Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

3a6d5694ee...da.exe

windows10-2004-x64

10

3a6d5694ee...da.exe

windows10-ltsc 2021-x64

10

3a6d5694ee...da.exe

windows11-21h2-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows11-21h2_x64
  • resource
    win11-20241007-en
  • resource tags

    arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    03/02/2025, 08:39

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    3a6d5694eec724726efa3327a50fad3efdc623c08d647b51e51cd578bddda3da.exe

  • Size

    624KB

  • MD5

    a6980e543efa40771ed1dcf84b29d732

  • SHA1

    6586b2155afa5d7cda5cd3f8a7af37c4fe126a1d

  • SHA256

    3a6d5694eec724726efa3327a50fad3efdc623c08d647b51e51cd578bddda3da

  • SHA512

    d1ca8724c8879442907b7e45b59b954100ada37e036aa17496920a9783eb0738ff51831854acc8cafd805c116bfea47a903270fec74949f10b36eddf971ac06f

  • SSDEEP

    12288:/ktG6SXJb0DdQ0k0HGzZbkh0wchQ5HYaIhadnR/t256S5AA2Ltyaxn1gUEEkfTSX:kS9JmVSvGWEAng/qwnYPRslWPLu1

Score
10/10
medusaransomwarecredential_accessdiscoverypersistenceransomwarespywarestealer

Malware Config

Signatures

  • Medusa Ransomware

    Ransomware first identified in 2022 that is distinct from the similarly named ransomware family MedusaLocker.

    ransomwaremedusaransomware
  • Medusaransomware family
    medusaransomware
  • Renames multiple (8661) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Credentials from Password Stores: Windows Credential Manager 1 TTPs

    Suspicious access to Credentials History.

    credential_accessstealer
  • Drops startup file 5 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops desktop.ini file(s) 64 IoCs
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Network Share Discovery 1 TTPs

    Attempt to gather information on host network.

    discovery
  • Drops file in Program Files directory 64 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 58 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 4 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 12 IoCs
  • Kills process with taskkill 44 IoCs
    defense_evasion
  • Modifies Internet Explorer settings 1 TTPs 6 IoCs
    adwarespyware
  • Modifies registry class 43 IoCs
  • Runs net.exe
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 49 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 9 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\3a6d5694eec724726efa3327a50fad3efdc623c08d647b51e51cd578bddda3da.exe
    "C:\Users\Admin\AppData\Local\Temp\3a6d5694eec724726efa3327a50fad3efdc623c08d647b51e51cd578bddda3da.exe"
    1⤵
    • Drops startup file
    • Drops desktop.ini file(s)
    • Drops file in Program Files directory
    • Suspicious use of WriteProcessMemory
    PID:1560
    • C:\Windows\SysWOW64\net.exe
      net stop "Acronis VSS Provider" /y
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4032
      • C:\Windows\SysWOW64\net1.exe
        C:\Windows\system32\net1 stop "Acronis VSS Provider" /y
        3⤵
          PID:3328
      • C:\Windows\SysWOW64\net.exe
        net stop "Enterprise Client Service" /y
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:4584
        • C:\Windows\SysWOW64\net1.exe
          C:\Windows\system32\net1 stop "Enterprise Client Service" /y
          3⤵
            PID:1444
        • C:\Windows\SysWOW64\net.exe
          net stop "Sophos Agent" /y
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:848
          • C:\Windows\SysWOW64\net1.exe
            C:\Windows\system32\net1 stop "Sophos Agent" /y
            3⤵
              PID:3144
          • C:\Windows\SysWOW64\net.exe
            net stop "Sophos AutoUpdate Service" /y
            2⤵
            • Suspicious use of WriteProcessMemory
            PID:3436
            • C:\Windows\SysWOW64\net1.exe
              C:\Windows\system32\net1 stop "Sophos AutoUpdate Service" /y
              3⤵
                PID:2992
            • C:\Windows\SysWOW64\net.exe
              net stop "Sophos Clean Service" /y
              2⤵
              • Suspicious use of WriteProcessMemory
              PID:3032
              • C:\Windows\SysWOW64\net1.exe
                C:\Windows\system32\net1 stop "Sophos Clean Service" /y
                3⤵
                  PID:4752
              • C:\Windows\SysWOW64\net.exe
                net stop "Sophos Device Control Service" /y
                2⤵
                • Suspicious use of WriteProcessMemory
                PID:4112
                • C:\Windows\SysWOW64\net1.exe
                  C:\Windows\system32\net1 stop "Sophos Device Control Service" /y
                  3⤵
                    PID:2600
                • C:\Windows\SysWOW64\net.exe
                  net stop "Sophos File Scanner Service" /y
                  2⤵
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of WriteProcessMemory
                  PID:3016
                  • C:\Windows\SysWOW64\net1.exe
                    C:\Windows\system32\net1 stop "Sophos File Scanner Service" /y
                    3⤵
                      PID:4476
                  • C:\Windows\SysWOW64\net.exe
                    net stop "Sophos Health Service" /y
                    2⤵
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of WriteProcessMemory
                    PID:4604
                    • C:\Windows\SysWOW64\net1.exe
                      C:\Windows\system32\net1 stop "Sophos Health Service" /y
                      3⤵
                        PID:900
                    • C:\Windows\SysWOW64\net.exe
                      net stop "Sophos MCS Agent" /y
                      2⤵
                      • System Location Discovery: System Language Discovery
                      • Suspicious use of WriteProcessMemory
                      PID:2916
                      • C:\Windows\SysWOW64\net1.exe
                        C:\Windows\system32\net1 stop "Sophos MCS Agent" /y
                        3⤵
                          PID:4852
                      • C:\Windows\SysWOW64\net.exe
                        net stop "Sophos MCS Client" /y
                        2⤵
                        • System Location Discovery: System Language Discovery
                        • Suspicious use of WriteProcessMemory
                        PID:1704
                        • C:\Windows\SysWOW64\net1.exe
                          C:\Windows\system32\net1 stop "Sophos MCS Client" /y
                          3⤵
                            PID:3244
                        • C:\Windows\SysWOW64\net.exe
                          net stop "Sophos Message Router" /y
                          2⤵
                          • System Location Discovery: System Language Discovery
                          • Suspicious use of WriteProcessMemory
                          PID:1972
                          • C:\Windows\SysWOW64\net1.exe
                            C:\Windows\system32\net1 stop "Sophos Message Router" /y
                            3⤵
                              PID:2040
                          • C:\Windows\SysWOW64\net.exe
                            net stop "Sophos Safestore Service" /y
                            2⤵
                              PID:3824
                              • C:\Windows\SysWOW64\net1.exe
                                C:\Windows\system32\net1 stop "Sophos Safestore Service" /y
                                3⤵
                                  PID:3696
                              • C:\Windows\SysWOW64\net.exe
                                net stop "Sophos System Protection Service" /y
                                2⤵
                                • System Location Discovery: System Language Discovery
                                PID:4624
                                • C:\Windows\SysWOW64\net1.exe
                                  C:\Windows\system32\net1 stop "Sophos System Protection Service" /y
                                  3⤵
                                    PID:5080
                                • C:\Windows\SysWOW64\net.exe
                                  net stop "Sophos Web Control Service" /y
                                  2⤵
                                    PID:5084
                                    • C:\Windows\SysWOW64\net1.exe
                                      C:\Windows\system32\net1 stop "Sophos Web Control Service" /y
                                      3⤵
                                        PID:4276
                                    • C:\Windows\SysWOW64\net.exe
                                      net stop "SQLsafe Backup Service" /y
                                      2⤵
                                        PID:3356
                                        • C:\Windows\SysWOW64\net1.exe
                                          C:\Windows\system32\net1 stop "SQLsafe Backup Service" /y
                                          3⤵
                                          • System Location Discovery: System Language Discovery
                                          PID:2692
                                      • C:\Windows\SysWOW64\net.exe
                                        net stop "SQLsafe Filter Service" /y
                                        2⤵
                                        • System Location Discovery: System Language Discovery
                                        PID:2364
                                        • C:\Windows\SysWOW64\net1.exe
                                          C:\Windows\system32\net1 stop "SQLsafe Filter Service" /y
                                          3⤵
                                            PID:1272
                                        • C:\Windows\SysWOW64\net.exe
                                          net stop "Symantec System Recovery" /y
                                          2⤵
                                            PID:1372
                                            • C:\Windows\SysWOW64\net1.exe
                                              C:\Windows\system32\net1 stop "Symantec System Recovery" /y
                                              3⤵
                                                PID:4648
                                            • C:\Windows\SysWOW64\net.exe
                                              net stop "Veeam Backup Catalog Data Service" /y
                                              2⤵
                                                PID:1492
                                                • C:\Windows\SysWOW64\net1.exe
                                                  C:\Windows\system32\net1 stop "Veeam Backup Catalog Data Service" /y
                                                  3⤵
                                                  • System Location Discovery: System Language Discovery
                                                  PID:4772
                                              • C:\Windows\SysWOW64\net.exe
                                                net stop "AcronisAgent" /y
                                                2⤵
                                                  PID:1496
                                                  • C:\Windows\SysWOW64\net1.exe
                                                    C:\Windows\system32\net1 stop "AcronisAgent" /y
                                                    3⤵
                                                      PID:4152
                                                  • C:\Windows\SysWOW64\net.exe
                                                    net stop "AcrSch2Svc" /y
                                                    2⤵
                                                      PID:3912
                                                      • C:\Windows\SysWOW64\net1.exe
                                                        C:\Windows\system32\net1 stop "AcrSch2Svc" /y
                                                        3⤵
                                                        • System Location Discovery: System Language Discovery
                                                        PID:4292
                                                    • C:\Windows\SysWOW64\net.exe
                                                      net stop "Antivirus" /y
                                                      2⤵
                                                      • System Location Discovery: System Language Discovery
                                                      PID:1892
                                                      • C:\Windows\SysWOW64\net1.exe
                                                        C:\Windows\system32\net1 stop "Antivirus" /y
                                                        3⤵
                                                          PID:1456
                                                      • C:\Windows\SysWOW64\net.exe
                                                        net stop "ARSM" /y
                                                        2⤵
                                                          PID:3504
                                                          • C:\Windows\SysWOW64\net1.exe
                                                            C:\Windows\system32\net1 stop "ARSM" /y
                                                            3⤵
                                                            • System Location Discovery: System Language Discovery
                                                            PID:1820
                                                        • C:\Windows\SysWOW64\net.exe
                                                          net stop "BackupExecAgentAccelerator" /y
                                                          2⤵
                                                            PID:3568
                                                            • C:\Windows\SysWOW64\net1.exe
                                                              C:\Windows\system32\net1 stop "BackupExecAgentAccelerator" /y
                                                              3⤵
                                                                PID:3176
                                                            • C:\Windows\SysWOW64\net.exe
                                                              net stop "BackupExecAgentBrowser" /y
                                                              2⤵
                                                                PID:1976
                                                                • C:\Windows\SysWOW64\net1.exe
                                                                  C:\Windows\system32\net1 stop "BackupExecAgentBrowser" /y
                                                                  3⤵
                                                                    PID:1484
                                                                • C:\Windows\SysWOW64\net.exe
                                                                  net stop "BackupExecDeviceMediaService" /y
                                                                  2⤵
                                                                    PID:572
                                                                    • C:\Windows\SysWOW64\net1.exe
                                                                      C:\Windows\system32\net1 stop "BackupExecDeviceMediaService" /y
                                                                      3⤵
                                                                        PID:1348
                                                                    • C:\Windows\SysWOW64\net.exe
                                                                      net stop "BackupExecJobEngine" /y
                                                                      2⤵
                                                                      • System Location Discovery: System Language Discovery
                                                                      PID:1188
                                                                      • C:\Windows\SysWOW64\net1.exe
                                                                        C:\Windows\system32\net1 stop "BackupExecJobEngine" /y
                                                                        3⤵
                                                                          PID:4968
                                                                      • C:\Windows\SysWOW64\net.exe
                                                                        net stop "BackupExecManagementService" /y
                                                                        2⤵
                                                                          PID:1084
                                                                          • C:\Windows\SysWOW64\net1.exe
                                                                            C:\Windows\system32\net1 stop "BackupExecManagementService" /y
                                                                            3⤵
                                                                              PID:2596
                                                                          • C:\Windows\SysWOW64\net.exe
                                                                            net stop "BackupExecRPCService" /y
                                                                            2⤵
                                                                              PID:4708
                                                                              • C:\Windows\SysWOW64\net1.exe
                                                                                C:\Windows\system32\net1 stop "BackupExecRPCService" /y
                                                                                3⤵
                                                                                  PID:916
                                                                              • C:\Windows\SysWOW64\net.exe
                                                                                net stop "BackupExecVSSProvider" /y
                                                                                2⤵
                                                                                  PID:4172
                                                                                  • C:\Windows\SysWOW64\net1.exe
                                                                                    C:\Windows\system32\net1 stop "BackupExecVSSProvider" /y
                                                                                    3⤵
                                                                                      PID:2332
                                                                                  • C:\Windows\SysWOW64\net.exe
                                                                                    net stop "bedbg" /y
                                                                                    2⤵
                                                                                      PID:4728
                                                                                      • C:\Windows\SysWOW64\net1.exe
                                                                                        C:\Windows\system32\net1 stop "bedbg" /y
                                                                                        3⤵
                                                                                          PID:5032
                                                                                      • C:\Windows\SysWOW64\net.exe
                                                                                        net stop "DCAgent" /y
                                                                                        2⤵
                                                                                          PID:2072
                                                                                          • C:\Windows\SysWOW64\net1.exe
                                                                                            C:\Windows\system32\net1 stop "DCAgent" /y
                                                                                            3⤵
                                                                                              PID:2632
                                                                                          • C:\Windows\SysWOW64\net.exe
                                                                                            net stop "EPSecurityService" /y
                                                                                            2⤵
                                                                                              PID:4620
                                                                                              • C:\Windows\SysWOW64\net1.exe
                                                                                                C:\Windows\system32\net1 stop "EPSecurityService" /y
                                                                                                3⤵
                                                                                                  PID:3772
                                                                                              • C:\Windows\SysWOW64\net.exe
                                                                                                net stop "EPUpdateService" /y
                                                                                                2⤵
                                                                                                  PID:2704
                                                                                                  • C:\Windows\SysWOW64\net1.exe
                                                                                                    C:\Windows\system32\net1 stop "EPUpdateService" /y
                                                                                                    3⤵
                                                                                                      PID:1872
                                                                                                  • C:\Windows\SysWOW64\net.exe
                                                                                                    net stop "EraserSvc11710" /y
                                                                                                    2⤵
                                                                                                      PID:696
                                                                                                      • C:\Windows\SysWOW64\net1.exe
                                                                                                        C:\Windows\system32\net1 stop "EraserSvc11710" /y
                                                                                                        3⤵
                                                                                                          PID:2420
                                                                                                      • C:\Windows\SysWOW64\net.exe
                                                                                                        net stop "EsgShKernel" /y
                                                                                                        2⤵
                                                                                                          PID:3996
                                                                                                          • C:\Windows\SysWOW64\net1.exe
                                                                                                            C:\Windows\system32\net1 stop "EsgShKernel" /y
                                                                                                            3⤵
                                                                                                              PID:2292
                                                                                                          • C:\Windows\SysWOW64\net.exe
                                                                                                            net stop "FA_Scheduler" /y
                                                                                                            2⤵
                                                                                                              PID:1748
                                                                                                              • C:\Windows\SysWOW64\net1.exe
                                                                                                                C:\Windows\system32\net1 stop "FA_Scheduler" /y
                                                                                                                3⤵
                                                                                                                  PID:2580
                                                                                                              • C:\Windows\SysWOW64\net.exe
                                                                                                                net stop "IISAdmin" /y
                                                                                                                2⤵
                                                                                                                  PID:2864
                                                                                                                  • C:\Windows\SysWOW64\net1.exe
                                                                                                                    C:\Windows\system32\net1 stop "IISAdmin" /y
                                                                                                                    3⤵
                                                                                                                      PID:4596
                                                                                                                  • C:\Windows\SysWOW64\net.exe
                                                                                                                    net stop "IMAP4Svc" /y
                                                                                                                    2⤵
                                                                                                                      PID:32
                                                                                                                      • C:\Windows\SysWOW64\net1.exe
                                                                                                                        C:\Windows\system32\net1 stop "IMAP4Svc" /y
                                                                                                                        3⤵
                                                                                                                          PID:2368
                                                                                                                      • C:\Windows\SysWOW64\net.exe
                                                                                                                        net stop "macmnsvc" /y
                                                                                                                        2⤵
                                                                                                                          PID:2532
                                                                                                                          • C:\Windows\SysWOW64\net1.exe
                                                                                                                            C:\Windows\system32\net1 stop "macmnsvc" /y
                                                                                                                            3⤵
                                                                                                                              PID:2144
                                                                                                                          • C:\Windows\SysWOW64\net.exe
                                                                                                                            net stop "masvc" /y
                                                                                                                            2⤵
                                                                                                                              PID:228
                                                                                                                              • C:\Windows\SysWOW64\net1.exe
                                                                                                                                C:\Windows\system32\net1 stop "masvc" /y
                                                                                                                                3⤵
                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                PID:4660
                                                                                                                            • C:\Windows\SysWOW64\net.exe
                                                                                                                              net stop "MBAMService" /y
                                                                                                                              2⤵
                                                                                                                                PID:2336
                                                                                                                                • C:\Windows\SysWOW64\net1.exe
                                                                                                                                  C:\Windows\system32\net1 stop "MBAMService" /y
                                                                                                                                  3⤵
                                                                                                                                    PID:3988
                                                                                                                                • C:\Windows\SysWOW64\net.exe
                                                                                                                                  net stop "MBEndpointAgent" /y
                                                                                                                                  2⤵
                                                                                                                                    PID:2268
                                                                                                                                    • C:\Windows\SysWOW64\net1.exe
                                                                                                                                      C:\Windows\system32\net1 stop "MBEndpointAgent" /y
                                                                                                                                      3⤵
                                                                                                                                        PID:2412
                                                                                                                                    • C:\Windows\SysWOW64\net.exe
                                                                                                                                      net stop "McAfeeEngineService" /y
                                                                                                                                      2⤵
                                                                                                                                        PID:1780
                                                                                                                                        • C:\Windows\SysWOW64\net1.exe
                                                                                                                                          C:\Windows\system32\net1 stop "McAfeeEngineService" /y
                                                                                                                                          3⤵
                                                                                                                                            PID:1204
                                                                                                                                        • C:\Windows\SysWOW64\net.exe
                                                                                                                                          net stop "McAfeeFramework" /y
                                                                                                                                          2⤵
                                                                                                                                            PID:1692
                                                                                                                                            • C:\Windows\SysWOW64\net1.exe
                                                                                                                                              C:\Windows\system32\net1 stop "McAfeeFramework" /y
                                                                                                                                              3⤵
                                                                                                                                                PID:3100
                                                                                                                                            • C:\Windows\SysWOW64\net.exe
                                                                                                                                              net stop "McAfeeFrameworkMcAfeeFramework" /y
                                                                                                                                              2⤵
                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                              PID:1548
                                                                                                                                              • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                C:\Windows\system32\net1 stop "McAfeeFrameworkMcAfeeFramework" /y
                                                                                                                                                3⤵
                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                PID:3628
                                                                                                                                            • C:\Windows\SysWOW64\net.exe
                                                                                                                                              net stop "McShield" /y
                                                                                                                                              2⤵
                                                                                                                                                PID:720
                                                                                                                                                • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                  C:\Windows\system32\net1 stop "McShield" /y
                                                                                                                                                  3⤵
                                                                                                                                                    PID:4848
                                                                                                                                                • C:\Windows\SysWOW64\net.exe
                                                                                                                                                  net stop "McTaskManager" /y
                                                                                                                                                  2⤵
                                                                                                                                                    PID:2200
                                                                                                                                                    • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                      C:\Windows\system32\net1 stop "McTaskManager" /y
                                                                                                                                                      3⤵
                                                                                                                                                        PID:4556
                                                                                                                                                    • C:\Windows\SysWOW64\net.exe
                                                                                                                                                      net stop "mfemms" /y
                                                                                                                                                      2⤵
                                                                                                                                                        PID:3536
                                                                                                                                                        • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                          C:\Windows\system32\net1 stop "mfemms" /y
                                                                                                                                                          3⤵
                                                                                                                                                            PID:4432
                                                                                                                                                        • C:\Windows\SysWOW64\net.exe
                                                                                                                                                          net stop "mfevtp" /y
                                                                                                                                                          2⤵
                                                                                                                                                            PID:8
                                                                                                                                                            • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                              C:\Windows\system32\net1 stop "mfevtp" /y
                                                                                                                                                              3⤵
                                                                                                                                                                PID:1112
                                                                                                                                                            • C:\Windows\SysWOW64\net.exe
                                                                                                                                                              net stop "MMS" /y
                                                                                                                                                              2⤵
                                                                                                                                                                PID:4928
                                                                                                                                                                • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                  C:\Windows\system32\net1 stop "MMS" /y
                                                                                                                                                                  3⤵
                                                                                                                                                                    PID:1428
                                                                                                                                                                • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                  net stop "mozyprobackup" /y
                                                                                                                                                                  2⤵
                                                                                                                                                                    PID:1948
                                                                                                                                                                    • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                      C:\Windows\system32\net1 stop "mozyprobackup" /y
                                                                                                                                                                      3⤵
                                                                                                                                                                        PID:2524
                                                                                                                                                                    • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                      net stop "MsDtsServer" /y
                                                                                                                                                                      2⤵
                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                      PID:3932
                                                                                                                                                                      • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                        C:\Windows\system32\net1 stop "MsDtsServer" /y
                                                                                                                                                                        3⤵
                                                                                                                                                                          PID:5048
                                                                                                                                                                      • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                        net stop "MsDtsServer100" /y
                                                                                                                                                                        2⤵
                                                                                                                                                                          PID:3140
                                                                                                                                                                          • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                            C:\Windows\system32\net1 stop "MsDtsServer100" /y
                                                                                                                                                                            3⤵
                                                                                                                                                                              PID:768
                                                                                                                                                                          • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                            net stop "MsDtsServer110" /y
                                                                                                                                                                            2⤵
                                                                                                                                                                              PID:2472
                                                                                                                                                                              • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                C:\Windows\system32\net1 stop "MsDtsServer110" /y
                                                                                                                                                                                3⤵
                                                                                                                                                                                  PID:3920
                                                                                                                                                                              • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                net stop "MSExchangeES" /y
                                                                                                                                                                                2⤵
                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                PID:4696
                                                                                                                                                                                • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                  C:\Windows\system32\net1 stop "MSExchangeES" /y
                                                                                                                                                                                  3⤵
                                                                                                                                                                                    PID:2592
                                                                                                                                                                                • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                  net stop "MSExchangeIS" /y
                                                                                                                                                                                  2⤵
                                                                                                                                                                                    PID:4044
                                                                                                                                                                                    • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                      C:\Windows\system32\net1 stop "MSExchangeIS" /y
                                                                                                                                                                                      3⤵
                                                                                                                                                                                        PID:4908
                                                                                                                                                                                    • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                      net stop "MSExchangeMGMT" /y
                                                                                                                                                                                      2⤵
                                                                                                                                                                                        PID:4056
                                                                                                                                                                                        • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                          C:\Windows\system32\net1 stop "MSExchangeMGMT" /y
                                                                                                                                                                                          3⤵
                                                                                                                                                                                            PID:4300
                                                                                                                                                                                        • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                          net stop "MSExchangeMTA" /y
                                                                                                                                                                                          2⤵
                                                                                                                                                                                            PID:436
                                                                                                                                                                                            • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                              C:\Windows\system32\net1 stop "MSExchangeMTA" /y
                                                                                                                                                                                              3⤵
                                                                                                                                                                                                PID:3412
                                                                                                                                                                                            • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                              net stop "MSExchangeSA" /y
                                                                                                                                                                                              2⤵
                                                                                                                                                                                                PID:224
                                                                                                                                                                                                • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                  C:\Windows\system32\net1 stop "MSExchangeSA" /y
                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                    PID:3184
                                                                                                                                                                                                • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                  net stop "MSExchangeSRS" /y
                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                  PID:3164
                                                                                                                                                                                                  • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                    C:\Windows\system32\net1 stop "MSExchangeSRS" /y
                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                    PID:4780
                                                                                                                                                                                                • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                  net stop "MSOLAP$SQL_2008" /y
                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                    PID:1756
                                                                                                                                                                                                    • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                      C:\Windows\system32\net1 stop "MSOLAP$SQL_2008" /y
                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                        PID:4592
                                                                                                                                                                                                    • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                      net stop "MSOLAP$SYSTEM_BGC" /y
                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                        PID:3744
                                                                                                                                                                                                        • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                          C:\Windows\system32\net1 stop "MSOLAP$SYSTEM_BGC" /y
                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                            PID:3388
                                                                                                                                                                                                        • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                          net stop "MSOLAP$TPS" /y
                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                            PID:1844
                                                                                                                                                                                                            • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                              C:\Windows\system32\net1 stop "MSOLAP$TPS" /y
                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                PID:2140
                                                                                                                                                                                                            • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                              net stop "MSOLAP$TPSAMA" /y
                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                PID:3000
                                                                                                                                                                                                                • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                  C:\Windows\system32\net1 stop "MSOLAP$TPSAMA" /y
                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                    PID:5068
                                                                                                                                                                                                                • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                  net stop "MSSQL$BKUPEXEC" /y
                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                    PID:2372
                                                                                                                                                                                                                    • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                      C:\Windows\system32\net1 stop "MSSQL$BKUPEXEC" /y
                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                        PID:792
                                                                                                                                                                                                                    • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                      net stop "MSSQL$ECWDB2" /y
                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                        PID:776
                                                                                                                                                                                                                        • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                          C:\Windows\system32\net1 stop "MSSQL$ECWDB2" /y
                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                            PID:404
                                                                                                                                                                                                                        • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                          net stop "MSSQL$PRACTICEMGT" /y
                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                            PID:644
                                                                                                                                                                                                                            • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                              C:\Windows\system32\net1 stop "MSSQL$PRACTICEMGT" /y
                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                PID:1116
                                                                                                                                                                                                                            • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                              net stop "MSSQL$PRACTTICEBGC" /y
                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                              PID:3228
                                                                                                                                                                                                                              • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                C:\Windows\system32\net1 stop "MSSQL$PRACTTICEBGC" /y
                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                  PID:4764
                                                                                                                                                                                                                              • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                net stop "MSSQL$PROFXENGAGEMENT" /y
                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                  PID:4876
                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                    C:\Windows\system32\net1 stop "MSSQL$PROFXENGAGEMENT" /y
                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                      PID:4716
                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                    net stop "MSSQL$SBSMONITORING" /y
                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                      PID:1464
                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                        C:\Windows\system32\net1 stop "MSSQL$SBSMONITORING" /y
                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                          PID:5004
                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                        net stop "MSSQL$SHAREPOINT" /y
                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                          PID:1420
                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                            C:\Windows\system32\net1 stop "MSSQL$SHAREPOINT" /y
                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                              PID:1448
                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                            net stop "MSSQL$SQL_2008" /y
                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                              PID:1196
                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                C:\Windows\system32\net1 stop "MSSQL$SQL_2008" /y
                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                  PID:3080
                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                net stop "MSSQL$SYSTEM_BGC" /y
                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                  PID:4744
                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                    C:\Windows\system32\net1 stop "MSSQL$SYSTEM_BGC" /y
                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                      PID:4900
                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                    net stop "MSSQL$TPS" /y
                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                      PID:880
                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                        C:\Windows\system32\net1 stop "MSSQL$TPS" /y
                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                          PID:4416
                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                        net stop "MSSQL$TPSAMA" /y
                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                          PID:3904
                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                            C:\Windows\system32\net1 stop "MSSQL$TPSAMA" /y
                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                              PID:3788
                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                            net stop "MSSQL$VEEAMSQL2008R2" /y
                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                            PID:1144
                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                              C:\Windows\system32\net1 stop "MSSQL$VEEAMSQL2008R2" /y
                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                PID:3168
                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                              net stop "MSSQL$VEEAMSQL2012" /y
                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                              PID:2740
                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                C:\Windows\system32\net1 stop "MSSQL$VEEAMSQL2012" /y
                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                  PID:1716
                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                                net stop "MSSQLFDLauncher" /y
                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                  PID:3152
                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                    C:\Windows\system32\net1 stop "MSSQLFDLauncher" /y
                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                      PID:948
                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                                    net stop "MSSQLFDLauncher$PROFXENGAGEMENT" /y
                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                    PID:4484
                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                      C:\Windows\system32\net1 stop "MSSQLFDLauncher$PROFXENGAGEMENT" /y
                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                        PID:3240
                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                                      net stop "MSSQLFDLauncher$SBSMONITORING" /y
                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                        PID:3524
                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                          C:\Windows\system32\net1 stop "MSSQLFDLauncher$SBSMONITORING" /y
                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                            PID:3192
                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                                          net stop "MSSQLFDLauncher$SHAREPOINT" /y
                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                          PID:3056
                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                            C:\Windows\system32\net1 stop "MSSQLFDLauncher$SHAREPOINT" /y
                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                            PID:2480
                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                                          net stop "MSSQLFDLauncher$SQL_2008" /y
                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                            PID:2180
                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                              C:\Windows\system32\net1 stop "MSSQLFDLauncher$SQL_2008" /y
                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                PID:3908
                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                                              net stop "MSSQLFDLauncher$SYSTEM_BGC" /y
                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                PID:4004
                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                                  C:\Windows\system32\net1 stop "MSSQLFDLauncher$SYSTEM_BGC" /y
                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                    PID:1004
                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                                                  net stop "MSSQLFDLauncher$TPS" /y
                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                    PID:3292
                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                                      C:\Windows\system32\net1 stop "MSSQLFDLauncher$TPS" /y
                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                        PID:2308
                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                                                      net stop "MSSQLFDLauncher$TPSAMA" /y
                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                        PID:2476
                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                                          C:\Windows\system32\net1 stop "MSSQLFDLauncher$TPSAMA" /y
                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                            PID:4296
                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                                                          net stop "MSSQLSERVER" /y
                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                            PID:3640
                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                                              C:\Windows\system32\net1 stop "MSSQLSERVER" /y
                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                PID:4156
                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                                                              net stop "MSSQLServerADHelper100" /y
                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                              PID:920
                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                                                C:\Windows\system32\net1 stop "MSSQLServerADHelper100" /y
                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                  PID:1968
                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                                                                net stop "MSSQLServerOLAPService" /y
                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                  PID:4088
                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                                                    C:\Windows\system32\net1 stop "MSSQLServerOLAPService" /y
                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                      PID:1352
                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                                                                    net stop "MySQL80" /y
                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                    PID:1032
                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                                                      C:\Windows\system32\net1 stop "MySQL80" /y
                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                        PID:2392
                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                                                                      net stop "MySQL57" /y
                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                      PID:5076
                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                                                        C:\Windows\system32\net1 stop "MySQL57" /y
                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                          PID:5100
                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                                                                        net stop "ntrtscan" /y
                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                          PID:3112
                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                                                            C:\Windows\system32\net1 stop "ntrtscan" /y
                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                              PID:1408
                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                                                                            net stop "OracleClientCache80" /y
                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                            PID:4656
                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                                                              C:\Windows\system32\net1 stop "OracleClientCache80" /y
                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                              PID:1644
                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                                                                            net stop "PDVFSService" /y
                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                              PID:3496
                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                                                                C:\Windows\system32\net1 stop "PDVFSService" /y
                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                  PID:4824
                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                                                                                net stop "POP3Svc" /y
                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                  PID:3052
                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\net1 stop "POP3Svc" /y
                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                      PID:2228
                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                                                                                    net stop "ReportServer" /y
                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                      PID:1984
                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\net1 stop "ReportServer" /y
                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                          PID:4084
                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                                                                                        net stop "ReportServer$SQL_2008" /y
                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                          PID:4480
                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\net1 stop "ReportServer$SQL_2008" /y
                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                              PID:2192
                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                                                                                            net stop "ReportServer$SYSTEM_BGC" /y
                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                              PID:2056
                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\net1 stop "ReportServer$SYSTEM_BGC" /y
                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                  PID:676
                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                                                                                                net stop "ReportServer$TPS" /y
                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                  PID:4532
                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\net1 stop "ReportServer$TPS" /y
                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                      PID:3420
                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                                                                                                    net stop "ReportServer$TPSAMA" /y
                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                      PID:1460
                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\net1 stop "ReportServer$TPSAMA" /y
                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                          PID:2436
                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                                                                                                        net stop "RESvc" /y
                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                          PID:3956
                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\net1 stop "RESvc" /y
                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                              PID:480
                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                                                                                                            net stop "sacsvr" /y
                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                              PID:3748
                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\net1 stop "sacsvr" /y
                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                  PID:1340
                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                                                                                                                net stop "SamSs" /y
                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                  PID:4828
                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\net1 stop "SamSs" /y
                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                      PID:3816
                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                                                                                                                    net stop "SAVAdminService" /y
                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                      PID:2172
                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\net1 stop "SAVAdminService" /y
                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                          PID:3196
                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                                                                                                                        net stop "SAVService" /y
                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                        PID:4776
                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\net1 stop "SAVService" /y
                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                            PID:3136
                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                                                                                                                          net stop "SDRSVC" /y
                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                            PID:3040
                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\net1 stop "SDRSVC" /y
                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                              PID:3160
                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                                                                                                                            net stop "SepMasterService" /y
                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                              PID:4820
                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\net1 stop "SepMasterService" /y
                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                PID:4924
                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                                                                                                                              net stop "ShMonitor" /y
                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                PID:1568
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\net1 stop "ShMonitor" /y
                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                    PID:2728
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                                                                                                                                  net stop "Smcinst" /y
                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                    PID:4964
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\net1 stop "Smcinst" /y
                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                        PID:2460
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                                                                                                                                      net stop "SmcService" /y
                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                        PID:5044
                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\net1 stop "SmcService" /y
                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                            PID:2300
                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                                                                                                                                          net stop "SMTPSvc" /y
                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                            PID:4108
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\net1 stop "SMTPSvc" /y
                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                PID:2264
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                                                                                                                                              net stop "SNAC" /y
                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                PID:1600
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\net1 stop "SNAC" /y
                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                    PID:5016
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                                                                                                                                                  net stop "SntpService" /y
                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                  PID:2612
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\net1 stop "SntpService" /y
                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                      PID:2772
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                                                                                                                                                    net stop "sophossps" /y
                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                      PID:5060
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\net1 stop "sophossps" /y
                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                          PID:132
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                                                                                                                                                        net stop "SQLAgent$BKUPEXEC" /y
                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                          PID:3936
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\net1 stop "SQLAgent$BKUPEXEC" /y
                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                              PID:944
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                                                                                                                                                            net stop "SQLAgent$ECWDB2" /y
                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                            PID:876
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\net1 stop "SQLAgent$ECWDB2" /y
                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                PID:4552
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                                                                                                                                                              net stop "SQLAgent$PRACTTICEBGC" /y
                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                              PID:3552
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\net1 stop "SQLAgent$PRACTTICEBGC" /y
                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                  PID:4608
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                                                                                                                                                                net stop "SQLAgent$PRACTTICEMGT" /y
                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                  PID:3592
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\net1 stop "SQLAgent$PRACTTICEMGT" /y
                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                    PID:1656
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                                                                                                                                                                  net stop "SQLAgent$PROFXENGAGEMENT" /y
                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                    PID:2604
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\net1 stop "SQLAgent$PROFXENGAGEMENT" /y
                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                        PID:2484
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                                                                                                                                                                      net stop "SQLAgent$SBSMONITORING" /y
                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                        PID:1136
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\net1 stop "SQLAgent$SBSMONITORING" /y
                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                            PID:3188
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                                                                                                                                                                          net stop "SQLAgent$SHAREPOINT" /y
                                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                                            PID:1944
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\net1 stop "SQLAgent$SHAREPOINT" /y
                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                PID:2116
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                                                                                                                                                                              net stop "SQLAgent$SQL_2008" /y
                                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                PID:4768
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\net1 stop "SQLAgent$SQL_2008" /y
                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1996
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  net stop "SQLAgent$SYSTEM_BGC" /y
                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2152
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\net1 stop "SQLAgent$SYSTEM_BGC" /y
                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4136
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      net stop "SQLAgent$TPS" /y
                                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4520
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\net1 stop "SQLAgent$TPS" /y
                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4944
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          net stop "SQLAgent$TPSAMA" /y
                                                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2456
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\net1 stop "SQLAgent$TPSAMA" /y
                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4580
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            net stop "SQLAgent$VEEAMSQL2008R2" /y
                                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3656
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\net1 stop "SQLAgent$VEEAMSQL2008R2" /y
                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4248
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              net stop "SQLAgent$VEEAMSQL2012" /y
                                                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3148
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\net1 stop "SQLAgent$VEEAMSQL2012" /y
                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3872
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  net stop "SQLBrowser" /y
                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4316
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\net1 stop "SQLBrowser" /y
                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2796
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      net stop "SQLSafeOLRService" /y
                                                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1688
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\net1 stop "SQLSafeOLRService" /y
                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2556
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        net stop "SQLSERVERAGENT" /y
                                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2396
                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\net1 stop "SQLSERVERAGENT" /y
                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4348
                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            net stop "SQLTELEMETRY" /y
                                                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3780
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\net1 stop "SQLTELEMETRY" /y
                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1684
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                net stop "SQLTELEMETRY$ECWDB2" /y
                                                                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2808
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\net1 stop "SQLTELEMETRY$ECWDB2" /y
                                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4712
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                    net stop "SQLWriter" /y
                                                                                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2920
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\net1 stop "SQLWriter" /y
                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3028
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                      net stop "SstpSvc" /y
                                                                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3272
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\net1 stop "SstpSvc" /y
                                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3892
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                          net stop "svcGenericHost" /y
                                                                                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5088
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\net1 stop "svcGenericHost" /y
                                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3352
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                              net stop "swi_filter" /y
                                                                                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4508
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\net1 stop "swi_filter" /y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4812
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  net stop "swi_service" /y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1884
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\net1 stop "swi_service" /y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:752
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    net stop "swi_update_64" /y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1880
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\net1 stop "swi_update_64" /y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1724
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        net stop "TmCCSF" /y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3068
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\net1 stop "TmCCSF" /y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1232
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          net stop "tmlisten" /y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4864
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\net1 stop "tmlisten" /y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1992
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              net stop "TrueKey" /y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2280
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\net1 stop "TrueKey" /y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3672
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  net stop "TrueKeyScheduler" /y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4920
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\net1 stop "TrueKeyScheduler" /y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1404
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      net stop "TrueKeyServiceHelper" /y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:424
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\net1 stop "TrueKeyServiceHelper" /y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3428
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          net stop "UI0Detect" /y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3876
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\net1 stop "UI0Detect" /y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2020
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            net stop "VeeamBackupSvc" /y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3976
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\net1 stop "VeeamBackupSvc" /y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4932
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                net stop "VeeamBrokerSvc" /y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:796
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\net1 stop "VeeamBrokerSvc" /y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3900
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    net stop "VeeamCatalogSvc" /y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2988
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\net1 stop "VeeamCatalogSvc" /y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3476
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      net stop "VeeamCloudSvc" /y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3928
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\net1 stop "VeeamCloudSvc" /y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4012
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          net stop "VeeamDeploymentService" /y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3344
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\net1 stop "VeeamDeploymentService" /y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2552
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            net stop "VeeamDeploySvc" /y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1856
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\net1 stop "VeeamDeploySvc" /y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4376
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                net stop "VeeamEnterpriseManagerSvc" /y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1000
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\net1 stop "VeeamEnterpriseManagerSvc" /y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4192
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  net stop "VeeamMountSvc" /y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:896
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\net1 stop "VeeamMountSvc" /y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3636
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    net stop "VeeamNFSSvc" /y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3584
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\net1 stop "VeeamNFSSvc" /y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1020
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        net stop "VeeamRESTSvc" /y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5064
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\net1 stop "VeeamRESTSvc" /y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2136
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            net stop "VeeamTransportSvc" /y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3108
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\net1 stop "VeeamTransportSvc" /y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1208
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                net stop "W3Svc" /y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1040
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\net1 stop "W3Svc" /y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2876
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    net stop "wbengine" /y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3432
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\net1 stop "wbengine" /y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1564
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        net stop "WRSVC" /y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:324
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\net1 stop "WRSVC" /y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3204
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            net stop "MSSQL$VEEAMSQL2008R2" /y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3360
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\net1 stop "MSSQL$VEEAMSQL2008R2" /y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2320
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                net stop "SQLAgent$VEEAMSQL2008R2" /y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5128
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\net1 stop "SQLAgent$VEEAMSQL2008R2" /y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5176
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  net stop "VeeamHvIntegrationSvc" /y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5192
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\net1 stop "VeeamHvIntegrationSvc" /y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5240
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      net stop "swi_update" /y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5256
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\net1 stop "swi_update" /y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5304
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          net stop "SQLAgent$CXDB" /y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5320
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\net1 stop "SQLAgent$CXDB" /y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5368
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              net stop "SQLAgent$CITRIX_METAFRAME" /y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5384
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\net1 stop "SQLAgent$CITRIX_METAFRAME" /y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5432
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                net stop "SQL Backups" /y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5448
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\net1 stop "SQL Backups" /y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5496
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  net stop "MSSQL$PROD" /y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5516
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\net1 stop "MSSQL$PROD" /y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5564
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    net stop "Zoolz 2 Service" /y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5580
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\net1 stop "Zoolz 2 Service" /y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5628
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        net stop "MSSQLServerADHelper" /y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5644
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\net1 stop "MSSQLServerADHelper" /y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5692
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          net stop "SQLAgent$PROD" /y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5708
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\net1 stop "SQLAgent$PROD" /y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5756
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              net stop "msftesql$PROD" /y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5772
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\net1 stop "msftesql$PROD" /y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5820
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  net stop "NetMsmqActivator" /y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5836
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\net1 stop "NetMsmqActivator" /y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5884
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      net stop "EhttpSrv" /y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5900
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\net1 stop "EhttpSrv" /y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5948
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          net stop "ekrn" /y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5964
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\net1 stop "ekrn" /y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:6012
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            net stop "ESHASRV" /y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:6028
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\net1 stop "ESHASRV" /y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6076
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                net stop "MSSQL$SOPHOS" /y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:6096
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\net1 stop "MSSQL$SOPHOS" /y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5124
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  net stop "SQLAgent$SOPHOS" /y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3632
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\net1 stop "SQLAgent$SOPHOS" /y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5180
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    net stop "AVP" /y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5172
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\net1 stop "AVP" /y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5236
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        net stop "klnagent" /y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5220
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\net1 stop "klnagent" /y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5292
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            net stop "MSSQL$SQLEXPRESS" /y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5336
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\net1 stop "MSSQL$SQLEXPRESS" /y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5400
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                net stop "SQLAgent$SQLEXPRESS" /y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5440
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\net1 stop "SQLAgent$SQLEXPRESS" /y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5508
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    net stop "wbengine" /y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5488
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\net1 stop "wbengine" /y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5560
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        net stop "kavfsslp" /y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5552
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\net1 stop "kavfsslp" /y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5612
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            net stop "KAVFSGT" /y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5664
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\net1 stop "KAVFSGT" /y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5652
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                net stop "KAVFS" /y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5768
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\net1 stop "KAVFS" /y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5784
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    net stop "mfefire" /y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5816
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\net1 stop "mfefire" /y
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5892
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        taskkill /F /IM zoolz.exe /T
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Kills process with taskkill
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5868
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        taskkill /F /IM agntsvc.exe /T
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Kills process with taskkill
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:6084
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        taskkill /F /IM dbeng50.exe /T
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Kills process with taskkill
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:6120
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        taskkill /F /IM dbsnmp.exe /T
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Kills process with taskkill
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3012
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        taskkill /F /IM encsvc.exe /T
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Kills process with taskkill
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5252
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        taskkill /F /IM excel.exe /T
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Kills process with taskkill
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5300
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        taskkill /F /IM firefoxconfig.exe /T
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Kills process with taskkill
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5380
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        taskkill /F /IM infopath.exe /T
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Kills process with taskkill
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5456
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        taskkill /F /IM isqlplussvc.exe /T
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Kills process with taskkill
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5608
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        taskkill /F /IM msaccess.exe /T
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Kills process with taskkill
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5724
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        taskkill /F /IM msftesql.exe /T
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Kills process with taskkill
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5828
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        taskkill /F /IM mspub.exe /T
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Kills process with taskkill
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5888
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        taskkill /F /IM mydesktopqos.exe /T
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Kills process with taskkill
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5936
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        taskkill /F /IM mydesktopservice.exe /T
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Kills process with taskkill
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:6036
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        taskkill /F /IM mysqld.exe /T
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Kills process with taskkill
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2716
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        taskkill /F /IM mysqld-nt.exe /T
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Kills process with taskkill
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5284
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        taskkill /F /IM mysqld-opt.exe /T
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Kills process with taskkill
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5364
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        taskkill /F /IM ocautoupds.exe /T
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Kills process with taskkill
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5460
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        taskkill /F /IM ocomm.exe /T
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Kills process with taskkill
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5484
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        taskkill /F /IM ocssd.exe /T
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Kills process with taskkill
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5588
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        taskkill /F /IM onenote.exe /T
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Kills process with taskkill
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5736
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        taskkill /F /IM oracle.exe /T
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Kills process with taskkill
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5924
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        taskkill /F /IM outlook.exe /T
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Kills process with taskkill
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1416
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        taskkill /F /IM powerpnt.exe /T
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Kills process with taskkill
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2168
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        taskkill /F /IM sqbcoreservice.exe /T
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Kills process with taskkill
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4804
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        taskkill /F /IM sqlagent.exe /T
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Kills process with taskkill
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5328
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        taskkill /F /IM sqlbrowser.exe /T
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Kills process with taskkill
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5412
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        taskkill /F /IM sqlservr.exe /T
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Kills process with taskkill
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5532
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        taskkill /F /IM sqlwriter.exe /T
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Kills process with taskkill
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5700
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        taskkill /F /IM steam.exe /T
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Kills process with taskkill
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5832
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        taskkill /F /IM synctime.exe /T
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Kills process with taskkill
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5808
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        taskkill /F /IM tbirdconfig.exe /T
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Kills process with taskkill
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:6112
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        taskkill /F /IM thebat.exe /T
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Kills process with taskkill
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3480
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        taskkill /F /IM thebat64.exe /T
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Kills process with taskkill
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4808
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        taskkill /F /IM thunderbird.exe /T
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Kills process with taskkill
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5352
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        taskkill /F /IM visio.exe /T
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Kills process with taskkill
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5528
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        taskkill /F /IM winword.exe /T
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Kills process with taskkill
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5704
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        taskkill /F /IM wordpad.exe /T
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Kills process with taskkill
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1580
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        taskkill /F /IM xfssvccon.exe /T
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Kills process with taskkill
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5860
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        taskkill /F /IM tmlisten.exe /T
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Kills process with taskkill
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5896
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        taskkill /F /IM PccNTMon.exe /T
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Kills process with taskkill
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3736
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        taskkill /F /IM CNTAoSMgr.exe /T
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Kills process with taskkill
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5164
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        taskkill /F /IM Ntrtscan.exe /T
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Kills process with taskkill
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5276
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        taskkill /F /IM mbamtray.exe /T
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Kills process with taskkill
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5632
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        cmd /c ping localhost -n 3 > nul & del C:\Users\Admin\AppData\Local\Temp\3a6d5694eec724726efa3327a50fad3efdc623c08d647b51e51cd578bddda3da.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:7608
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\PING.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          ping localhost -n 3
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Runs ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:6604
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\SysWOW64\WerFault.exe -u -p 1560 -s 380
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Program crash
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3860
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Boot or Logon Autostart Execution: Active Setup
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Suspicious use of SendNotifyMessage
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:7272
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 1560 -ip 1560
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:6636
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\sihost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        sihost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4224
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            explorer.exe /LOADSAVEDWINDOWS
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Boot or Logon Autostart Execution: Active Setup
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops desktop.ini file(s)
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Enumerates connected drives
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Checks SCSI registry key(s)
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Suspicious use of SendNotifyMessage
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5864
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Enumerates system info in registry
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Modifies Internet Explorer settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:7708
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Checks processor information in registry
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4492
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Enumerates system info in registry
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Modifies Internet Explorer settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3860
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Enumerates system info in registry
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Modifies Internet Explorer settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4652
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Enumerates system info in registry
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Modifies Internet Explorer settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4692
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Enumerates system info in registry
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Modifies Internet Explorer settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3524
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Enumerates system info in registry
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Modifies Internet Explorer settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4964

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Network

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        MITRE ATT&CK Enterprise v15

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Reconnaissance

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Resource Development

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Initial Access

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Execution

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Persistence

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Boot or Logon Autostart Execution

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        T1547

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Active Setup

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        T1547.014

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Privilege Escalation

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Boot or Logon Autostart Execution

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        T1547

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Active Setup

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        T1547.014

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Defense Evasion

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Modify Registry

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        2
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        T1112

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Credential Access

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Credentials from Password Stores

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        2
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        T1555

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Credentials from Web Browsers

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        T1555.003

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Windows Credential Manager

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        T1555.004

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Unsecured Credentials

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        T1552

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Credentials In Files

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        T1552.001

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Discovery

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Browser Information Discovery

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        T1217

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Network Share Discovery

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        T1135

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Peripheral Device Discovery

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        2
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        T1120

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Query Registry

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        5
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        T1012

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Remote System Discovery

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        T1018

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        System Information Discovery

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        4
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        T1082

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        System Location Discovery

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        T1614

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        System Language Discovery

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        T1614.001

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        System Network Configuration Discovery

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        T1016

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Internet Connection Discovery

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        T1016.001

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Lateral Movement

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Collection

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Data from Local System

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        T1005

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Command and Control

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Exfiltration

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Impact

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Replay Monitor

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Loading Replay Monitor...

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Downloads

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\$Recycle.Bin\S-1-5-21-3587106988-279496464-3440778474-1000\desktop.ini
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          488B

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          e201e298362e1d7ca83f32961871e326

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          c1f0cc68d522c644e51c26975df24d0cbf60133b

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          e91703776a314f2608ffc4349ee220047d89977a3f6f3fd4bfc34162cc55db77

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          7fba69b22860e455008fd8134491d735f88bc43a8667aed89518824c3b505792553f9742377fef94af3ea911c618fa57aefd11f8fa88527ac56a9250ec0ee435

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\ProgramData\Microsoft\Windows\Caches\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x0000000000000002.db.MEDUSA
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          290KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          633f425595743d45946b5b944049dd9c

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          d6d36723a080ba730ab3e5c7c26b191dcb560418

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          2013722116c9ba8688105cfad1bd170f877a83caf41d465f51fdf5706d3f6bc6

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          b1b034c63ff266589cc7c4c1369ad5fece71c42274c54aba50317883c08a8d43341a684241dba60a1a86febcf8c2b4233552071b3987c2f4210cb178e5fb4dfb

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\ProgramData\Microsoft\Windows\Caches\{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000001.db.MEDUSA
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          625KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          e90c0ba31ed504aab0bdcd0630714324

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          6bbc54d4a924551389f806176915db126c6b05dd

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          29ba594aa4598cf381f1e12f6e95d087924530b9dc1383d2aea78ed2ef83ecdf

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4709734fd048a2dd14406c2b340052436d09c8c1c022d6d61bbb60d6f6871d6560fc40d31e83c832586355986944181fc4b6e5366468abc8f1c939bf28c0a99b

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          174B

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          e0fd7e6b4853592ac9ac73df9d83783f

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          2834e77dfa1269ddad948b87d88887e84179594a

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          feea416e5e5c8aa81416b81fb25132d1c18b010b02663a253338dbdfb066e122

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          289de77ffbe328388ad080129b7460712985d42076e78a3a545124881c30f564c5ef8fb4024d98903d88a6a187c60431a600f6ecbbe2888ee69e40a67ce77b55

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\{03BA58C4-B905-4D30-88C9-B63C603DA134}.3.ver0x0000000000000001.db.MEDUSA
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          415KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          86d3b1ced0d7feeebd879ab6220124ad

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          f82db2fa626298ebdd659d5c9eac0e9e4f052a1d

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          dab01e9fb896311da4dd3a1b651c45c8c3cb0b6568144fe798b306e3ea847629

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          e8b7a24f8080494254870033b26799eda23f2ac1ef719bc98c9ff921501e46a128e5ca5a7a1f684c95c4f33777aea4cb56529a543f2dd141ebe2dcac5ead6004

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x000000000000001d.db.MEDUSA
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          91KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4cc46b3b8433ce37b97736504c760ca0

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          a667fd453b603eb887dddc34d6d5946c8d3c9761

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          cc6f35bb125174b8b64645186f1d6ed15da9b9c6dc1798f06ac18a258b31a917

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          8c2248b76e4396dac2fe8baf150eed2b61463f13ebf8ea520ca4f83b279a739a071a2ffb312f9196f99aaadd2eb265303ca4ff70d50733f4db72afe6f4a03654

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_16.db
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1024KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          ec594403a7071116e2d25d5a43c820b7

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          0c765deb43f76a3eb663ad5f33cc44055bc3d2b4

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          30ab6b417c056c65812304dfe9f9ac1b4f115e9dc14fe05ecdc4214e0454a909

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4682ad513a91c0f5ad0e91ae440d12e8580ffcd58651cc9299b77d0290f7c8a083a03b28ddbfb1603525d711790eb38f0200581642bbc7c6e251d8864dd5ddfa

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_32.db
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1024KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          f6e1f069d114505202ec8317f1a2da69

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          9b4bede1e7e8b444233ab79d9daa3d21aab94f03

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          91d16d04b8b17c0647f0e20372c017db88288e0ed684fbbcb8cfa328f0b7108d

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          a6704105097e9d555ca63a08e60ab17144fe1912a527fd944f5194161a476889efdf2f8856bf4cbf54cd08ebd4de19dadd71c97ef0662a3bcd61084d7ef32cb9

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_48.db
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1024KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          feea57c24fa355e419e3e5a3b1a13449

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          b6d0899d45a2bd979907229917e25f6947f8ce2e

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          cd28020cfcfd0852deeb9c26e6f1493a839fae045eccc3eb259b1fb652f9e8f3

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          034ca2c39617062d72515a1f36743045cc271845a80aca631756dd0b7601b32442a83198e32439edfeba7bb05e11754926a12776662d3b92a35ff14697653fe2

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_48.db
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1024KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          776d5b84faf2d4435ea7d67649071056

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          81be51b09eb8f2892b14025541d46dc59b75323d

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          8b18f76b9fd2ab6af105887b0b1184d9a8da1625cc5d7b9001cf6a116ea533d3

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          d60f460f0119fab31673ae0601b43dc60c46b27249cc6e61f391826b986b9c38827db7e6f7baba435d1e5643cc2f8028abd466a4ffebef012851acbed8bbae98

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          7KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          57f5dbfb6ae1976db991130cca57e7d3

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          a3cf4bda4805ada94874537862251a25ddb98420

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          8c8571761c817211405b868f67d2475bc4bf0f0f3cc2b61f7b3619002a85b553

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          ab4a07d3da7f194f28e65bf0b2f12c5f5d594c4a00e00f9fffed920dec3269c57a7d9d248a4a3e3a640b5606a6f352d38be8ae77f29555f6f92fec70c02ef58d

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          7KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          3e9d54d986e11f7d7e56505a842aa724

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          0d3a010f7845fbd08e59eed43cd9d2debc9dc079

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          f940aa0ae9101b49b953c40585a160dad078676d33720d0294e9b182ea2773ec

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          f2cf8bf1867aa0541fa67fba3135ef3125990533b2f5b7c0755098854cbf670e935bb3c3b84bc7cf864c2b75e55251940ed64c1b3ecdf96ec93dbf0c7c280e04

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_16.db
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          24B

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          419a089e66b9e18ada06c459b000cb4d

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          ed2108a58ba73ac18c3d2bf0d8c1890c2632b05a

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          c48e42e9ab4e25b92c43a7b0416d463b9ff7c69541e4623a39513bc98085f424

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          bbd57bea7159748e1b13b3e459e2c8691a46bdc9323afdb9dbf9d8f09511750d46a1d98c717c7adca07d79edc859e925476dd03231507f37f45775c0a79a593c

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_16.db
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1024KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          7b23d7c7a23fe4c63766820b9b458138

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          85a327b690c0cb86d7b687d4bf62a357d9e01888

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          7ad39248fee7ae7074ccdb6a0e92123c30cc260060c299eabac0abb0fb480f92

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          6a0648bf1a5bafc0f7c7c43e1f18b1865f388baf0fe1935928443de3a5f9a9968f464f54fd9a5eedc188304f63a6ec49171012a06a2cd6f49009408a889e69d4

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_48.db
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          24B

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          ae6fbded57f9f7d048b95468ddee47ca

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          c4473ea845be2fb5d28a61efd72f19d74d5fc82e

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          d3c9d1ff7b54b653c6a1125cac49f52070338a2dd271817bba8853e99c0f33a9

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          f119d5ad9162f0f5d376e03a9ea15e30658780e18dd86e81812dda8ddf59addd1daa0706b2f5486df8f17429c2c60aa05d4f041a2082fd2ec6ea8cc9469fade3

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_idx.db
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          7KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          ab446de0b4a409b05089d37e9db613d1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          7e3ea91eb36170b8595655458222628fe7aa9bed

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          131309b85a31857769b0201b2aef1533de9563d119f7e7f022c130573ea333cb

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          7aef650c62aa80d843e17a39417e0e171738f12690a21310ee5fa9f86a188e4b79a118a0861795356909df3ae881158f36f06dc0bbebb48f640af1c12c869466

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_idx.db
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          7KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1924cbb953ba1f8c2933dc0f96d93657

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          de6d47f57ef4bc8ff68839f7c83d5c1e04e0706d

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          bdc6a23bb46e433abff5cdcdd3e8562782225a80c4961402c6e75e5f11c97bdd

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          c3081c85ab8a03e020773683dfe652b3111a5ba85505db9968be4f6c949181b8b9991f5264b35ac91f4471e2487bb29e2984feec3fc9eb12c1db4c84defc1b03

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\StartUnifiedTileModelCache.dat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          9KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          f3cd694227913f146c7f78e20e1be554

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          8a0df29c79dc29a963fa5477304ba660397f1289

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          fcaab8e3e2c2c7638af508ff5dce7592695a037daa6ce0ebf0f309dc516be430

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          2307c7d37e9ee77de3be81e53aa7628852e4a8b3c9d3e53f5197a96aab46e0b3956c2798b88adbaa05a2fd8f6096fd78e6e25d0a4e277d4c16f0e6db562d772f

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\StartUnifiedTileModelCache.dat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          6KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          e8ca914dd9b2dbf7265f3fd315f53c5e

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          e06cb887b2616144460afae5b368c2f3c32e4008

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          9858cd72a1c6d8c02b4851e322d68ae21658a033307faa6f551afe3f0c68b5f5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          c7e3aa88660c585fe3fd2fbc0ae91c3a66a8505a39d67c4cf76b50cb4999649a66cfc5ee84e96a6b57e91522c57fad726f405b34eea41836ab44fb8cccfea589

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\StartUnifiedTileModelCache.dat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          10KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          9f8296fc56a6d3372af50392b5d38393

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          c9410fe932573f09dc69f905deb6acc5da26c8bb

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          d9c49e51794af69c1e36283e17740585e806cb0b7b918e40f3b1dfb1e01d38db

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          c3d9e74ea321a65399bf70f5a599122b497f81a9095b12f9de4fc2cb32ebe12cd99672e83715b1e83135bd1f6ee126aaf7b32ed4e765959cde676bd22d04983d

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133830456676799196.txt
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          2KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          5f1c60979b9db82664cbe9e511bbd1df

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          d9906662b4b3d255c59d3d7688eaa552dd9eb552

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1d57c365cd1ee9147654f78faa239f7e786a8a49b17794ad04c90a7d7178c900

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          0d9c4e1dfde8383167994cf8d1a5162f17215ebe476f5d1d09d1da07a9395c056fcc369b7e6b00d65f817e52ca3c3c3c853783e39f39ff9f1cbe1fb27ead18a5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133830456794219258.txt
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          64KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          6dddcd4f1278c9edc8cbf3b7878e0466

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          e735c72a89c697978d4023db020ddb6699e25d73

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          5b79c3f52b470e814b8ba8afaeafe6244773d23064a73c2b68b3804b123b1cc5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          bb266598adc58e0faae381eed2f3019b9f1341cc4c866274c0118ec055e0405645ff3ef36be3767606d8323cb49f0aa34b0c22c3f4ef565d308eaa017e581241

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchUnifiedTileModelCache.dat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          2KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          fd46c67ca1d3c5df58c0e2cbd0c863d9

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          488a2a636590960f3773b1e448d94ac2065c3fd7

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          a8d26a165544446988940815bf81313004c1c9b1e366d5fce7061d3668a2b6e0

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          28147ff34988d0cc2345f4105174f4d90d8ae0e32952d38e9d714d15b76f05a0f6a33918d2c598a92fc9884f02ec9ab688a72892828f456bc8a85be5426b9e9c

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • F:\!!!READ_ME_MEDUSA!!!.txt
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          3KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          5403d641e60c7d266a7070be82dba163

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4362f925483128ee3fc65d1612309c0475b5cd59

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          b60a2235cf8d69a222692ac19230be187e062ab208dbe7ff24027ef47ce0634d

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          a013d8462fe8e039150356ef9773b20114d6ae21d21331bb05db200710f1d3b699234ce51cbade7f3caeec577f520cdcc145d149bebdb552e0ebd90fcc41147d

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/4492-28265-0x000001CB815F0000-0x000001CB815F1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/4492-28271-0x000001CB815F0000-0x000001CB815F1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/4492-28268-0x000001CB815F0000-0x000001CB815F1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/4492-28270-0x000001CB815F0000-0x000001CB815F1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/4492-28260-0x000001CB815F0000-0x000001CB815F1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/4492-28261-0x000001CB815F0000-0x000001CB815F1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/4492-28259-0x000001CB815F0000-0x000001CB815F1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/4492-28269-0x000001CB815F0000-0x000001CB815F1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/4492-28266-0x000001CB815F0000-0x000001CB815F1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/4492-28267-0x000001CB815F0000-0x000001CB815F1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Download