692 2092 MAWWEM.exe 36 PID 2092 wrote to memory of 2616 2092 MAWWEM.exe 38 PID 2092 wrote to memory of 2616 2092 MAWWEM.exe 38 PID 2092 wrote to memory of 2616 2092 MAWWEM.exe 38 PID 2092 wrote to memory of 2616 2092 MAWWEM.exe 38 PID 2692 wrote to memory of 2592 2692 net.exe 39 PID 2692 wrote to memory of 2592 2692 net.exe 39 PID 2692 wrote to memory of 2592 2692 net.exe 39 PID 2692 wrote to memory of 2592 2692 net.exe 39 PID 2616 wrote to memory of 2148 2616 MAWWEM.exe 40 PID 2616 wrote to memory of 2148 2616 MAWWEM.exe 40 PID 2616 wrote to memory of 2148 2616 MAWWEM.exe 40 PID 2616 wrote to memory of 2148 2616 MAWWEM.exe 40 PID 2616 wrote to memory of 2620 2616 MAWWEM.exe 41 PID 2616 wrote to memory of 2620 2616 MAWWEM.exe 41 PID 2616 wrote to memory of 2620 2616 MAWWEM.exe 41 PID 2616 wrote to memory of 2620 2616 MAWWEM.exe 41 PID 2148 wrote to memory of 1904 2148 net.exe 43 PID 2148 wrote to memory of 1904 2148 net.exe 43 PID 2148 wrote to memory of 1904 2148 net.exe 43 PID 2148 wrote to memory of 1904 2148 net.exe 43 PID 2620 wrote to memory of 1920 2620 MAWWEM.exe 119 PID 2620 wrote to memory of 1920 2620 MAWWEM.exe 119 PID 2620 wrote to memory of 1920 2620 MAWWEM.exe 119 PID 2620 wrote to memory of 1920 2620 MAWWEM.exe 119 PID 2620 wrote to memory of 2460 2620 MAWWEM.exe 45 PID 2620 wrote to memory of 2460 2620 MAWWEM.exe 45 PID 2620 wrote to memory of 2460 2620 MAWWEM.exe 45 PID 2620 wrote to memory of 2460 2620 MAWWEM.exe 45 PID 1920 wrote to memory of 2532 1920 MAWWEM.exe 47 PID 1920 wrote to memory of 2532 1920 MAWWEM.exe 47 PID 1920 wrote to memory of 2532 1920 MAWWEM.exe 47 PID 1920 wrote to memory of 2532 1920 MAWWEM.exe 47 PID 2460 wrote to memory of 1956 2460 MAWWEM.exe 48 PID 2460 wrote to memory of 1956 2460 MAWWEM.exe 48 PID 2460 wrote to memory of 1956 2460 MAWWEM.exe 48 PID 2460 wrote to memory of 1956 2460 MAWWEM.exe 48
Processes
-
C:\Users\Admin\AppData\Local\Temp\95cd7ebc8e12f8ca394f533fdfd67ac9.exe"C:\Users\Admin\AppData\Local\Temp\95cd7ebc8e12f8ca394f533fdfd67ac9.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1936 -
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop sharedaccess2⤵
- Suspicious use of WriteProcessMemory
PID:2184 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess3⤵PID:2156
-
-
-
C:\Windows\SysWOW64\MAWWEM.exeC:\Windows\system32\MAWWEM.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2384 -
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop sharedaccess3⤵
- Suspicious use of WriteProcessMemory
PID:860 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess4⤵PID:2664
-
-
-
C:\Windows\SysWOW64\MAWWEM.exeC:\Windows\system32\MAWWEM.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2092 -
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop sharedaccess4⤵
- Suspicious use of WriteProcessMemory
PID:2692 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess5⤵PID:2592
-
-
-
C:\Windows\SysWOW64\MAWWEM.exeC:\Windows\system32\MAWWEM.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2616 -
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop sharedaccess5⤵
- Suspicious use of WriteProcessMemory
PID:2148 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess6⤵PID:1904
-
-
-
C:\Windows\SysWOW64\MAWWEM.exeC:\Windows\system32\MAWWEM.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2620 -
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop sharedaccess6⤵PID:1920
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess7⤵PID:2532
-
-
-
C:\Windows\SysWOW64\MAWWEM.exeC:\Windows\system32\MAWWEM.exe6⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2460 -
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop sharedaccess7⤵PID:1956
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess8⤵PID:3000
-
-
-
C:\Windows\SysWOW64\MAWWEM.exeC:\Windows\system32\MAWWEM.exe7⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
PID:2960 -
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop sharedaccess8⤵PID:2508
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess9⤵PID:2776
-
-
-
C:\Windows\SysWOW64\MAWWEM.exeC:\Windows\system32\MAWWEM.exe8⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
PID:1624 -
C:\Windows\SysWOW64\MAWWEM.exeC:\Windows\system32\MAWWEM.exe9⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
PID:2804 -
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop sharedaccess10⤵PID:1092
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess11⤵PID:2980
-
-
-
C:\Windows\SysWOW64\MAWWEM.exeC:\Windows\system32\MAWWEM.exe10⤵
- Executes dropped EXE
- Loads dropped DLL
PID:764 -
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop sharedaccess11⤵PID:2940
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess12⤵PID:1692
-
-
-
C:\Windows\SysWOW64\MAWWEM.exeC:\Windows\system32\MAWWEM.exe11⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
PID:1628 -
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop sharedaccess12⤵PID:2248
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess13⤵PID:564
-
-
-
C:\Windows\SysWOW64\MAWWEM.exeC:\Windows\system32\MAWWEM.exe12⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
PID:268 -
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop sharedaccess13⤵PID:876
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess14⤵PID:1432
-
-
-
C:\Windows\SysWOW64\MAWWEM.exeC:\Windows\system32\MAWWEM.exe13⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
PID:1500 -
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop sharedaccess14⤵PID:2336
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess15⤵PID:2424
-
-
-
C:\Windows\SysWOW64\MAWWEM.exeC:\Windows\system32\MAWWEM.exe14⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
PID:1224 -
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop sharedaccess15⤵PID:1960
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess16⤵PID:1164
-
-
-
C:\Windows\SysWOW64\MAWWEM.exeC:\Windows\system32\MAWWEM.exe15⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
PID:2660 -
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop sharedaccess16⤵PID:980
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess17⤵PID:2044
-
-
-
C:\Windows\SysWOW64\MAWWEM.exeC:\Windows\system32\MAWWEM.exe16⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
PID:2892 -
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop sharedaccess17⤵PID:2016
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess18⤵PID:2208
-
-
-
C:\Windows\SysWOW64\MAWWEM.exeC:\Windows\system32\MAWWEM.exe17⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
PID:956 -
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop sharedaccess18⤵PID:1532
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess19⤵PID:2288
-
-
-
C:\Windows\SysWOW64\MAWWEM.exeC:\Windows\system32\MAWWEM.exe18⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
PID:2872 -
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop sharedaccess19⤵PID:1168
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess20⤵PID:2232
-
-
-
C:\Windows\SysWOW64\MAWWEM.exeC:\Windows\system32\MAWWEM.exe19⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
PID:2908 -
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop sharedaccess20⤵PID:3004
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess21⤵PID:3068
-
-
-
C:\Windows\SysWOW64\MAWWEM.exeC:\Windows\system32\MAWWEM.exe20⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
PID:1580 -
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop sharedaccess21⤵PID:2376
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess22⤵PID:2160
-
-
-
C:\Windows\SysWOW64\MAWWEM.exeC:\Windows\system32\MAWWEM.exe21⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
PID:3060 -
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop sharedaccess22⤵PID:2588
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess23⤵PID:2184
-
-
-
C:\Windows\SysWOW64\MAWWEM.exeC:\Windows\system32\MAWWEM.exe22⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
PID:860 -
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop sharedaccess23⤵PID:2668
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess24⤵PID:2480
-
-
-
C:\Windows\SysWOW64\MAWWEM.exeC:\Windows\system32\MAWWEM.exe23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2592 -
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop sharedaccess24⤵PID:2584
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess25⤵PID:2468
-
-
-
C:\Windows\SysWOW64\MAWWEM.exeC:\Windows\system32\MAWWEM.exe24⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
PID:3052 -
C:\Windows\SysWOW64\MAWWEM.exeC:\Windows\system32\MAWWEM.exe25⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1920 -
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop sharedaccess26⤵PID:1996
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess27⤵PID:2496
-
-
-
C:\Windows\SysWOW64\MAWWEM.exeC:\Windows\system32\MAWWEM.exe26⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
PID:2396 -
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop sharedaccess27⤵PID:1912
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess28⤵PID:2936
-
-
-
C:\Windows\SysWOW64\MAWWEM.exeC:\Windows\system32\MAWWEM.exe27⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
PID:2548 -
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop sharedaccess28⤵PID:340
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess29⤵PID:1752
-
-
-
C:\Windows\SysWOW64\MAWWEM.exeC:\Windows\system32\MAWWEM.exe28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1764 -
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop sharedaccess29⤵PID:932
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess30⤵PID:2308
-
-
-
C:\Windows\SysWOW64\MAWWEM.exeC:\Windows\system32\MAWWEM.exe29⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
PID:1584 -
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop sharedaccess30⤵PID:2080
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess31⤵PID:2560
-
-
-
C:\Windows\SysWOW64\MAWWEM.exeC:\Windows\system32\MAWWEM.exe30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:600 -
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop sharedaccess31⤵PID:1516
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess32⤵PID:836
-
-
-
C:\Windows\SysWOW64\MAWWEM.exeC:\Windows\system32\MAWWEM.exe31⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
PID:876 -
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop sharedaccess32⤵PID:2424
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess33⤵PID:1012
-
-
-
C:\Windows\SysWOW64\MAWWEM.exeC:\Windows\system32\MAWWEM.exe32⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
PID:1548 -
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop sharedaccess33⤵PID:1960
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess34⤵PID:2436
-
-
-
C:\Windows\SysWOW64\MAWWEM.exeC:\Windows\system32\MAWWEM.exe33⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1544 -
C:\Windows\SysWOW64\MAWWEM.exeC:\Windows\system32\MAWWEM.exe34⤵
- Executes dropped EXE
PID:3024 -
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop sharedaccess35⤵PID:1056
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess36⤵PID:1088
-
-
-
C:\Windows\SysWOW64\MAWWEM.exeC:\Windows\system32\MAWWEM.exe35⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2288 -
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop sharedaccess36⤵PID:1744
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess37⤵PID:2156
-
-
-
C:\Windows\SysWOW64\MAWWEM.exeC:\Windows\system32\MAWWEM.exe36⤵
- Executes dropped EXE
PID:812 -
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop sharedaccess37⤵PID:3004
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess38⤵PID:884
-
-
-
C:\Windows\SysWOW64\MAWWEM.exeC:\Windows\system32\MAWWEM.exe37⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1612 -
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop sharedaccess38⤵PID:2276
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess39⤵PID:2488
-
-
-
C:\Windows\SysWOW64\MAWWEM.exeC:\Windows\system32\MAWWEM.exe38⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2816 -
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop sharedaccess39⤵PID:2760
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess40⤵PID:2472
-
-
-
C:\Windows\SysWOW64\MAWWEM.exeC:\Windows\system32\MAWWEM.exe39⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3000 -
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop sharedaccess40⤵PID:2776
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess41⤵PID:2644
-
-
-
C:\Windows\SysWOW64\MAWWEM.exeC:\Windows\system32\MAWWEM.exe40⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2004 -
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop sharedaccess41⤵PID:1784
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess42⤵PID:2948
-
-
-
C:\Windows\SysWOW64\MAWWEM.exeC:\Windows\system32\MAWWEM.exe41⤵
- Executes dropped EXE
PID:2388 -
C:\Windows\SysWOW64\MAWWEM.exeC:\Windows\system32\MAWWEM.exe42⤵
- Executes dropped EXE
PID:2560 -
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop sharedaccess43⤵PID:412
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess44⤵PID:1232
-
-
-
C:\Windows\SysWOW64\MAWWEM.exeC:\Windows\system32\MAWWEM.exe43⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:456 -
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop sharedaccess44⤵PID:2416
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess45⤵PID:692
-
-
-
C:\Windows\SysWOW64\MAWWEM.exeC:\Windows\system32\MAWWEM.exe44⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1960 -
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop sharedaccess45⤵PID:1532
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess46⤵PID:3064
-
-
-
C:\Windows\SysWOW64\MAWWEM.exeC:\Windows\system32\MAWWEM.exe45⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1056 -
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop sharedaccess46⤵PID:1744
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess47⤵PID:2768
-
-
-
C:\Windows\SysWOW64\MAWWEM.exeC:\Windows\system32\MAWWEM.exe46⤵
- Executes dropped EXE
PID:2216 -
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop sharedaccess47⤵PID:2484
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess48⤵PID:2760
-
-
-
C:\Windows\SysWOW64\MAWWEM.exeC:\Windows\system32\MAWWEM.exe47⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2996 -
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop sharedaccess48⤵PID:1664
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess49⤵PID:1752
-
-
-
C:\Windows\SysWOW64\MAWWEM.exeC:\Windows\system32\MAWWEM.exe48⤵
- Executes dropped EXE
PID:2976 -
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop sharedaccess49⤵PID:340
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess50⤵PID:1012
-
-
-
C:\Windows\SysWOW64\MAWWEM.exeC:\Windows\system32\MAWWEM.exe49⤵
- Executes dropped EXE
PID:2940 -
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop sharedaccess50⤵PID:2032
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess51⤵PID:3032
-
-
-
C:\Windows\SysWOW64\MAWWEM.exeC:\Windows\system32\MAWWEM.exe50⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:692 -
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop sharedaccess51⤵PID:3064
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess52⤵PID:3004
-
-
-
C:\Windows\SysWOW64\MAWWEM.exeC:\Windows\system32\MAWWEM.exe51⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2468 -
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop sharedaccess52⤵PID:2956
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess53⤵PID:704
-
-
-
C:\Windows\SysWOW64\MAWWEM.exeC:\Windows\system32\MAWWEM.exe52⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1792 -
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop sharedaccess53⤵PID:1436
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess54⤵PID:3032
-
-
-
C:\Windows\SysWOW64\MAWWEM.exeC:\Windows\system32\MAWWEM.exe53⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2424 -
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop sharedaccess54⤵PID:2164
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess55⤵PID:2412
-
-
-
C:\Windows\SysWOW64\MAWWEM.exeC:\Windows\system32\MAWWEM.exe54⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3064 -
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop sharedaccess55⤵PID:1664
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess56⤵PID:2088
-
-
-
C:\Windows\SysWOW64\MAWWEM.exeC:\Windows\system32\MAWWEM.exe55⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1508 -
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop sharedaccess56⤵PID:340
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess57⤵PID:3080
-
-
-
C:\Windows\SysWOW64\MAWWEM.exeC:\Windows\system32\MAWWEM.exe56⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:704 -
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop sharedaccess57⤵PID:3092
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess58⤵PID:3140
-
-
-
C:\Windows\SysWOW64\MAWWEM.exeC:\Windows\system32\MAWWEM.exe57⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3112 -
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop sharedaccess58⤵PID:3152
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess59⤵PID:3224
-
-
-
C:\Windows\SysWOW64\MAWWEM.exeC:\Windows\system32\MAWWEM.exe58⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3188 -
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop sharedaccess59⤵PID:3208
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess60⤵PID:3268
-
-
-
C:\Windows\SysWOW64\MAWWEM.exeC:\Windows\system32\MAWWEM.exe59⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3236 -
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop sharedaccess60⤵PID:3276
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess61⤵PID:3324
-
-
-
C:\Windows\SysWOW64\MAWWEM.exeC:\Windows\system32\MAWWEM.exe60⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3296 -
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop sharedaccess61⤵PID:3344
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess62⤵PID:3388
-
-
-
C:\Windows\SysWOW64\MAWWEM.exeC:\Windows\system32\MAWWEM.exe61⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3372 -
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop sharedaccess62⤵PID:3400
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess63⤵PID:3448
-
-
-
C:\Windows\SysWOW64\MAWWEM.exeC:\Windows\system32\MAWWEM.exe62⤵
- Executes dropped EXE
PID:3420 -
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop sharedaccess63⤵PID:3468
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess64⤵PID:3512
-
-
-
C:\Windows\SysWOW64\MAWWEM.exeC:\Windows\system32\MAWWEM.exe63⤵
- Executes dropped EXE
PID:3488 -
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop sharedaccess64⤵PID:3528
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess65⤵PID:3572
-
-
-
C:\Windows\SysWOW64\MAWWEM.exeC:\Windows\system32\MAWWEM.exe64⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3548 -
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop sharedaccess65⤵PID:3592
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess66⤵PID:3636
-
-
-
C:\Windows\SysWOW64\MAWWEM.exeC:\Windows\system32\MAWWEM.exe65⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3612 -
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop sharedaccess66⤵PID:3648
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess67⤵PID:3696
-
-
-
C:\Windows\SysWOW64\MAWWEM.exeC:\Windows\system32\MAWWEM.exe66⤵PID:3672
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop sharedaccess67⤵PID:3708
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess68⤵PID:3760
-
-
-
C:\Windows\SysWOW64\MAWWEM.exeC:\Windows\system32\MAWWEM.exe67⤵PID:3728
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop sharedaccess68⤵PID:3772
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess69⤵PID:3820
-
-
-
C:\Windows\SysWOW64\MAWWEM.exeC:\Windows\system32\MAWWEM.exe68⤵PID:3796
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop sharedaccess69⤵PID:3832
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess70⤵PID:3920
-
-
-
C:\Windows\SysWOW64\MAWWEM.exeC:\Windows\system32\MAWWEM.exe69⤵PID:3860
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop sharedaccess70⤵PID:3884
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess71⤵PID:3948
-
-
-
C:\Windows\SysWOW64\MAWWEM.exeC:\Windows\system32\MAWWEM.exe70⤵PID:3904
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop sharedaccess71⤵PID:3956
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess72⤵PID:4000
-
-
-
C:\Windows\SysWOW64\MAWWEM.exeC:\Windows\system32\MAWWEM.exe71⤵PID:3976
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop sharedaccess72⤵PID:4020
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess73⤵PID:4064
-
-
-
C:\Windows\SysWOW64\MAWWEM.exeC:\Windows\system32\MAWWEM.exe72⤵PID:4040
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop sharedaccess73⤵PID:4076
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess74⤵PID:3076
-
-
-
C:\Windows\SysWOW64\MAWWEM.exeC:\Windows\system32\MAWWEM.exe73⤵PID:2760
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop sharedaccess74⤵PID:340
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess75⤵PID:3180
-
-
-
C:\Windows\SysWOW64\MAWWEM.exeC:\Windows\system32\MAWWEM.exe74⤵PID:3144
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop sharedaccess75⤵PID:3232
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess76⤵PID:3212
-
-
-
C:\Windows\SysWOW64\MAWWEM.exeC:\Windows\system32\MAWWEM.exe75⤵PID:3152
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop sharedaccess76⤵PID:3244
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess77⤵PID:3380
-
-
-
C:\Windows\SysWOW64\MAWWEM.exeC:\Windows\system32\MAWWEM.exe76⤵PID:3276
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop sharedaccess77⤵PID:3452
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess78⤵PID:3544
-
-
-
C:\Windows\SysWOW64\MAWWEM.exeC:\Windows\system32\MAWWEM.exe77⤵PID:3440
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop sharedaccess78⤵PID:3512
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess79⤵PID:3624
-
-
-
C:\Windows\SysWOW64\MAWWEM.exeC:\Windows\system32\MAWWEM.exe78⤵PID:3572
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop sharedaccess79⤵PID:3632
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess80⤵PID:3680
-
-
-
C:\Windows\SysWOW64\MAWWEM.exeC:\Windows\system32\MAWWEM.exe79⤵PID:3668
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop sharedaccess80⤵PID:3752
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess81⤵PID:3772
-
-
-
C:\Windows\SysWOW64\MAWWEM.exeC:\Windows\system32\MAWWEM.exe80⤵PID:3792
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop sharedaccess81⤵PID:3900
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess82⤵PID:3952
-
-
-
C:\Windows\SysWOW64\MAWWEM.exeC:\Windows\system32\MAWWEM.exe81⤵PID:3836
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop sharedaccess82⤵PID:3888
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess83⤵PID:4068
-
-
-
C:\Windows\SysWOW64\MAWWEM.exeC:\Windows\system32\MAWWEM.exe82⤵PID:3960
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop sharedaccess83⤵PID:4060
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess84⤵PID:2348
-
-
-
C:\Windows\SysWOW64\MAWWEM.exeC:\Windows\system32\MAWWEM.exe83⤵PID:3004
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop sharedaccess84⤵PID:3180
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess85⤵PID:3232
-
-
-
C:\Windows\SysWOW64\MAWWEM.exeC:\Windows\system32\MAWWEM.exe84⤵PID:3156
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop sharedaccess85⤵PID:3364
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess86⤵PID:3560
-
-
-
C:\Windows\SysWOW64\MAWWEM.exeC:\Windows\system32\MAWWEM.exe85⤵PID:3304
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop sharedaccess86⤵PID:3508
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess87⤵PID:3564
-
-
-
C:\Windows\SysWOW64\MAWWEM.exeC:\Windows\system32\MAWWEM.exe86⤵PID:3684
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop sharedaccess87⤵PID:3680
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess88⤵PID:3776
-
-
-
C:\Windows\SysWOW64\MAWWEM.exeC:\Windows\system32\MAWWEM.exe87⤵PID:3736
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop sharedaccess88⤵PID:3952
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess89⤵PID:3888
-
-
-
C:\Windows\SysWOW64\MAWWEM.exeC:\Windows\system32\MAWWEM.exe88⤵PID:3984
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop sharedaccess89⤵PID:3992
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess90⤵PID:3272
-
-
-
C:\Windows\SysWOW64\MAWWEM.exeC:\Windows\system32\MAWWEM.exe89⤵PID:2348
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop sharedaccess90⤵PID:3308
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess91⤵PID:3380
-
-
-
C:\Windows\SysWOW64\MAWWEM.exeC:\Windows\system32\MAWWEM.exe90⤵PID:3392
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop sharedaccess91⤵PID:3564
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess92⤵PID:4052
-
-
-
C:\Windows\SysWOW64\MAWWEM.exeC:\Windows\system32\MAWWEM.exe91⤵PID:3776
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop sharedaccess92⤵PID:3820
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess93⤵PID:3232
-
-
-
C:\Windows\SysWOW64\MAWWEM.exeC:\Windows\system32\MAWWEM.exe92⤵PID:3212
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop sharedaccess93⤵PID:3096
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess94⤵PID:3608
-
-
-
C:\Windows\SysWOW64\MAWWEM.exeC:\Windows\system32\MAWWEM.exe93⤵PID:3640
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop sharedaccess94⤵PID:3884
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess95⤵PID:3820
-
-
-
C:\Windows\SysWOW64\MAWWEM.exeC:\Windows\system32\MAWWEM.exe94⤵PID:3564
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop sharedaccess95⤵PID:3824
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess96⤵PID:3820
-
-
-
C:\Windows\SysWOW64\MAWWEM.exeC:\Windows\system32\MAWWEM.exe95⤵PID:3084
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop sharedaccess96⤵PID:3512
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess97⤵PID:4112
-
-
-
C:\Windows\SysWOW64\MAWWEM.exeC:\Windows\system32\MAWWEM.exe96⤵PID:3468
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop sharedaccess97⤵PID:4124
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess98⤵PID:4172
-
-
-
C:\Windows\SysWOW64\MAWWEM.exeC:\Windows\system32\MAWWEM.exe97⤵PID:4144
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop sharedaccess98⤵PID:4184
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess99⤵PID:4236
-
-
-
C:\Windows\SysWOW64\MAWWEM.exeC:\Windows\system32\MAWWEM.exe98⤵PID:4212
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop sharedaccess99⤵PID:4256
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess100⤵PID:4300
-
-
-
C:\Windows\SysWOW64\MAWWEM.exeC:\Windows\system32\MAWWEM.exe99⤵PID:4276
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop sharedaccess100⤵PID:4316
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess101⤵PID:4360
-
-
-
C:\Windows\SysWOW64\MAWWEM.exeC:\Windows\system32\MAWWEM.exe100⤵PID:4336
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop sharedaccess101⤵PID:4372
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess102⤵PID:4424
-
-
-
C:\Windows\SysWOW64\MAWWEM.exeC:\Windows\system32\MAWWEM.exe101⤵PID:4400
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop sharedaccess102⤵PID:4440
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess103⤵PID:4484
-
-
-
C:\Windows\SysWOW64\MAWWEM.exeC:\Windows\system32\MAWWEM.exe102⤵PID:4468
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop sharedaccess103⤵PID:4496
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess104⤵PID:4544
-
-
-
C:\Windows\SysWOW64\MAWWEM.exeC:\Windows\system32\MAWWEM.exe103⤵PID:4516
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop sharedaccess104⤵PID:4556
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess105⤵PID:4608
-
-
-
C:\Windows\SysWOW64\MAWWEM.exeC:\Windows\system32\MAWWEM.exe104⤵PID:4584
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop sharedaccess105⤵PID:4620
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess106⤵PID:4672
-
-
-
C:\Windows\SysWOW64\MAWWEM.exeC:\Windows\system32\MAWWEM.exe105⤵PID:4648
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop sharedaccess106⤵PID:4680
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess107⤵PID:4728
-
-
-
C:\Windows\SysWOW64\MAWWEM.exeC:\Windows\system32\MAWWEM.exe106⤵PID:4700
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop sharedaccess107⤵PID:4748
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess108⤵PID:4792
-
-
-
C:\Windows\SysWOW64\MAWWEM.exeC:\Windows\system32\MAWWEM.exe107⤵PID:4768
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop sharedaccess108⤵PID:4808
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess109⤵PID:4852
-
-
-
C:\Windows\SysWOW64\MAWWEM.exeC:\Windows\system32\MAWWEM.exe108⤵PID:4828
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop sharedaccess109⤵PID:4872
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess110⤵PID:4916
-
-
-
C:\Windows\SysWOW64\MAWWEM.exeC:\Windows\system32\MAWWEM.exe109⤵PID:4892
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop sharedaccess110⤵PID:4928
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess111⤵PID:4980
-
-
-
C:\Windows\SysWOW64\MAWWEM.exeC:\Windows\system32\MAWWEM.exe110⤵PID:4956
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop sharedaccess111⤵PID:5004
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess112⤵PID:5048
-
-
-
C:\Windows\SysWOW64\MAWWEM.exeC:\Windows\system32\MAWWEM.exe111⤵PID:5024
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop sharedaccess112⤵PID:5068
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess113⤵PID:5112
-
-
-
C:\Windows\SysWOW64\MAWWEM.exeC:\Windows\system32\MAWWEM.exe112⤵PID:5088
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop sharedaccess113⤵PID:3988
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess114⤵PID:4168
-
-
-
C:\Windows\SysWOW64\MAWWEM.exeC:\Windows\system32\MAWWEM.exe113⤵PID:3608
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop sharedaccess114⤵PID:4156
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess115⤵PID:4296
-
-
-
C:\Windows\SysWOW64\MAWWEM.exeC:\Windows\system32\MAWWEM.exe114⤵PID:4232
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop sharedaccess115⤵PID:4284
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess116⤵PID:4412
-
-
-
C:\Windows\SysWOW64\MAWWEM.exeC:\Windows\system32\MAWWEM.exe115⤵PID:4356
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop sharedaccess116⤵PID:4420
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess117⤵PID:4480
-
-
-
C:\Windows\SysWOW64\MAWWEM.exeC:\Windows\system32\MAWWEM.exe116⤵PID:4488
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop sharedaccess117⤵PID:4500
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess118⤵PID:4556
-
-
-
C:\Windows\SysWOW64\MAWWEM.exeC:\Windows\system32\MAWWEM.exe117⤵PID:4580
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop sharedaccess118⤵PID:4644
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess119⤵PID:4684
-
-
-
C:\Windows\SysWOW64\MAWWEM.exeC:\Windows\system32\MAWWEM.exe118⤵PID:4624
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop sharedaccess119⤵PID:4716
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess120⤵PID:4856
-
-
-
C:\Windows\SysWOW64\MAWWEM.exeC:\Windows\system32\MAWWEM.exe119⤵PID:4752
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop sharedaccess120⤵PID:4844
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess121⤵PID:4952
-
-
-
C:\Windows\SysWOW64\MAWWEM.exeC:\Windows\system32\MAWWEM.exe120⤵PID:4916
-
C:\Windows\SysWOW64\MAWWEM.exeC:\Windows\system32\MAWWEM.exe121⤵PID:2240
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop sharedaccess122⤵PID:5052
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-